Getting rid of the "Security Tool" Virus from Windows XP or how Ubuntu saved the day

I recently had my first Windows Virus experience: A friend caught on to the "Security Tool" virus from the Internet while downloading free mp3 songs. This post is about how to remove the virus files, but basically, its a case-in-point about removing any stubborn or harmful Windows files or copying them out.

This software is a really nasty piece of code, it resembles a genuine anti-virus/anti-spyware tool, tempting users to click on it. It makes the system really sluggish, even worse, it changes the registry files. I also found that it had corrupted the Master Boot Record (though this may have been because of multiple hard resets).

The virus files basically sit in a folder with the following path:

C:\Documents and Settings\All Users\Application Data\[random numbers]\

So this is the folder that needs to be removed.

There are available programs that will remove Security Tool, but this presumes that the system is responsive enough to allow you to download the anti-malware, and that it boots up fine in the safe mode. These programs are a easier way to go forward if these two conditions are met.

However, the computer I worked on, was beyond that point, getting the blue screen of death on every boot. It was more important to get all the useful data out to some external storage, since the data was not backed up.

So, we had, Ubuntu to the rescue. The idea is to create a bootable CD of Ubuntu, which is one of the best Linux distributions, and then boot from the CD. (This requires your BIOS setting to have CD as a preferred boot device to the Hard disk, but that's normally the case in most computers - In case its not, this can be changed. Here's how)

Once Ubuntu has booted from CD, next step is to mount the Windows Hard disk drive. This can be done using the terminal(Here's how) for those more comfortable with it, or with the Disk Manager Utility in System Administration(Here's Ubuntu Manual).

Once mounted, copying data out to an external disk, or deleting files will look familiar to most of the us used to pretty GUIs.

So why not Windows recovery console? I tried, it did not seem to work well for me.

Does this work when Windows has an administrative password? I don't know for sure, but it should. I had a dual boot system that had admin password for Windows, but that never stopped the Linux distro from reading/writing files there.

Lessons to learn? Stay safe on the Internet, and backup data frequently.

Thoughts? Makes me uneasy about how easy it may be to steal files from random unattended computers,I wonder what can be done about it (Have the hard disk password protected?).. Also, May be Windows Vista or Windows 7 is safer, with stricter control on what gets installed..

Acknowledgments? a gifted collaborator, my liege lord, and my close friend, who gave me my learning platform.

On Confirming Sine Waves

I was recently asked what was the best way of confirming that a given measured waveform was a sine wave. It was a simple question, but that got me thinking...Its easy enough to eyeball a waveform and give a quick judgment, but when one really has to be sure, how to go about this?

If the frequency of the expected sine waveform is known, One method would be, to take the cross-correlation between the measured signal and the ideally expected one.

But the most foolproof way, is to take the fourier transform of the waveform. This gives a lot more information than the correlation, it actually tells you what all frequencies make up your wave. Matlab has an implementation of the fast fourier transform (called fft for short).

The fourier transform of a sine wave of a frequency f, is two dirac delta functions of half the amplitude of the original wave. When plotted on a frequency vs. amplitude plot, they show up as two lines at f, -f with half the amplitude of the original wave.

The Fourier Transform method, however, also has to caveats. The fourier transform function expects an infinite waveform as an input. The measured signal would be anything but that (because of equipment limitations/practicality). Hence, a windowing function is needed to attenuate the edges. The other gotcha is, that sometimes, Harmonics of a single frequency will show up on the fourier transform, i.e. spectral lines at 1f, 2f etc if f was your expected frequency. In such cases, the amplitude of the main f frequency spectral line to the other harmonics' amplitude serves as a good indicator of how good the signal is.

This post diverts from my other more systems-like posts, but I just realised that this is hands-on stuff, that probably doesn't get published anywhere, and hence noteworthy.

p.s. There's also a C implementation of the Fast fourier transform from MIT. Cheekily, its called the fastest fourier transform in the west(FFTW) :)