Crazy ORZ - begone!

In the past few days, my Grisoft AVG started interrupting my work and browsing with alarming pop-ups saying "THREAT DETECTED!"

I immediately ran a full test scan (a long one), and was somewhat surprised that the test results showed no infection.
And yet the pop-ups continued to pester me... until today.

Because I never had any malware before - and because Grisoft is phasing out their wonderful free AVG program (updates will only be available until June 28) - at first I suspected that it was a cunning device by Grisoft to lure more paying customers. (Not nice of me, I know, I am very contrite.)

Then I ran one of my favourite (and regularly updated) applications: Spybot Search & Destroy.
Nothing.

Then I ran a full test at PC Pitstop (the OLD battery, I find it much better than the new Overdrive version)...

Aha!

There was no mention of any virus or malware on their list of programs and processes running on my PC - but there was an "unrecognised" program: ORZ.exe.

I ran a search to find out more about it.
It turned out to be a keylogger - a Trojan.

Aghh!

Not stopping to waste anger on my faithful daily "protectors" (AVG and S & D), I ran another search to find out how to remove it. A quick look at the various forums (I know: it should be fora, but this is not time to engage in dead-language speak, please!) showed that millions of computers have been affected by it since late May and (especially) early June - and the one thing that kept popping up was the supposed inability to remove it effectively.

There is nothing I enjoy more than a challenge - especially if I know I can win, relying on my own resources.

But it wasn't that difficult at all.
Here's what I did:

I used the Windows "search" function to find the EXE itself.
It was - as Orz is supposed to be - located in the Temp folder.
Obviously, I clicked on it and selected "delete".
It didn't work.

So I thought of renaming it - specifically, changing its extension.
I did: I changed it to BMP (don't ask why, it was the first one that came to mind).
And then, I tried to delete it again.
It didn't work. The file was reported to be "in use".
(It figures!)

So I renamed it again, this time to DOC.
Then I opened the newly created "document" and deleted everything in it (it wasn't actually readable, as you can imagine).
then I tried to delete it.
Again, it didn't work.

So I did what you should NOT do (unless you're a dreadnaught hothead fool like myself, obviously) and opened the register (prompt command REGEDIT). I searched for "ORZ.", found a few entries, carefully read their data (location ettc.), and deleted them.

Then I emptied the "bin" and ran another search on my PC, to find any other possible files with the name ORZ.*

There was the ORZ.doc (previously BMP) again!

So I did what I should have done many minutes earlier: I opened the Device Manager (hit CTRL + ALT and DEL at the same time) and checked the list of running processes...
There it was: ORZ.exe, as if I had never renamed it!
I terminated the process.
Then I tried deleting the renamed ORZ bugger - and this time, of course, it worked.

Then I emptied the trash again and ran another search to find any ORZ. files on my PC.

None were found.
And the AVG has been keeping quiet ever since, too: no more pop-ups, no more "threat detected".

I hope you find this rambling of some use.

And remember: if you're looking for advice on removing ORZ today but you only find this entry a week from now, thank Google snaily crawl for it...




IMPORTANT:

I am NOT recommending anyone to proceed as described in this entry. If you do so and something - anything - goes wrong, do not blame me.

YSL Forever

"Fashions fade, style is forever"

Yves Saint Laurent (1936 - 2008)

Yves Saint Laurent died tonight in Paris.
From cancer.

He was called an enfant terrible in his youth. And he remained one.
That's the secret of many a great artist: to remain a child at heart.

(You doubt that fashion design is art?
Then have a look at the title of this section of the Metropolitan Museum of Art, where some of YSL's historic designs are preserved. Or this timeline.)


We will be writing more on YSL in the near future.
Meanwhile, here is a design or two, from among his more emblematic creations; and an early work.

Enjoy.

That's what they were made for.

Yves Saint Laurent, Evening dress, 1969–1970
The Metropolitan Museum of Art, New York.

And here's the description from the MET online catalog:

Diana Vreeland recalled of Saint Laurent, "He struck me right away as a person with enormous inner strength, determination and full of secrets. I think his genius is in letting us know one of his secrets from time to time." The sheer theatricality of this evening dress shows Saint Laurent at his most flamboyant and transfigurative.

Before Saint Laurent was Saint Laurent,
he was already Saint Laurent...







Yves Saint Laurent, evening dress, for Christian Dior, 1958.
The dress is coming up for auction at Christie's (sale no. 2017), in July 2008

... and then rocked on with the times

"There is no attire quite as beautiful as the naked human body. There is no prettier gown for a woman than the arms of a man she loves.
But for those who aren't so lucky, I am there."

Yves Saint Laurent

Originally published here.