Weirdest thing...

Last night I booted my home machine. It started ok, but once I logged on it was dog slow. "Whut", says I, "this is strange".

Task Manager showed that one process, InoRT.exe, was using 99% of the CPU, but there's no hard drive activity. InoRT.exe, that's supposed to be the antivirus program. Hm, this is suspicious. I reboot, and still see the same symptom. At this point I'm more annoyed than worried, because I actually backed up everything interesting just this weekend.

Now I disable the network connection and let the process run for a while. No change. I then kill InoRT.exe; start Spybot S&D to scan; enable the network connection again so I can get updates for Spybot S&D (when did I even run that last? Can't remember); disable the network connection and start scanning. The scan shows one entry I've never seen before:

n-Case is it? Never heard of. I start my second machine to do some research, and find plenty of references to it - turns out it some kind of spyware. How did that get there? I've applied all patches; I don't run as admin, and my surfing habits aren't very... interesting.

I keep reading and learn about the expected symptoms, how to remove it manually etc. Only what I read doesn't match up. I haven't seen any unexpected ads on the machine. The reg key that was reported, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\schedulingagent, points to C:\WINDOWS\System32\mstask.exe and I can see that this file hasn't been tampered with. I start looking for the other files that should be involved in n-Case, but can't find them.

As I'm looking around, I notice that I'm kinda low on disk space though - only about 2GB free on a 120GB partition. Ok, let me delete some F1 races I recorded this summer...

...hey could that be the problem, low disk space...?

...so I free up 30GB in a few minutes, reboot, and - fancy that - all seems ok.

Lessons learned - 1) having a recent backup helps preventing panic, 2) don't assume the worst, 3) don't save old F1 races when you know that you won't watch them more than once...

This posting is provided "AS IS" with no warranties, and confers no rights.