Tales from the Scottish-Sounding Antivirus Company No. 6: The Demon-Possessed Computer
[**NOTE:** Previous TftSSAVC: [1](https://old.reddit.com/r/talesfromtechsupport/comments/7x8av3/tales_from_the_scottishsounding_anti_virus/), [2](https://old.reddit.com/r/talesfromtechsupport/comments/9e2kqi/tales_from_the_scottishsounding_antivirus_company/), [3](https://old.reddit.com/r/talesfromtechsupport/comments/9j89x4/tales_from_the_scottishsounding_antivirus_company/), [4](https://old.reddit.com/r/talesfromtechsupport/comments/9owbh7/tales_from_the_scottishsounding_antivirus_company/) and [5](https://old.reddit.com/r/talesfromtechsupport/comments/mig6p6/tales_from_the_scottishsounding_antivirus_company/). AG]
#Dramatis Personae `$Customer`(s) - *the customer at the other end of a phone line (who was very far, far away in this case)* `$Jr.Programmer` - *then doing overflow tech support (we were busy that day)* `$Me` - *as well, me, /u/goretsky* `$TheBoss` - *the founder of the Scottish-Sounding Antivirus Company*
#Prelude With Halloween coming up, it seems like a good time to share this particular tale from the Scottish-Sounding Antivirus Company.
As with the [previous tale](https://old.reddit.com/r/talesfromtechsupport/comments/mig6p6/tales_from_the_scottishsounding_antivirus_company/), this happened around around 1992 or so. I won't bother describing the office in detail, since I did so in the preceding tale. However, I will note that tech support was nominally located on the west side of the building, opposite the entrance on the east side, since that put us in the back of the building. While tech support was normally meant to be "out of sight, out of mind" of people (the idea that tech support wasn't a cost-center but rather a service offering that allowed us to compete with our, uh, competitors was only slowly emerging in Silicon Valley), this was less an issue of (several execs had their office along the same side of the building) but more an issue of where the best place in the building was to put the bull pen of tech support engineers, as it was my desire that the tech support people have a semi-enclosed space in order to better communicate, collaborate and learn with each other.
#The Call That said, we were rather busy at the time the call this came in, so the call didn't start in the tech support cube space, but rather up front near the `$TheBoss`'s corner office, where the `$Jr.Programmer` was helping to take calls as the tech support call queue overflowed. Why was `$Jr.Programmer`'s office at the front of the building just down the hall from`$TheBoss`'s office? Well, we were in hypergrowth mode, and the `$Jr.Programmer`'s office was literally a desk **in** the hall.
This particular tech support call came in from a `$Customer` in Australia.^1 Now, you might be wondering why someone would call the U.S. from Australia, but you have to understand: This was the early 1990s, before the rise of internet service providers and email. Yes, both had been around for several years, but they weren't common. While tech-savvy customers could email us, call the BBS or one of the various online services like CompuServe and send a message, or send a fax, a lot of tech support was still done over the phone.
For those wondering, CallerID was not yet widely available, at least in the United States, and in California its use was being argued against by a plethora of telemarketers, polllsters, collection agencies and others who loudly explained how this horrible new technology would disrupt their job, put them all out of business, crash the economy, etc. CallerID eventually did start to roll out later in the 1990s, and none of those predictions came true.
And international phone calls were **expensive**. In those pre-VoIP days, telephone calls were often routed over circuit-switched (not packet-switched) networks, which meant that a direct connection was established between your telephone, and the telephone of the person calling you. We recognized that, and we also knew that anyone who was spending tens or even hundreds of dollars to call us. There was an unwritten rule that you helped international callers out fast because whatever was going on was an emergency situation (at least to them).
Anyways, that particular `$Customer` had been routed to the `Jr.Programmer`'s desk, as they had expressed computer virus symptoms, and the regular tech support staff were all on phone calls at the moment.
Eventually, word got back to `$Me` that the `$Jr.Programmer` was on an overflow tech support call, that it wasn't going well, and I went forward to relieve him.
After doing the hand-off and introducing myself as the manager of tech support, I asked the `$Customer` what was going on with their PC.
#The Demon-Possessed Computer The `$Customer` explained that their computer was possessed by a demon, and that it was leering at them and making faces in the monitor.
Now, computer viruses that displayed graphics were rare, but not unheard of. All of the ones out there that did things like that were well-known, and from the `$Customer`'s description, it sounded like something brand new, a computer virus that had not been previously seen or reported by anyone. That meant that it was critical to isolate a copy of it, so we could get it in for analysis and add detection and a cleaner for it.
For the next 45 minutes or so, I walked the `$Customer` through every trick I knew to identify a virus. I walked the `$Customer` through doing a directory of their `C:\DOS\` directory, looking for programs they hadn't run/weren't familiar with, and asked them to note the size of those files before and after running them, since an increased file size meant a program had been infected by parasitic file infecting computer virus. I had them check for reduced amounts of memory by running the `MEM` command to see if the system reported a full 655,360 bytes of RAM was installed. A standard trick of boot sector and master boot record viruses (MBR) at the time was to place their code at the top of memory and then tell the computer it had less memory installed, so that their code could reside there unmolested and spread to other disks as they were accessed. Most users wouldn't notice the difference if a computer reported it had 640K of memory installed versus a little less, like 638K or 636K. We tried to check floppy diskette boot sectors, and the hard disk's MBR.
At some point, I was convinced that we were likely dealing not with a file infecting virus, but a stealthy boot sector and MBR infector like the [Den Zuk](https://www.f-secure.com/v-descs/denzuk.shtml) virus, which hooked the reset function (pressing Ctrl+Alt+Del rebooted a computer under DOS) to display its graphics instead of rebooting the computer. A stealth virus back then meant a computer virus that while in memory redirected attempts to look at its own code on disk, instead redirecting the user to clean uninfected code on the disk.
In order to diagnose this, I told the `$Customer`to unplug the PC from the wall outlet to make sure it was really powered off, so that we could cleanly boot it up from an uninfected floppy diskette, and continue the hunt for it there.
The `$Customer` did this, assured me that the computer was physically unplugged from the wall, and informed me the demon will still on the computer's monitor and looking at them after it was unplugged.
#A Shift In Tactics At this point, I realized we^2 were not dealing with a new computer virus, but rather someone who was mentally ill, and that I had wasted nearly an hour of time. I told the caller that they needed to reach out to a priest, rabbi or cleric to deal with this, and just repeated that answer each time they tried to ask me something else to get them off the line, explaining that we only could deal with actual computer viruses and this was out of scope for us. Eventually I managed to close the call.
#The Moral of the Story My immediate reaction, was annoyance, but that was more of the frustration born of trying to hunt down something that didn't exist. That only lasted for a matter of seconds, because the more I thought about it, the more I felt bad for the `$Customer` because they believed it was a real thing happening on their computer, that they had just spent a fortune on an international long distance phone call to the America, and weren't able to get help.
As technical support people, you get all sorts of callers, and you have to take what they say at face value, no matter how strange it sounds, because you don't know them. All you know is what they are describing to you from the other end of the phone line, somewhere around the world.
As technical support professionals, you are obligated to treat those that contact you with courtesy and respect, and when it turns out to be something that is seemingly silly or trivial, not to embarrass or mock them in any way, but smooth things out and close the callin such a way that leaves their dignity intact.
#Epilogue A day or two later, `$TheBoss` sauntered into the office (he'd stopped coming in daily, but was still in several times a week), and I rushed over to tell him about the call.
He was genuinely enthused and interested, asked me all sorts of questions about the call, and was somewhat crestfallen when I told him I didn't have the contact information for the `$Customer` as this was right up his alley. I should note that `$TheBoss` was an avid reader of [The Weekly World News](https://en.wikipedia.org/wiki/Weekly_World_News), and would frequently go on about how it was the finest news source, since every story it covered was told by someone who believed it had happened. A story of a computer being haunted by ghosts or possessed by demons was definitely the kind of story that the `$TheBoss` was interested in.
We never got a call back, or found out what happened.
Regards,
Aryeh Goretsky
----- ^1 International long distance telephone calls back then almost always had an analog circuit somewhere in the connection, so you'd hear static, hissing, sometimes faint crosstalk from other calls or echoes, etc., while on the phone. They were not digital like today's phone calls with integrated noise suppression, echo cancellation, and so forth.
^2 A group of coworkers had gathered around, listening as I tried to hunt down the computer virus.
-----
**UPDATE** (20261030-0155 GMT±0): Added a little more information about how we used to help users check for new viruses over the phone.
**UPDATE** (20261029-1859 GMT±0): Added a section explaining why we didn't have CallerID.