Article 12 - Viruses

Viruses / Malware

This is a never ending topic, but viruses in various forms (including "spyware" and "adware"), cause so many problems to so many people. Cleaning computers of viruses represents a significant part of my activities, and can be very tedious. The easiest way to do this clean up is to reformat the hard drive, and then reinstall everything again from scratch. The down side of this is that you have to have all the CD’s required to set up the PC again, and there has to be a back up of all documents and other files.

Malware (a general term that includes spyware and adware) has been mentioned in the news recently, and it has been reported that hackers that at one time spent their time developing viruses are now developing malware. Viruses can be disruptive, damaging, and annoying. Malware can be used to gather account information and passwords (online banking, credit cards), which are then used to steal money.

The following piece, which appeared in the magazine "PC Advisor" recently, highlights this point:

Sunbelt Software, which makes anti-spyware tools, says that it has stumbled across a massive ID theft ring that is using a well known spyware program to break into and systematically steal confidential information from an unknown number of computers worldwide.

The operation was discovered during research Sunbelt was doing on a spyware program belonging to a particularly dangerous class of browser hijacking tools called CoolWebSearch.

CoolWebSearch programs are extremely hard to detect and remove, and are used to re-direct users to web sites that use spyware tools to collect a variety of information from infected computers.

The CoolWebSearch variant being studied by Sunbelt turned infected systems into spam zombies and uploaded a variety of personal information to a remote server apparently located in the United States. That server holds a ‘treasure trove of information’ for ID thieves, according to Sunbelt.

Sunbelt’s research showed the information being uploaded to the remote server included chat sessions, user names, passwords, and bank information. The bank information included details of a company bank account with over $350.000.

The records being uploaded also contained eBay account information. Among the highly personal information Sunbelt retrieved from the server was one family’s holiday plans.

While possibly not quite so nasty, "tools" such as MyWebSearch and others with similar names are also potentially dangerous spyware, and care should be taken when downloading such tools.

There is no need to panic, however. Follow a few simple rules, and you can keep your computer and your personal information safe.

How do you know that there is a virus on your computer? Some of the symptoms are:

When going to the internet, you are no longer directed to your normal "home page". This may be compounded by an inability to access your home page at all.
The computer runs very slowly, particularly when accessing the internet.
When you access the "status" of your internet connection, there is a lot of activity on the phone line, even though you are not really doing anything. Note here, however, that such activity can be caused by automatic updates being down loaded by your anti virus program or Microsoft.
When you examine the list of active processes (using the ALT / CNTL / DEL key combination) there are processes such as "websearch0", "websearch1" active. Delete such a task and it will return almost immediately! Note here, that when you are not really doing anything, the "CPU Usage" figure should be zero%, or not much more. When this number stays at or near 100%, then you probably have a virus.

How do you keep your computer virus and malware free?

Install a good antivirus program (the best are McAfee and Norton), keep the virus definitions up to date, and run a full system scan once a week.
Install a program that can find and remove spyware (e.g. Ad-Aware, Spybot S&D), keep the definitions up to date, and run a full system scan once a week. It is worth having both antivirus and anti-spyware programs.
Microsoft regularly issues security patches and updates for the different versions of Windows (98, ME, 2000, XP) and other Microsoft products. Make sure your version of Windows is up to date, with all the latest security updates and patches (http://windowsupdate.microsoft.com), and check once a month.
Remove any unused / unwanted toolbars that clog up internet explorer - these are usually listed in "add and remove programs".

Articles