Computer Viruses: Repel, Reveal, and Remove

Virus pre­ven­tion is a lit­tle like den­tal cleanings.

Maybe you put it off longer than you should, even though deep down you know that’s a mis­take. Then when some­thing finally goes really, painfully wrong you smack your­self in the head for not tak­ing care of it sooner.

I’ll try to make this as pain­less as possible.

When time and money are tight—say you’re a small or medium-sized non­profit with no IT staff—it’s an awfully easy thing to let slide.

But please don’t, for your own sake.

Really.

Pretty please.

Cau­tion­ary Tale: When Bad Things Hap­pen to Good Computers

Recently a client’s web­site was hacked. Some­one used his login to con­nect to the web­site and upload a file with evil soft­ware, hop­ing oth­ers would be infected upon vis­it­ing his site.

For­tu­nately his web host­ing com­pany quickly noticed the prob­lem, restored the non-evil ver­sion of his site, and emailed him with the scary news. If they hadn’t, besides infect­ing other peo­ples’ com­put­ers his site could have ended up on the black­list for one or more search engines. While that’s not the end of the world, it’s a bit of a nui­sance to get off of the blacklists.

How could some­one get his pass­word to hack his site?

Maybe they grabbed his pass­word as it flew around the Inter­net or a wire­less net­work. But the more likely expla­na­tion made me ner­vous: maybe some­body got the pass­word by using some kind of virus or other mali­cious soft­ware (mal­ware) and pulled it right off of his computer.

So I advised him in how to aggres­sively scan his com­put­ers for mal­ware, clean them if needed, and min­i­mize the risk of future infestations—much of the infor­ma­tion that I’m pro­vid­ing in this article.

Yep, maybe some­one used mal­ware to pull the infor­ma­tion off of his computer.

Or… wait a minute… maybe they pulled it off of my com­puter.

Uh-oh.

An Attack of e-pochondria

Now, I am pro­foundly risk-averse. I’m a very wary Inter­net user, and I reli­giously scan, update, backup up, clean, and main­tain all my com­put­ers. Like the car buff who cleans her vin­tage Camaro’s dash­board with a tooth­brush, except that I’m clean­ing my oper­at­ing sys­tem with a toothbrush.

In fact, some­one look­ing at my behav­ior from out­side my head might use words like “com­pul­sive” or even “para­noid”. And I was okay with that: as far as I knew it had been at least a decade since any kind of mal­ware had dark­ened my doorstep.

But as I thought about it…

Lots of lit­tle imper­fec­tions in my com­puter started look­ing less like annoy­ances and more like tell­tales of evil soft­ware lurk­ing in the shad­ows. Slow startup? Prob­lems with shut­downs? Inter­mit­tent hangs? My hard drive grind­ing away for no appar­ent rea­son? Maybe it was just Win­dows being Win­dows. Or maybe not.

The idea that his site might have been hacked because of mal­ware on my com­puter seri­ously wor­ried me besides gen­er­ally weird­ing me out me out.

What fol­lowed was the geek equiv­a­lent of com­pul­sive hand-washing: end­lessly scan­ning my com­put­ers with a wide vari­ety of tools, read­ing up on the lat­est sys­tem hacks and patches, and gen­er­ally think­ing too much about my com­puter instead of just work­ing with my computer.

Alien Virus from the Future

The upshot of all this fren­zied scan­ning? I’m clean.

Or if I’m not clean, I have some alien virus from the future that’s smart enough to fool me and a bunch of major and minor secu­rity ven­dors, in which case (and I’m writ­ing this to the virus, which I’m sure is read­ing this)—I give up. You win. Take what you want from my hard drive, just don’t dis­in­te­grate my car or steal my house.

Are You At Risk? Mac vs. PC vs. That Other One

Nearly all the world’s per­sonal com­put­ers (desk­tops and lap­tops) are using one of three oper­at­ing sys­tem: Microsoft Win­dows, Apple Mac OS, and the free open source Linux.

Is that because Win­dows is poorly made, or just because Win­dows is a bet­ter tar­get, rep­re­sent­ing 85% to 90% of the com­puter mar­ket?

I use all three oper­at­ing sys­tems, I’ve seen the argu­ments, and I’ve come to this con­clu­sion: I don’t care. I just know that right now Win­dows is the Val­ley of the Shadow of Death, so that’s where this arti­cle will walk.

Repel, Reveal, and Remove

Defense #1. Keep Win­dows up to date with fixes from Microsoft

Tired of tak­ing flak for all the Win­dows mal­ware out­breaks, Microsoft has become much more assertive about auto­mat­i­cally installing updates on our com­put­ers. It does this through the Win­dows Update ser­vice, and in par­tic­u­lar through Auto­matic Updates.

This ser­vice runs on your com­puter and con­tin­u­ally mon­i­tors for patches and advi­sories from Microsoft, down­load­ing and installing them as needed.

Some peo­ple find that intru­sive and annoy­ing. Those peo­ple are over­look­ing the fact that a mal­ware infec­tion is even more annoying.

Microsoft pro­vides good infor­ma­tion on auto­matic updates, includ­ing instruc­tions on how to enable them. I strongly rec­om­mend using Microsoft’s rec­om­mended set­tings, which will auto­mat­i­cally down­load and install updates with­out you need to do anything.

Pushy? You bet. Safer? Ditto.

Defense #2. Keep other soft­ware up to date too.

Besides Win­dows, other pro­grams you use might acci­den­tally let mal­ware run on your com­puter. For exam­ple, in the last year or two Adobe Acro­bat Reader has been the tar­get of numer­ous attacks.

Most major soft­ware ven­dors make patches avail­able if you go to their web­sites and down­load them. How­ever, in the last few years many ven­dors have started doing the same kind of proac­tive check­ing that Win­dows does.

For exam­ple, Adobe, Apple, Google, and Microsoft all have sys­tem to auto­mat­i­cally check for updates to their soft­ware, and gen­er­ally you don’t need to do any­thing to make these ser­vices check for updates, though you can usu­ally request updates on demand (often via the Help menu). In fact, you can check for updates to Microsoft Office using Win­dows Update.

Defense #3. Browse Wisely

That mal­ware has to come from some­where, and more often than not it comes from the Inter­net, whether through email or browsing.

We’ll deal with email in the next section.

As for brows­ing, yes it’s pos­si­ble for bad things to hap­pen just by vis­it­ing a web­site. Never down­load a file from a site unless you have good rea­son to trust the site is safe, and gen­er­ally avoid vis­it­ing sites unless you know them to be safe.

Defense #4. Let secu­rity soft­ware con­tin­u­ally pro­tect you.

Keep­ing Win­dows and other soft­ware updated, and brows­ing wisely: that’s a good start. But it’s not enough. You need soft­ware that can pre­vent, detect, and elim­i­nate mal­ware infections.

If you can afford it, a paid, com­mer­cial secu­rity suite is a good invest­ment. A secu­rity suite is a col­lec­tion of soft­ware tools that pro­tect you in many ways: auto­mat­i­cally scan­ning your down­loads and email, auto­mat­i­cally updat­ing the list of mal­ware they fight, pro­tect­ing you while you browse the web, and more.

In just the last 2–3 years these pro­grams have got­ten much bet­ter, not only at detect­ing prob­lems but at get­ting in your face as lit­tle as nec­es­sary. Through­out the year I often read mag­a­zine arti­cles and author­i­ta­tive web­sites that review and com­pare secu­rity suites. If you want to be sure you’re get­ting the cur­rent cham­pion, find a recent com­par­a­tive review from this kind of source.

Besides online sources like CNET.com, the fol­low­ing mag­a­zines run secu­rity roundups about once a year and will give you good information:

- Con­sumer Reports
– PC World
– Max­i­mum PC

If you’re less con­cerned about the cur­rent cham­pion (it does vary from year to year) and just want a solid secu­rity pack­age, these gen­er­ally rate well:

Qual­i­fied non­prof­its can get secu­rity tools like Nor­ton very inex­pen­sively through Tech­Soup. For exam­ple, as of this writ­ing Nor­ton Inter­net Secu­rity, gen­er­ally rated very highly among secu­rity suites, will run you just $6. Upgrad­ing to Nor­ton 360, which adds some nice backup fea­tures, only pushes the tab to $8.

But if you can’t afford a com­mer­cial suite, there are some very good free options too.

These typ­i­cally don’t rate quite as well as the highly-rated com­mer­cial pack­ages, though some rate bet­ter than low-rated com­mer­cial packages.

They also offer fewer fea­tures; for exam­ple, some will scan your hard drive when you ask them to, but won’t auto­mat­i­cally scan in the back­ground, scan your email, or warn you of risky web­sites. Most free secu­rity pack­ages are “freemium” soft­ware: you can down­load the free ver­sion, but get a more pow­er­ful or con­ve­nient ver­sion by paying.

Impor­tant: Update Your Software

Secu­rity soft­ware is only as good as its knowl­edge. New mal­ware is being invented at a fero­cious rate, and the peo­ple invent­ing try to make it smarter than last week’s secu­rity software.

When new mal­ware gets dis­cov­ered, secu­rity ven­dors need to let their soft­ware know about the new threat by updat­ing the software’s ency­clo­pe­dia of threats and the traces they leave behind.

All paid secu­rity soft­ware, and some free soft­ware, will auto­mat­i­cally down­load these def­i­n­i­tions. Their fre­quency varies, with some updat­ing many times a day. For most paid soft­ware pack­ages, this is their hook to keep you pay­ing: when you buy the soft­ware you get a cer­tain period of free updates, typ­i­cally a year. After that period you’ll have to pay for your “sub­scrip­tion” to be renewed. It might feel like lar­ceny, but it’s worth the money to have the lat­est protection.

For some pack­ages, though, you have to down­load the def­i­n­i­tions man­u­ally. For exam­ple, some free secu­rity soft­ware will make you down­load updates man­u­ally, enabling auto­matic updates if you buy the paid ver­sion of the software.

So when you install your secu­rity soft­ware, check whether it sup­ports auto­matic updates. If not, it’s crit­i­cal that you cre­ate a peri­odic reminder (at least weekly) to down­load the lat­est definitions.

Defense #5. Do peri­odic scans for malware.

Some free soft­ware, and all paid secu­rity suites, give you a good deal of auto­matic pro­tec­tion by mon­i­tor­ing your com­puter constantly.

Regard­less, you should occa­sion­ally do a com­plete scan of your com­puter if your secu­rity soft­ware doesn’t do this for you auto­mat­i­cally. Within your secu­rity soft­ware you should find an option called some­thing like “Scan” or “Scan Now”. I rec­om­mend doing a com­plete sys­tem scan at least monthly in addi­tion to what­ever auto­matic pro­tec­tion your secu­rity soft­ware pro­vides. I scan my own com­put­ers much more often than that, typ­i­cally weekly, to be safe.

How­ever, no secu­rity soft­ware tool can detect every kind of mal­ware. For this rea­son, to be extra safe you might peri­od­i­cally scan with a dif­fer­ent tool than your nor­mal secu­rity software.

These tools aren’t ade­quate for your pri­mary secu­rity pro­tec­tion, but they pro­vide a reas­sur­ing (and free) sec­ond, or third, or fourth opinion:

Take­aways

In sum­mary, doing these things will make a mal­ware attack much less likely–and if one does happy, you’ll be much more likely to catch it and fix it.

Patch and Prevent

1. Enable Auto­matic Updates Enable auto­matic updates for Win­dows and any other soft­ware that sup­ports it.
2. Down­load with Cau­tion Use good sense with downloads.
3. Get Mon­i­tor­ing Help Don’t trust your good sense: install a tool that flags dan­ger­ous sites.

Mon­i­tor and Eliminate

1. Install a Secu­rity Suite Install secu­rity soft­ware that will mon­i­tor your com­puter continually.
2. Update Secu­rity Soft­ware Keep your secu­rity soft­ware up to date.
3. Peri­odic Scan Peri­od­i­cally (monthly or more) do an ad hoc secu­rity scan of your hard drive.
4. Con­sider a Sec­ond Opin­ion For extra safety, con­sider occa­sional scans with a dif­fer­ent secu­rity program.

Here’s wish­ing you good luck and good health through the con­tin­ual virus season.