A few years ago we were hoping that along with the development of new computing technologies we will get rid of all kind of viruses and spyware. It is true that Windows became safer and the Virus and Spyware detecting programs are better than before. But at the same time the Internet became much faster, email and messaging programs are familiar to everybody. The number of Internet users grew enormously and so the virus distribution possibilities. Almost every day somebody calls me about computer problems, when they start to describe what is going on in most cases I recognize an infected computer.
What are the symptoms of infected computer?
In general if the computer is out of your control very likely that it is infected.
The most common symptoms that I’ve noticed are:
· Computer is slowing down, it is always busy doing something
· Firewall asking permissions to allow some unknown programs to access to the Internet
· Visible configuration changes are made on your desktop
· Unknown processes and/or programs start when Windows starts
· Some policy changes are made without your notice (e.g. Windows Task Manager is disabled)
· Some essential programs do not work anymore (e.g. Internet Explorer )
· You are getting lot of pop-ups, sometimes very embarrassing ones
How to detect the virus, trojan, spyware etc.?
You know that your computer is infected what to do and where to start?
- Scan your computer using available Antivirus and Anti Spyware programs; update them before scanning if your Internet still works. Try to run them in Safe Mode if it is possible. Most of Antivirus and Anti Spyware programs will work in safe mode without problems. From known programs Norton Antivirus with its default configuration settings doesn’t work in Safe Mode. You might get it work using different configuration changes.
What is the Safe Mode and How to go there?
Safe Mode is a Windows Diagnostic mode. In Safe mode only those services (processes) are starting which are necessary for Windows basic functionality. This means that Spyware or Viruses are sleeping even if they are set up to start when Windows starts. And if they are not started you can delete them easily. Restart your Computer. While it is restarting keep pressing F8 key. From the Safe Mode menu choose “Safe Mode with Networking” option, which will allow you to use the Internet in Safe Mode and update your Antivirus program.
- If you don’t have Antivirus and Anti Spyware programs you can start from checking the working processes list in the Windows Task Manager. The fastest way to open the Task Manager is pressing Ctrl+Alt+Del keys together.
In the Task Manager choose the Processes Tab and left click once or twice on CPU column to arrange processes in descending order. Now on the top of the Task Manager’s windows you see processes that consume most of your CPU’s power. You might recognize some known names, so live them alone. If the Process Name is not known check it in the Internet (better in Google). Type the exact process name including the extension and search. For common system processes you will get thousands of search results. Read one or two of them and it will be clear if it is a legitimate process belonging to the Windows OS, MS Office etc. or some kind of virus or spyware. You will get lot of search results for known viruses as well. If in the internet nobody knows about the file most likely it is a spyware or a virus.
After recognizing the viruses you need to find the locations of the files to delete them. Click on Start => Search, the “Search Results” window will open. Type the file name with the extension in the “Search for files and folders named:” field; put checkmark in the “Advanced Options” checkbox. Be sure that checkboxes “Search system folders” “Search hidden files and folders” and “Search Subfolders” are checked.
But what if the file name contains some unknown symbols like this – ñsrss.exe.
There is a little system tool in the Windows XP called “Character Map”. Open it:
Start => All Programs => Accessories => System Tools => Character Map, find the character you need ( put checkmark in the “Advanced view” checkbox and change the “Character Set:” if it’s necessary), select , copy the character and paste it into the search box.
3. The next common place to look for spyware is in the System Registry:
Start => Run => regedit
Spyware and viruses creating new registry keys or changing existing key values.
They can be anywhere in the system registry and it is very difficult manually to find and fix the changes they made. However, there are two known places in the registry where it worth to check for spyware entries:
HKEY_LOCAL_MACHINE => SOFTWARE => Microsoft => Windows => CurrentVersion => Run
and
HKEY_LOCAL_MACHINE => SOFTWARE => Microsoft => Windows => CurrentVersion => Run
Under the key HKEY_LOCAL_MACHINE are listed processes that start when computer starts, from the other hand under the key HKEY_CURRENT_USER are listed processes that start only for particular user. Viruses like to add an entry in these places and start when windows starts. You need to check is there any processes here that associated with viruses.
Checking in the Registry is much easier than in the Task Manager. In the Task Manager you need to type the name of the process into search engine, in the Registry you can double click on the process name, highlight, copy and paste it into the Search Engine. If you find the virus entry simply deletes it.
Microsoft warns users to be extremely careful with the changes in the System Registry because inside the registry there are not any security features that prevent you from damaging your computer. You can select and delete big chunks of the Registry and kill your Windows installation without any warnings. However it is also truth that practically you can do changes in the registry; clean it, if you know what you are doing.
How to delete the virus, trojan, spyware etc.?
After finding the location of the virus you want to delete it to clean the computer. In some cases you can do that without any problem. However lot of viruses designed to not let you delete them. You might receive the following message.
Here are the methods that you can use to delete the virus:
1. Try to End the Process in the Task Manager and delete the file.
If this doesn’t work,
2. Restart the computer in Safe Mode and delete the file
If this doesn’t work,
3. If you have second Windows Operating System installed on the computer, reboot to the second Operating System and delete the file.
Or
4. Remove the hard drive from the computer and attach it to another computer and delete the file.
Or
5. If you have Windows XP installation CD, reboot computer from the CD, enter to the Recovery Console mode and delete the file
