July 2010 - Newsletter Article

How to Clean up a Virus

by Marshall Wright

Sooner or later every computer user in New Jersey will get hit with a virus or spyware - let's call it malware. It's frustrating because you have done all of the right things. You've updated the anti-virus software and run the anti-spyware software, and yet here you are with a virus popping up Viagra ads every 30 seconds. What do you do next? If you are like many of my customers, you pick up the phone and call your support company for help.

How do you know if the computer is infected with a virus or spyware? Here are some of the tell tale signs the computer has been compromised.

The computer starts running more slowly than usual for no apparent reason.

Pop-ups start appearing even though you haven't done anything

An annoying pop-up keeps coming back telling you to buy some anti- virus software

The web sites for Symantec, McAfee, AVG and other anti -virus vendors are no longer reachable

The anti- virus software you installed suddenly vanishes or is disabled

You are no longer able to surf the internet

There are suddenly conflicts with some of the software running on the computer

Unfortunately, the writers of viruses and spyware continue to improve their software, so I anticipate the symptoms to change, and eventually disappear. Now that you have concluded you are infected, what do you do? The most important thing to do is immediately get the computer off of the internet. Most of the malware today is designed to communicate with a host system to receive instructions on what to do next. This often involves installing additional software, disabling anti-virus software and eliminating the ability to get to web sites for help. Stopping this escalation of infection is the key to being able to resolve the issue with standard tools.

If you have any anti -virus or spyware software installed on the computer, now is the time to run a scan. Hopefully the scan will find and eliminate the virus before it is able to fully take over, or hijack the computer. If the computer doesn't have any tools to attack the virus, than you will need to download tools on another computer and copy them to a USB drive do install them on the infected computer. Tools that we use include Malware Bytes, AVG, Symantec Anti-Virus, McAfee Virus Scan, Spybot, Spyware Doctor and Microsoft Defender. Please note the AND in the last statement. Removal of most viruses requires the usage of several tools to fully eliminate the threat. By using this approach, within several hours of running scans, the computer should be safe to use and connect to the internet again. If the computer suddenly goes wild after reconnecting to the Internet, you know the scanning wasn't successful.

If you weren't successful getting the virus removed with the tools and process described above, you only have a few choices remaining.

1. Completely erase the hard drive and re-install everything - thereby losing all of your data.

2. Buy a new computer - thereby losing all of your data.

3. Put the computer back on the Internet and use a third party, like Symantec to remotely try and remove the virus.

4. Bring the computer to a computer repair shop

When our customers bring computers in to our office in Red Bank, NJ for virus remediation, we run a series of tests and scans to determine the severity of the infection. Typically by the time we receive the computer it is seriously infected. If data recovery is required, the hard drive is removed and "slaved" to a special computer with every anti-virus software know to mankind (not really, but we have a dozen programs to choice from). Since the infected hard drive is not the boot drive, we are able to find and kill the viruses, or just recover the files the customer needs for the new computer. After the drive is cleaned as much as possible, it is reinstalled in the computer. Typically upon startup the computer will try and re-infect itself. During this time, registry edits are needed to fully eliminate the virus from the hard drive. Several reboots and scans later, the computer will be ready to deliver back to the customer.

From start to finish a virus remediation with a hard disk removal will take between 4 to 8 hours, depending on the level of infection. With the time and effort involved, virus remediation is not cheap.

Another technology that can get a user back up and running faster is snaps, or backups. By restoring the computer to a running state before the virus was suspected, the user may lose some data, but will have the computer back much faster for a fraction of the cost. Technologies like Retrospect allow computers to safely be rolled back to a prior state for a fraction of the cost of remediation. DeckerWright Corporation can implement these technologies for you. Contact us today!

About the Author:
Marshall Wright of DeckerWright Corporation has been providing New Jersey businesses with HARDWARE, SOFTWARE & NETWORKING technology consulting services since 1984.

Looking for a New Jersey company to help remove malware on your business computer system?
Contact DeckerWright for Virus Remediation.

 

Copyright © 2011 DeckerWright Corporation. All Rights Reserved * Red Bank, New Jersey * 732.747.9373