Virus
Posted 06/06/2010 - 23:04 - Helpful Comment
Link
If you truly believe you have been hit with a virus, the only secure way to clean it up is to reformat and reinstall the OS. No need for new hard drive.
** Do not trust anyone who simply states that they can run a program to clean the virus out for you, and not suggest reformatting the machine. That person has no clue about how malware works. **
GONE are the days when viruses intentionally erased your hard drive or put up stupid notes to make you aware you got hit. The intent now is to silently slurp data, and to make your machine a host accessible and capable of running programs remotely by the controller.
A lot of malware is now of the type that will call home to get other instructions and bigger/badder libraries of malware. Virus scanners might catch the original program, but will not likely catch the new stuff.
While working for a security firm I did tests on the state of the art for malware detection software a few years ago. With a dozen of the big name scanners, the *best* one caught maybe 50% of the test pieces of malware. These tests malwares were built from common kits used by script kiddies and some were over five years old. Meaning: even the best of the bunch caught less than 50% of five year old viruses. Those numbers dropped significantly for new malware!
My suggestion would be to;
- back up your data.
- install your OS onto a newly formatted hard drive
- install the latest patches (most malware is thwarted if you simply keep your machine up to date)
- install Microsoft's Security Essentials (a free AV that is nothing to sneeze at, surprisingly)
or use Free AVG or buy AVG, NOD32, Kaspersy or others mentioned here, and scan your backup.
- finally restore files back to your PC.
FYI,
Yes, Windows and other OS's have bugs in the image decoders that can allow a malicious image to execute code when the image is viewed. Simply opening a web page or email for instance can infect your machine almost instantly. Keep your OS patched, as most of these issues have been patched in recent months.
To help further protect your machine, get ride of Adobe Acrobat Reader.
Bigger attack vector than the Windows OS is now Adobe Reader because it is so easy to attack and most people trust PDF as a solid non-tamperable block of data.
Do not use Adobe Reader. Use FoxIt (not perfect but eliminates most of the bugs Adobe refuses to fix).
If you must use Adobe, find out how to turn off JavaScript and turn off Execution of embedded code (YES, Adobe actually allows Adobe Reader to execute foreign code! Ugh!)
** Do not trust anyone who simply states that they can run a program to clean the virus out for you, and not suggest reformatting the machine. That person has no clue about how malware works. **
GONE are the days when viruses intentionally erased your hard drive or put up stupid notes to make you aware you got hit. The intent now is to silently slurp data, and to make your machine a host accessible and capable of running programs remotely by the controller.
A lot of malware is now of the type that will call home to get other instructions and bigger/badder libraries of malware. Virus scanners might catch the original program, but will not likely catch the new stuff.
While working for a security firm I did tests on the state of the art for malware detection software a few years ago. With a dozen of the big name scanners, the *best* one caught maybe 50% of the test pieces of malware. These tests malwares were built from common kits used by script kiddies and some were over five years old. Meaning: even the best of the bunch caught less than 50% of five year old viruses. Those numbers dropped significantly for new malware!
My suggestion would be to;
- back up your data.
- install your OS onto a newly formatted hard drive
- install the latest patches (most malware is thwarted if you simply keep your machine up to date)
- install Microsoft's Security Essentials (a free AV that is nothing to sneeze at, surprisingly)
or use Free AVG or buy AVG, NOD32, Kaspersy or others mentioned here, and scan your backup.
- finally restore files back to your PC.
FYI,
Yes, Windows and other OS's have bugs in the image decoders that can allow a malicious image to execute code when the image is viewed. Simply opening a web page or email for instance can infect your machine almost instantly. Keep your OS patched, as most of these issues have been patched in recent months.
To help further protect your machine, get ride of Adobe Acrobat Reader.
Bigger attack vector than the Windows OS is now Adobe Reader because it is so easy to attack and most people trust PDF as a solid non-tamperable block of data.
Do not use Adobe Reader. Use FoxIt (not perfect but eliminates most of the bugs Adobe refuses to fix).
If you must use Adobe, find out how to turn off JavaScript and turn off Execution of embedded code (YES, Adobe actually allows Adobe Reader to execute foreign code! Ugh!)
Posted 07/06/2010 - 07:40 - Helpful Comment
Link
I used AVG Free right up the time it let through a nasty attack as described above. I would not recommend AVG any more and all I can say is that Norton 2010 has so far delivered the goods at reasonable cost. I suspect there are better products but the cost in footprint and money seems more.
I'm sure Glyn is right but the SPYBOT boys will give you very detailed instructions on how to get rid of an infection that will take a few hours, umpteen restarts and lots of downloads but will work and that's all I have ever used them for.
I'm sure Glyn is right but the SPYBOT boys will give you very detailed instructions on how to get rid of an infection that will take a few hours, umpteen restarts and lots of downloads but will work and that's all I have ever used them for.
---------------------------------------------------
You can see some of my shots at my Flickr account.
You can see some of my shots at my Flickr account.
Posted 07/06/2010 - 08:37
Link
Firstly, I wouldn't panic until you "know" you have a virus - you say in your opening line that you "think" you do - before taking drastic steps it's best to know thine enemy, as it were.
Secondly - I've seen 3 machines in the past month that were "working fine until I put g**gle chrome on it". I know lots of people use it, but maybe there are conflicts with some setups.
If you are using Vista, you can pop the DVD in and select to boot from it, then run the auto-repair tool.
If your worst fears are realised, or for peace of mind you choose to go with a fresh install on a new HDD - think carefully about what protection you need - sometimes you can have too much.
As others have listed what they use, I'll do the same;
Firewall in Router, Windows Defender and MS Security Essentials. As I'm with BT all mail is scanned at their end and then by Security essentials at this end. I don't use IE for browsing as a rule - only for certain sites that won't work correctly with my chosen browser, which is Opera.
People will now be staring at this and thinking the worst, which is fine. I rarely download anything and when I do, it's from a reputable source (I don't file-share or use P2P technology) so they'll be taking their own steps to ensure that they keep their house in order.
I've tried AVG and Norton and various others in the past as well as Zone Alarm - all they did was hog resources and duplicated what I had either as part of my ISP package, or as part of the OS.
The only time a virus got through to my machine was when I was using AVG+Zonealarm some 6 or so years back, but they let it straight through.
Secondly - I've seen 3 machines in the past month that were "working fine until I put g**gle chrome on it". I know lots of people use it, but maybe there are conflicts with some setups.
If you are using Vista, you can pop the DVD in and select to boot from it, then run the auto-repair tool.
If your worst fears are realised, or for peace of mind you choose to go with a fresh install on a new HDD - think carefully about what protection you need - sometimes you can have too much.
As others have listed what they use, I'll do the same;
Firewall in Router, Windows Defender and MS Security Essentials. As I'm with BT all mail is scanned at their end and then by Security essentials at this end. I don't use IE for browsing as a rule - only for certain sites that won't work correctly with my chosen browser, which is Opera.
People will now be staring at this and thinking the worst, which is fine. I rarely download anything and when I do, it's from a reputable source (I don't file-share or use P2P technology) so they'll be taking their own steps to ensure that they keep their house in order.
I've tried AVG and Norton and various others in the past as well as Zone Alarm - all they did was hog resources and duplicated what I had either as part of my ISP package, or as part of the OS.
The only time a virus got through to my machine was when I was using AVG+Zonealarm some 6 or so years back, but they let it straight through.
Posted 07/06/2010 - 08:37
Link
Just a thought, is the AV software you're using a Norton product?
I only ask as they're notorious for this sort of behaviour on the run up to licence renewal.
I'll never touch their products again after having nothing but trouble with them, yet PC World seem intent on lumbering every poor soul who buys a system with these tyrannical programs.
I only ask as they're notorious for this sort of behaviour on the run up to licence renewal.
I'll never touch their products again after having nothing but trouble with them, yet PC World seem intent on lumbering every poor soul who buys a system with these tyrannical programs.
Cheers, HG
K110+DA40, K200+DA35, K3 and a bag of lenses, bodies and other bits.
Mustn't forget the Zenits, or folders, or...
PPG entries.
K110+DA40, K200+DA35, K3 and a bag of lenses, bodies and other bits.
Mustn't forget the Zenits, or folders, or...
PPG entries.
Posted 07/06/2010 - 08:46
Link
I have never heard any suggestion that Norton will allow an infection through when nearing renewal - hardly a recipe for getting someone to pay again surely?
Pre 2009 versions I would not have touched Norton as it was slow, inefficient, very obtrusive but they seem to have taken comments on board as 2009 and 2010 versions are fast and just get on with things only telling you when they detect an 'issue'.
But of course this is a very personal choice - however unlike Ray I don't trust my ISP to trap virus attachments etc. although they do have a very competent system, well they tell me they do.
Mike
Pre 2009 versions I would not have touched Norton as it was slow, inefficient, very obtrusive but they seem to have taken comments on board as 2009 and 2010 versions are fast and just get on with things only telling you when they detect an 'issue'.
But of course this is a very personal choice - however unlike Ray I don't trust my ISP to trap virus attachments etc. although they do have a very competent system, well they tell me they do.
Mike
---------------------------------------------------
You can see some of my shots at my Flickr account.
You can see some of my shots at my Flickr account.
Posted 07/06/2010 - 08:49
Link
I personal hate any think by Norton soft ware
and yes started to have trouble with chrome so I reinstalled it and less than a week later it will not even load up so that is now going in the bin
as for the virus yes you are right it is only "I think"
bullgard says are has scanned my computer and not found any viruses and the uniblue disc scanner has not found any broken links
my os is XP pro on my main computer
James
and yes started to have trouble with chrome so I reinstalled it and less than a week later it will not even load up so that is now going in the bin
as for the virus yes you are right it is only "I think"
bullgard says are has scanned my computer and not found any viruses and the uniblue disc scanner has not found any broken links
my os is XP pro on my main computer
James
My Fluidr
"To see in colour is a delight for the eye, But to see in black and white is a delight for the soul" ANDRI HERY
"To see in colour is a delight for the eye, But to see in black and white is a delight for the soul" ANDRI HERY
Posted 07/06/2010 - 08:54
Link
I agree with you mike about Norton being intrusive
Photoshop is now running very slow and the printer viewer is taking forever to load up with a preview
even the spelling checker has stopped working on forum
James
Photoshop is now running very slow and the printer viewer is taking forever to load up with a preview
even the spelling checker has stopped working on forum
James
My Fluidr
"To see in colour is a delight for the eye, But to see in black and white is a delight for the soul" ANDRI HERY
"To see in colour is a delight for the eye, But to see in black and white is a delight for the soul" ANDRI HERY
Posted 07/06/2010 - 09:01
Link
Ah, XP, have you uploaded any updates recently?
When XP became available, many years age, the latest Win98SE updates were suddenly coming from a server which had been 'hacked' and was installing al sorts of malware/crap.
Now I know Microsoft wouldn't do this( )to make people upgrade but...
Before anybody shouts at me, yes I did have a couple of problematic updates just before I moved to Win7.
Is Bullgard Virgin's AV?
When XP became available, many years age, the latest Win98SE updates were suddenly coming from a server which had been 'hacked' and was installing al sorts of malware/crap.
Now I know Microsoft wouldn't do this( )to make people upgrade but...
Before anybody shouts at me, yes I did have a couple of problematic updates just before I moved to Win7.
Is Bullgard Virgin's AV?
Cheers, HG
K110+DA40, K200+DA35, K3 and a bag of lenses, bodies and other bits.
Mustn't forget the Zenits, or folders, or...
PPG entries.
K110+DA40, K200+DA35, K3 and a bag of lenses, bodies and other bits.
Mustn't forget the Zenits, or folders, or...
PPG entries.
Posted 07/06/2010 - 09:01 - Helpful Comment
Link
Well, that helps. If you are using a "genuine" copy of XP (as I'm sure you are) have a look at the MS fix-it centre, which is a small download from them - it's got a rage of tools to fix errors and the like and is also free.
I'm also reminded of a piece of "file management" software that is being punted about (can't remember the name atm) but it makes all sorts of claims about how it optimises your system etc...
A friend was taken in by this and installed it but was then unable to open most of his data files. It seems this program changes file associations in Windows for some reason. Once I'd taken it off and spent time restoring the links, everything was fine.
I'm also reminded of a piece of "file management" software that is being punted about (can't remember the name atm) but it makes all sorts of claims about how it optimises your system etc...
A friend was taken in by this and installed it but was then unable to open most of his data files. It seems this program changes file associations in Windows for some reason. Once I'd taken it off and spent time restoring the links, everything was fine.
Posted 07/06/2010 - 09:02
Link
Most of the more malicious virus programmes are intended to allow remote access to your drives in order to steal info, etc. To see if your machine is visible to others, try this:
Go to http://grc.com (type exactly, no "www" needed).
Click on "Shields Up!!"
Scroll down and click on "Shields Up!" in the "Hot Spots" section.
Click on "Proceed" - you may have to confirm this action.
In the resultant window, click on "All Service Ports." Wait for the scan to finish. Unless you get a True Stealth Analysis "Passed" notification, your machine is vulnerable and needs investigating.
HTH.
Go to http://grc.com (type exactly, no "www" needed).
Click on "Shields Up!!"
Scroll down and click on "Shields Up!" in the "Hot Spots" section.
Click on "Proceed" - you may have to confirm this action.
In the resultant window, click on "All Service Ports." Wait for the scan to finish. Unless you get a True Stealth Analysis "Passed" notification, your machine is vulnerable and needs investigating.
HTH.
Z1, K10D, D-BG2 Grip, DA 1:3.5-5.6 18-55mm AL, DA 1:3.5-6.3 18-250mm ED AL(IF), AF540FGZ Flash, FA 1:1.7 50mm, DA 1:2.4 70mm Limited, Wireless Remote (Did I offend you? Click here).
Posted 07/06/2010 - 09:10
Link
Thanks for that, Argee - very useful.
I've just run it and got the required result. A great tool to have in the "kit".
I've just run it and got the required result. A great tool to have in the "kit".
Posted 07/06/2010 - 09:43
Link
I understand there's a huge selection of Patches coming on Tuesday from M$S
My PC Lappy will be dealt with when I come back from France - and it's done by a mate using LogMeIn since I don't use M$S or PCs - this lappy is kept for my daughter #1 so she can log into work.
That machine was used by my husband and never had a problem - no Norton stuff on it - he used Avast , mailwasher and various spyware detectors . All our machines have software Firewalls and sit behind a router .
I do have an AV ready for use if necessary but I only run this about every 6 months Yes I am careful very very careful indeed
My PC Lappy will be dealt with when I come back from France - and it's done by a mate using LogMeIn since I don't use M$S or PCs - this lappy is kept for my daughter #1 so she can log into work.
That machine was used by my husband and never had a problem - no Norton stuff on it - he used Avast , mailwasher and various spyware detectors . All our machines have software Firewalls and sit behind a router .
I do have an AV ready for use if necessary but I only run this about every 6 months Yes I am careful very very careful indeed
let the education continue
proud owner of a couple of cameras and a few bits and bobs
proud owner of a couple of cameras and a few bits and bobs
Posted 07/06/2010 - 09:47
Link
It does sound like a Malware problem to me, I have seen this before, and rectified it.
Colin
“Nobody made a greater mistake than he who did nothing because he could do only a little.”
Edmund Burke (1729 – 1797)
[IMG]http://i941.photobucket.com/albums/ad254/weldingblues/K-7userbar-red.jpg[/IMG]
“Nobody made a greater mistake than he who did nothing because he could do only a little.”
Edmund Burke (1729 – 1797)
[IMG]http://i941.photobucket.com/albums/ad254/weldingblues/K-7userbar-red.jpg[/IMG]
Add Comment
To leave a comment - Log in to Pentax User or create a new account.
605 posts
17 years
Bury
I've never heard of a virus attached to a JPG
Algi
I had a similar problem a few months back, went through all the usual routines of removing all the accumulated junk and de-fragging the HD, but the real crunch came when a program I relied on (SuperAntiSpyware, or SAS) ran so slowly that it was overtaken by a glacier. SAS were not able to offer a cure. It was fairly obvious that some malignant software was responsible. I put a new HD in, formatted it with the PC Manufacturer's rescue disk (early XP Home), went through a lot of hassle to get the Windows Service Packs downloaded, and now the PC is back up to speed (wish I was).
SAS now flies again and I tried out the new Microsoft Security Essentials program. The early one was a load of ****, the new one is rather good. AVG is good also, but some anti-spyware programs will not work with it. You pays yer money, or downloads yer freebie, and takes yer choice.
Geoff
X-5
istDS
K2000
P50.
Lenses Digital: 50-200, 18-55 KAF: 28-80.
Lenses KA & K: SMC-KA f2.0, SMC-K f1.4, SMC-K f1.7 Tokina KA 28-70 , SMC Pentax 70-210 F4, Sigma KA 75-300 , Hanimex 500mm Mirror, and the Tamron Adaptall-2 stuff.
and then there's all the M42 kit, and the accessories ...