The
number
one
problem
we see
by far
is
‘malware’
or
malicious
software.
Software
is
considered
malware
based on
the
perceived
intent
of the
creator
rather
than any
particular
features.
It
includes
computer
viruses,
worms, Trojan
horses,
spyware,
dishonest
adware,
and
other
malicious
and
unwanted
software.
Within
this
group,
the
number
one
problem
is
spyware
and
rogue anti-spyware.
The ASC
(Anti-Spyware
Coalition)
drafted
a
definition
of
“spyware”
in
August
2005.
The ASC
defines
spyware
and
other
potentially
unwanted
technologies
as those
that
“impair
users’
control
over
material
changes
that
affect
their
user
experience,
privacy,
or
system
security;
use of
their
system
resources,
including
what
programs
are
installed
on their
computers;
or
collection,
use, and
distribution
of their
personal
or
otherwise
sensitive
information.”
“Spyware”
is
something
of a
grey
area, so
there’s
no
consistent
definition
for it.
However,
as the
name
suggests,
it’s
often
loosely
defined
as
software
that is
designed
to
gather
data
from a
computer
and
forward
it to a
third
party
without
the
consent
or
knowledge
of the
computer’s
owner/operator.
This
includes
monitoring
key
strokes,
collecting
confidential
information
(passwords,
credit
card
numbers,
PIN
numbers,
etc.),
harvesting
e-mail
addresses,
or
tracking
browsing
habits.
There’s
a
further
by-product
of
spyware
where
such
activities
inevitably
affect
network
performance,
slowing
down the
system
and
thereby
affecting
the
whole
business
process.
The
reason
“spyware”
is such
a grey
area is
that it
is
really
just a
catch-all
term for
a wide
assortment
of
malware-related
programs,
rather
than a
defined
category.
Most
“spyware”
definitions
apply
not only
to
“adware”,
“pornware”
and
“riskware”
programs,
but also
to many
Trojan
programs:
Backdoor
Trojans,
Trojan
Proxies
and PSW
Trojans.
Such
programs
have
been
around
for
almost a
decade,
when
some of
first
AOL
password
stealers
appeared.
However,
at that
time the
term
“spyware”
had not
yet been
used.
Another
reference
to
spyware
is
“adware”.
In this
case,
spyware
can
exist in
the form
of
malicious
backdoor
programs
that
open up
ports,
initiate
an FTP
server,
or
collect
keystroke
information
and
transmit
it back
to the
attacker.
Spyware
can
exist in
the form
of legal
and
desirable
commercial
applications
that
give
network
administrators
a great
deal of
power
both
over
what
they can
affect,
and view
their
managed
systems.
Although
such
programs
are not
new,
their
use for
malicious
purposes
has
increased
in
recent
years
and they
have
received
much
greater
attention,
both
from the
media
and from
“spyware”-only
vendors.
Symptoms
Home
Page
Hijacking
Home
page
hijacking
is when
malware
changes
the
Internet
Explorer
home
page,
and then
locks
down a
system
so that
the user
cannot
change
their
home
page
back to
his/her
original
choice.
Search
Engine
Games
Internet
Explorer
has
several
built-in
search
facilities
that use
well-known,
legitimate,
search
engines.
There is
the
Explorer
Pane
that
appears
to the
left of
screen,
as well
as the
ability
to
search
from the
address
bar.
One of
the most
popular
forms of
malware
is
search
engine
hijacking.
Suddenly
your
well
known
search
engine
in
Internet
Explorer
will
disappear
to be
replaced
by an
unfamiliar
stranger.
Toolbars
Another
common
symptom
of
malware
is the
appearance
of a new
toolbar
that
invariably
claims
to
provide
a Web
search
or other
service.
It may
appear
at the top
or
bottom
of
the screen
and sometimes
cannot
be
turned
off.
Pop-Up Advertisements
Pop-up
advertisements
can be a
normal
part of
internet
surfing.
Many
sites
use
them.
However,
pop-up
advertisements
that
appear
even
when we
are not
actively
surfing
the web
are not
normal,
nor is
it
normal
to see
so many
advertisements
that
normal
Web
surfing
is
hampered,
or our
systems
collapse
under
the
load.
Nor is
it
normal
to see
non-family
friendly
pop-ups
during
casual
Web
surfing.
Nor is
it
normal
to see
pop-up
windows
that
fill the
entire
screen
and
cannot
be
closed.
Crashes/Boot
Failures
Ok,
programs
can
crash.
They
always
have,
and
although
crashes
now are
rarer
than
they
were, a
few
years
ago,
consistent
crashing
of your
system
or
browser
is not
OK or
normal.
So what
is a
normal
crash,
and what
is a
malware
crash?
Well,
first of
all,
malware
crashes
often
involve
unusual
file
names
such as
aodxyz3256.dll
or may
refer to
unknown
modules
(files).
Secondly,
malware
crashes
may
occur
when you
are not
actually
doing
anything.
Your PC
may be
turned
on, but
idle.
Finally,
and the
worst
events
are, when
your
system
crashes
on
boot-up.
If you
notice
this
after
you have
been
experiencing
other
malware
symptoms,
it is
likely
that you
have a
serious
infection,
but do
not
fret;
most, if
not all,
of your
data is
likely
to be
safe or
recoverable.
But your
system
needs
serious
repair
work.
Prevention
By far
the
easiest,
fastest
and
least
expensive
way to
fix an
infection
is to
prevent
it from
ever
happening
in the
first
place.
How?
Use a
reputable
anti-malware
product
that
contains
both
anti-virus
and
anti-spyware.
All the
other
tools
that
some
anti-malware
contain
are like
spices
in a
soup.
Not
needed,
but
sometimes
nice to
have.
What is
the
best?
That
answer
can vary
from
month to
month,
and we
test
differing
products
regularly, but we
currently use Kaspersky
Internet
Security
in our
shop,
but as
it tends
to be a
bit
‘technical’
for most
folks,
we
recommend
AVG Free
edition
as a
good all
around
defender
for most
everyone.
We
always
recommend
using
the
trial
that
most
products
have to
be sure
it fits
your
system
and your
style of
use.
Also be
sure to
remove
one
before
installing
another,
as too
many
protectors
can be
worse
that the
malware
itself.
Be
aware,
none of
them are
perfect,
and even
with the
best
installed,
you can
get
infected
if you
are not
careful.
Avoiding
infection
is kind
of like
avoiding
getting
mugged.
1)Be aware of your surroundings. (It is easy to look safe on the web, trust sites by reputation.)
2)Stay out of ‘bad’ neighborhoods. (There are ‘strings’ to that free music and software.)
3)Do not act like a victim. (Since you really can’t do that, have a good protection software.)
Cure
Now it
becomes
complicated...
In our
shop, to
completely
remove
all the
malware
requires
up to 7
scans
including
3
proprietary
scans
available
no where
else.
We also
complete
a manual
clean-up
of the
registry
and hard
drive.
All
totaled,
that is
2-5 hours
of time
in front
of the
system,
and 15+
hours of
scan
time.
When
your
system
leaves
the shop
we
guarantee
there
are no
detectable
infections
left.
What!
Did we
just
qualify
that
statement
with
'detectable'?
Yes,
because
there
are new
bad guys
every
day, we
have to
use that
qualification.
IS MY
DATA
GONE??!
Not
likely,
even if
we have
to
reinstall
Windows
due to
malware
damage.
Hardly
anyone
ever
looses
data to
malware,
just
programs
and the
OS, but
even
that is
rare.
Our
record
infection
was
15,480
infections
cleaned
from a
single
system
with NO
data
loss,
and
still
only
$125.00
for the
entire
service.
Synopsis
We now
know
that
unexpected
home
page
and
search
engine
changes,
new
toolbars,
pop-up
windows,
and some
Internet
Explorer
crashes
are not
normal
and can
be
caused
by
malware.
What do
we do
now?
Well, we
check
our
system
for
infections.