Infections Beyond Repair
Most people say that once a machine is infected with a virus, there is no practical way to know for sure if it is ever truly safe. You could take out the drive, attach it to a Linux machine for scans, and run all the latest tools. But this doesn’t guarantee success.
Think of it as an arms race between the virus writers and the anti-virus writers. Many viruses re-write parts of the Windows operating system. They are written specifically to sneak past popular anti-virus software, namely Norton and McAfee.
The solution, especially for machines with nasty viruses, is a clean install of the operating system. This can’t be done from within Windows. The important data should be backed up and the drive should be formatted and a clean install should be performed.
Before the old data is put back on the computer, it too should be scanned. Even documents can contain little programs (Macros) that could contain viruses.
Client Story
A recent client in Virginia had a computer that was badly infected. After the computer booted up, supposed anti-virus software popped up indicating that there were viruses. This was certainly true, but the anti-virus software was bogus. It just asked for his credit card info to fix the problems. If he had provided his credit card, I am sure that the virus would not have been removed. He would have probably just gotten many unauthorized charges.
His computer was no longer his. He had no administrator privileges. He had no “My Computer”, no CD drive, and no task manager. His system tray in the bottom right corner only had the words “VIRUS ALERT!”.
Without much hope, I initially tried Windows is Avast! 4 Home Edition. One feature that Avast has over the previously mentioned AVG is the ability to scan Windows before booting into Windows machines.
Unfortunately, much of the operating system had been modified, so Avast could not fix it. I removed the drive, placed it in a Linux machine, backed up and scanned the important files, and then ran Darik’s Boot and Nuke to wipe the drive.
The desktop was an HP that did not come with a restore disk, so we had to purchase another copy of Windows to install.
I told the customer how many viruses use social engineering to work. Messages appear in an email or browser pop-up window and they appear legitimate so users click on them. He asked me how to tell the real pop-ups for the fake ones. Without computer experience, it is very difficult to know.
Windows Vista has made this worse. By constantly asking people to approve even small tasks, it conditions people to just click “Okay” for everything.
His computer now is up and running again. It is behind a router with a firewall and has the Firefox web browser and Avast anti-virus. Hopefully that will keep him safe from viruses and malware. At least he can rest assured that his machine is not currently hi-jacked after a clean operating system install.
Data backups should be done regularly and automatically. SyncBack for Windows does that.
