Happily, deleting a files does not remove them. Only the references to the files are gone. Usually some files can be recovered if you know what file type [...]]]> A recent client accidentally deleted several important files and removed them from the recycle bin. Another client had done a system rollback that effectively removed important files.

Happily, deleting a files does not remove them. Only the references to the files are gone. Usually some files can be recovered if you know what file type you’re looking for and if the file location on the hard drive hasn’t been overwritten by new files. This is why it’s important to not install a program to recover files. Just the act of installing something will overwrite the data you want to recover.

I like Recuva Portable, available for free here:
http://www.piriform.com/recuva/builds

The Portable version can run from a USB or CD and does not need to be installed or be copied onto the main hard drive.

Every week I remove viruses from Windows computers. Here’s a common scenario:

Someone gets a fake alert like this and realizes that they have a virus.

When they call me, I tell them to turn off the computer. This is because a virus can continue to inflict more damage. It can install [...]]]> Viruses Abound

Every week I remove viruses from Windows computers. Here’s a common scenario:

Someone gets a fake alert like this and realizes that they have a virus.

When they call me, I tell them to turn off the computer. This is because a virus can continue to inflict more damage. It can install other viruses and even encrypt your hard drive to hold your data hostage to demand a $200 ransom. Turning off a computer stops whatever the virus is doing.

Use a Live Rescue CD

The first thing I do with the computer is boot into a Live CD to search for viruses. Typically the computer displays the key to press for boot options. It is usually one of these: F1, F2, , F10, F12 or Del. The computers may be set up to boot from the CD if one is available.

By booting into another operating system, you keep the virus from running, inflicting damage, and actively thwarting virus scans. The Live CDs I use include:

• Kaspersky Rescue Disk
• AVG Rescue CD
• Bitdefender Rescue CD
• Avira AntiVir Rescue System

Lately, I have found Kaspersky Rescue Disk to be the most effective. This approach also works from a USB stick if the computer’s BIOS supports booting from USB.

Update Virus Definitions

Because new viruses are out all the time, it’s best to update the virus definitions. This is done by connecting the computer to the Internet by an ethernet cable if your Live CD supports it.

Scan for Viruses

Kaspersky typically finds viruses like this, a trojan named Packed.Win32.Katusha.o.

Boot Computer and Fix Internet Redirects

Boot the computer, then check for a Proxy setup in Internet Explorer’s Connection Settings. If there is one, disable it by changing to automatic settings. Similarly, check your network connection properties for IPv4 TCP/IP. Often you will see something like this, which should be changed to automatic settings.

Install Microsoft Security Essentials

There are a lot of decent Antivirus programs, but I like Microsoft Security Essentials because it finds viruses, is lightweight, and is free without nagware.

Other Things To Do

If there are still problems, other things that can be done:

• Install Malwarebytes Antimalware or other antivirus software if you still suspect problems. You should not typically run multiple antivirus programs at once.
• Boot into Safe Mode (F8 key at computer startup) to make system changes if you suspect that there is still an active virus. Or try another Live Rescue CD.
• Uninstall unused or virus-installed programs, available in Control Panel – Uninstall a Program.
• Remove startup items from Programs – Startup folder. You can also remove startup items by typing msconfig into the Start or Run box.
• Give up on system. Wipe the hard drive and reinstall the operating systems and programs. Sometimes this is the only remaining option if the operating system has been severely compromised. By pulling the drive and connecting to another computer as a peripheral drive, you can backup the data.

Run Windows Update

By running Windows Update and installing all the service packs, you are applying security patches and reducing the likelihood of getting viruses in the future.

Conclusion

Viruses can be scary and destroy your data. These steps can help, but once you have a virus, there are no guarantees. An infected computer is owned by the virus folks.

Therefore, in addition to protecting your computer, you should have backups of your important files such as photos or financial documents. If you have sensitive data, it can be encrypted with TrueCrypt or other tools.

Most businesses have trouble keeping track of their license keys. A tool to see what keys you are using for Windows and Microsoft Office is:

LicenseCrawler by Klinzmann

It’s free software. The author jokingly requests that users send him a picture of their hometown instead of payment. Must be funny in German.

Much of the report covers recent botnets. Botnets start when a virus infects a computer, either through spam or an infected web page. [...]]]> The Microsoft Security Intelligence Report (SIR) outlines PC security threats and is based on data captured by Microsoft. Here is a download to the latest volume, covering the first half of 2010.

Much of the report covers recent botnets. Botnets start when a virus infects a computer, either through spam or an infected web page. The virus puts the Windows machine under the control of the botnet, typically run by criminal syndicates. The report explains how criminals use and share your information.

Viruses are on the rise. In the three months between April and June 2010, Microsoft cleaned up more than 6.5 million infections, twice as much as the same period in 2009.

This chart shows the number of computers cleaned by Microsoft, listed by country.

This map illustrates the percentage of computers infected in particular regions. The infection rate was highest in South Korea where 14.6 out of every 1000 machines were found to be enrolled in botnets.

Stay Safe

As always, be sure to run Windows Updates and some form of Anti-virus. I prefer the free Microsoft Security Essentials, which I find to be just as effective but less of a memory hog than anti-virus by Symantec or McAfee.

Or you can just use a Mac which has had almost no threats. The only real-world attack that I know of for the Mac was a Trojan-infected version of Apple iWork that you would get from a pirated torrent download site. Besides that, the only Mac threats have been proof-of-concept attacks developed by researchers but never used.

For Windows – [...]]]> It’s sometimes difficult to find out what’s taking up all your computer hard drive space. That’s why I like these free programs which visually display the contents of your hard drive by file size. These programs make it easy to find and delete large files and directories that you no longer need.

For Windows – Disk Space Fan

Disk Space Fan shows you a beautiful fan of your hard drive space. Here’s a video of how it works. When you install the free version, it allows you to use the Pro version for free for 15 days, then it reverts to the free version automatically. All the basic tools are included in the free version though.

UPDATE: Daniel in the comments alerted me to the fact that Disk Space Fan is a ripoff of the Mac app DaisyDisk available at http://daisydiskapp.com.

For Mac – GrandPerspective

GrandPerspective for Mac OS X is similar to Disk Space Fan but chooses the box metaphor to visually display your files. The first segment of this video explains how it works.

For more ideas on saving hard disk space, look at the Lifehacker article How to Analyze, Clean Out, and Free Space on Your Hard Drive.

Microsoft just came out with a beta of their next version, Microsoft Security Essentials 2.0 featuring:

http://fixitcenter.support.microsoft.com/Portal/

Click Try it Now!, install the software, run Mircosoft Fix it and choose the category of your problem. Mircosoft Fix it then looks for and can automatically fix lots of issues.

The Atlantic Monthy magazine has a great article titled The Enemy Within on the history of Conficker and where we are now. It’s a fascinating read for both technical security buffs and non techies.

It starts:

The Enemy Within by [...]]]> I have mentioned several times that Conficker is considered the most dangerous virus to date.

The Atlantic Monthy magazine has a great article titled The Enemy Within on the history of Conficker and where we are now. It’s a fascinating read for both technical security buffs and non techies.

It starts:

The Enemy Within by Mark Bowden

When the Conficker computer “worm” was unleashed on the world in November 2008, cyber-security experts didn’t know what to make of it. It infiltrated millions of computers around the globe. It constantly checks in with its unknown creators. It uses an encryption code so sophisticated that only a very few people could have deployed it. For the first time ever, the cyber-security elites of the world have joined forces in a high-tech game of cops and robbers, trying to find Conficker’s creators and defeat them. The cops are failing. And now the worm lies there, waiting …

Image credit: Alex Ostroy