When Viruses Attack!
When you're hit by a bad virus attack, it becomes pretty obvious, pretty fast. Your computer starts to behave oddly. Here are a few symptoms you might see individually or in combination:
As soon as you think you might be infected with a virus, immediately use your antivirus program to update its virus signaturesthese are snapshots of viruses used by the program to identify an infection (see Figure 1.6). All antivirus programs have this feature built in. You click an update button in the software and the updates are fetched from the Internet.
Figure 1.6. Your antivirus program probably missed the virus your computer is infected with because its signatures were out of date.
Then use the antivirus program to run a system scan (see Figure 1.7). Choose to run a deep or thorough scan, if possible, as opposed to a quick scan.
Figure 1.7. Scan your hard drive for viruses as soon as you think you are infected.
Disconnect As Soon As Possible
One of the first things most malware tries to do when it creates an infectionand this especially includes virusesis to make contact with the outside world. So one of the first things you should do after detecting an infection (after updating your virus and spyware signatures via the Internet) is to disconnect your computer from your home network, if you have one, and get off the Internet.
Figure 1.8. Right-click the wireless icon in your Windows system tray in the bottom right and choose Disable to turn off your Wi-Fi connection.
Virus Infection Found! How to Cleanse Your System
When the antivirus program finds a virus, it alerts you immediately and asks for a decision. Make a note of the virus's name and have it removed.
If your antivirus program fails to remove the virus, all is not lost. It could be that infected files are running and so they can't be deleted by Windows. Try scanning the computer in Windows Safe Mode. This is a special emergency mode in which Windows starts up in a raw state and loads only the bare necessities into memory.
To get into safe mode, shut down and restart the computer. When the screen is black (and before the Windows logo appears), hit the F8 key. You might have to press the F8 key a few times to trigger it. A menu appears. Use the arrow key to choose Safe Mode, and press Enter.
If you are presented with a choice of Windows logins (one for you, your spouse, and your hairy little children, perhaps), choose the administrator login. If it's your computer, chances are that you are the administrator.
When the Windows desktop appears in safe mode, run your antivirus program and scan the system for viruses. Because safe mode loads only the necessary processes in memory, the virus is not loaded unless it has infected one of the system files that makes Windows run. In safe mode, you should be able to easily kill the virus.
Your antivirus program might ask if it should quarantine the virus or delete it. If you quarantine the files, they are put in the computer equivalent of jail, an electronically walled-off area where they can't cause any further damage. From the quarantine area, they can be submitted to the antivirus maker for analysis, if you choose to do this. If you choose to delete the snared virus, it is wiped from your computer.
My Antivirus Program Won't Update!
If your antivirus program fails to fetch the latest virus signatures, a virus might have stomped on your Internet connection. Some viruses modify the Windows HOSTS file, a holdover from the early days of computer networking that helps a system find other computers on the Internet. The HOSTS file on your computer is normally found in the following folders:
The file can be opened with Notepad or another text editor. It contains comments that begin with the character #these can be left alone (see Figure 1.9).
Figure 1.9. The HOSTS file can be modified by malware to block access to websites. Pictured is a healthy HOSTS file.
The HOSTS file should contain only one other line:
Any other lines of text can be removed. After editing it, save the file and close it. Now try to update your anti-virus program. You should have no problem.