Understanding tech language: The difference between malware and a virus

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="clear: both; color: #222222; font-family: 'Helvetica Neue',Arial,sans-serif; font-size: 14px; line-height: 19px; margin: auto; min-height: auto; width: 320px;"><img src="http://zapt1.staticworld.net/images/article/2013/09/0919-thumb-100053021-large.jpg" style="border-width: 0px; max-width: 100%; vertical-align: middle; width: 320px;" /></div><div style="margin: 0px 0px 10px; overflow: hidden;"><em style="color: #25a7d7; display: inline!important; font-size: 15px; font-weight: 700; line-height: 1.7em; margin-right: 5px; text-transform: uppercase;"><em style="display: inline!important; line-height: 1.7em; margin-right: 5px;"><span style="color: #222222; line-height: 1.7em;">Depending on how technically correct you want to be, viruses are a subset of malware, or the two words mean the same thing.</span></em></em><br /><a name="more"></a></div><br /><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">The word <em>malware</em> (malicious software) describes any piece of code designed to infect your computer (or mobile device) and make it do things that you don't want it to do, such as mass-mail spam or steal your banking passwords. Trojans, worms, and rootkits are all types of malware.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">And so is a <em>virus</em>, in its most technically-correct meaning. A virus is malicious code that spreads by infecting existing files, similar to the way a biological virus spreads by infecting living cells.</div><br /><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">Once common, true computer viruses have become quite rare. Criminals have found better ways to spread malicious code.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">So if viruses are rare, why do people still talk about them? And why do we still run antivirus programs?</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">Viruses were the dominant form of malware in the 1980s and 90s, when personal computers were first becoming common. At that time, there was no commonly-used umbrella term such as <em>malware</em>, so people called any malicious program a<em> virus</em>.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">And the word has stuck. Although that program you keep running in the background protects you (hopefully) from all forms of malware, it's called<em>antivirus </em>because that type of program has always been called <em>antivirus.</em></div></div>

Understanding tech language: The difference between malware and a virus

Depending on how technically correct you want to be, viruses are a subset of malware, or the two words mean the same thing. The word  malwar...

Read more »

Understanding tech language: The difference between malware and a virus

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="clear: both; color: #222222; font-family: 'Helvetica Neue',Arial,sans-serif; font-size: 14px; line-height: 19px; margin: auto; min-height: auto; width: 320px;"><img src="http://zapt1.staticworld.net/images/article/2013/09/0919-thumb-100053021-large.jpg" style="border-width: 0px; max-width: 100%; vertical-align: middle; width: 320px;" /></div><div style="margin: 0px 0px 10px; overflow: hidden;"><em style="color: #25a7d7; display: inline!important; font-size: 15px; font-weight: 700; line-height: 1.7em; margin-right: 5px; text-transform: uppercase;"><em style="display: inline!important; line-height: 1.7em; margin-right: 5px;"><span style="color: #222222; line-height: 1.7em;">Depending on how technically correct you want to be, viruses are a subset of malware, or the two words mean the same thing.</span></em></em><br /><a name="more"></a></div><br /><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">The word <em>malware</em> (malicious software) describes any piece of code designed to infect your computer (or mobile device) and make it do things that you don't want it to do, such as mass-mail spam or steal your banking passwords. Trojans, worms, and rootkits are all types of malware.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">And so is a <em>virus</em>, in its most technically-correct meaning. A virus is malicious code that spreads by infecting existing files, similar to the way a biological virus spreads by infecting living cells.</div><br /><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">Once common, true computer viruses have become quite rare. Criminals have found better ways to spread malicious code.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">So if viruses are rare, why do people still talk about them? And why do we still run antivirus programs?</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">Viruses were the dominant form of malware in the 1980s and 90s, when personal computers were first becoming common. At that time, there was no commonly-used umbrella term such as <em>malware</em>, so people called any malicious program a<em> virus</em>.</div><div style="line-height: 1.7em; margin: 0px 0px 0.7em;">And the word has stuck. Although that program you keep running in the background protects you (hopefully) from all forms of malware, it's called<em>antivirus </em>because that type of program has always been called <em>antivirus.</em></div></div>

Understanding tech language: The difference between malware and a virus

Depending on how technically correct you want to be, viruses are a subset of malware, or the two words mean the same thing. The word  malwar...

Read more »

When malware strikes: How to clean an infected PC

<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questionable Web sites. You don't open suspicious email attachments. You keep Java, Flash, and Adobe Reader up-to-date—or better yet, you <a href="http://www.pcworld.com/article/2030153/how-i-ditched-the-security-risks-and-lived-without-java-reader-and-flash.html" style="color:rgb(37,167,215)" target="_blank">learn to live without them</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">But against all odds, a clever new Trojan horse slipped through the cracks, and now you're the unhappy owner of an infected PC. Or perhaps a less-vigilant friend has begged you to clean up a plague-ridden mess.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Obviously, you need to scan the computer and remove the malware. Here's a methodical approach that you can use to determine what the problem is, how to scan, and what to do afterward to protect the PC from future invasions.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">1. Verify the infection</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Is the PC in question really infected? I've seen people blame "another damn virus" for everything from a bad sound card to their own stupidity. The first step in restoring the system's health is to determine whether what you're dealing with is a virus rather than a problem with hardware, software, or user error.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">If your PC is unusually slow, or if it seems to do a lot of things on its own that you haven't asked it to do, you have reason to be suspicious. But before you decide that a virus must be responsible, take a moment to launch the Windows Task Manager (right-click the Windows taskbar, and select <em>Task Manager</em> from the pop-up menu). Open the <em>Processes</em> tab, and check for any strange or unknown applications running in the background—especially those with nonsensical names and no recognizable authority listed in the description. The odd-looking "wuauclt" process is fine, for example, because it belongs to Microsoft (it's actually part of the Windows Update service, as you can tell from the description.)</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Of course, this is only general guidance; there's nothing to stop a piece of malware from masquerading as a legitimate process by sporting an inoffensive description. That said, you'd be surprised how often a piece of malware gives itself away with a line of strange characters or symbols where the process description should be.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">2. Check for sure signs of malware</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Truly insidious malware will preemptively block you from trying to remove it. If your PC suddenly won't load utilities that might help you manually remove malware—such as msconfig or regedit—be suspicious. If your antivirus program suddenly stops loading, that's a huge red flag.</p> <a href="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="426" src="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a><small style="font-size:9px;text-align:center;text-transform:uppercase;display:block;float:left;background-image:url(http://csmb.staticworld.net/images/furniture/techhive/backgroundwhite70.png);color:rgb(51,51,51);padding:1px 3px 2px;background-repeat:initial initial">AVG</small>Fake warnings like this one try to scare you into running a file to 'remove malware' (read: install malware) or giving up your credit card information to pay for bogus antivirus software.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Sometimes the attack is more obvious. If a program you don't recognize suddenly pops up and starts displaying dire warnings and asks you to run an executable file or asks for your credit card number, your PC is<em>definitely</em> infected with some nasty malware. Never fork over your credit card information or other personal data to a program or website that tries to warn you that your PC is about to die. More often than not it's a <a href="http://www.pcworld.com/article/239272/rogues.html" style="color:rgb(37,167,215)" target="_blank">rogue program</a>, fear-mongering malware that tries to scare you into giving up your private info by issuing doomsday warnings of imminent hard drive failure, catastrophic viral infection, or worse.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">3. Check online for possible fixes</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> The one benefit of those scary pop-ups is that they could point you toward a cure. Use your favorite search engine to look for phrases that appear in the pop-up—you'll probably find other people fighting the same infection. Their experiences could help you identify your enemy or even find step-by-step instructions for removing the malware. Be prudent: Take advice only from sites that seem reputable, and remember to perform a full scan of your PC after you've followed any instructions, even ours.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Barring any clues that lead you to a magic solution, scanning becomes your next and most important step.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">4. Assume that your old virus scanner is compromised</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Don't waste time scanning your hard drive(s) with your regular antivirus program. After all, that program probably failed to catch the malware in the first place.</p><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> But don't be too hard on it. Nothing's perfect, and even the best antivirus program can occasionally miss a new or particularly cleverly designed virus. And once that virus slips through, your antivirus program is compromised. You have to assume that the malware, not the security software, is in control.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You need a fresh malware scanner—one that's not already installed on your computer. It must be capable of detecting and removing malware from your PC, and you need to run it in an environment where the malware can't load first. Linux is your best bet, but before you jump to that option, try booting into Windows Safe Mode to see if you can outflank your virus infestation there.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">5. Use a lightweight scanner inside Safe Mode</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Windows has a Safe Mode that boots a minimal version of the operating system, with generic drivers and nothing else. It doesn't load most startup applications and—most likely—it won't load the malware that's infesting your PC.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">To enter Safe Mode, boot your computer and press the F8 function key<strong> </strong>before Windows starts loading. The timing is tricky, so it's best to mash F8 repeatedly from the moment the motherboard manufacturer's logo appears onscreen until you get the boot menu.</p> <a href="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Use the Windows boot menu to access Safe Mode.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When you reach that menu, select <em>Safe Mode with Networking</em> from the list of boot options.<em> </em>The <em>with Networking</em> part is important—you're going to need Internet access to solve your virus problem.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Once in Safe Mode, open Internet Explorer (using other browsers in Safe Mode is often problematic) and run a reputable online virus scanner such as<a href="http://www.bitdefender.com/scanner/online/free.html" style="color:rgb(37,167,215)" target="_blank">Bitdefender</a>. For best results I recommend using the <a href="http://www.eset.com/us/online-scanner/" style="color:rgb(37,167,215)" target="_blank">ESET Online Scanner</a>, a Web-based virus detection app that is always up-to-date and runs off a remote server. You'll have to accept a browser add-in, but the scanner should remove it when it's done. Before you start the scan, click<em>Advanced settings </em>and enable as many extra levels of scrutiny as you can, including scanning file archives and browser data.</p> <a href="http://images.techhive.com/images/article/2013/05/eset-3-100039274-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="529" src="http://images.techhive.com/images/article/2013/05/eset-3-100039274-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The ESET Online Scanner runs in your browser and does a thorough job of rooting out malware from your PC.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> You might also try Trend Micro's<a href="http://housecall.trendmicro.com/us/" style="color:rgb(37,167,215)" target="_blank">HouseCall</a>. Though it isn't a Web app, it is portable, so you can download HouseCall on another computer and copy it to a flash drive, thereby creating a portable PC virus scanner. Then, when you run into trouble you can plug the flash drive into the infected PC and run the program from there (you'll still need an Internet connection for a definition update, however.) When using HouseCall, don't run it on default settings: Before you click the big blue<em>Scan Now</em> button, click <em>Settings</em> and select <em>Full system scan.</em></p> <a href="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="460" src="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Trend Micro's HouseCall utility is another excellent, free virus scanner and malware removal tool.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Whichever scanner you use, don't rush to get through this part of the process. Check the options and select the slowest, most thorough scan. Then, once the scan has started, step away from the PC. Read a book. Do the dishes. Spend time with someone you love. The scan will—and should—take hours.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">6. Remember: The second scan's the charm</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When that first scan is done—just to be sure—run another one with a different scanner. It's easy, and you'll sleep better after multiple scanners have assured you that your drive is clean.</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)"> 7. Look to Linux as your last line of defense</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Booting into Safe Mode may not short-circuit particularly malicious malware. If you still have trouble with an infection after running multiple scans in Safe Mode, you'll have to bypass Windows altogether and avoid booting from the hard drive. To manage that trick, use a bootable CD or flash drive running a Linux-based antivirus utility.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You don't have to know Linux to take this step. But you will want an Internet connection, since these scanners must go online to update their malware databases.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">The first step is to download a bootable virus scanner as an .iso file. From it, you can easily create a bootable CD. In Windows 7, double-click the file and follow the prompts. In Windows 8, right-click the file and select <em>Burn disc image</em>. For earlier versions of Windows, you'll need a third-party program such as the free <a href="http://isorecorder.alexfeinman.com/W7.htm" style="color:rgb(37,167,215)" target="_blank">ISO Recorder</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">With its Windows-like user interface, the <a href="https://support.kaspersky.com/viruses/rescuedisk" style="color:rgb(37,167,215)" target="_blank">Kaspersky Rescue Disk</a> will make you feel at home. But you have to be careful in setting up the scan. First, the Kaspersky Rescue Disk doesn't update its malware dictionary automatically. To do this manually, select the <em>Update Center </em>tab and click <em>Start update</em>. Once the utility is updated, return to the<em>Objects Scan</em> tab, click <em>Settings</em>, and set the security level to the highest position. Make sure that all of your hard drives are checked before you start the scan and leave the room.</p> <a href="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>When you boot your PC with the Kaspersky Rescue Disk utility, you'll find yourself in a custom Linux environment. Simply update the Rescue Disk, crank all the scan settings up to maximum power, and let 'er rip.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> If you want to boot the Kaspersky Rescue Disk from a flash drive, you'll need to download the prosaically named <a href="http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/rescue2usb.exe" style="color:rgb(37,167,215)" target="_blank">Utility to record Kaspersky Rescue Disk 10 to USB devices</a>. Save it in the same folder as the .iso file, run the utility, and follow the wizard.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">The <a href="http://www.f-secure.com/de/web/labs_global/removal-tools/-/carousel/view/142" style="color:rgb(37,167,215)" target="_blank">F-Secure Rescue CD</a> isn't as outwardly friendly as Kaspersky's program. In fact, it may make you nostalgic for DOS. But it works, though you may receive the following (unduly alarming) warning message: <em>If a Windows system file is infected, the computer may not restart.</em> I've never heard of anyone whose Windows system failed to restart after an F-Secure scan, and I suspect that the eventuality is very rare. I also suspect that if malware did infect a Windows system file—and if F-Secure couldn't clean the file without destroying it—reinstallation might be your only option anyway.</p> <a href="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The F-Secure Rescue CD is a bare-bones cleaning utility for when you need to wipe every piece of malware from your PC without starting Windows.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> F-Secure has a stripped down, unattractive, text-based user interface. But unlike Kaspersky, it updates its definitions automatically (if it can find an Internet connection), and starts a full, thorough scan with no fuss—you have to do little more than agree to the EULA.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">F-Secure doesn't offer a special USB utility. If you want to move a copy of it onto a flash drive, you'll have to download and run the <a href="http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/" style="color:rgb(37,167,215)" target="_blank">Universal USB Installer</a>. In Step 1, you'll find <em>F-Secure Rescue CD </em>near the bottom of a very long list. I suggest you go straight to the bottom, and then look for it while slowly scrolling up.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">8. Protect your newly disinfected PC</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When you're satisfied that your drive is clean, try rebooting into good old Windows. Then uninstall your old antivirus program—it has been compromised.</p><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Of course, you don't want to stay unprotected. Reinstall the program and update to the latest version, or (if you've lost all faith in it) install a competitor. For more information on how to choose the best antivirus program for your needs, check out our full rundown—with empirical testing—of the <a href="http://www.pcworld.com/article/2025949/security-software-showdown-9-antivirus-suites-empirically-tested.html" style="color:rgb(37,167,215)" target="_blank">best security software</a> available today.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Because when it comes to malware, a byte of prevention is worth a terabyte of cure.</p>

When malware strikes: How to clean an infected PC

You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questi...

Read more »

When malware strikes: How to clean an infected PC

<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questionable Web sites. You don't open suspicious email attachments. You keep Java, Flash, and Adobe Reader up-to-date—or better yet, you <a href="http://www.pcworld.com/article/2030153/how-i-ditched-the-security-risks-and-lived-without-java-reader-and-flash.html" style="color:rgb(37,167,215)" target="_blank">learn to live without them</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">But against all odds, a clever new Trojan horse slipped through the cracks, and now you're the unhappy owner of an infected PC. Or perhaps a less-vigilant friend has begged you to clean up a plague-ridden mess.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Obviously, you need to scan the computer and remove the malware. Here's a methodical approach that you can use to determine what the problem is, how to scan, and what to do afterward to protect the PC from future invasions.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">1. Verify the infection</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Is the PC in question really infected? I've seen people blame "another damn virus" for everything from a bad sound card to their own stupidity. The first step in restoring the system's health is to determine whether what you're dealing with is a virus rather than a problem with hardware, software, or user error.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">If your PC is unusually slow, or if it seems to do a lot of things on its own that you haven't asked it to do, you have reason to be suspicious. But before you decide that a virus must be responsible, take a moment to launch the Windows Task Manager (right-click the Windows taskbar, and select <em>Task Manager</em> from the pop-up menu). Open the <em>Processes</em> tab, and check for any strange or unknown applications running in the background—especially those with nonsensical names and no recognizable authority listed in the description. The odd-looking "wuauclt" process is fine, for example, because it belongs to Microsoft (it's actually part of the Windows Update service, as you can tell from the description.)</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Of course, this is only general guidance; there's nothing to stop a piece of malware from masquerading as a legitimate process by sporting an inoffensive description. That said, you'd be surprised how often a piece of malware gives itself away with a line of strange characters or symbols where the process description should be.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">2. Check for sure signs of malware</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Truly insidious malware will preemptively block you from trying to remove it. If your PC suddenly won't load utilities that might help you manually remove malware—such as msconfig or regedit—be suspicious. If your antivirus program suddenly stops loading, that's a huge red flag.</p> <a href="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="426" src="http://images.techhive.com/images/article/2013/05/rogue_malware1-100039329-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a><small style="font-size:9px;text-align:center;text-transform:uppercase;display:block;float:left;background-image:url(http://csmb.staticworld.net/images/furniture/techhive/backgroundwhite70.png);color:rgb(51,51,51);padding:1px 3px 2px;background-repeat:initial initial">AVG</small>Fake warnings like this one try to scare you into running a file to 'remove malware' (read: install malware) or giving up your credit card information to pay for bogus antivirus software.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Sometimes the attack is more obvious. If a program you don't recognize suddenly pops up and starts displaying dire warnings and asks you to run an executable file or asks for your credit card number, your PC is<em>definitely</em> infected with some nasty malware. Never fork over your credit card information or other personal data to a program or website that tries to warn you that your PC is about to die. More often than not it's a <a href="http://www.pcworld.com/article/239272/rogues.html" style="color:rgb(37,167,215)" target="_blank">rogue program</a>, fear-mongering malware that tries to scare you into giving up your private info by issuing doomsday warnings of imminent hard drive failure, catastrophic viral infection, or worse.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">3. Check online for possible fixes</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> The one benefit of those scary pop-ups is that they could point you toward a cure. Use your favorite search engine to look for phrases that appear in the pop-up—you'll probably find other people fighting the same infection. Their experiences could help you identify your enemy or even find step-by-step instructions for removing the malware. Be prudent: Take advice only from sites that seem reputable, and remember to perform a full scan of your PC after you've followed any instructions, even ours.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Barring any clues that lead you to a magic solution, scanning becomes your next and most important step.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">4. Assume that your old virus scanner is compromised</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Don't waste time scanning your hard drive(s) with your regular antivirus program. After all, that program probably failed to catch the malware in the first place.</p><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> But don't be too hard on it. Nothing's perfect, and even the best antivirus program can occasionally miss a new or particularly cleverly designed virus. And once that virus slips through, your antivirus program is compromised. You have to assume that the malware, not the security software, is in control.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You need a fresh malware scanner—one that's not already installed on your computer. It must be capable of detecting and removing malware from your PC, and you need to run it in an environment where the malware can't load first. Linux is your best bet, but before you jump to that option, try booting into Windows Safe Mode to see if you can outflank your virus infestation there.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">5. Use a lightweight scanner inside Safe Mode</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Windows has a Safe Mode that boots a minimal version of the operating system, with generic drivers and nothing else. It doesn't load most startup applications and—most likely—it won't load the malware that's infesting your PC.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">To enter Safe Mode, boot your computer and press the F8 function key<strong> </strong>before Windows starts loading. The timing is tricky, so it's best to mash F8 repeatedly from the moment the motherboard manufacturer's logo appears onscreen until you get the boot menu.</p> <a href="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/entering-safe-mode-100039271-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Use the Windows boot menu to access Safe Mode.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When you reach that menu, select <em>Safe Mode with Networking</em> from the list of boot options.<em> </em>The <em>with Networking</em> part is important—you're going to need Internet access to solve your virus problem.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Once in Safe Mode, open Internet Explorer (using other browsers in Safe Mode is often problematic) and run a reputable online virus scanner such as<a href="http://www.bitdefender.com/scanner/online/free.html" style="color:rgb(37,167,215)" target="_blank">Bitdefender</a>. For best results I recommend using the <a href="http://www.eset.com/us/online-scanner/" style="color:rgb(37,167,215)" target="_blank">ESET Online Scanner</a>, a Web-based virus detection app that is always up-to-date and runs off a remote server. You'll have to accept a browser add-in, but the scanner should remove it when it's done. Before you start the scan, click<em>Advanced settings </em>and enable as many extra levels of scrutiny as you can, including scanning file archives and browser data.</p> <a href="http://images.techhive.com/images/article/2013/05/eset-3-100039274-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="529" src="http://images.techhive.com/images/article/2013/05/eset-3-100039274-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The ESET Online Scanner runs in your browser and does a thorough job of rooting out malware from your PC.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> You might also try Trend Micro's<a href="http://housecall.trendmicro.com/us/" style="color:rgb(37,167,215)" target="_blank">HouseCall</a>. Though it isn't a Web app, it is portable, so you can download HouseCall on another computer and copy it to a flash drive, thereby creating a portable PC virus scanner. Then, when you run into trouble you can plug the flash drive into the infected PC and run the program from there (you'll still need an Internet connection for a definition update, however.) When using HouseCall, don't run it on default settings: Before you click the big blue<em>Scan Now</em> button, click <em>Settings</em> and select <em>Full system scan.</em></p> <a href="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="460" src="http://images.techhive.com/images/article/2013/05/housecall-1-100039277-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>Trend Micro's HouseCall utility is another excellent, free virus scanner and malware removal tool.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Whichever scanner you use, don't rush to get through this part of the process. Check the options and select the slowest, most thorough scan. Then, once the scan has started, step away from the PC. Read a book. Do the dishes. Spend time with someone you love. The scan will—and should—take hours.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">6. Remember: The second scan's the charm</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When that first scan is done—just to be sure—run another one with a different scanner. It's easy, and you'll sleep better after multiple scanners have assured you that your drive is clean.</p><h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)"> 7. Look to Linux as your last line of defense</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Booting into Safe Mode may not short-circuit particularly malicious malware. If you still have trouble with an infection after running multiple scans in Safe Mode, you'll have to bypass Windows altogether and avoid booting from the hard drive. To manage that trick, use a bootable CD or flash drive running a Linux-based antivirus utility.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">You don't have to know Linux to take this step. But you will want an Internet connection, since these scanners must go online to update their malware databases.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">The first step is to download a bootable virus scanner as an .iso file. From it, you can easily create a bootable CD. In Windows 7, double-click the file and follow the prompts. In Windows 8, right-click the file and select <em>Burn disc image</em>. For earlier versions of Windows, you'll need a third-party program such as the free <a href="http://isorecorder.alexfeinman.com/W7.htm" style="color:rgb(37,167,215)" target="_blank">ISO Recorder</a>.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">With its Windows-like user interface, the <a href="https://support.kaspersky.com/viruses/rescuedisk" style="color:rgb(37,167,215)" target="_blank">Kaspersky Rescue Disk</a> will make you feel at home. But you have to be careful in setting up the scan. First, the Kaspersky Rescue Disk doesn't update its malware dictionary automatically. To do this manually, select the <em>Update Center </em>tab and click <em>Start update</em>. Once the utility is updated, return to the<em>Objects Scan</em> tab, click <em>Settings</em>, and set the security level to the highest position. Make sure that all of your hard drives are checked before you start the scan and leave the room.</p> <a href="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/kaspersky-1-100039281-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>When you boot your PC with the Kaspersky Rescue Disk utility, you'll find yourself in a custom Linux environment. Simply update the Rescue Disk, crank all the scan settings up to maximum power, and let 'er rip.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> If you want to boot the Kaspersky Rescue Disk from a flash drive, you'll need to download the prosaically named <a href="http://rescuedisk.kaspersky-labs.com/rescuedisk/updatable/rescue2usb.exe" style="color:rgb(37,167,215)" target="_blank">Utility to record Kaspersky Rescue Disk 10 to USB devices</a>. Save it in the same folder as the .iso file, run the utility, and follow the wizard.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">The <a href="http://www.f-secure.com/de/web/labs_global/removal-tools/-/carousel/view/142" style="color:rgb(37,167,215)" target="_blank">F-Secure Rescue CD</a> isn't as outwardly friendly as Kaspersky's program. In fact, it may make you nostalgic for DOS. But it works, though you may receive the following (unduly alarming) warning message: <em>If a Windows system file is infected, the computer may not restart.</em> I've never heard of anyone whose Windows system failed to restart after an F-Secure scan, and I suspect that the eventuality is very rare. I also suspect that if malware did infect a Windows system file—and if F-Secure couldn't clean the file without destroying it—reinstallation might be your only option anyway.</p> <a href="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-orig.png" style="color:rgb(37,167,215)" target="_blank"><img alt="" border="0" height="435" src="http://images.techhive.com/images/article/2013/05/f-secure-1-100039275-large.png" style="border-width:0px;vertical-align:middle;width:auto;min-height:auto;max-width:100%;float:left" width="580"></a>The F-Secure Rescue CD is a bare-bones cleaning utility for when you need to wipe every piece of malware from your PC without starting Windows.<p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> F-Secure has a stripped down, unattractive, text-based user interface. But unlike Kaspersky, it updates its definitions automatically (if it can find an Internet connection), and starts a full, thorough scan with no fuss—you have to do little more than agree to the EULA.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">F-Secure doesn't offer a special USB utility. If you want to move a copy of it onto a flash drive, you'll have to download and run the <a href="http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/" style="color:rgb(37,167,215)" target="_blank">Universal USB Installer</a>. In Step 1, you'll find <em>F-Secure Rescue CD </em>near the bottom of a very long list. I suggest you go straight to the bottom, and then look for it while slowly scrolling up.</p> <h2 style="font-family:facitweb,sans-serif;margin-top:1em;margin-bottom:0.25em;color:rgb(34,34,34)">8. Protect your newly disinfected PC</h2><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> When you're satisfied that your drive is clean, try rebooting into good old Windows. Then uninstall your old antivirus program—it has been compromised.</p><p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif"> Of course, you don't want to stay unprotected. Reinstall the program and update to the latest version, or (if you've lost all faith in it) install a competitor. For more information on how to choose the best antivirus program for your needs, check out our full rundown—with empirical testing—of the <a href="http://www.pcworld.com/article/2025949/security-software-showdown-9-antivirus-suites-empirically-tested.html" style="color:rgb(37,167,215)" target="_blank">best security software</a> available today.</p> <p style="line-height:1.7em;margin:0px 0px 0.7em;color:rgb(34,34,34);font-family:'Helvetica Neue',Arial,sans-serif">Because when it comes to malware, a byte of prevention is worth a terabyte of cure.</p>

When malware strikes: How to clean an infected PC

You work hard to protect your PC from the malicious thugs of our digital world. You keep your antivirus program up to date. You avoid questi...

Read more »