6

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Why do I always find the strangest programs and the strangest text files all the time? All kinds of weird things happen, like my screen changes and the address line doesn't change in IE, just weird stuff. Is it me or could there really be something going on? I've never had so much trouble with any computer before and I am on a public access point where I live.

Any advice will be greatly appreciated. I either need peace of mind, or a good defence, because this is getting out of hand.

1
  • Have a look at some of the Q&A on security.stackexchange.com - could help you out.
    – Rory Alsop
    Jul 24, 2011 at 10:53

3 Answers 3

6

Firstly, Never use public access points without WPA2 encryption!!!

If you are infected (on Windows), and assuming that the infection hasn't disabled stuff, you could try running this in a command window (start->run->cmd)

netstat -ano

it should hopefully return a list of listening and active tcp/udp ports and remote addresses. No one nowadays wants to infect your machine and not be able to communicate with it, either to control it or to siphon information from you, so this command is quite revealing, though it only shows active connections, and you might have a hard time deciphering and resolving the addresses, so shut down all other active programs such as skype first, which usually has loads of connections open.

If they only communicate once a day, then you might miss it. Many viruses now block access to sites such as http://housecall.trendmicro.com which is a good first port of call for a scan. If you can't reach it then you are almost certainly infected with something. Currently a nasty root kit is going around called TDSS or TD4, very difficult to remove but kaspersky.com has some useful information about it.

I don't have or use any antivirus for a decade and don't get infected. Keep windows up to date, run behind a real firewall, don't click on unknown links or answer questions that lead to unreputable sites, and don't install stuff you can't be sure about - especially antivirus programs!

I recommend using Firefox or Chrome instead of IE, but any are OK as long as they are kept up to date.

5
  • 2
    The chances of a remote user is very low. By default, Vista/7 remote connections are turned off. Plus the computer kicks you off to the login screen.
    – surfasb
    Jul 24, 2011 at 0:00
  • My school has WPA2 Enterprise encryption and I am still able to control most of the school's computers. I don't think WPA2 or WEP will actually make a difference, but if you use an unsecured connection people will be able to capture your website cookies and login to your online accounts.
    – user78429
    Jul 24, 2011 at 0:14
  • netstat is good, but I like TCPView for general use.
    – Synetech
    Jul 24, 2011 at 0:57
  • RDP, on a non-server version of Windows, will only allow one user total at a time. If a user connects via RDP the user at the console will be kicked off (it will look like the computer has locked itself, but it will say "Logged in from some.host" above the password prompt. It's possible to remove the one-user limitation, but not something you would do accidentally. @bckbck, you are probably using another technology like VNC (I've seen a number of schools myself that install VNC on all clients with one password). It's very unlikely that an attacker would install a GUI client like this, though Jul 24, 2011 at 3:39
  • Also, WPA2 != client isolation! client isolation is an optional feature of routers that is usually turned off by default. I believe this feature is why Andy referred to WPA2. So if it's a public access point, even if it's WPA2 protected, it's still very likely that others on the network can initiate connections with you directly. If the the AP is some kind of commercial setup (Cisco product or such), then client isolation is probably implemented. If it's just a home router someone's set up, chances are they forgot this step. Jul 24, 2011 at 3:41
2

It helps to know what OS you use. But I assume you are using Windows because you are using IE. Most of the characteristics you describe are kind of vague.

  • Random Text files? You should post the names and where they are located. Generally, text files are just a symptom of a bigger situation, if any.
  • Screen changes? like your resolution changing? Color changing? Does it just shut off?

In general, a public access point isn't the most ideal method. I don't think it invites criminals like parking in the wrong neighborhood however. Probably want to get the router configured to use protected wireless(WPA). They ask that you use a password of 8 or more characters. 10 or more would be my recommendation.

The best way to protect your identity is to restrict what you download. Harmless facebook games, little widgets, etc are what I'm talking about. Keep in mind, while these folks who wrote the program are probably not after your money, the programs have that capability.

I'd also advise you download a separate internet browser for your banking, shopping, etc. It's a small measure but anything is better than nothing.

Lastly, if you are in the US, pay the 10 dollars and get a quick copy of all your credit reports from the Big Three agencies. Scan them annually and you should be fine.

2
  • Remember that you are entitled to one report from each agency each year, for free. Go to www.annualcreditreport.com. AnnualCreditReport.com is the (only) official website created by the three major agencies to provide the legally mandated free report, do not trust other websites. FreeCreditReport.com, in particular, is a scam (it automatically subscribes you to a fee service, if I recall correctly). Jul 24, 2011 at 3:46
  • This is true. I just find it more convenient to pay 10 bucks and get all three instantly. Then just cancel it.
    – surfasb
    Jul 24, 2011 at 6:21
-1

Furthermore, if anyone wants to be sure they are not infected with anything while doing any online shopping or banking transactions, then I cannot recommend this highly enough:

Go to http://fedoraproject.org/en/get-fedora

Download and burn to a CD or pendrive. Reboot the computer and configure to boot off the CD or USB pendrive into what you just created.

Every time you boot into it you'll have a brand new, free Linux operating system with a browser and firewalled connection to the net through your router or WIFI (but still only use WPA2!), and windows malware can't touch it. (It is completely separate and won't touch the installed Windows, but you can mount the hard disks and use it to fix Windows problems without any active viruses trying to stop you.)

This is the ONLY way you can be absolutely sure that you don't have anything nasty running in the background.

4
  • 1
    Meh, VM is faster and arguably just as secure. If you make it too time consuming, users may skimp on using the tool and thus destroy all the work you did. A security tool used 100% of the time will beat out any other tool used only 99% of the time.
    – surfasb
    Jul 24, 2011 at 0:46
  • +1 for a virtual machine. Use a VM host like VirtualBox that supports snapshotting so that you can keep returning it to a fresh state easily. Jul 24, 2011 at 3:49
  • True, VMs are fantastic, but it's only a matter of time before viruses sniff the traffic and subvert VM forwarding. Hardly simple for the average user to comprehend and setup, and an operating system still needs to be installed, with all the time that takes. Burn a CD or stick, restart. Even my 70 year old Mum can do that! Jul 24, 2011 at 4:58
  • 1
    This should have been included in your previous answer.
    – Nifle
    Jul 25, 2011 at 12:21

Not the answer you're looking for? Browse other questions tagged .