Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Why do I always find the strangest programs and the strangest text files all the time? All kinds of weird things happen, like my screen changes and the address line doesn't change in IE, just weird stuff. Is it me or could there really be something going on? I've never had so much trouble with any computer before and I am on a public access point where I live.

Any advice will be greatly appreciated. I either need peace of mind, or a good defence, because this is getting out of hand.

share|improve this question

marked as duplicate by Nifle, random Jul 27 '11 at 0:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Have a look at some of the Q&A on security.stackexchange.com - could help you out. –  Rory Alsop Jul 24 '11 at 10:53
add comment

3 Answers

Firstly, Never use public access points without WPA2 encryption!!!

If you are infected (on Windows), and assuming that the infection hasn't disabled stuff, you could try running this in a command window (start->run->cmd)

netstat -ano

it should hopefully return a list of listening and active tcp/udp ports and remote addresses. No one nowadays wants to infect your machine and not be able to communicate with it, either to control it or to siphon information from you, so this command is quite revealing, though it only shows active connections, and you might have a hard time deciphering and resolving the addresses, so shut down all other active programs such as skype first, which usually has loads of connections open.

If they only communicate once a day, then you might miss it. Many viruses now block access to sites such as http://housecall.trendmicro.com which is a good first port of call for a scan. If you can't reach it then you are almost certainly infected with something. Currently a nasty root kit is going around called TDSS or TD4, very difficult to remove but kaspersky.com has some useful information about it.

I don't have or use any antivirus for a decade and don't get infected. Keep windows up to date, run behind a real firewall, don't click on unknown links or answer questions that lead to unreputable sites, and don't install stuff you can't be sure about - especially antivirus programs!

I recommend using Firefox or Chrome instead of IE, but any are OK as long as they are kept up to date.

share|improve this answer
2  
The chances of a remote user is very low. By default, Vista/7 remote connections are turned off. Plus the computer kicks you off to the login screen. –  surfasb Jul 24 '11 at 0:00
    
My school has WPA2 Enterprise encryption and I am still able to control most of the school's computers. I don't think WPA2 or WEP will actually make a difference, but if you use an unsecured connection people will be able to capture your website cookies and login to your online accounts. –  user78429 Jul 24 '11 at 0:14
    
netstat is good, but I like TCPView for general use. –  Synetech Jul 24 '11 at 0:57
    
RDP, on a non-server version of Windows, will only allow one user total at a time. If a user connects via RDP the user at the console will be kicked off (it will look like the computer has locked itself, but it will say "Logged in from some.host" above the password prompt. It's possible to remove the one-user limitation, but not something you would do accidentally. @bckbck, you are probably using another technology like VNC (I've seen a number of schools myself that install VNC on all clients with one password). It's very unlikely that an attacker would install a GUI client like this, though –  jcrawfordor Jul 24 '11 at 3:39
    
Also, WPA2 != client isolation! client isolation is an optional feature of routers that is usually turned off by default. I believe this feature is why Andy referred to WPA2. So if it's a public access point, even if it's WPA2 protected, it's still very likely that others on the network can initiate connections with you directly. If the the AP is some kind of commercial setup (Cisco product or such), then client isolation is probably implemented. If it's just a home router someone's set up, chances are they forgot this step. –  jcrawfordor Jul 24 '11 at 3:41
add comment

It helps to know what OS you use. But I assume you are using Windows because you are using IE. Most of the characteristics you describe are kind of vague.

  • Random Text files? You should post the names and where they are located. Generally, text files are just a symptom of a bigger situation, if any.
  • Screen changes? like your resolution changing? Color changing? Does it just shut off?

In general, a public access point isn't the most ideal method. I don't think it invites criminals like parking in the wrong neighborhood however. Probably want to get the router configured to use protected wireless(WPA). They ask that you use a password of 8 or more characters. 10 or more would be my recommendation.

The best way to protect your identity is to restrict what you download. Harmless facebook games, little widgets, etc are what I'm talking about. Keep in mind, while these folks who wrote the program are probably not after your money, the programs have that capability.

I'd also advise you download a separate internet browser for your banking, shopping, etc. It's a small measure but anything is better than nothing.

Lastly, if you are in the US, pay the 10 dollars and get a quick copy of all your credit reports from the Big Three agencies. Scan them annually and you should be fine.

share|improve this answer
    
Remember that you are entitled to one report from each agency each year, for free. Go to www.annualcreditreport.com. AnnualCreditReport.com is the (only) official website created by the three major agencies to provide the legally mandated free report, do not trust other websites. FreeCreditReport.com, in particular, is a scam (it automatically subscribes you to a fee service, if I recall correctly). –  jcrawfordor Jul 24 '11 at 3:46
    
This is true. I just find it more convenient to pay 10 bucks and get all three instantly. Then just cancel it. –  surfasb Jul 24 '11 at 6:21
add comment

Furthermore, if anyone wants to be sure they are not infected with anything while doing any online shopping or banking transactions, then I cannot recommend this highly enough:

Go to http://fedoraproject.org/en/get-fedora

Download and burn to a CD or pendrive. Reboot the computer and configure to boot off the CD or USB pendrive into what you just created.

Every time you boot into it you'll have a brand new, free Linux operating system with a browser and firewalled connection to the net through your router or WIFI (but still only use WPA2!), and windows malware can't touch it. (It is completely separate and won't touch the installed Windows, but you can mount the hard disks and use it to fix Windows problems without any active viruses trying to stop you.)

This is the ONLY way you can be absolutely sure that you don't have anything nasty running in the background.

share|improve this answer
1  
Meh, VM is faster and arguably just as secure. If you make it too time consuming, users may skimp on using the tool and thus destroy all the work you did. A security tool used 100% of the time will beat out any other tool used only 99% of the time. –  surfasb Jul 24 '11 at 0:46
    
+1 for a virtual machine. Use a VM host like VirtualBox that supports snapshotting so that you can keep returning it to a fresh state easily. –  jcrawfordor Jul 24 '11 at 3:49
    
True, VMs are fantastic, but it's only a matter of time before viruses sniff the traffic and subvert VM forwarding. Hardly simple for the average user to comprehend and setup, and an operating system still needs to be installed, with all the time that takes. Burn a CD or stick, restart. Even my 70 year old Mum can do that! –  Andy Lee Robinson Jul 24 '11 at 4:58
1  
This should have been included in your previous answer. –  Nifle Jul 25 '11 at 12:21
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.