Computer viruses: description, prevention, and recovery.

Introduction:

This article discusses the following:

• How to determine whether your computer is infected with a computer virus, a worm, or a Trojan
• How to recover from an infection
• How to prevent future infections from a computer virus

More Information:

What is a computer virus?

A computer virus is a small software program that spreads from one computer to another computer and that interferes with computer operation. A computer virus may corrupt or delete data on a computer, use an e-mail program to spread the virus to other computers, or even delete everything on the hard disk.

Computer viruses are most easily spread by attachments in e-mail messages or by instant messaging messages. Therefore, you must never open an e-mail attachment unless you know who sent the message or unless you are expecting the e-mail attachment. Computer viruses can be disguised as attachments of funny images, greeting cards, or audio and video files. Computer viruses also spread by using downloads on the Internet. Computer viruses can be hidden in pirated software or in other files or programs that you may download.

Symptoms of a computer virus

If you suspect or confirm that your computer is infected with a computer virus, obtain the current antivirus software. The following are some primary indicators that a computer may be infected:

• The computer runs slower than usual.
• The computer stops responding, or it locks up frequently.
• The computer crashes, and then it restarts every few minutes.
• The computer restarts on its own. Additionally, the computer does not run as usual.
• Applications on the computer do not work correctly.
• Disks or disk drives are inaccessible.
• You cannot print items correctly.
• You see unusual error messages.
• You see distorted menus and dialog boxes.
• There is a double extension on an attachment that you recently opened, such as a .jpg, .vbs, .gif, or .exe. extension.
• An antivirus program is disabled for no reason. Additionally, the antivirus program cannot be restarted.
• An antivirus program cannot be installed on the computer, or the antivirus program will not run.
• New icons appear on the desktop that you did not put there, or the icons are not associated with any recently installed programs.
• Strange sounds or music plays from the speakers unexpectedly.
• A program disappears from the computer even though you did not intentionally remove the program.

Note: These are common signs of infection. However, these signs may also be caused by hardware or software problems that have nothing to do with a computer virus. Unless you run the Microsoft Malicious Software Removal Tool, and then you install industry-standard, up-to-date antivirus software on your computer, you cannot be certain whether a computer is infected with a computer virus or not.

Symptoms of worms and trojan horse viruses in e-mail messages

When a computer virus infects e-mail messages or infects other files on a computer, you may notice the following symptoms:

• The infected file may make copies of itself. This behavior may use up all the free space on the hard disk.
• A copy of the infected file may be sent to all the addresses in an e-mail address list.
• The computer virus may reformat the hard disk. This behavior will delete files and programs.
• The computer virus may install hidden programs, such as pirated software. This pirated software may then be distributed and sold from the computer.
• The computer virus may reduce security. This could enable intruders to remotely access the computer or the network.
• You receive an e-mail message that has a strange attachment. When you open the attachment, dialog boxes appear, or a sudden degradation in system performance occurs.
• Someone tells you that they have recently received e-mail messages from you that contained attached files that you did not send. The files that are attached to the e-mail messages have extensions such as .exe, .bat, .scr, and .vbs extensions.

Symptoms that may be the result of ordinary Windows functions

A computer virus infection may cause the following problems:

• Windows does not start even though you have not made any system changes or even though you have not installed or removed any programs.
• There is frequent modem activity. If you have an external modem, you may notice the lights blinking frequently when the modem is not being used. You may be unknowingly supplying pirated software.
• Windows does not start because certain important system files are missing. Additionally, you receive an error message that lists the missing files.
• The computer sometimes starts as expected. However, at other times, the computer stops responding before the desktop icons and the taskbar appear.
• The computer runs very slowly. Additionally, the computer takes longer than expected to start.
• You receive out-of-memory error messages even though the computer has sufficient RAM.
• New programs are installed incorrectly.
• Windows spontaneously restarts unexpectedly.
• Programs that used to run stop responding frequently. Even if you remove and reinstall the programs, the issue continues to occur.
• A disk utility such as Scandisk reports multiple serious disk errors.
• A partition disappears.
• The computer always stops responding when you try to use Microsoft Office products.
• You cannot start Windows Task Manager.
• Antivirus software indicates that a computer virus is present.

Note: These problems may also occur because of ordinary Windows functions or problems in Windows that are not caused by a computer virus.

How to remove a computer virus?

Even for an expert, removing a computer virus can be a difficult task without the help of computer virus removal tools. Some computer viruses and other unwanted software, such as spyware, even reinstall themselves after the viruses have been detected and removed. Fortunately, by updating the computer and by using antivirus tools, you can help permanently remove unwanted software.

To remove a computer virus, follow these steps:

1. Install the latest updates from Microsoft Update on the computer.
2. Update the antivirus software on the computer. Then, perform a thorough scan of the computer by using the antivirus software.
3. Download, install, and then run the Microsoft Malicious Software Removal Tool to remove existing viruses on the computer. To download the Malicious Software Removal Tool, visit the following Microsoft Web site:

http://www.microsoft.com/security/malwareremove/default.mspx

For more information about how to remove a computer virus, visit the following Microsoft Web site:

http://www.microsoft.com/protect/computer/viruses/remove.mspx 

How to protect your computer against viruses?

To protect your computer against viruses, follow these steps:

1. On the computer, turn on the firewall.
2. Keep the computer operating system up-to-date.
3. Use updated antivirus software on the computer.
4. Use updated antispyware software on the computer.

For more information about how to protect a computer against viruses, visit the following Microsoft Web site:

http://www.microsoft.com/protect/computer/default.mspx 

The information in this article applies to:

• Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
• Microsoft Windows Server 2003, Standard Edition (32-bit x86)
• Microsoft Windows Server 2003, Web Edition
• Microsoft Windows Server 2003, 64-Bit Datacenter Edition
• Microsoft Windows Server 2003, Enterprise x64 Edition
• Microsoft Windows Small Business Server 2003 Premium Edition
• Microsoft Windows Small Business Server 2003 Standard Edition
• Microsoft Windows XP Home Edition
• Microsoft Windows XP Professional
• Microsoft Windows XP Tablet PC Edition
• Microsoft Windows 2000 Server
• Microsoft Windows 2000 Advanced Server
• Microsoft Windows 2000 Professional Edition
• Microsoft Windows 2000 Datacenter Server
• Microsoft Windows NT 4.0
• Microsoft Windows Millennium Edition
• Microsoft Windows 98 Second Edition
• Microsoft Windows 95
• Microsoft Outlook 2000 Standard Edition
• Microsoft Outlook 2002 Standard Edition
• Microsoft Outlook Express 6.0

12 Basic PC Troubleshooting Questions.

PC Troubleshooting:

 

1. Has the system ever worked properly?

•   Is the system just out of the box or has anyone worked on it?
•  Did this function ever work before?
•  Are the phone lines correctly connected to the modem?
•  Is the phone line connected through a surge protector?
•  Has the modem ever dialed out or detected a dial tone?

Right out of the box issues could point to shipping, assembly or an incorrect image download.  Components or cables may have shaken loose during shipping.  Look for indicators of proper functionality (e.g. o/s loading correctly), or failure (e.g. beep codes) of components.

 2. Has anything changed?

• When did the issue begin?
• Has this been a recurring problem?
• Did this happen today, last week?
• Has anyone added or removed any hardware or software?
• How long has the client been receiving this error?

If the error has been appearing for a long time, the client may have made his own attempts to troubleshoot the issue.  Ask what steps the client has already taken and what he may have done to try to fix it.  The client may have moved the system, loosened something, or missed something while setting up the system at a new location.  Relating the start time to the purchase date, changes to hardware/software and other factors affecting the PC, you may be able to narrow the possible causes of the issue.  

3. When did the system start doing this?

• Was anything downloaded off the Internet?
• Was the system completely shut down and restarted?
• Was e-mail sent or received?
• What was running previous to shutting down?
• Did the system lockup?
• What was the last thing the client did to the system?

This may provide an idea of what has happened to the system.  The client may have terminated a program incorrectly or shut down the system before exiting Windows.

 4. Was anything changed?

• Does the system seem to take longer to boot, to connect, to display a picture?
• Was the machine moved?
• Is the system suddenly in VGA mode?
• Could the sound be muted somewhere?
• Are any of the standard computer noises missing or different?

Changing desktop settings, default printer, resolution, screen savers can affect performance. The abnormal sounds that system makes may indicate where the issue lies.

5. Have you added any hardware or software?

• Is there an external device hooded to the machine (fax, answering machine, surge protector, scanner)?
• Does the user have call waiting, voice mail, caller recognition?
• Where any applications added or files zipped or unzipped?
• Has the client added any hardware/software to the system?

Check configuration; third party hardware/software manufacturers; check Device Manager in Windows – conflicts often occur after adding hardware; try removing recent additions to the system; software additions can cause driver issues, change system files and boot files, or update files causing new issues.

6. Did anyone else have access to this system?

• If so, who used it last?
• Are they available for questions?
• Were any of the system settings changed?

 Do not assume that nothing has changed just because the client has not changed anything.

7. Where is this happening? In one program or more than one?

• Does it happen in Dos, Windows or both?
• What o/s is the client using?
• If the problem is software, is a DOS or Windows application?
• Has the problem software been deleted (or uninstalled) and re-installed?

Get specific – different o/s need different troubleshooting steps and tools.  Take a close look at related programs.  Problems in several programs may indicate an operating system issue or a hardware issue, as opposed to an application error.  Problems in only one program may point to reinstalling that program.

8. Is there an error message?  If so what is it EXACTLY?

• When does the error message appear?
• Are there error messages associated with the attempted use of the program?

Error messages, which sound similar, may point to entirely different problems.  Write down the error message – word for word – and the details when the client receives it.  Enter the exact message into the tools.  There may be a quick solution: If the error is generated by a Microsoft program, check TechNet for the error.  If the error is generated by third party – redirect client to the manufacturer.

9. Does it happen every time or just sometimes?

• Does the same action always bring about the same results?
• If this has occurred before, is it after the initial boot?
• What is the timing of the failure?

Look for commonalities.  They can point to the root cause.  If the issue is constant, you may be able to recreate it and collect more info.  Chances are it may be a hardware setting somewhere or a hardware issue.  If the issue occurs only shortly after the system is turned on or only after the system has been on for an hour, the system may have a heat-related problem.  If the issue happens in only one application, chances are the issue is software related.  Random issues generally are hardware related.

10. Is everything else working properly?

• Have there been problems with other apps/hardware.

 A client may not realize that seemingly unrelated issues may be caused by the same problem.

11. Is the system on a network or attached to another system?

•  Network server may be down, breaking a connection to a needed program or file.
• Try booting without the network, unless the computer is a network server. If it helps narrow the cause. 
• Clients are sometimes unaware of the role of the server or another connected computer plays in certain applications.

12. Are there environmental concerns affecting the system?

• How long is the phone cord (6 feet)?
• Is the system close to any heavy electrical machinery?
• Is the system close to an electrical transformer or high-tension power lines?
• Has there been an electrical storm through the area recently?

Electric motors, florescent lights, fish tanks, power stations, broadcast towers, heavy-duty power lines construction equipment or construction in progress can cause issues with computer systems.  Damaged wall sockets, surge protectors that have taken a hit, or a blown circuit fuse in the house affect the amount of electricity flowing to the computer.