Thursday, 16 September 2010

Malware Intro

Malware is a rather large topic to cover, it is short for malicious software, there are many categories of malware but they can all be described as “software which is installed to a PC without the owner’s informed consent”. Note how I state informed consent as you can consent to having malware being installed on your PC without you really knowing or understanding that you’re doing it. Sounds complicated ey?

As I’ve said, there are many classes of malware, some you would of heard of and some you might not of, it seems that new classes are cropping up all the time. Here is a list of common malware categories, see if any of these ring a bell.

Adware
This generally is more annoying than it is dangerous, Adware programs will popup adverts, typically through your browser at somewhat random times. A lot of the time they will tell you your infected with a virus and that you should click inside the advert to download some software to remove what it has artificially found. Don’t do it.

Spyware
This typically goes hand in hand with Adware but its main purpose is to literally spy on your PC activities, again centralised around your browser. When you go to websites it keeps a track of them and then sends the information to who or whatever it is programmed to send it to. When used in conjunction with Adware software then you can get targeted adverts specifically to what you have recently been looking at on the internet. Again most of the time its harmless but just really annoying, you actually feel quite invaded as the adverts are targeted to you.

Worms
A worm can best be described as a stand alone virus, they can be quite cunning and change their names but they hide on your system and do whatever they are designed to do. They have been known to spread through the internet via email like wildfire. A worm can do anything its programmed to do so your only defence is good antivirus software and ensuring you have the latest security updates installed. It should also go without saying but don’t open up any file that you haven’t scanned and are uncertain about.

Trojans/Trojan horses
Trojans are arguably the bad boys of their malware class, their purpose is to get you to install them as they pretend to be something else and sit covertly on your PC collecting information and allowing a remote user access to your PC or file system. It’s a stealth program so you probably wouldn’t know that you had it installed. The first clue might be your credit card details being used in a foreign country. Certain Trojans will allow remote access and control of the PC, so someone else could move your mouse for you. They could capture information that you’ve entered into a website. Basically a well written Trojan is about as bad as it gets from a “life impacting” perspective. You might not lose your files on your PC but you might lose your bank account instead, food for thought?



Viruses
Now you must of heard of this one, everything seems to be a virus and for the most part if you call a Trojan a virus no one will correct you on it except for the resident computer nerd. A virus can be described as self replicated software with a negative impact. A ‘Virus’ is a pretty generic term, it’s a program that can do pretty much anything it is written to do, this could be opening up your browser every 10 seconds or deleting your mater boot record so your PC wont boot. In the same way a program can be written to do helpful things a Virus is a program that does unhelpful negative things. It might make your PC say hello to you each morning or it might delete or of your cherished photos. Viruses like to infect other files with their nasty code so its easy for them to spread from one PC to another via the internet, cds, floppy disks (if anyone uses them anymore?)  USB drives or any other means of transferring a file


There are several other catagories that I wont go into such as keyloggers, dialers, crimeware, spybots, rootkits .. the list goes on.

What we want to know now is how to fix these issues out so our systems are clean, safe and stable.

Luckily enough, there are a lot of tools that are freely available to download on the internet. The next section will describe the steps we need to take to remove Malware from our systems. None of the steps are particularly difficult and even a novice will be able to use the software listed.


Saturday, 11 September 2010

Removing Malware

We have established that there is plenty of nasty programs around that you can inadvertantly install on your PC. Obviously prevention is better than cure but the fact your reading this probably means your past the prevention stage. So lets have a look at the curing stage.
As a side note, I am not connected with the produts listed on the pages listed on this site, these are programs that i use myself when fixing PC's. My only affiliation might be through adverts placed on the site. So you can be assured that im not trying to sell you anything, its unbiased advice based on what I have experienced.
The first point of call is to install MalwareBytes directly from the Malwarebytes website, don’t use Peer 2 Peer or torrents to download the file as you might find that it has been altered and may do more harm than good.
Download the required setup file from www.malwarebytes.org and you can rest assured the file is clean and safe to run on your PC.
Malwarebytes has a free version which is more than acceptable for removing the nasties. If you are computer savvy then just jump a head and run the program and do a system scan. At this stage since we are expecting malware on the PC don’t bother with a quick scan. Do a full System scan, yes it takes longer and we are all impatient to a degree but there is no point in doing a quick scan and missing potential malware.
For those who are not quite as computer savvy lets look at the steps needed to use the program. Its not hard honest.
Left click this link www.malwarebytes.org and you will see this screen.

Left Click the Blue 'Download Free Trial' button.
You will then automatically be taken to the download page hosted by CNET. You will see  a page very simular to this.

Left click the 'Download Now' Link.
You will then get a box pop up confirming the download, click yes to start downloading it to your PC. Differnt browser plugins have differnt boxes for downloading files so its not worth having a screen shot. They all do the same thing, depending on your internet speed your download will be complete in a few minutes.
Now hopefully you remembered where the file was saved to, if not take it as a learning experience, first check 'My Documents' or C:\Downloads or your desktop. If you cant find it you will have to have a search through your PC. The setup file your looking for is callled 'mbam-setup-1.46.exe'. The file name is correct a the time of writing but it may change with differnt updates and versions.
Once you have located the file, double left click it to start the installation. When the installation starts do the following.
  • Select your language and left click OK
  • Left Click 'Next' when it asks you if you want to install the program.
  • Left Click the white circle to accept the licence agreement (after reading it)
  • Left Click 'Next'
  • Left Click Next again when it shows you the version history.
  • Leave the program path as its default and left click 'Next'
  • Allow it to add a shortcut to the start menu by clicking 'Next' again.
  • Allow it to create a desktop icon by clicking 'Next'
  • Click 'Install'
  • Leave the two check boxes selected and Left Click 'Finish'
Malware bytes will then automatically update its definitions, the definitions are just a set of instructions used to detect Malware, you should let it update its definitions often.
You will see a screen like this as it updates itself. It shouldnt take very long, a few minutes depending on connection speed.

Once it has finished updating itself you should see a box like this popup confirming that the update has been installed sucessfully.

Your Version number will most likely be differnt, thats normal.
Left Click 'OK' and wait a second and the main Malware Bytes window will pop up.
The main window should look something very simular to this below

Select the 'Perform Full Scan' button then left click 'Scan'
The next window will let you select the drives you want to scan, typically you will want to scan C:\ Drive as that is the default drive for most Windows installations. You can scan CD's and any other external drives here too.. We will just be scanning C:\ in this tutorial but the process is the same for any other drive listed.

Make sure C:\ is selected if its not then just left click the empty square to put the tick in place and that means its selected
Then Left click 'Scan'
Now you should see the screen below, you are going to be in for a bit of a wait so you might aswell go and make a cup of tea. It all depends on how many files you have on your system it could take 20 minutes or it could take much longer, my prefernce is to let it run over night and deal with it in the morning after my cornflakes. Typically you wont be doing  a Full System Scan so it will be much quicker in the future  but we want to make sure we dont have any nasties lurking anywhere.

Cup of tea time whilst it completes the scan, it has a lot of work to do so we cant complain.
The more files you have and the slower your PC is then the more time it will take.