BuyLow.com Computers And Internet - Internet Security, Computers, Mobile Devices, Networks

BuyLow.com | Resources | Contact Us


 

Recovering from a Trojan Horse or Virus

by the United States Computer Emergency Readiness Team
www.us-cert.gov

Michael D. Durkota and Will Dormann It can happen to anyone. Considering the vast number of viruses and Trojan horses traversing the Internet at any given moment, it’s amazing it doesn’t happen to everyone. Hindsight may dictate that you could have done a better job of protecting yourself, but that does little to helpyou out of your current predicament. Once you know that your machine is infected with a Trojan Horse or virus (or if your machine is exhibiting unexpected behavior and you suspectthat something is wrong), what can you do? If you know what specific malicious program has infected your computer, you can visit one ofseveral antivirus web sites and download a removal tool. Chances are, however, that you will not be able to identify the specific program. Unfortunately your other choices are limited, butthe following steps may help save your computer and your files. 1. Call IT supportIf you have an IT support department at your disposal, notify them immediately and followtheir instructions.2. Disconnect your computer from the Internet Depending on what type of Trojan horse or virus you have, intruders may have access to yourpersonal information and may even be using your computer to attack other computers. You canstop this activity by turning off your Internet connection. The best way to accomplish this is tophysically disconnect your cable or phone line, but you can also simply “disable” your networkconnection. 3. Back up your important files At this point it is a good idea to take the time to back up your files. If possible, compile all ofyour photos, documents, Internet favorites, etc., and burn them onto a CD or DVD or save themto some other external storage device. It is vital to note that these files cannot be trusted, sincethey are still potentially infected. (Actually, it’s good practice to back up your files on a regular basis so that if they do get infected, you might have an uninfected set you can restore.)4. Scan your machineSince your computer (including its operating system) may be infected with a malicious program, it is safest to scan the machine from a live CD (or “rescue” CD) rather than a previously installedantivirus program. Many antivirus products provide this functionality. Another alternative is touse a web-based virus removal service, which some antivirus software vendors offer (try searching on “online virus scan”). Or you could just try Microsoft’s web-based PC Protection Scan. The next best action is to install an antivirus program from an uncontaminated source such as aCD-ROM. If you don’t have one, there are many to choose from, but all of them should provide the tools you need.

After you install the software, complete a scan of your machine. The initial scan will hopefullyidentify the malicious program(s). Ideally, the antivirus program will even offer to remove the malicious files from your computer; follow the advice or instructions you are given. If the antivirus software successfully locates and removes the malicious files, be sure to followthe precautionary steps in Step 7 to prevent another infection. In the unfortunate event thatthe antivirus software cannot locate or remove the malicious program, you will have to followSteps 5 and 6. 5. Reinstall your operating systemIf the previous step failed to clean your computer, the most effective option is to wipe or format the hard drive and reinstall the operating system. Although this corrective action will also result in the loss of all your programs and files, it is the only way to ensure your computeris free from backdoors and intruder modifications.Many computer vendors also offer a rescue partition or disc(s) that will do a factory restore ofthe system. Check your computer’s user manual to find out whether one of these is providedand how to run it.Before conducting the reinstall, make a note of all your programs and settings so that you canreturn your computer to its original condition.It is vital that you also reinstall your antivirus software and apply any patches that may be available. Consult “Before You Connect a New Computer to the Internet” for further assistance.6. Restore your files If you made a backup in Step 3, you can now restore your files. Before placing the files back indirectories on your computer, you should scan them with your antivirus software to check themfor known viruses. 7. Protect your computerTo prevent future infections, you should take the following precautions: • Do not open unsolicited attachments in email messages.• Do not follow unsolicited links.• Maintain updated antivirus software. • Use an Internet firewall.• Secure your web browser.• Keep your system patched.To ensure that you are doing everything possible to protect your computer and your importantinformation, you may also want to read some of the articles in the Resources section below.

105 Responses to “Recovering from a Trojan Horse or Virus”

  1. ??????? ?? ??????.. ????????? ??? ??????.. ????? ???? ??? ??????????.

  2. ??????? ???????!????? ???? ????-??????????.

  3. ??????? ??? ?? ????, ????? ???????? ??????, ??? ????? ????????

  4. Nadine

    Hi there,
    Can i take a one small pic from your blog?

    Thanks
    Nadine

    —————————

    Nadine,
    Which one?

  5. ?? ??? ???? ???????? ? ????? ?????? ?????. ????????? ,??? ?? ??? ???????????. ????? ????????? ?????? ????

  6. ????? ???????????, ???? ?? ???????.

  7. ????????? ????? ?????, ? ?? ???????? ?? ?? ???????

  8. ???????? ??????, ?????? ?????? ???? ?????????? ?????????? ?? ??????.????? ????? ?? ???? “??? ?????”. ? ?? ???, ??? ??????? ?? ???????????.

  9. ??????,??????!!!
    ? ??? ?? ????? ????? ??? ????????? ???????????- ??????????????, ??? ??????? ????????

  10. ????,??????!!!
    ? ??? ?? ????? ????? ??? ??????????- ?????????, ??? ??????? ?????????

  11. ????? ? ??????????????? ?? ????? ?????? …

  12. ????? ????? ? ???????, ??????? ????!

  13. ??????? ???? ??????? ??????? ?????? – “??? ????? — ??????, ??? ?? ????? — ????”. ?????, ????????? ??? ???? ?? ??????. ??? ????.

  14. ??? ?????? ???? ????? ????? ??????? ???????? ?? ??? ?????? ????? )

    ???? ????????, ????, ????????? ??????
    ???????? ? ??????? ????? ? ??????,
    ? ????????? ???? ? ?????? ??-?? ????? –
    ??? ??????? ?? ???? ??????????????, ??????!

  15. ??????????? ?? ????? ????? ???? ??????, ? ????????? ??? ???????-?? ???????? ?????? ?? ???. ?? ??? ????? ?????????? ???????? ?? ???????, ? ??? ???…

  16. ??????? ??? ?? ????, ????? ???????? ??????, ??? ????? ????????

  17. ?????????? – ??? ??? ?????, ? ? ??? ??? ?????
    ???????? ?? ??? ??????? ? ???????? ?????????

  18. ? ?? ?? ???????????? ? ???, ????? ??????????? ??????? ??? ???? ????, ?? ??????? ????? ? ??? ??????? ??????????

  19. ???????? ???? ?? ????, ?? ??? ? ??????? ????? ??????????

  20. ????? ???? ???????? ???? ????????, ?? ???? ??????? ??????? ?????.

  21. ??????? ???: ? ???????? ,? ??????????

  22. ????? ?????????, ?? ??? ? ??????? ???????? ?? ??? ???????? ?????? ?? ????. ????? ??????????? ???? ??????!

  23. ????? ?? ????, ??????? ? ?????????

  24. ? ??? ???????? ?????? ? ??? ????? ????? ????? ???????. ??? ??????????? ??????? ???????!

  25. ?? ??? ?????? ??????? ??? ?????? ??????? ??????? ???????, ????!

  26. ???????????,???????? ?????!!!
    ????? ??????????? ??????????. ?????????? ???????, ?? ?????, ??? ????????? ????? ?????????????? ? ????????? ?????? ??????? ??????????. ??????? ???????!!!

  27. ????? ???? ????????? ??????, ???????!

  28. Hi,
    Everything dynamic and very positively! :)

    Thank you
    Elcorin

  29. ????????? ????? ?????, ? ?? ???????? ?? ?? ???????

  30. ?? ?????? ?? ??????? ? ????? ?????????, ??? ??????.

  31. ??????, ??? ?????? ?? ?????: ?? ?? ??????? ???? ?????????.

  32. ??????? ????????. ??????? ? ???????????. ???????? ?? ???

  33. ????????? ? ?????????????, ? ????? ??? ???-?? ?? ???? ?????

  34. ?????????? ????, ???????!

  35. ?????? ??????. ???????, ?????-?????? ????? ????? ???????? ? ?? ????? ?????…

  36. ? ????????? ???? ??????? ??? ????, ????? ???????????????? ????. ????? ?????? ??? ????, ????? ??????? ??????.

  37. ??????????? ?? ????? ????? ???? ??????, ? ????????? ??? ???????-?? ???????? ?????? ?? ???. ?? ??? ????? ?????????? ???????? ?? ???????, ? ??? ???…

  38. ???????????,??????!!!
    ????? ??????????? ??????????. ?????????? ???????, ?? ?????, ??? ????????? ????? ?????????????? ? ????????? ???????? ???? ??????????. ??????? ???????!!!

  39. ???????? ????, ?? ????? ???????.

  40. ??? ????? ??? ??????? ?????? ? ?????? ???? ???? ? ?????????? ????????. ????? ??????? ??? ??????? ?????????.

RSS BugTraq

  • [SECURITY] [DSA 2100-1] New openssl packages fix double free
    Posted by Moritz Muehlenhoff on Aug 30------------------------------------------------------------------------ Debian Security Advisory DSA-2100-1 security () debian org http://www.debian.org/security/ Moritz Muehlenhoff August 30, 2010 http://www.debian.org/security/faq ------------------------------------------------------------------------ Package : opens […]
  • Re: [Full-disclosure] QtWeb Browser version 3.3 build 043 Insecure DLL Hijacking Vulnerability (wintab32.dll)
    Posted by security curmudgeon on Aug 30: 1. OVERVIEW : : The QtWeb Browser application is vulnerable to Insecure DLL Hijacking : Vulnerability. Similar terms that describe this vulnerability have been : come up with Remote Binary Planting, and Insecure DLL : Loading/Injection/Hijacking/Preloading. : 3. VULNERABILITY DESCRIPTION : : The QtWeb Browser applicat […]
  • [ MDVSA-2010:165 ] libHX
    Posted by security on Aug 30 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:165 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libHX Date : August 30, 2010 Affected: 2009.0, 2009.1, 2010.0, 2010.1 _________________________ […]
  • {Lostmon - Groups} Safari for windows Invalid SGV text style Webkit.dll DoS
    Posted by Lostmon lords on Aug 30################################################### Safari for windows Invalid SGV text style Webkit.dll DoS Vendor URL:www.apple.com Advisore:http://lostmon.blogspot.com/2010/08/safari-for-windows-invalid-sgv-text.html Vendor notify :Yes exploit available :YES ################################################### Safari browse […]
  • R7-0036: FCKEditor.NET File Upload Code Execution
    Posted by HD Moore on Aug 30R7-0036: FCKEditor.NET File Upload Code Execution August 30, 2010 -- Vulnerability Details: FCKEditor contains a file renaming bug that allows remote code execution. Specifically, it is possible to upload ASP code via the ASP.NET connector  in FCKEditor. The vulnerability requires that the remote server be running IIS. This vulne […]