When working with other people, I am quite often asked, “How did you do that?” (when I bring up Windows Explorer or the ‘Run’ dialog box with just a one combined keystroke). A few little known keyboard shortcuts are the secret.

You can use the following keyboard shortcuts with a Microsoft Natural Keyboard or any other compatible keyboard that includes the Windows logo key () and the Application key ().

Press	To
	Display or hide the Start menu.
+ BREAK	Display the System Properties dialog box.
+ D	Show the desktop.
+ M	Minimize all windows.
+ Shift + M	Restores minimized windows.
+ E	Open My Computer.
+ F	Search for a file or folder.
+ CTRL + F	Search for computers.
+ F1	Display Windows Help.
+ L	Lock your computer if you are connected to a network domain, or switch users if you are not connected to a network domain.
+ R	Open the Run dialog box.
	Display the shortcut menu for the selected item.
+ U	Open Utility Manager.

(*** Disclaimer: If you do not feel comfortable doing any of the following procedures, please contact a local computer service company like Geeks in Phoenix. You will need a second computer connected to the internet for the following. Proceed at your own risk! ***)

Signs you may be infected:

• You get ‘Pop Ups’ alerting you that your computer may be infected from software you do not remember installing.
• You may have new software icons you did not have before on your desktop.
• You may find your anti-virus software alerts you of a threat, but is no longer working.
• You may not be able to get to a particular web site or not even be able to get on the internet at all.

The following is a general guideline to detecting and removing a virus from your computer. As always, have a good working backup before attempting any of these procedures.

1. Isolate the suspected computer by disconnecting the network cable or turning off the wifi adapter. This will stop anything from getting on your network to infect other systems and getting to the internet to make connection with its author and/or server.
2. Turn off ‘System Restore’ on all hard drives. Find a ‘My Computer’ icon and right click on it. Choose ‘Properties. Then select the tab named ’System Restore’. Select the check box ‘Turn off System Restore on all drives’ and click ‘Apply’

You now have stopped the ability to get outside of the computer and the ability to be restored from a ‘restore point’. It’s now time to get to work.

Depending on the severity of the infection, I will use either USB drives or finalized cd-r’s to install software. With the newer infections that can write across networks and to any writable media (floppy, memory card, USB drives, etc.), it's best just to grab a bunch of cd-r’’s and write all of the different software you’ll need to cd.

First thing, go over to Malwarebytes’ https://www.malwarebytes.com/ and download a copy of their Anti-Malware program. Put it on your choice of media and install on the suspected computer. Then select ‘Perform quick scan’ and click ‘Scan’.

Allow the program to take what ever actions required (which may include a reboot). Once the program has finished, let’s proceed to scan for viruses.

(***Disclaimer: Never install more than one anti-virus program on a system.***)

If you have anti-virus software, check it to find out if it is still working. A lot of infections will disable your anti-virus. If this is the case, reinstalling it may get it to work again. If this doesn’t work, you will need to uninstall it completely, so you can reinstall a new copy of the antivirus software. Once this is done do a complete scan of the system.

If you do not have any anti-virus, go over to AVG Free https://www.avg.com and download a copy. Also download the latest definition files. Put all of the files on media and install the anti-virus. Once installed, you can upgrade the definitions by selecting ‘Update from file’ when you have the program open. Then do a complete scan of the system.

(***Disclaimer: Before installing a firewall in Windows XP / Vista, disable the Windows Firewall in the Control Panel first. Also, never install more than one software firewall on a system.***)

Once you have run both Malware and an anti-virus scan on the system, you should have a good hand on the situation.

(*** If you are still having issues that you’re anti-virus and/or spyware software cannot remove, please seek professional assistance. ***)

Before attempting to reconnect the suspect system to the internet, make sure that you have a software and/or hardware firewall in place. I use both a hardware firewall behind my internet connection and software firewalls on the servers / workstations.

For more information on Free Internet Security Software, check out this blog entry:

Free Internet Security Software

And for a detail description of one of the worst cases of infection I have seen yet, check out this blog entry:

Virus Removal

Till later,
Scott

Here is a list of four free Internet Security programs I recommend for those on a budget. Keep in mind that free software often comes with limitations, but are fully functional. Some of them require manual updating, but that is a small price to pay for great free software. Let us start with an Anti-Virus program:

(***Disclaimer: Never install and run two anti-virus programs on the same system.***)

AVG Free https://www.avast.com/

Upside: Here is a fully functional Anti-Virus program that has Anti-Virus, Anti-Spyware, E-mail, and link scanners. The program is fully automatic in updating itself. It can be updated from a file (USB drive) when you have to quarantine a system by disconnecting it from the internet/intranet.
Downside: There is no free technical support. Support for this product is sold at blocks of 15 minutes.

Next is a Firewall program:

(***Disclaimer: Before installing a firewall in Windows XP / Vista, disable the Windows Firewall in the Control Panel first. Moreover, never install and run two software firewalls on the same system.***)

ZoneAlarm http://www.zonealarm.com/

Upside: The program is fully automatic in updating itself.
Downside: It only provides inbound and outbound protection, but does it in full stealth mode. It also requires internet access to install.

Let us now look at two free spyware/malware programs. My first choice is Malwarebytes Anti-Malware. Note: I ranked Malwarebytes first only because it can be installed and run without the need for internet access (I use USB drives for installing software on quarantined systems).

Malwarebytes Anti-Malware https://www.malwarebytes.com/

Upside: It is an excellent malware program. It can be installed and run without internet access (always download the latest version first).
Downside: You have to open the program and manually update it.

Spybot https://www.safer-networking.org/

Upside: It is an excellent spyware scanner with many features, including an ‘Immunization’ feature for your internet browser. It can also update itself when the program is started.
Downside: It requires internet access to install. Not a good thing if you have to quarantine a system by disconnecting it from the internet/intranet.

I hear more and more of new computer users getting severely infected with Malware, Spyware, Trojans, etc.. I am currently working on a system that is, by far, the worst one I have ever seen. I have the system back running and will document the procedures I followed in the next couple of days. I’m also going to include links to the free (yes free!) software you can download and use to prevent this from happening to you.

Till then,
Scott

*** Update 02/08/2009 ***

Link to Free Internet Security Software

Note: I took on this client as I felt he needed the assistance. He’s an older veteran who just graduated from school. He bought a used computer and then connected it to a high-speed connection.  Without any knowledge of what he needed for security software, he quickly got infected. The story does end happily (should I tell you now or make you go to the bottom of the page).  Alright, I built a new system for him from my spare parts and loaded all of his old software on to it. System cost: $0. Good feeling: Priceless (sorry MasterCard, I had to use it).

Let me first outline the situation. I got a call from a gentleman whom had purchased a used computer, and it got infected. It was so bad that it would not even boot into Safe Mode. When I got it, I immediately went to back it up. It was then I discovered the system would not boot to a cd-rom (red flag). This was my first issue.

The system had a floppy drive, so I installed a network card I knew worked and had DOS drivers. I then created network boot disks and was able to backup across the network. The data being transmitted from the client was different in size to what the server was receiving (red flag).

I now had a good working image of the hard drive. It was apparent that a system driver was failing to load and causing the crash. I wanted the check the hard drive for errors first. Since this drive was FAT 32, I used a Windows 98 SE boot disk with support tools and ran scandisk on the hard drive. The surface scan indicated a bad cluster on the drive (drive failure!). A quick download of the diagnostic software from the hard drive manufacturer confirmed the hard drive failure.

Luckily I had a hard drive of equal size and cloned the drive image back to a new drive. A quick Scandisk to check for errors and away I went, but I still got errors when booting. I changed the boot options and was able to get the error screen to stay up. I took a photo to do more research. It turns out the error is coming from the on-board IDE controller (controller failure for sure, possible motherboard failure). This would explain the issue with the cd-rom.

I happen to have a spare PCI IDE controller card from when I had to have eight drives in one of my systems (opposed to the standard four at the time). I’ll tell the story of the system that I built that I had to disable all onboard devices to keep running later. What I did to keep that 486 running was amazing.

I installed the controller card and almost immediately discovered the BIOS were coming up scrambled. I couldn’t bootstrap the bios. That was it, motherboard failure. The project now was how to rebuild the computer. The motherboard failure made me leery of using any of the old hardware. You don’t know what else may be damaged (we know the hard drive was).

So I went around the home to see what I could find. A Pentium-D 805, ECS P4M800, a 256 MB stick of PC-3200 memory, cd-rom, floppy drive, hard drive, power supply, and case. A little modification to the case allowed clearance for the power connector to the motherboard, and I was off and running.

I assembled the system and got the original image loaded on it. I was still getting boot errors, but it did boot. Of course, Windows found all sorts of new hardware. But the Pop Ups were coming on hard and fast. And so were the system errors.

So I went and opened the hard drive image file, and it was there I found a couple hundred infections. I made a copy of the image and then proceeded to edit the contents of it manually.

I was able to remove about three hundred (300) or so infected files. I then pushed the revised image to the new system. I could get the Pop Ups and errors to come down quite a bit. I turned off System Restore, installed Malwarebytes and started a scan. It found several infections and removed all on reboot.

I then installed AVG, updated definitions by file, and ran a complete scan. It was then that I found out that this system was beyond repair. It had an infection that attaches itself to every executable file on the hard drive. AVG found over seven thousand (7,000) of these infections. At this point, it is time to completely wipe the hard drive and do a clean install of Windows.

That’s where the story ends. I reloaded all of the applications, user files, etc. The computer is in place and running beautifully. It’s again hooked up to high-speed internet, but this time with protection.

This one is for the ‘Geeks’. Tips, questions and comments, from ‘Geeks’ to ‘Geeks’. Just click the 'Comments' link below.