A-Tec Computer Repair

Home    -    Repair    -    Malware Removal    -    Networking    -    Contact    -    About Me    -    My Location    -    Computer Tips

 

 

 
 

Malware Infections

You have found central Kentucky's expert on malware removal.  Yes, I'm bragging a bit but I've also removed more than enough of today's modern malware to know exactly how it operates, how to safely remove the associated files and how to detect and reverse the varied damages it causes.

Malware designers are constantly changing the look of the main interface and the location it hides itself and its multiple re-installers.  However, the method of infection and symptoms of being infected are still the same, beginning with a pop-up on a webpage.

In most all malware infections, the user is tricked into installing it on their own computer by clicking the OK button or the X on a script-generated popup.  Below are some examples of these dangerous tripwires:


Pop-up viewed on a Windows 7 or Vista Machine (Internet Explorer)

   
A couple viewed on a Windows XP Machine


Windows 7 / Vista (Internet Explorer)


Windows 7 / Vista (Firefox)


Windows 7 (Internet Explorer)

Look familiar?  These simple-looking pop-ups are what I call malware trip-wires and they do not come from your anti-virus.  Look at them again and commit them to memory because there is a similarity - they want you to click on them.  These are FAKE warnings loaded onto your browser by way of scripts from web pages and if you interact with these pop-up windows, you will install malware on yourself.

Don't click the OK or Cancel buttons or even the "X" - these and similar pop-ups must be closed by using Task Manager.  Right-click on the clock in your tray and choose Task Manager.  Click the Application tab and "End Task" the pop-up and the web pages that appear in this list.
 

 


Some are more tricky...
The pop-ups above is pretty easy to recognize as a generic fakes, but take a look at the one below:

You don't have to go to bad places to come in contact with malware.  The one above was loaded from a celebrity gossip site.  It's spoofing a warning from Microsoft Security Essentials which is a very popular free anti-virus.  This is a bad one because it uses official-looking imbedded images in the pop-up and can install the initial malware file without needing for you to click on it.  Interacting further with this one will cause deeper damages.

If something similar to this appearing on your screen, don't fall for the trick by clicking on it.  Call me instead.

 




What's the difference between a virus and malware?

Computer viruses are so named because they operate similarly to the viruses that invade our own bodies.  A computer virus is caught by exposure and then replicates itself.  It spreads internally within the system, spreads to other computers, and it even mutates.  Viruses are usually created with the goals of random malicious damage and also maybe to give its creator some satisfaction and notoriety among his peers.  Most viruses are written to spread automatically and take on lives of their own.

But malware as discussed here refers to programs that were written to cause specific changes to a computer's software and settings.  This type of malicious software installs behind the user's anti-virus, takes advantage of the way Windows operates and alters critical key areas that greatly reduce a computer's functionality to the point of being unusable.

The end-goal of most of today's common malware seems to be to force the user to a web site that promises a removal tool in exchange for a fee.  For this reason, these types of malicious programs have also been called ransom-ware.

Once the initial trip-wire has been clicked on, an animated pop-up window posing as a virus scanner loads onto the screen.  Examples: 

The type of pop-ups above are meant to trick the user into believing that an official virus scan is taking place and that the scan is detecting a large list of viruses, Trojans, and other nasties.  These pop-up scanners are fakes as well as the list of infections that it shows that it has found.  Common names that these things use includes Antivirus 2010, Antivirus 2011, SecurityTool, Win 7 Security 2012, AV Security 2012, XP Home Security 2012, etc..

Once infected with this type of malware, the user's Internet connection is sometimes cut off or altered where only certain sites can be accessed - it might open your web browser to strange-looking search sites or blank pages but it usually makes a site available where a credit card or bank account number can be entered to pay for a "cure".  The desktop wallpaper might be changed to have a scary message and as long as the malware is on the user's system, the random pop-up warnings and fake scans will continue.

Other damages brought forth in a full-blown infection causes programs to not open, prevents the user's real anti-virus from loading, sprinkles distasteful icons on the desktop, and the system will slow to a crawl as random pop-ups repeat themselves.  With a certain malware family, the fake scanner and its message load immediately at boot-up and Windows fails to load.

Recent infections cause the disappearance of the Windows Security Center service and will hijack web searches to land on other rigged and potentially dangerous "search sites".


The screenshot above is an extreme example but is representative of the varied
types of pop-up "warnings" that can happen in a full-blown malware infection.

Expert Removal:

My malware removal technique is unique and was developed and perfected during countless and successful removals for customers.  It begins with identifying the family of the active malware and proceeds from there where I take actions in a certain order based on the malware type and damages present.  After my manual removal/repair, I perform system scans to be sure all remnants, hidden and dormant files from the present and past infections are gone and obscure settings are restored.

Removal attempts by random methods can make the problem worse.  As long as no one has tried to remove an infection with the wrong method, my expert removal and damage reversal technique never fails - I know how malware enters, where it goes, how it operates, where its trigger files reside, how to remove it, and how to reverse its damages.

Kitchen-sink approaches using random automated cleaners to remove malware can be destructive and will rarely detect and repair all the varied damages/changes that malware can do to Windows systems.  The Windows utility called System Restore should not be used against malware.  Invasive cures like ComboFix and SmitFraud Removal are rarely necessary - their use has unnecessary risks and they are often not successful on today's modern malware.

Again - removal attempts performed by the inexperienced can make the problem much worse and can make the repair process more difficult, time-consuming, and sometimes even prohibitive.

If you take your computer to most repair centers for malware/virus removal, the common solution is to reinstall Windows. This will be a costly service and will definitely remove the infection but it will also remove everything else - you will needlessly lose your user-installed programs and customization settings. They will also charge extra to back up your irreplaceable user data.

Reinstalling Windows is rarely necessary as a solution for viruses and malware.  My removal method is effective, safe, thorough and complete.  After I remove the malware and reverse the damages, I then check, tweak and tune the system to make it run faster than it did before the infection.

  A word of warning: I've seen machines that had irreparable damage after home virus removal attempts were performed.  You are taking your chances trying System Restore and some automated cleaners.

I understand the temptation, but please realize the risks of using blind, shotgun tactics.  I get great results manually removing fresh malware infections and have found that most malware-related damages that cannot be repaired easily by me are usually the results of actions having been taken beforehand by someone inexperienced trying to remove the malware.

Windows' System Restore used as a malware cure can cause instruction conflicts and errors which could bring blue screens or even cause the system to not load Windows.  This can be considered as part of the malware trap - either by design or by accident.  System Restore takes only certain settings back to an earlier date and does NOT remove the actual malware or root-kit files.  If part of the damage was to your userinit file and also to its associated registry instruction, running System Restore without repairing the userinit file first will prevent the user from logging into Windows.

The worst examples of botched attempts were caused by applications the owners ran which left their machines in a state with their network controllers not being able to obtain IP addresses automatically and not resolving DNS names.  This was not because of proxy server settings, corrupt DNS caches, or altered hosts files - this was actual damage to and deletion of files and instructions associated with the TCP/IP stack or Windows' DNS-related services and is sometimes not repairable.

Another critical situation involves the malware type that hides desktop files and the shortcuts that appear in the Programs list.  Doing the wrong thing with this one can cause these seemingly missing items to be permanently deleted. 

I can quickly get your computer back like it was if it is left alone.

At the first sign of malware, do not do a System Restore to an earlier date or throw automated removal programs at it.  Call A-Tec.  A computer infected with malware as described above if brought immediately to me, can be completely repaired without a reformat/reinstall.
 

Removal Fees:

The price I charge for malware removal is included in the house call or drop-off rate.  On a reasonably-fast machine, the removal, damage detection/reversal, 2nd opinion scanning procedure and system tune-up will last about 1-1½ hours and if scheduled and brought to my shop, it can usually be done for the basic drop-off fee usually while you wait.  Of course malware can be removed onsite at your residence or business for the applicable one-hour house-call rate.

Some machines when stacked with CPU-taxing applications run painfully slow - thus slowing down the repair/scanning process considerably.  An additional fee of $30 per half hour may apply to onsite malware repair on very slow machines.  If your machine was really slow before the infection, the removal process will be slow as well.  You'll already know if you own such a machine and you may want to consider a Windows reinstall as the best solution.


Future Protection:

Since I am very familiar with the mechanics of malware and know how these things operate, I also know how they are best prevented.  After my malware removal process, I will explain how the malware got on your system, uninstall the anti-virus that didn't work, and will install my favorite user-friendly, lean-running anti-virus application at no additional charge.

 

 
     

© Copyright 2012 A-Tec Computer