Studio711.com – Ben Martens

So now you’ve failed Part 1 or Part 2 of this security series and you have a virus. What should you do? The best thing is to stop everything. Turn off the machine and call your favorite geek. Offer them cookies and ask nicely. Remember that the virus warning might be fake and there’s nothing wrong with your computer.

If it’s legit and your computer is actually infected, your favorite geek is going to ask two things:

1. Do you have all your data backed up? Good grief people, the answer better be a resounding yes. I’ve blogged about this so much. Here’s the test to see how good your backups are: if I walk into your house, throw your computer out into the street and drive over it, what is your reaction? If you’re only mad because of the money loss then you have good backups. If you start crying because of all the pictures and memories that you’ve lost, then YOU NEED TO BACK UP NOW. There’s no excuse for it. Go to http://www.crashplan.com and sign up. It’s stupid simple, nearly free and it will protect your precious memories without you having to think about it.
2. Do you have the discs to reinstall all your software? Take all those discs that came with your computer and throw them in a bag for safe keeping. If you buy physical software, add the discs to that bag. If you buy software on the Internet, save a copy of it somewhere (not on your computer) to be reused later. Don’t forget to keep all the product keys with the discs too. If you’ve lost the product keys to Windows or Office, check out Magic Jelly Bean (or this open source version). It’s a nifty tool that helped me out recently.

They want to know these answers because the best way to remove a virus is to wipe the computer and start over. The time it takes to do that will almost certainly be less than the time it takes to try to surgically remove the virus. And when it’s all over, wiping the computer is the only way to make sure the virus is really gone.

Part 1 covered attacks through your browser. Part is is about attacks via email. We just had a mandatory training for all employees at work because somebody had this happen to them on a work machine and it created a ton of trouble. You really have to be on the lookout.

The first rule is to never click any link that you get in an email. If you always follow that rule, you are extremely unlikely to have any problems.

Ok, we both know that rule will be broken. So what should you think about before clicking on a link in an email?

1. Assume it’s a scam, a virus, or both.
2. Are you expecting to receive a link from the sender? Did your buddy call up and say “hey I have this hilarious YouTube video, I’ll send you a link”? If so then you’re probably good to go.
3. Does it look like something the sender would normally send you? Did your relative who normally writes you long text-only emails suddenly send you an email that only has a single link in it? Just leave it alone. Wait until you know that it’s something they really sent you before you click it.
4. Is some entity like PayPal or your bank telling you that you need to view something on their website? I NEVER click links like this even if I’m completely convinced they are fake. The penalties for being wrong are too great. If my bank says I have an important message about my account security or PayPal says I need to adjust my account settings, I don’t click on the link. Instead, I open up a browser and manually type in the address for my bank. If it’s a legit message, it will also show up somewhere in my account on their site. This is an important guideline to follow with phone calls too. If I ever get someone asking for any personal information, red flags go off. For example, when my credit card company called and said my card had been stolen, they started asking for my social security number, etc to verify some things. I politely asked for the caller’s name and extension, hung up, called the number on the back of my credit card and got back to talking to that same person. That convinced me he was legit and I continued. It’s too easy to scam people this way! I’ve caught people in the act like this too. Just the other day I had someone calling to collect money for the “King County Police” (which is an imaginary org) so I asked for his name and badge number so I could call him back to verify he was legit. It was a scam and it was funny to hear him squirm. (I later reported it to the sheriff’s office though it probably doesn’t do much good.)

When in doubt, don’t open a link. If you have to open a link, assume it’s a scam or virus and don’t open the link. If you REALLY have to open the link, see if you can get to that site without clicking on the link. And if you REALLY REALLY have to click the link, make sure that the sender actually intended to send it to you.

Only the paranoid survive. Everyone else gets a virus.

A laptop recently landed on my desk full of some lovely viruses. I won’t say who it was, but really, you shouldn’t be too embarrassed. These virus writers are good at what they do and it’s easy to be tricked. As I fixed up the laptop, I thought about a short series of blog posts that might be of interest to many of you readers, not just the household that got hacked. I’ll cover how virus writers try to get you through your browser, how they attack via email, and then what to do after you suspect you’ve been hacked.

The most common viruses get onto your machine because you clicked something. It’s pretty difficult to have a computer sitting idle with no human in front of it and get a virus. We are the weakest link. So when hackers try to attack you via websites, they’re going to present you with something that is out of the ordinary, but just plausible enough that you’ll click on it. These popups might seem fairly legit. Here’s an example:

A geek will look at this and know it’s fake, but to the general populace, this seems like something serious that should be fixed by clicking Accept and Install. How can you tell it’s fake? That’s tricky but some basic ways are that this installation box is inside of a browser window. That’s your first red flag. What video player is it trying to update? If it’s going to install something, it should be pretty specific. If you have questions you could take that product name and search for it.

But really the best way to defend against this type of thing is to know the legitimate ways you’ll be warned about this type of thing and then be incredibly suspicious of anything that tells you to install something or “click here to fix your computer.” These days, nearly everything that is needed to fix your computer happens automatically in the background via Windows Update. You might see some notifications from Microsoft Security Essentials when you haven’t run a scan in a while but that’s about it.

You should also have Windows User Account Control enabled. Whenever a program tries to install on your machine or access protected areas of the operating system, it will pop up a warning dialog that asks if you’re sure you know what’s going on. Unfortunately if you believed something like the image above then this probably won’t stop you, but it’s a good backstop to really think about what you’re doing.

So if you get a popup that says you have a virus or that is asking you to install something unexpected, just stop. It’s probably a lie, but just in case it’s legitimate and Microsoft Security Essentials is trying to save you, snap a photo with your phone and email it to your favorite geek. Ask them if it’s legit and what you should click. You might save yourself a lot of trouble.