Dec 16, 2014 09:06 PM
(This post was last modified: Jan 18, 2015 04:11 PM by -Hyperion.)
![[Image: 2xNRisW.png]](https://i.imgur.com/2xNRisW.png/)
I have to decided to write this quick guide since there seems to be a lot of confusion over what an actual infection is verses windows messing up. There is also a panic that sets in that needs to be addressed on what you do when actually infected.
If asking for help follow all instructions! You are not clean just because a few scans said so! Please wait for the ok from an expert and read everything carefully!!!
Am I infected?
I could write out a long list on symptoms of infection but Kaspersky has already worded it perfectly which I will share with you.
Unexpected Crashes: If you’ve ever experienced this, you probably already know the hard way that your system crashing or regularly switching to the terrifying blue screen of death is a major red flag that something is very wrong. If it’s happening to you now, immediately scan your system for infections.
Slow System: If you you’re not running any resource-heavy applications on your system but it’s running slowly anyway, it may be because your system is infected with a virus.
Excessive Hard Drive Activity: Similarly, if you notice a lot of hard drive activity even when your computer is idle, this is a warning sign of a potential infection.
Strange Windows: If strange windows pop up during the booting process, particularly those that warn you of lost access to various drives on your system, something is wrong.
Peculiar Messages: If those troubling dialogue boxes crop up when your system is running alerting you that various programs or files won’t open, this is also a bad sign.
Bad Program Activity: If your programs go missing, are corrupted, or start to open themselves without your initiation, and/or if you receive notification that a program is attempting to access the Internet without your command, this is a serious warning sign that you are the victim of malware. If you receive notification that a program is attempting to access the Internet without your command, this is a serious warning sign that you are the victim of malware.
Random Network Activity: If your router is constantly blinking indicating a high level of network activity when you aren’t running any significant programs or accessing high amounts of Internet data, something might be wrong.
Erratic Email: If your emails aren’t sent, or you hear from your contacts that they’re getting strange emails from you that you did not send yourself, this is a strong indication that your system has been compromised (or that your email password has been stolen).
Blacklisted IP Address: If you receive notification that your IP address has been blacklisted, consider this about as sure a sign as any that your PC is not in good hands — there’s a very good chance it means your system has been compromised and is being used as one tentacle in far-reaching, spam-sending botnet. I would like to add on to this with blocked websites and having websites redirected to other sites. This can be a sign that the host files have been edited or that a browser hijacker is present.
Unexpected Antivirus Disabling: Many malware programs are designed to disable the antivirus suites that would otherwise eradicate them, so if your antivirus system is suddenly not operating this could be a sign of a much larger problem.
Source
You may also wonder what I am infected with or just what do these terms mean? You can read/learn more about the various malware/virus types and variants on VeraCode's website.
The only real way to be sure is to get an in-deep check-up (and by that, I do not mean run to run Malwarebytes and Avira then call it good/clean if nothing is being returned, or even if something is being returned) by an expert/professional of the malware removal field.
I am infected, now what?
So if you believe that you are indeed infected, what should you do ?
You should start by following these steps, in order:
- Shut down your computer until you are ready to remove the infection (or at least, receive assistance to get it removed);
- Get on a clean and secure computer, gather the necessary tools/programs and ask for help/assistance;
- Change the passwords of all your accounts;
- Enable 2FA (Two-Factor Authentication) where it's available (most major websites and services like games, online payments, emails, etc. supports 2FA. For more information about it you can always look up on their website for the right procedure to follow or go to your account Security settings);
Click here to read more about 2FA and find a lists of sites that support it.
- Be prepared to check other computers/laptops on your network (in case you get infected with a spreading-type virus, such as a worm;
- Always be ready to back-up your data (securely) and reinstall Windows. Sometimes, malware/virus cannot be removed and the only way to get rid of them is to do a clean formatting and re-partitioning of your hard drive and reinstalling Windows, sadly;
[BHCPU] Program/Software advices and recommendations Help Desk by Aurа
Then, you'll most likely get redirected to my tutorial/guide for generic malware removal, here:
[BHCPU] Brotherhood Academy - Lesson 3: Removing Malware by -Hyperion
How can I get assistance here?
There are lots of ways to get assistance on here and other reputed websites (mainly forums).
Some tips include:
- Only follow directions/instructions from one person (multiple instructions may cause issues and make the clean-up procedure more lengthy)
- Follow all instructions to the letter, do not cut any corners thinking it well save time and if you're not sure about an instruction, don't be afraid to ask to the person that is helping you to be more clear;
- Save every logs you're getting from the scans you're running, then copy/paste them on either Pastebin or PrivatePaste and post them in your thread. You have no idea how many intel this gives to the person assisting you, so please do it;
Even with an expert looking at it there, depending of what malware you are infected with (we're talking about risky ones here, like polymorphic viruses, not adwares, spywares, some backdoor trojans, etc.), there's no way to be 100% sure that your system is indeed clean. However, if you are being helped by a reliable and professional helper, yes, you can be sure of it ONCE, and only ONE he declares you clean. After a clean up it is highly recommended that you get a reputable Antivirus product installed, but also patch your security where it's failing (firewall, Antimalware, browser extensions, etc). I also recommend scanning with an Antimalware, such as Malwarebytes, once a week.
Once a month you can also run Tron
You may also need to fix any residual problems caused. by an infections such as browser setting and registry problems. If this is the case, you are totally free to update your thread with these issues, and the member who assisted you will help you fix them.
Also, I suggest you to take a look at Aura's thread below to make sure to know what to do when requesting assistance here, and also, how to receive assistance properly:
[Read] What you need to know when receiving assistance in the White Hat Help section by Aurа
Feel free to shoot me or Aura any questions that you may have.
Thank you and have a good day.
Thread formatting and editing done by Aurа
![[Image: T2TtNNn.png]](https://i.imgur.com/T2TtNNn.png)
