Massive Malware

Massive Malware: a reader asks…

I have a 6+ year old Dell laptop that is running very slowly and weird things are happening. I have Avast free antivirus on it for protection, and my Windows 7 has all the available updates. What should I do?

Ok, the first thing you should do is recognize that computer viruses are very much old news in the world of threats to your digital life these days. Hackers who develop attacks are hard at work dreaming up new ways to compromise your security, and expect that folks will have some sort of antivirus program on a Windows PC. Even the free ones like Avast do a fairly decent job of keeping computer viruses, worms and trojans at bay. But they do nothing about the much larger and more prevalent problems we are encountering at this point in time. Malware has become big business and is a much larger threat against your digital life security these days.

Those problems you are experiencing could simply be a factor of a computer that’s well past it’s intended service life. Six years for a Windows PC is a long time, and your computer’s hard drive may be failing. That could cause Windows to hiccup a lot, and slow everything way down. But just as likely (if not more so), your computer is suffering from malware infections.

These infections are, generally speaking, blended threats which combine two or more types of attack mechanisms. And they make use of malware, spyware, adware, fake programs, social engineering, and scare tactics to infect your computer. If you’ve ever visited a website, downloaded and installed a free program from the internet, opened an email (or even worse, an email’s file attachment), or responded to spam, the chances are good you’ve been infected. Since your computer has no protection against these types of threats, I’d say it’s a foregone conclusion. So you’re asking me what you should do? Here’s my prescription:

First, you need to clean up your laptop.

1. Go to www.malwarebytes.org and download Malwarebytes Antimalware. The free version is fine for now. Install it, update it and scan your system. Hint: go into the settings and add the “Scan for rootkits” option before starting the scan. The scan might take hours to run, and when it’s finally done you will be presented with a list of malware along with “Potentially Unwanted Programs”. Don’t bother to cherry-pick the list, have Malwarebytes remove all of it. Then restart your computer, and run another scan. If the second scan doesn’t find anything, you’re good to proceed. If it does, remove everything restart, and repeat. Your goal is to get a scan that says it didn’t find anything.
2. Go to an online computer security scanning service and scan your computer for problems. It doesn’t hurt to use more than one,  (just not at the same time). Try http://www.bitdefender.com/scanner/online/free.html, http://housecall.trendmicro.com/, http://www.pandasecurity.com/romania/support/tools_homeusers.htm and http://www.eset.com/us/online-scanner/.
3. Go to your Control Panel’s Programs and Features window. Go down this list of installed programs and be brutal about uninstalling programs you don’t really need or use. In particular, you should uninstall most programs you downloaded from the internet Also uninstall any so-called system optimizer programs, and any toolbar programs or add-ins.
4. Go to your web browser‘s settings page and remove any extra search engines that you don’t need, any add-ins or extensions that you don’t recognize and need, and consider resetting the browser (back to default settings). The procedure is different for each brand of browser (IE, Chrome, Firefox, Opera, Safari, etc.) if you need help, leave a comment below telling me which browser you’re using and I’ll give you more explicit instructions. If you’re using a browser other than IE, also check and make sure you’re using the latest version of that web browser (go to the Help > About screen to check).
5. Here’s the painful part: go change all your passwords – email, website, online banking & credit card, social networking – everything. You really need a password manager so you can give each entity a unique and strong password without you having to remember them all. I recommend www.lastpass.com, which is free for just your computer (or $12/year if you want it on your smartphone as well as all computers & tablets).

So why such drastic action? Your computer is most likely riddled with malware, and likely a lot of your personal data and online activity has been delivered to hackers for future nefarious use. I’ve seen computers where the initial Malwarebytes scan identifies over 2,000 instances of malware. You see, malware is crafted to replicate itself and drop copies all over your hard drive, including in hidden folders and other out-of-the-way places. This malware is also doing a great job of harvesting everything it can from you and your hard drive. That includes websites you visit (and login credentials), your address book, your emails (sent and received), your social networking activity (and login credentials), and more. This is actually a form of ‘digital rape’ and it’s both disgusting and shocking.

Yes, your computer might not be as compromised as I’m assuming, but in this day and age, you can’t know whether you’ve been compromised or not until unexplained things start happening. Such as identity theft, ruining your credit rating, folks telling you that you’ve been sending spam or posting wild things on social media sites, etc.

Second, you need to take steps to better protect yourself. Here’s my short list:

1. Pay your $25/year for Malwarebytes Anti-Malware Premium to provide full-time protection (and this doesn’t conflict with your antivirus).
2. Consider upgrading from that free antivirus to something more robust, such as my recommended Bitdefender Internet Security ($60/year or less, look for it on sale).
3. Also get yourself the best anti-exploit protection available, which is Malwarebytes Anti-Exploit Premium (also $25/year).
4. And pop for the $12/year for LastPass Premium (if you have a smartphone) so you can manage strong and unique passwords on all your online accounts.

So all of the above will run you $122 (or less) per year. Sounds like a lot huh? Well it’s a drop in the bucket if your computer becomes unusable, or worse if your identity, credit rating, and online accounts are compromised. And don’t think that just replacing your aging computer with a new one will negate the need for this protection, even though Windows 10 comes with basic antivirus and firewall support, it’s really not nearly good enough for protecting yourself against today’s hackers.

Lastly (and sorry for being blunt), you need to get more savvy about your use of your computer: practice safe computing (here’s a handy guide), and start looking at your computer not as a long-term investment, but as a consumable. In general, I’ve found that Microsoft Windows PCs generally last on average 3-4 years before they start giving you trouble. Repair costs in the US being what they are, it’s usually a better value to replace that computer rather than fix it. Of course, this is couched in terms of the lower-cost computers, many high-end Ultrabooks and the newest Windows laptops (generally going for well over $1,000) might last you longer, particularly at this point in time. For the pricier Apple Macbooks, you can look to an average service life of 6-8 years. But if you’re looking to save money up-front, a cheaper Windows computer will not likely be any better of an investment than your current computer.

Ed. Note: a followup with this reader revealed that their computer had over 800 instances of malware that were drastically affecting the operation. Cleaning the computer up made a huge difference in the computer’s usability. But it’s still a six-year-old computer and so the reader is now shopping for a replacement.