Instant viruses

By Ron Nutter
Network World Fusion, 11/20/00

This is not necessarily a network question, but it does have to do with America Online.

I believe that I received a virus of some sort from something downloaded while on America Online. I'm not sure what the name of it is, but I know that it is a password stealer.

When you sign on to AOL, the correct password is said to be invalid. Then, you retype the same password in, and it lets you on. But, as soon as it loads, the screen turns gray. Then, the computer freezes, and you have no choice but to just turn the computer off and turn it back on. Another thing, my computer won't shut down if I try to shut it down from the Start menu.

I also figured out that my win.ini file is messed up. I was hoping that you could help me answer some of these questions. Basically what I want to know is, how can I get rid of this virus?

Leah

The first thing that I need to tell you is to be prepared to lose everything and start over from scratch. At any time during the virus cleaning process, you may have a machine that won't boot anymore from the hard drive.

The first thing we need to do is to make sure you don't have some type of a boot sector virus. Since you mention win.ini, I will assume that you are using Windows 3.1/95/98. To make sure we can catch any boot sector viruses correctly, you will need to prepare a DOS boot diskette that will get us access to the hard drive. Next, get a virus scanner that will work from DOS. I have used several different anti-virus programs over the past several years and my favorite as of late has been McAfee Anti-virus from Network Associates.

Before I start getting flooded with e-mail, there are several very good anti-virus programs available to use, McAfee happens to be the one that my company uses and it has solved more than one problem I have had that other anti-virus packages haven't found.

Also Network Associates support is very good and well worth the price. Once you have downloaded an anti-virus scanner that will work from DOS, install it on your computer and make sure that you have the latest anti-virus signature files applied.

Once you have cured or removed any viruses that you have found at this level, download the Windows version of the anti-virus scanner that you were using at the DOS level. Start Windows but not any of the applications that you normally use, install the Windows anti-virus software and the latest signature files. Begin the scanning process and see what can be cured and make a list of the files that can't be cured. If the files that can't be cured are Microsoft-supplied files, you will probably be able to recopy those from CD.

Once you have finished running your anti-virus software, you should have a machine that is virus-free. I would strongly recommend that you get at least one good backup, if not two. Leave the anti-virus software installed and running as you test the applications you have installed on the machine. You may find that you have to uninstall and reinstall applications that were damaged as a part of the virus infection.

In addition to an anti-virus program for your computer, you may want to consider some type of personal firewall. That's right, personal firewall. There are several available on the market by Norton Internet Security, Black Ice and others. Where some of the packages differ is the ability for you to control what goes out in addition to what goes in. This can become a real eye-opener where you will see some of your installed applications sending out information that you didn't know was leaving your computer.