Cleaning up after Anti-Viruses

Cleaning up after Anti-Viruses

Nikhil Rastogi, Jun 01, 2008 1220 hrs IST

Anti-Virus programs do catch the culprits and remove them -- but what happens in the aftermath?

Effective strategies to stop viruses in their tracks

After viruses have done their dirty work, here's what you need to do to resolve the situation. The Anti-Virus which I've used in this example is avast! Anti-Virus 4.8 Home Edition. It is free and quite good. The latest full virus definitions of this Anti-Virus can be found here. Please note these virus definitions can only be used by avast! 4.8 version and not previous versions nor to update other Anti-Viruses.

1. First things first, in case of a virus attack, stop everything that you are doing and unplug from the Network. Network = Internet or LAN or both. When I say unplug actually physically yank the cable, don't just "disconnect" from the internet. Software (viruses are software) smart enough to taker over your computer could possibly emulate internet being OFF.

This will also ensure that you are trapping/sandboxing the virus in your computer only. Yes, it's still in your computer -- at least, don't help spread the infection. No USB flash disks, no external hard drives, no burning CD's or anything. These all help spread the infection. If you are worried about you data, just relax for now, you data is probably safe, don't try and back it up, which may lead the virus to transfer to the backup device which would eventually come back when you attach the device back into your computer.

2. Now is the time to do a virus scan. Run a full system scan, not just C:\ drive of you PC. Most Anti-Virus programs have that ability. If you any half-decent virus scanner, it would be periodically updating itself from the internet. If it hasn't then you may be in for some additional troubleshooting. You would need to manually download the full virus-def package from a different PC. If that's not an option, then just run the scan. Hopefully the scanner is updated enough to catch the virus. Otherwise you'll need to go online to download the updates hopefully through another computer as you don't want virus program phoning home from your computer itself. Mind you, manual updates of "Anti-Virus definitions" are sufficiently large, anywhere above 10MB close to 30MB. Incremental updates which are updated daily are only a few KB in size.

3. Stick around to see if the Anti-Virus asks you for action when the virus is caught. If it asks, put the infected files in the quarantine it's safer than deleting them. If you've an option, set to "Always quarantine the file".

Also it will help immensely to write down what the exact name of the virus is and which file it has infected and the entire path. This can be a great help later on when troubleshooting "After-Virus Blues".

4. Sometimes an Anti-Virus may say that it cannot quarantine or delete the infected file as "Access is denied". It's best at the time to stop the scan as it's clearly not doing the job and set a "boot time scan" which basically restarts your computer and starts the scan before Windows even starts. This is to ensure scanning is efficient and all programs including viruses don't work till Windows boots. Boot time scanning is a sure shot way of catching viruses as they have a tendency to sit in System Restore of Windows which Anti-Virus programs cannot scan within normal Windows operating state.

5. After scanning the computer, it should be free of infection hopefully. You can check the quarantined section of the Anti-Virus program to see which virus it is and some information about it. Be careful here as to not to accidentally "Restore" the file or cut/copy paste it somewhere else in the computer as this will be setting the virus loose again.

If you are lucky the virus did not install/corrupt any software or file on your computer. Most viruses today aren't made to destroy data on the computer (as older ones did which were probably made by pre-pubescent teens influenced by watching too many Giant Robot episodes). Nowadays, viruses are meant to snoop data. They want your personal info such as credit card numbers, passwords for banks using key loggers or simply your internet browsing habits for marketers which are commonly known as Spyware. As you can imagine this is much more beneficial than trying to wipe out data (which would probably land the virus writer an all time high with an inflated ego).