NWA-PCUG Newsletter Article, May 2011
What a Nasty Virus Can Do To Your Computer
By Merle Nicholson, Secretary,
Tampa PCUG, Florida
November 2010 issue, Bits of Blue

http://www.tpcug.org
Merle (at) merlenicholson.com (click to email author)

I recently was asked to remove a virus from a friend/client’s notebook. For all intents and purposes, it rendered the computer completely in-operative. The virus was in a virus category of “Rogue antivirus software.” There are many of them out there for the unwary to catch, and this one, called “ThinkPoint,” even has the Windows flag on it to further fool you into thinking it is legitimate. The only option you can see is “Safe Startup,” and that takes you to a virus scanner and a way to purchase the product. If you close it out, it shows you a blank desktop, no icons, no menus. You can turn the machine off, that’s about it. Turn it back on, same situation. I did figure out a way to kill it through the Task Manager’s Run command, and then run the desktop. I also found some things written up on the Internet to do something similar, but no help in removing it. I did remove it using some very clever, obscure skills, several virus scanners, then finding and removing twenty or so copies of it. But the computer really didn’t work well enough to use. What I found surprised me, and this is what the article is about and what you can do.

Here’s a list of what I found. Some things are by deduction and may not be 100% accurate. But I am 100% certain that these problems existed. All of the things fit into a strategy that prevents you from fixing the computer.

1. The worst thing: The computer will not boot into safe mode. It blue screens every time. I’m speculating that ThinkPoint either corrupted an existing driver or put a new one in that loads and then fails. The way to fix this is to do a system repair or a complete reformat and installation. I did not want to impose that cost on my customer, and she agreed (it’s not a primary computer, and it’s rather old). So I left it that way.

2. All the system restore points were unusable. Refused to restore to any point.

3. To run most anything, an official-looking popup would ask to confirm the logon user and give a box for an alternative user account that did not work. This is to make sure that everything you try is run under the current user account which has been modified to prevent circumventing the virus. What you want to run is Explorer.exe giving you your desktop, and every effort is made to prevent you from doing this.

4. Most – perhaps all – items in Control panel will not run. It gave a warning that the administrator account has restricted its use. I did manage to get into the power configuration, but it would not accept any change. The computer would go into sleep mode after about 20 minutes, keeping me from running a full system scan from any antivirus software unless I sat there and wiggled the mouse occasionally for four hours.

5. The Internet articles say that even if you purchase the software to fix a bogus virus, ThinkPoint stays on the computer. The uninstall just errors out.

6. The Internet articles say that it installs other viruses, and I did find a half dozen other viruses, mostly downloaders.

7. It leaves about 20 copies of itself under various random names, and places items in the registry to run each of them. So removing the active virus is just the beginning. I also found a couple of viruses in the System Restore files.

8. It apparently makes changes to the current user account profile that look like group policy changes, even though this was Windows XP Home, which doesn’t have group policy capability.

9. Only after all the bad software is cleared from the machine can you then get rid of the modified account by creating a new administrative account, copying all of the user files from the old to the new – except for the profile files, then deleting the old account after locating the email files.

Isn’t this scary? It is to me, and I (95%) fixed this one with a lot of work. The idea of having to fix my own machine after something like this gives me nightmares.

What you can do to prevent this: A sizable number of virus infections now are rogue anti-virus’. There’s an understandable reason for this. It creates revenue. Old-fashioned viruses are malicious, but have no revenue-producing strategy. In other words, it’s now about money. Most all viruses are sent to you via web pages, and most of those are porn sites, either designed that way or hacked from outside. Porn sites are visited so often, they are a very good candidate for this kind of thing. Also, presumably the porn site owners don’t have the skill to remove sophisticated hacks. But most any web site is vulnerable. In any case, you must select something on the site – click on it – to give the browser a chance to violate security rules.

The next common way to get a virus is with downloads. And that means just about any download or file transfer. So you have to get any and all files from reputable sites like iTunes or Downloads.com, Amazon etc., which have the resources to check their own content.

But that leaves any and all file-sharing sites absolutely and definitely off the list. So if you’re downloading songs for free, you’re in trouble. Any file-sharing site’s software must be uninstalled from your computer.

And that also goes for any peer-to-peer gaming sites, LimeWire, Kazaa, and any and all IM programs that allow peer-to-peer file exchanges.

And while we’re at it, remove – uninstall – anything that says “Toolbar.” Right now. Want to know why toolbars are free? Because they’re a conduit for pushing advertising to you; and they’re easily exploited. Besides you don’t need them. They want you to believe you do, of course! But the browser itself and a couple of favorites will do anything a toolbar will do.

An alternative is giving up gaming and IM and to start purchasing songs. So if you have kids who will just die without peer-to-peer gaming or IM and stealing songs, the answer is to live with it with some intelligent prevention.

First, if at all possible, put the kids (and maybe grandpa) on a Windows 7 machine. If you have some internal networking and file sharing, Windows 7 Pro is better because it will back up to a network drive. But so will Acronis Home, or 2010 or 2011, running under Win 7 Home Premium.

Make sure you have a full system backup, and replace it monthly. Use Windows 7 Backup or Acronis. Believe me, restoring the entire system hard drive is way, way better than any alternative that I can think of. Look at what I had to do with ThinkPoint. Want to try it?

I guess it’s obvious, but a strong anti-virus program running on your machine is essential. BUT – this is important – make sure you look at the scheduling part of it and make sure it will automatically download new definitions and also run a full system scan at a time of day that the machine will most likely be turned on. Same for Windows Updates. Make certain that all important updates are installed as soon as they are available.

Password protect your main administrative account (this is the one that comes first with the computer) and bury the password paper in the back yard and leave the location with your attorney. Better yet, Win 7 allows you to create a flash drive that will unlock the computer. Hide it under some rubber fake dog poop someplace.

THEN: Create a non-administrative account for yourself – a regular non-privileged account, and a separate one – or one for each kid. A regular account cannot install software. But most importantly, SOFTWARE that is run under this account can’t install software. Ah HA!

Then one more step. Set the screensavers to require a sign-in on wake-up, and ALWAYS log off when you leave the computer. That’s especially essential when leaving the administrative account.

Skills: There are a few things that would be very helpful to learn. The big one is navigating the computer file system using Windows Explorer. Find out how your files are organized, and more importantly, how to change what files you can view. That’s in Windows Explorer, Tools, Folder Options, View tab. Second Important Skill – learn to use the Add, Remove Programs. That’s “Programs and Features” in Vista and Win 7. When you find an installed program that you are not using (say, anything with the word Apple or toolbar), just uninstall it, and see how it goes.

Click here to return to top



==================================================================