The University of Massachusetts Amherst
Categories
Security Virus/Malware

Cyber Security Awareness: What is Malware?

What is Malware?

Malware is any type of malicious software that can infect your computer and slow performance, monitor usage, steal sensitive information, or gain access to privileged areas on your computer.  These can be harmful to your computer and your files. This post will discuss the different types of malware, how to tell if your computer is infected, prevention, and removal. For more detailed information about computer security resources, check out the IT Help Services Security Center online or stop into the IT Help Center for a free Security Check-up.

Categories
Operating System Security Software Virus/Malware

Virus Prevention

As a general rule of thumb, there are some things that are good to do to keep your computer running its best.

  1. Keep everything up to date!
  2. Don’t click links you’re unsure about.
  3. Don’t visit questionable websites.
  4. Run an anti-virus program.
  5. Scan with an anti-virus program and an anti-spyware program at least once a month.

Keeping programs up to date is one of the easiest ways to prevent a Virus or Spyware infection. Windows XP, Vista, and Mac OS X will all prompt you to install updates if you have it configured to do so. It is configured as such by default.

As for updating all the other programs installed, we use a program called Secunia PSI. It scans your computer for all the programs installed that it has in its database. It then checks it against the current versions of those programs and provides you with links to where to download updates. You can download it here. It’s an amazing tool to know what to update.

As a general rule, you should keep your Operating System (XP, Vista, OSX) as well as Java and Adobe Flash Player up to date. Those are the most common ways viruses and spyware can gain access to your computer.

As a rule of thumb, don’t click on links to suspicious websites. In many programs, you can mouse over the link to see the HTTP address. Just remember to air on the side of caution.

Don’t go to suspicious sites.  If you’re not sure about the site, try searching Google for it.  If a lot of hits come up like “Spyware, removal of spyware, virus related” etc, don’t go to that site.  Also, if you had gotten a virus in the past from a questionable website, don’t go to that website again.

Run an anti-virus program.  This should be really easy for people affiliated with UMass.  UMass has a site license for McAfee Enterprise Virus Scan.  You can get it on the OIT website here.  If you have an older version of McAfee Enterprise Virus Scan installed, uninstall it first.  It might cause weird errors to occur if installing just over the older version.  Also, if you have any other anti-virus programs installed, you should only have one installed.  You shouldn’t have more that one anti-virus program installed, as they tend to fight each other and slow everything down.  Uninstall all but one anti-virus program.

The last way to protect yourself is to run full scans with your anti-virus and anti-spyware software once per month, whether you think you need it or not.  Think of it like an oil change for your car.  It cleans out all the sludge that may build up, whether you see it or not.  If you have the version of McAfee Enterprise Virus Scan distributed from the OIT site mentioned above, McAfee will update itself every day, and run a full scan in the background once a week.  You should also run a full scan once a month with your anti-spyware software of your choice.  We use Spybot Search and Destroy, which can be found here.

Categories
Hotfix Operating System Security Software Virus/Malware

“Conficker Worm Could Create World’s Biggest Botnet”

I saw this article on Slashdot today and wanted to warn everyone out there. Nine million infected computers running Microsoft systems is an incredible amount of machines compromised.

Make sure your McAfee Enterprise is up to date and your Windows machine has installed all the latest updates!

As the article states, the worm propagates through un-patched Windows systems and through USB thumb-drives. This means that having a secure system or up-to-date virus protection is NOT ENOUGH! You need a combination of both. This is good computer usage in practice anyway, but we see an incredible amount of un-patched XP and Vista systems come in with virus infections.

What you see when an infected USB-drive is plugged-in
What you see when an infected USB-drive is plugged-in
The above image shows what happens when you plug-in an infected USB-stick into a machine. Notice the “Publisher not Specified,” text in gray under the open option? That should be your first clue right there. Do NOT click on this, as this will launch the virus and infect your computer.

It’s just that little yellow icon in your system tray, that little place with icons by the time in the bottom left. Click – Express Install – Done. It’s really that simple.

For those that are interested, the Microsoft Security Bulletin can be read here.

Categories
Operating System Virus/Malware Windows

How to delete the Windows Antivirus virus

If you have seen this screen then you know what virus I am referring to.

Here in Software Support, we use a program called ComboFix that you can download yourself by clicking here. This software will clean up most instances of this known type of virus called “Smitfraud,” and will generally leave your system much more operable than before. Recently, the number of outbreaks of this virus and ones like it have become staggering.

This software changes daily and must be downloaded every time it is run! The best way to do this is to download it on a computer that is clean and copy it over onto a USB pen drive.

Usually at Software Support there is a lull in the middle of the semester, but last fall the amount of traffic into SWS was something that I have never seen in my four years of working here.

If you feel that your computer is not running correctly, or if you think that the error messages that are popping up are not from your normally installed anti-virus or anti-spyware software, this should be your first step in alleviating the problem.

Of course, if you are having issues running the software or are not comfortable doing this, you can bring the computer in and we will run it for you.

Categories
Virus/Malware

AIM Viruses

Many users are curious as to how their systems are infected with viruses. While there are many different ways that this can happen, one common method is via something called an AIM virus. Sent as messages over AIM or other instant messaging clients (e.g. MSN Messenger, AIM, GTalk), users receive an instant message saying something like, “Check out these pictures of you I found on Facebook (Myspace, Flickr, etc.)” When a user clicks on the link, their computer is infected with a virus which subsequently sends similar messages to all the buddies on their contact list. Currently, only Windows users are affected by AIM viruses, but all users should be wary of links that they receive.

It is important to double check with friends who send you links over AIM. You can always send a message back saying, “Hey! Did you just send me a link about pictures on Facebook? I know that viruses can look like links from people on my buddy list.” If you are unsure, it’s best to discard the link.

Getting an AIM virus can slow down your computer dramatically. Additionally, if OIT detects that your computer is trying to infect others, you may lose your Internet connection until the virus is removed. Depending on the virus that infects your computer, it is possible to get other infections.

To remove an AIM virus, you can try a fantastic little program called AIMFix, a tool developed by Jay Loden. However, in some cases, the infection may have advanced to such a point where AIMFix will not be able to remove all the viruses. Members of the UMass community can download and install McAfee Virusscan Enterprise for free from the OIT website. Just make sure that you uninstall any other antivirus programs that you have (e.g. Norton Internet Security, McAfee Security Center, AVG, Trend Micro); multiple antivirus programs can conflict and slow down your computer. If this doesn’t help or you have other questions, you can always call OIT for more assistance.