Get documents about "virus - Get as PDF
Document Sample
Hornet Guide: Dealing with Viruses
5 Security Steps
You are probably reading this because your computer has disconnected from the network after it • Operating System
was detected as being infected with a virus. Updates
• Antivirus Protection
• Protective Firewall
• System Password
There are a lot of nasty viruses and worms out there, and the only way to protect your computer • Safe Computing
and keep your personal details and financial information (bank details and credit card numbers)
safe is to follow our recommendations. As there’s a good chance you’re reading this because you
have been infected and disconnected, please read carefully the following instructions if you want
to be reconnected as soon as possible.
What Is A Virus Disconnection?
This is when you are disconnected because your machine is infected with a virus. You may argue
you have a virus checker and there is no possible way you can or could have been infected, but is
your virus checker up to date and do you know how good your virus checker is?
There are several different types of viruses, and separating these into different categories isn’t that
easy because they all have different characteristics. Viruses in general may infect several files at a
time but others may just lay in wait on your machine until triggered. Networks are prone to virus
attacks and it’s often the case when one user is infected, several others are too if they don’t have
adequate protection.
If your computer is infected it is a threat and will be disconnected. Computers have been infected
within twenty seconds of being connected!
Virus Overview
Each year the Hornet Administration has to disconnect hundreds of users within Halls of Residence.
Virus infection is the most common reason for disconnection. Being disconnected is inconvenient
and can be avoided by taking appropriate steps to make sure that your computer is secure.
If your computer isn’t secure then there’s a good chance you won’t be connected on the network for
long – computers that are a threat to others aren’t tolerated and will be disconnected. To get back
on the network you may have to pay a reconnection fee, so to make sure that doesn’t happen to
you, ensure that you have followed our five step security plan.
If you have been disconnected you will be sent an e-mail. Check the email account you registered
for use with Hornet for a message. You will only get this message if you have correctly registered
your e-mail address. Your account status on the Hornet portal website will also show as
disconnected, whilst the e-mail sent to you may contain more information about the virus.
If you have been disconnected for a virus you will need to install up to date virus software to
scan for viruses. It is essential that you have the latest definitions, because viruses mutate and
may not be recognised by slightly out of date scanning software.
Simply having the latest definitions will not detect viruses unless you run a full system scan.
Schedule this to run on a regular basis.
Once you have eliminated the virus you also need to make sure your computer is patched with
the latest security updates for your operating system. Failure to follow these instructions will
inevitably lead to you being disconnected again.
www.manchester.ac.uk/halls/internet
1
Hornet Guide: Dealing with Viruses
Not all anti-virus software is the same. Freely available software packages rarely lack the
functionality or power of subscription services. Whilst freely available packages provide quick fixes
more comprehensive and long term security is something that you often have to buy.
Virus Removal, Upgrades and Repairs
Through our partnership with MicroDirect, Hornet is able to offer exclusive access to the eStore. The
eStore repair centre offers a range of services for Hornet users, including: Virus Removal, PC
Upgrades, Repairs and File Backup. Prices start from as little as £20, and our specialist technical
team will always try and resolve any problems you may be experiencing. For more information
please visit the website.
http://hornet.microdirect.co.uk
If you need help to remove a virus you need to read below
Once you have removed a virus and need reconnecting you need to log a problem and choose the ‘I
have removed the virus. Please reconnect me’ option. You will be sent an e-mail once you have been
reconnected.
In most cases once you have followed the instructions you will be reconnected, if however you have
repeatedly failed to secure your computer you may also be required to pay a reconnection fee. This
payment can be made at your Hall Office.
Antivirus Assisted Removal Method
If you want to try and tackle the problem yourself, the first thing to try is using some Antivirus
Software to assist you. Once you have an antivirus package installed start by turning of System
Restore.
Windows ME and Windows XP both come with a feature known as System Restore that enables
users to revert to specific restore points without impacting data files. The problem with this is virus
infected files maybe saved to these restore points making them unreachable by the antivirus
software.
Right-click My Computer, and then click Properties.
Click the System Restore tab.
Check the "Turn off System Restore" or "Turn off System Restore on all drives" check box.
Click Apply.
As noted in the message, this will delete all existing restore points. Click Yes.
Click OK.
If you are not able to detect or remove the virus we advise you to use the services provided by
external third part computer shops.
Such establishments offer a wide range of services for the purchase of computer hardware,
software and accessories and includes a virus removal and operating system patching service.
www.manchester.ac.uk/halls/internet
2
Hornet Guide: Dealing with Viruses
Once you have identified the virus you will then need to remove it. The maintenance of your
computers hardware and software is your responsibility, so you need to educate yourself about
computer security. The Symantec security response site is a good site to find information about
specific viruses and find virus removal tools. This site can be found here:
http://securityresponse.symantec.com/
Note: Only have one anti-virus, one firewall and one spyware checker installed at any one time.
Having two or more of each of these different types of security systems installed at any one time
may result in false or inadequate scan results.
There is a list of software and links to virus checkers on the hornet web site.
Some viruses will be removed using McAfee’s AVERT Stinger (http://vil.nai.com/vil/stinger/). This
program is easy to use and checks for a limited set of common viruses. It’s always a good idea to run
this program again after you think you have cleared an infection to check it’s been removed. Stinger
does not remove all viruses only certain ones and will not remove Trojan infections.
The University of Manchester has licensing agreements with both McAfee and SOPHOS so
members of The University of Manchester can get free copies of the full versions of antivirus
software offered by these two companies.
If you have been disconnected it maybe a good idea to find out if your virus checker is up-to-date. In
most cases users have virus checkers installed but they haven’t been updated for a long time. The
only way to find out if your virus checker is current is by opening it and looking for a virus definition
date. Virus definitions can be downloaded from the software producer’s site. The location on these
sites may vary depending on which antivirus software you have.
Once you have installed your virus checker it is recommended you backup all your important data
because the virus may have infected several files some of which maybe your documents/data. Scan
your machine and repair/delete all the files which are infected. Once you have performed a full
system scan, restart your computer and scan again.
Note: Some viruses will stop your virus scanner from operating. In this case you will need to
install an antivirus application form another manufacturer or seek professional help.
No Virus Found?
Some viruses are designed to elude antivirus software scanners. If no virus has been found on your
machine, but you have been disconnected because of a virus, then the virus checker you are using
cannot detect the problem. If this is the case you need to uninstall the virus checker and install
another before doing another full system scan. If you still fail to identify a virus please submit a
problem and mention the antivirus software you are using or have tried and that you cannot find a
virus.
The Virus Keeps Coming Back?
If the virus you keep on deleting keeps coming back something is wrong. Check to see if you have
disabled system restore. If it is disabled it maybe worth restarting your computer and going into
safe mode before performing a scan. You are more likely to find and successfully remove viruses in
safe mode because Windows only loads up necessary programs to start your machine.
www.manchester.ac.uk/halls/internet
3
Hornet Guide: Dealing with Viruses
Entering Safe Mode
Windows 95 • Once in safe mode scan your machine
with the antivirus program
• Restart the computer.
• Just after the POST diagnostics and Windows XP
memory count, start pressing the F8 key
• On the Startup Menu, choose Safe Mode If Windows XP is the only operating system
installed on your computer, booting into Safe
Windows 98/Me Mode with these instructions.
• Restart the computer and just after the • If the computer is running, shut down
POST diagnostics and memory count, Windows, and then turn off the power
start pressing the F8 key • Wait 30 seconds, and then turn the
• On the Startup Menu, choose Safe Mode computer on.
• Start tapping the F8 key. The Windows
Windows 2000 Advanced Options Menu appears. If you
begin tapping the F8 key too soon, some
• If the computer is running, shut down computers display a "keyboard error"
Windows, and then turn off the power message. To resolve this, restart the
• Wait 30 seconds, and then turn the computer and try again.
computer on. • Ensure that the Safe mode option is
• When you see the black-and-white selected.
Starting Windows bar at the bottom of • Press Enter. The computer then begins to
the screen, start tapping the F8 key. The start in Safe mode.
Windows 2000 Advanced Options Menu • Once in safe mode scan your machine
appears. with the antivirus program
• Ensure that the Safe mode option is
selected. In most cases, it is the first item More information on using safe mode can be
in the list and is selected by default. found here:
• Press Enter. The computer then begins to http://www.pchell.com/support/safemode.shtml
start in Safe mode.
www.manchester.ac.uk/halls/internet
4
Hornet Guide: Dealing with Viruses
Manual Removal Method
In order to be reconnected, you will need to:
Backup all your personal data
Format your hard drive and reinstall Windows
Upgrade your Windows to Service Pack 2 (provided on the Hornet CD)
Install, update and run an antivirus
Let us know when it's done by reporting it via the Terminal
As you have been disconnected you cannot access the necessary useful security websites from your
room. Nevertheless, you can download the necessary files from other computer cluster facilities in
your academic institution, such as the Manchester Computing Centre or Barnes Wallis Building,
where CD writers are available. The Halls of Residence Network (Hornet) Support Team cannot be
held responsible for any data loss that might occur. If you are concerned, seek professional help
from the Hornet MicroDirect Store (http://hornet.microdirect.co.uk).
Backup all your personal data
Your personal data is at risk. Before you do anything else, please make sure that you have a copy of
anything you want to keep, either on a memory stick (USB pen drive), CD, DVD or other reliable
media. Ask a friend to help you the first time, if you don't know how to do this. It will be useful for
the rest of your life.
Format your hard drive and reinstall Windows
The University of Manchester monitors all Hornet traffic and knows when you have been infected
because your computer behaves differently to normal. You could spend days and days trying to get
rid of this virus and unfortunately the new generation of viruses, trojans and worms are so smart
that they become extremely hard to detect locally. As a consequence, the easiest and quickest way
to make sure that your computer is clean is to format your hard drive and reinstall Windows. You
can do that from the Windows CD. Insert it, reboot your computer and follow the simple steps to
format and reinstall a clean Operating System.
Upgrade Windows XP to Service Pack 2
Microsoft releases many patches to plug security holes. A critical security update for Windows XP is
Service Pack 2 (SP2). If you are using another Operating System, please refer to the appropriate web
site to download the last Security Updates.
Install, update and run an antivirus package
You will need to install an antivirus and keep it up-to-date in the future, i.e. update it automatically
every day.
Let us know when it's done
Contact the Hornet Support Team using one of the Hornet terminals or directly from the Hornet
Portal using any computer with a working Internet connection
www.manchester.ac.uk/halls/internet/portal
www.manchester.ac.uk/halls/internet
5
Hornet Guide: Dealing with Viruses
Report the following problem “Virus Removed, Please reconnect me”, and explain to us what you
did in the comment section. A Hornet Rep may contact you to check that you followed the
instructions.
Please Note
IT IS YOUR RESPONSIBILITY TO ENSURE YOUR COMPUTER IS VIRUS-FREE.
Part of your educational learning experience at University is increasingly driven by a need to be IT
literate and aware. Residents need to make sure they are educated and knowledgeable in this field,
and employers are increasingly looking for people with this skill set. If you’re not an expert it’s in
your interests to develop your computing knowledge.
Increase Your Protection
By using a firewall you can prevent many attacks on your computer and virus infections. A firewall
is a protective boundary that monitors and restricts information that travels between your
computer and a network or the Internet. This provides a line of defence against programs or
persons trying to access your computer without your permission. Please refer to the hornet website
for more information.
Note: Installing Windows XP Service Pack 2 updates the Windows XP firewall and activates it if no
other firewall software is installed. You do not have to use Windows Firewall - you can install and
run any firewall that you choose. Evaluate the features of other firewalls and then decide which
firewall best meets your needs. If you choose to install and run another firewall, turn off Windows
Firewall. Running more than one firewall can actually be counter-effective or prohibit you from
accessing the internet at all.
Installing service packs and updates for your operating system will always increase your protection
from not only bugs but from people/software exploiting these bugs. Service packs and information
on this can be found on the Hornet web site.
Infected Again?
The virus disconnection procedure is as follows. This statement is designed to clarify the current
situation over users who have been disconnected for viruses three times and who need to pay the
£35 fee to be reconnected. If your computer is clean and correctly secured you should not be
infected again.
Virus Disconnection Fees
After paying the £35 fee, if you have not been infected for a 4 week period then the disconnection counter
is reset. After four weeks without a virus disconnection you will not have to pay the reconnection fee
again until you have been disconnected three more times.
After paying the £35 fee, if you are disconnected again within a 4 week period then you will be charged the
reconnection fee again for each subsequent reconnection until your computer remains virus free for 4
weeks.
www.manchester.ac.uk/halls/internet
6
