Have you ever worried that your computer has a virus or spyware (collectively called "malware")? We probably all go through that stage when we notice things running a bit slower or when we realize how often we buy things online. This is reasonable paranoia. But there are also more obvious reasons for suspecting that a computer is infected.
Symptoms of an infected computer
Tool options are hiddenClick
Start > Run, then type
REGEDIT. When you press
OK, Registry Editor should open if you have administrator access. If it does not, something is trying to prevent you from modifying registry settings. You can also open Windows Explorer (right-click
Start > Explore) and then
Tools > Folder Options. If you can’t find
Folder Options, malware might be hiding it.
Strange autostart entriesOnly experienced users should mess with the registry, but if you do manage to open it, you can navigate to the Run key (HKLM\Software\Microsoft\Windows\CurrentVersion\Run). You can see how it looks like in the screen below. If you know what applications are supposed to start automatically on your computer (many of us don’t), then you should be able to tell whether you have suspicious programs trying to start with them.
Constant warnings about infectionMany recent malware are rogue security applications—programs that pretend to be anti-spyware or antivirus software. Note that most legitimate security applications provide very conservative notifications. Don’t just install something because it warned you. If you need to install a security solution, visit a legitimate vendor site and download it from there. Many vendors (
AVG,
McAfee,
Trend Micro,
Symantec) provide free basic security software or trial versions.
Too many applications runningEveryone should have a decent process viewer for telling what applications are running on their computer. Windows Task Manager can help, but I personally love
Process Explorer. The company that used to provide this tool (Sysinternals) has been bought by Microsoft, so perhaps a version of this tool will be included in future versions of Windows.
Process Explorer provides a quick list of all kernel and user mode process trees and an easy way to locate process images (the file counterparts). Before a clean up effort, I recommend stopping all unnecessary process. To do this, you need to be able to identify which processes are critical. One good indicator is the company name, which tells you whether the running process from Microsoft, Adobe, Yahoo, or some webcam maker, for example.
Too many pop-ups and browser toolbarsIf your Web browser (Internet Explorer, Firefox, etc.) has too many third-party toolbars, you should be wary. Some toolbars are useful, like site rating toolbars or search bars, but a lot of them are installed with spyware. Plus, they can really mess up the browser interface. I try to keep my toolbars to a minimum and use only the
SiteAdvisor toolbar, since all browsers now have their own search bars.
How can you really tell?
The truth is most malware are pretty good at hiding their presence. Many malware use rootkits, which are very sophisticated ways of hiding from Windows APIs or the controls used to perform very basic actions in Windows. I often need to perform a scan to reassure myself that my computer is clean.
The scanner I currently use is the new
HouseCall 7.0 (currently in Beta, but appears to be very stable). This scanner supports process scanning (similar to what can be done manually with Process Explorer) and can also detect rootkits. It uses a selective scanning method that first lists critical and suspicious sections before starting the scan. HouseCall 7.0 will typically finish scans in less than 15 minutes. Now that’s a quick way to tell if your computer is infected or not.
The initial startup of HouseCall 7.0 can take a while, depending on your connection, but succeeding runs are pretty fast. If you would want to use HouseCall again, it’s suggested that you keep a local copy of the launcher, so you won’t have to download it.
HouseCall 7.0 will let you clean all detected malware and will even allow you to restore files it has deleted or cleaned. But you probably will not need this feature, unless you want to keep copies of malware.