Detecting and Managing Infections

Learning outcomes:

• Identify common signs that a computer is infected
• Compare how businesses and home users clean up an infection
• Describe the steps for removing malware from a home computer, using the right tools
• Explain how to prevent future infections

Would you like to download my PowerPoint to follow along?

• How can I tell there's an issue?
• Slow computer
• Pop-ups, and ads where there shouldn't be any
• Unusual activity
• Web pages that redirect
• Excessive CPU usage (check Task Manager)
• Connections to unknown machines
• What is it?
• Viruses
• Trojans
• Spyware
• Adware
• Rootkits
• How businesses fix it
• Wipe and reimage
• Fixing it at home, step 1
• Back up before you start!
• Disconnect from the internet
• Start in safe mode
• Step 2: run a one time scanner, not your normal antivirus
• Malwarebytes, for Windows and Mac
• Microsoft Safety Scanner, which stops working 10 days after you download it, so you always use a fresh copy
• Emsisoft Emergency Kit, which is portable, so it can run from a USB drive without installing
• Always use a clean, fresh download of the tool
• You can use more than one tool
• Step 3: check for adware
• Malwarebytes AdwCleaner, for adware, unwanted programs, and browser hijackers
• Step 4: check for rootkits with a deep scan
• Microsoft Defender Offline scan, built in to Windows. It restarts the computer and scans before Windows loads, so rootkits have a harder time hiding.
• Why not Kaspersky? Kaspersky's free rootkit tool was a common recommendation, but in June 2024 the US Commerce Department banned Kaspersky software in the US, because of the Russian government's possible control over the company. Kaspersky's updates stopped in the US in September 2024, and Kaspersky denies it's a risk.
  • Commerce Department press release (June 2024)
  • NPR: U.S. announces ban on antivirus software from a Russia-based cybersecurity company
  • NPR: Security firm Kaspersky denies it's a hazard after the U.S. bans its software
• How do I stop this in the future?
• Regular antivirus scans: keep it updated and active
• Only install one antivirus at a time, more isn't better
• Regular adware scans
• Use a firewall
• Practice safe computing, including off site backups in case of ransomware
• Keep a portable USB drive for cleaning computers
• Only download AI apps and models from official sources. A fake OpenAI model on Hugging Face spread password-stealing malware (BleepingComputer)
• Danger! Advanced tools
• Tools such as HijackThis, and deleting files on boot, can break a system if they're used wrong
• Only use them if you know exactly what you're removing

Suggested Activities and Discussion Topics:

• Discussion: why do businesses wipe and reimage instead of cleaning an infected computer?
• Activity: make a cleanup USB drive with fresh downloads of 2 of the tools above.
• Discussion: have you ever had an infected computer? What were the signs, and what did you do?
• Follow the instructions on this PDF (accessible HTML version)
• Final presentation: follow the instructions on this PDF (accessible HTML version)
• Final presentation topics: pick one from this PDF (accessible HTML version)

Would you like to see some more classes? View all classes