[IT}-- The warning signs of a PC infected with malware
Dennis O’Reilly
Last week’s news alert by Woody Leonhard described the high level of sophistication behind the Sinowal/Mebroot Trojan and described tools that attempt to remove the malware.
Many readers asked for more information on symptoms they should look for if they fear for their machines’ security.
Subscriber Leslie Kight asks the following question:
"Great article. I’m curious, though: what makes Woody suspect his XP machine is infected by Mebroot? What symptoms did he see to raise that question?"
Here’s Woody’s reply:
"I kept getting weird virus warnings from AVG. Viruses would appear, I would remove them, then they would reappear in different locations, or entirely different viruses would show up. AVG reported that the MBR [Master Boot Record] was being changed every time I rebooted, even when I did nothing.
I did a deep scan —first with AVG, then with NOD32— to remove all the reported malware, but the viruses kept reappearing. Antirootkit scans turned up nothing. Then I couldn’t connect to F-Secure’s Web site, so I pulled the plug.
As I said in the article, I have no idea at all if it was Mebroot. But I couldn’t find any reports of similar collections of problems and decided to err on the safe side.
Periodically reinstalling Windows is something I recommend anyway: once a year is ideal, in my experience. I’m happy to report that I’ve reinstalled XP Pro (SP3, of course), reactivated [Windows], and brought back the data files; everything appears to be working just fine. The machine’s snappier than ever".
Source: Windows Secrets
