DOCSLIB.ORG

Why Malware Works in Face of Antivirus Software

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Why Malware Works in Face of Antivirus Software Outsmarted - Why Malware Works in face of Antivirus Software Matthias Deeg, Sebastian Nerz, Daniel Sauder Outsmarted – Why Malware Works in face of Antivirus Software For many years, different types of malware rank among the biggest IT security threats both in the business and the private domain. In order to protect one- self from the dangers of malware, numerous software manufacturers offer IT security products like antivirus and endpoint protection software. But these products alone offer no sufficient protection from malware that knows some tricks, as the results of our recent research with the topic antivirus evasion show. n the recent past, there were several com- from antivirus software. Thereby, current results puter-based attacks against IT networks that of our recent research are presented and recom- became public and raised a lot of media at- mendations are given for dealing with threats and Itention. Especially the attacks against the New security risks caused by malware. York Times [1] and the Washington Post [2] at the beginning of 2013 had a world-wide media How Antivirus Software Works coverage and also heated the debate about such Current antivirus software, no matter if a stand- cyber threats with manufacturers of IT security alone software product or a component of a soft- products like antivirus and endpoint protection ware suite (host intrusion detection/prevention software. In both mentioned cases, attackers were software, endpoint protection software, etc.), uses able to install malware on computer systems of different methods to detect known and unknown employees in order to literally spy on the affect- threats by means of malware. ed companies – and this probably undetected for In general, these methods used for protecting sev eral months. computer systems from unwanted, malicious Once more, incidences like these have pointed software can be assigned to the following two out that in spite of the use of IT security prod- strategies: ucts like antivirus software or host intrusion de- tection/prevention software (HIDS/HIPS) such 1. Blacklisting attacks cannot be entirely prevented. This kind 2. Whitelisting of threat illustrates that enterprises and also gov- ernment agencies require a master plan with a In the context of antivirus software, the two working information security management and terms blacklisting and whitelisting simply mean security awareness of all employees. that the execution of a program is either explic- itly forbidden (being on a black list) or explicitly This paper discusses how developers of malware allowed (being on a white list). Thus, by following like trojan horses (in short trojans), viruses, and the blacklisting approach antivirus software worms proceed to hide their malicious intentions will prevent the execution of programs that are SySS GmbH | August 2014 Page 1|8 Outsmarted - Why Malware Works in face of Antivirus Software software and are added to their signature data- Exploiting base. Hence, with this method it is only possible Antivirus software does not offer any pro- to detect malware for which at least one corre- tection against attacks of vulnerable network sponding signature exists. services, for example, an outdated web server. The manner in which manufacturers of antivirus Because in such attacks, malicious code, so- software create signatures for malware and search called shellcode, is directly loaded into the for the specific patterns of course influences the main memory of the affected system and ex- error rate of signature-based malware detection ecuted there, for example by exploiting a buf- (error type 1 [false positive], error type 2 [false fer overflow vulnerability. Thus, there is no negative]). file containing the malicious code within the file system of the target system that could be Malware authors and users exploit this situa- found by the usual malware detection mecha- tion by developing and modifying malware in nisms of antivirus software. such a way that it does not contain any known signatures that are sufficient for classifying it as malware. Thus, this kind of malware cannot be not found on a black list. In contrast, using the detected by solely signature-based malware de- whitelisting approach antivirus software will only tection mechanisms. For bypassing some sig- allow the execution of programs found on a white nature-based malware detections it is sufficient list. These two strategies help to pursue the goal to compile the malware with different compiler allowing only desired, expected, and benign be- settings or with a different compiler (malware havior and preventing unwanted, unexpected, source code is available), or to compress and/or and malicious behavior. encrypt the executable file (malware source code The adminstration of black and white lists can is not available) using so-called EXE packers or either be the responsibility of the antivirus soft- EXE cryptors. In this way, the original function- ware, which is the default case for the blacklisting ality of known malware can be preserved but its strategy, or it can be the responsibility of the end form has changed. users or administrators, which is primarily the Thus, polymorphism is a big challenge for signa- case for the whitelisting strategy. ture-based detection mechanisms and is used by The majority of used antivirus software only fol- malware for a long time. lows the blacklisting strategy and thus tries to detect whether software is malicious and should Behavior-Based Malware Detection therefore not be executed. Behavior-based malware detection tries to deter- For malware detection there are generally the fol- mine the behavior of software and to classify it lowing two methods which are described in more according to defined criteria as benign or mali- detail in the following sections: cious. For this, usually rule-based techniques are used in combination with a scoring system and 1. Signature-based specified thresholds for calculated scores. This 2. Behavior-based detection method, also known as heuristic pro- cedure, is capable of detecting unknown malware Signature-Based Malware Detection due to its behavior. The used scoring system and By using signature-based malware detection, an- threshold values have a major influence on the tivirus software is searching for known patterns error rate of this generic method (error type I in the form of byte sequences (also called signa- [false positive], error type II [false negative]). The tures) in files that allow to identify specific mal- analysis of a software program can be performed ware. A disadvantage of this methodology is that only statically at which the code of the executable only known patterns can be searched for. These file is analyzed in a so-called static code analysis patterns are created by the manufacturers of an- and corresponding software behavior is deter- tivirus software based on analyses of malicious mined by means of the presence of specific fea- SySS GmbH | August 2014 Page 2|8 Outsmarted - Why Malware Works in face of Antivirus Software tures. However, a disadvantage of this approach Research Project: Antivirus Evasion is that only program code can be analyzed that is In the course of our research project with the top- directly accessible to the antivirus software. Thus, ic antivirus evasion, the authors have tested dif- program code that is only available during run- ferent antivirus evasion techniques with several time respectively detectable as code, for example well-known and widely used antivirus software due to compression, encryption or self-modi- products that follow the blacklisting strategy. fying code, is not considered for the static code The applied techniques are not new, they have analysis. been used by malware for years and exploit the abovementioned weaknesses in signature- and For this reason, most of the antivirus software behavior-based detection methods of antivirus uses a so-called sandbox environment besides a software. static code analysis. In the context of antivirus software, a sandbox means a secure and control- lable execution environment in which the behav- Characteristics of Antivirus Software: Up- ior of an executable file can be analyzed during dates and Scan Engines runtime and be classified as benign or malicious During the conducted antivirus evasion tests due to defined criteria. In this way, the effective- of this research project and during penetra- ness of some malware obfuscation methods, for tion tests, the SySS GmbH noticed on several instance based on compression or encryption, occasions that the behavior of scan engines can be reduced. Furthermore, another goal of of tested antivirus software products varied antivirus sandbox environments is to hide their in different environments. For example, if a presence and not to be detectable by malware. malicious file is not detected by the locally in- This prevents malware from adjusting its behav- stalled antivirus software, nevertheless, it can ior according to the discovered execution envi- be rated as malicious by the assumed identical ronment and thus malicious code is not executed scan engine when uploaded to VirusTotal. The within a sandbox. In general, the emulation of an reason for this different behavior one should execution environment is a very tough problem be aware of is that antivirus companies often and far from being perfectly implemented con- parametrize their scan engines specifically for sidering antivirus software sandboxes. There- VirusTotal (stronger heuristics, cloud interac- fore, there
Load more

Recommended publications
  • 9 Steps to Protect Against Ransomware
    9 Steps to ProtectUsers/Devices Against Ransomware Home Security Dashboard Security Dashboard IT Support Analyst Task Overview Devices Vulnerability Scan With Vulnerabilities In Last 30 Days Security Manager Critical Security Dashboard 40 Devices 95 Not Scanned Self Service Important/High 85 Estimated Not Scanned 90 Devices 31 Scanned So ware Catalog Moderate/Medium 15% Launchpad 90 Devices Asset Manager NA 140 Devices So ware Asset Hardware Asset Inventory Scan Most detected Critical/High Vulnerables In Last 30 Days In Last 30 Days Sign Out MS15-080_MSU 70 Devices 169 Not Scanned 42 Scanned MS15-084_MSU White Paper 70 Devices 20% MS15-049_INTL 50 Devices MS15-049_INTL 50 Devices Contents Introduction . 1 Prevention . .. 2 1. Patch the critical operating systems and applications .................................2 2. Ensure that antivirus software is up-to-date and that regular scans are scheduled .......3 3. Manage the use of privileged accounts ..............................................4 4. Implement access control that focuses on the data ...................................4 5. Define, implement, and enforce software rules .......................................6 6. Disable macros from Microsoft Office files ...........................................6 Other considerations . 6 7. Implement applications whitelisting ................................................7 8. Restrict users to virtualized or containerized environments ............................7 9. Back up critical files frequently .....................................................7 Ransomware incidents are on the rise . Fight back! . 8 References . 8 This document contains the confidential information and/or proprietary property of Ivanti Software, Inc. and its affiliates (referred to collectively as “Ivanti”), and may not be disclosed or copied without prior written consent of Ivanti. Ivanti retains the right to make changes to this document or related product specifications and descriptions, at any time, without notice.
    [Show full text]
  • Trojans and Malware on the Internet an Update
    Attitude Adjustment: Trojans and Malware on the Internet An Update Sarah Gordon and David Chess IBM Thomas J. Watson Research Center Yorktown Heights, NY Abstract This paper continues our examination of Trojan horses on the Internet; their prevalence, technical structure and impact. It explores the type and scope of threats encountered on the Internet - throughout history until today. It examines user attitudes and considers ways in which those attitudes can actively affect your organization’s vulnerability to Trojanizations of various types. It discusses the status of hostile active content on the Internet, including threats from Java and ActiveX, and re-examines the impact of these types of threats to Internet users in the real world. Observations related to the role of the antivirus industry in solving the problem are considered. Throughout the paper, technical and policy based strategies for minimizing the risk of damage from various types of Trojan horses on the Internet are presented This paper represents an update and summary of our research from Where There's Smoke There's Mirrors: The Truth About Trojan Horses on the Internet, presented at the Eighth International Virus Bulletin Conference in Munich Germany, October 1998, and Attitude Adjustment: Trojans and Malware on the Internet, presented at the European Institute for Computer Antivirus Research in Aalborg, Denmark, March 1999. Significant portions of those works are included here in original form. Descriptors: fidonet, internet, password stealing trojan, trojanized system, trojanized application, user behavior, java, activex, security policy, trojan horse, computer virus Attitude Adjustment: Trojans and Malware on the Internet Trojans On the Internet… Ever since the city of Troy was sacked by way of the apparently innocuous but ultimately deadly Trojan horse, the term has been used to talk about something that appears to be beneficial, but which hides an attack within.
    [Show full text]
  • Breaking Antivirus Software Joxean Koret, COSEINC 44CON, 2014
    Breaking Antivirus Software Joxean Koret, COSEINC 44CON, 2014 Breaking antivirus software Introduction Attacking antivirus engines Finding vulnerabilities Exploiting antivirus engines Antivirus vulnerabilities Conclusions Recommendations Antivirus Engines Common features of AV engines: Written in C/C++. Signatures based engine + heuristics. On-access scanners. Command line/GUI on-demand scanners. Support for compressed file archives. Support for packers. Support for miscellaneous file formats. Advanced common features: Packet filters and firewalls. Drivers to protect the product, anti-rootkits, etc... Anti-exploiting toolkits. Antivirus products or engines An antivirus engine is just the core, the kernel, of an antivirus product. Some antivirus engines are used by multiple products. For example, BitDefender is the most widely used antivirus kernel. It's used by so many products like QiHoo360, G-Data, eScan, F-Secure, etc... Most “big” antivirus companies have their own engine but not all. And some companies, like F-Secure, integrate 3rd party engines in their products. In general, during this talk I will refer to AV engines, to the kernels, except when specified the word “product”. Attack surface Fact: installing an application in your computer makes you a bit more vulnerable. You just increased your attack surface. If the application is local: your local attack surface increased. If the application is remote: your remote attack surface increased. If your application runs with the highest privileges, installs kernel drivers, a packet filter and tries to handle anything your computer may do... Your attack surface dramatically increased. Myths and reality Antivirus propaganda: “We make your computer safer with no performance penalty!” “We protect against unknown zero day attacks!”.
    [Show full text]
  • Cyber Warfare: Surviving an Attack
    14 Cyber Warfare: Surviving an Attack By Devabhaktuni Srikrishna Cyberspace is a new domain of warfare. Created to minimize the vulnerability of United States communications networks to a crippling nuclear first strike by the Soviet Union, the Internet that was originally envisioned to enhance U.S. security is turning into a battlefield 1 for nations or sub-national groups to launch virally spreading attacks 2 and induce network failures potentially involving critical infrastructure systems.3 Cyber warfare and cyberoffense 4 have been a part of U.S. military operations for decades.5 Treaties and rules of engagement define what is off-limits during a cyberwar.6 The more vulnerable the system is, the more policy is necessary to deter adversarial nations from launching attacks, and vice-versa. Some cyberattacks are analogous to air forces probing one anotherʼs defenses or perhaps to espionage during the Cold War, which occurred though there was no official war and no physical harm. Cyberespionage largest recent cyberattacks in their book, but due to a gap in theory and practice. operations of China, for example, against the United States and its allies Cyber War: The Next Threat to National Organizations are vulnerable to the extent have been going on for years and will Security and What to Do About It. Once a they want to be and to how much they want never really end.7 virus or malware is inadvertently to spend to address vulnerabilities. 14 And downloaded onto a networked personal cyber vulnerabilities can be completely U.S. Air Force General Kevin Chilton, computer (PC) by a user9, the PC can be eliminated -- unlike conventional, nuclear, former Commander-in-Chief of commandeered to perform cyberattacks chemical, or biological which are permanent Strategic Command, has stated that ranging from electronic banking crimes, vulnerabilities due to laws of nature.
    [Show full text]
  • Study on Computer Trojan Horse Virus and Its Prevention ZHU Zhenfang
    International Journal of Engineering and Applied Sciences (IJEAS) ISSN: 2394-3661, Volume-2, Issue-8, August 2015 Study on Computer Trojan Horse Virus and Its Prevention ZHU Zhenfang to steal or viciously revise files, spy system information, steal various commands and passwords, and even format users’ Abstract— In recent years, the fast development of computer hardware. In addition, Trojan horse virus usually records network technology, has become an integral part of human’s life, keyboard operation by means of keyboard record, and then work and study. But with the popularity of the Internet, obtains the account and password of E-bank. Attackers can computer viruses, Trojans and other new terms have become some well-known network vocabularies. Studies have shown directly steal users’ wealth by obtaining accounts and that most users of computer are more or less suffered from passwords. On the other hand, Trojan horse can also cause the computer virus. So people must attach great importance to the native machine be affected by other vicious virus. network security problem. The paper studied Trojan virus. Paper first introduced the concept, characteristics and PREVENTION OF HORSE VIRUS categories of the Trojan virus and its harm, and then focused on the way and means of the Trojan’s spread. It introduced the According to the above introduction, we know that Trojan virus loading and hiding technology, too. Its last part Trojan horse virus is very dangerous. If we neglect the focused on the prevention measures, it put forward reasonable prevention, our computer may be easily attacked. For the suggestions to users, and paper also put forward prevention prevention of Trojan intrusion, Trojan intrusion should be advice to improve network security.
    [Show full text]
  • The Antivirus Hacker's Handbook
    The Antivirus Hacker’s Handbook The Antivirus Hacker’s HHandanddbook Joxean Koret Elias Bachaalany The Antivirus Hacker’s Handbook Published by John Wiley & Sons, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2015 by John Wiley & Sons, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-1-119-02875-8 ISBN: 978-1-119-02876-5 (ebk) ISBN: 978-1-119-02878-9 (ebk) Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley .com/go/permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or war- ranties with respect to the accuracy or completeness of the contents of this work and specifi cally disclaim all warranties, including without limitation warranties of fi tness for a particular purpose. No warranty may be created or extended by sales or promotional materials.
    [Show full text]
  • Controlling for Cybersecurity Risks of Medical Device Software
    © Copyright AAMI 2014. Single user license only. Copying, networking, and distribution prohibited. Managing Risk Controlling for Cybersecurity Risks of Medical Device Software Kevin Fu and James Blum About the Authors Editor‘s Note: This article originally appeared in Communications of the ACM (2013;56[10]21–3; doi: 10.1145/2508701). Reprinted with permission. Kevin Fu, PhD, is an associate professor of While computer-related failures are known to Measuring Medical Device Security: computer science play a significant role in deaths and injuries Quantitative or Qualitative? and engineering involving medical devices reported to the U.S. Between years 2006 and 2011, 5,294 recalls and at the University of Food and Drug Administration (FDA),1 there is approximately 1.2 million adverse events of Michigan in Ann Arbor, MI. He also is a Sloan research no similar reporting system that meaningfully medical devices were reported to the FDA’s fellow. E-mail: [email protected] captures security-related failures in medical Manufacturer and User Facility Device devices. Experience (MAUDE) database.1 Almost 23% of James Blum, MD, Medical device software must satisfy system these recalls were due to computer-related is chief of critical properties, including safety, security, reliability, care and surgical failures, of which approximately 94% presented specialty anesthesia resilience, and robustness, among others. This medium to high risk of severe health conse- at Emory University column focuses on the challenges to satisfying quences (such as serious injury or death) to Hospital in a security property for medical devices: post- patients.1 For security incidents on medical Atlanta, GA, and market surveillance, integrity and availability, devices, no systematic national reporting assistant professor of anesthesiology and regulation and standards.
    [Show full text]
  • Breaking Antivirus Software Joxean Koret, COSEINC SYSCAN 360, 2014
    Breaking Antivirus Software Joxean Koret, COSEINC SYSCAN 360, 2014 Breaking antivirus software n Introduction n Attacking antivirus engines n Finding vulnerabilities n Exploiting antivirus engines n Antivirus vulnerabilities n Conclusions n Recommendations Antivirus Engines n Common features of AV engines: n Written in C/C++. n Signatures based engine + heuristics. n On-access scanners. n Command line/GUI on-demand scanners. n Support for compressed file archives. n Support for packers. n Support for miscellaneous file formats. n Advanced common features: n Packet filters and firewalls. n Drivers to protect the product, anti-rootkits, etc... n Anti-exploiting toolkits. Antivirus products or engines n An antivirus engine is just the core, the kernel, of an antivirus product. n Some antivirus engines are used by multiple products. n For example, BitDefender is the most widely used antivirus kernel. n It's used by so many products like G-Data, eScan, F- Secure, etc... n Most “big” antivirus companies have their own engine but not all. And some companies, like F-Secure, integrate 3rd party engines in their products. n In general, during this talk I will refer to AV engines, to the kernels, except when specified the word “product”. Attack surface n Fact: installing an application in your computer makes you a bit more vulnerable. n You just increased your attack surface. n If the application is local: your local attack surface increased. n If the application is remote: your remote attack surface increased. n If your application runs with the highest privileges, installs kernel drivers, a packet filter and tries to handle anything your computer may do..
    [Show full text]
  • Antivirus Software Anti-Spyware Software Firewall Protection
    Navigant Credit Union Security | PROTECTING YOUR COMPUTER Antivirus Software Anti-Spyware Software Software Updates Firewall Protection Antivirus software detects and responds Spyware is a type of program that monitors Software Updates come in the form of Firewalls help protect against attacks across to various types of malware (malicious a user’s computer activity, collects software “patches” that replace defective any network — the Internet, your home software). Malware includes viruses, information about a user without his sections of software code with corrected network, and even wireless networks, like at worms and other programs designed to knowledge, and then provides that code. damage or disrupt a computer system. information to a third party. the airport, library or work. Where do I get Antivirus software Where do I get Anti-Spyware software How do I keep my software programs updated? Where do I get a firewall? protection? protection? Some software programs, including Microsoft Microsoft Windows and Mac operating systems Antivirus software can be purchased at an Anti-Spyware software is available at any Windows and Mac operating systems, provide and even Antivirus software programs often electronics store, either online or offline. electronics store, either online or offline. automatic software updates. Keep these include firewalls. Firewalls can also be purchased automatic updates turned on so that your at most electronics stores or online. You can *Some Antivirus software vendors include: *Some Anti-Spyware vendors include: computer is protected routinely. obtain free firewalls online; however, they offer Symantec – www.symantec.com Symantec – www.symantec.com McAfee – www.mcafee.com McAfee – www.mcafee.com minimal or non-existent technical support and Trend Micro – www.trendmicro.com Microsoft – www.microsoft.com How do I check my computer operating documentation.
    [Show full text]
  • About Safeonline
    Online Security Software - SafeOnline About SafeOnline Prevx is a leading supplier of PC security products and now all our clients have the chance to download SafeOnline software for free. SafeOnline works on top of any anti-virus software and alongside all other security products you already have on your computer. However, unlike your anti-virus software, SafeOnline is designed to protect your log in details and personal information to help safeguard you against fraudulent websites and malicious software. There are three ways in which SafeOnline can help to protect you: 1. Helps to ensure the website is genuine Sometimes, people can try to steal your personal information by replicating a genuine website, then getting you to reveal your personal or financial details. This is known as phishing. Phishing websites are a growing problem on the internet and sometimes it’s hard to tell the genuine sites from the fake. This is why SafeOnline holds a list of well known phishing websites and alerts you if you visit any of them. 2. Added password protection It can help ensure the log in details you enter for a certain website are meant for that website. Whenever you enter your log in details into a new site for the first time, SafeOnline always asks whether you’d like to associate those details with that site. Doing this means that if you come across a phishing site and you start to enter your log in or personal details, SafeOnline will recognise the web address is different and you’ll be alerted that you’re entering your password into a site it’s not meant for.
    [Show full text]
  • Existing Evidence for the Effectiveness of Antivirus in Preventing Cyber Crime Incidents
    Georgia State University ScholarWorks @ Georgia State University EBCS Tools Evidence-Based Cybersecurity Research Group 2019 Existing Evidence for the Effectiveness of Antivirus in Preventing Cyber Crime Incidents David Maimon Georgia State University Follow this and additional works at: https://scholarworks.gsu.edu/ebcs_tools Recommended Citation Maimon, David, "Existing Evidence for the Effectiveness of Antivirus in Preventing Cyber Crime Incidents" (2019). EBCS Tools. 6. https://scholarworks.gsu.edu/ebcs_tools/6 This Article is brought to you for free and open access by the Evidence-Based Cybersecurity Research Group at ScholarWorks @ Georgia State University. It has been accepted for inclusion in EBCS Tools by an authorized administrator of ScholarWorks @ Georgia State University. For more information, please contact [email protected]. Existing Evidence for the Effectiveness of Antivirus in Preventing Cyber Crime Incidents David Maimon Center for Evidence Based Cybersecurity Georgia State University Antivirus software is a program designed to keep computer devices clean from malicious software (malware) such as viruses, worms, and trojans, and is commonly deployed on computer and smartphone users’ devices as the last line of defense against cyber-dependent crimes). In effort to assess the potential effectiveness of Antivirus products in preventing the development and progression of cyber-dependent crimes we searched in six major academic search engines for studies published between the years 2000-2016 using experimental or quasi- experimental research designs. Our findings reveal that several key approaches are employed by scholars when evaluating antivirus software’s performance. The typical evaluations conducted by commercial and scholarly labs are based on scans of collected or synthesized malware samples.
    [Show full text]
  • Us-Cert.Gov/Reading Room/Before You Plug In.Html
    Recovering from a Trojan Horse or Virus Michael D. Durkota and Will Dormann It can happen to anyone. Considering the vast number of viruses and Trojan horses traversing the Internet at any given moment, it’s amazing it doesn’t happen to everyone. Hindsight may dictate that you could have done a better job of protecting yourself, but that does little to help you out of your current predicament. Once you know that your machine is infected with a Trojan Horse or virus (or if your machine is exhibiting unexpected behavior and you suspect that something is wrong), what can you do? If you know what specific malicious program has infected your computer, you can visit one of several anti-virus web sites and download a removal tool. Chances are, however, that you will not be able to identify the specific program. Unfortunately your other choices are limited, but the following steps may help save your computer and your files. 1. Call IT support If you have an IT support department at your disposal, notify them immediately and follow their instructions. 2. Disconnect your computer from the Internet Depending on what type of Trojan horse or virus you have, intruders may have access to your personal information and may even be using your computer to attack other computers. You can stop this activity by turning off your Internet connection. The best way to accomplish this is to physically disconnect your cable or phone line, but you can also simply “disable” your network connection. 3. Back up your important files At this point it is a good idea to take the time to back up your files.
    [Show full text]