MSU-Northern ITS: IT Security - Help! I think my computer is infected!

Information Technology Services: My computer is infected!

Help! I think my computer is infected!

First of all, stay calm. A panic reaction might cause more damage than the virus. Not every one who thinks they have a virus actually does. Reformatting your hard disk is probably not necessary and may not even kill the virus.

Do not attempt to continue to work with an infected system, or let other people do so.
Close down any applications you have open, if possible.
Don't use any removable media, like flash drives, that have been connected to your machine in any other machines.
Do not under any circumstances exchange files with others until your system has been cleaned and their systems have been checked out.
Ensure that all people in your office and anyone else at risk is aware of the situation.

Verify McAfee antivirus software is installed and up-to-date. The Virus Definitions File should be no more than two days old. To verify the last virus definitions update, right click on the antivirus icon on your tool bar () and select VirusScan Console... On the VirusScan Console verify that the Autoupdate is scheduled to run daily, that the last updated succeeded and when the last update was:

Run the Autoupdate if necessary by right clicking on Autoupdate in the VirusScan Console and selecting Start.
When the update is complete, unplug your computer from the network.
Reboot your system in Safe Mode. To enter Safe Mode in Windows, restart your computer and tap the F8 key until you see a screen offering boot options. Select Safe Mode.
Run a full system scan for viruses by opening the VirusScan Console, right clicking on Full Scan and then Start. McAfee should find the virus(es) and remove them. There is no need to watch the scan, but pay careful attention to the scan results.
Scan again: repeat step 6 until the scan comes up clean.
After the virus has been removed, reconnect your computer to the network.
Run Windows Update to update your Operating System by clicking Start then Windows Update. This will open Internet Explorer to the Microsoft update page. Click the Express button. All priority updates will be downloaded and installed.
Run Windows Update again to ensure all available updates are installed. Repeat until all necessary updates are installed.
Ensure AutoUpdate is enabled in the VirusScan Console.
Get all removable media that you use together and check every one (this includes any backups you have).

Top of page

Return to Virus Protection

Quick Links Help Desk - 3765 ITS Home IT Security Services Information About... Site Index In this section... IT Security Stay Updated! Passwords Data Security Firewalls Virus Protection Help! I think I'm infected! While Traveling... Types of Threats E-mail Safety & Spam Phishing Identity Theft Malware Web Surfing Safely Social Networks Online Harassment Copyrights & Peer-to- Peer (P2P) Applications Related Links (external) MSU Security Web Site Help Desk MSU-Northern students, faculty and staff - Use the ITS Help Desk as the first point of contact for your technology problems, questions & services! Information Technology Services Help Desk Walk-in Support: Cowan Hall 117B Telephone Support: 265-3765 E-Mail Support: itstech Last Updated: 22-Jun-2009
	Information Technology Services: My computer is infected! Help! I think my computer is infected! First of all, stay calm. A panic reaction might cause more damage than the virus. Not every one who thinks they have a virus actually does. Reformatting your hard disk is probably not necessary and may not even kill the virus. Do not attempt to continue to work with an infected system, or let other people do so. Close down any applications you have open, if possible. Don't use any removable media, like flash drives, that have been connected to your machine in any other machines. Do not under any circumstances exchange files with others until your system has been cleaned and their systems have been checked out. Ensure that all people in your office and anyone else at risk is aware of the situation. Verify McAfee antivirus software is installed and up-to-date. The Virus Definitions File should be no more than two days old. To verify the last virus definitions update, right click on the antivirus icon on your tool bar () and select VirusScan Console... On the VirusScan Console verify that the Autoupdate is scheduled to run daily, that the last updated succeeded and when the last update was: Run the Autoupdate if necessary by right clicking on Autoupdate in the VirusScan Console and selecting Start. When the update is complete, unplug your computer from the network. Reboot your system in Safe Mode. To enter Safe Mode in Windows, restart your computer and tap the F8 key until you see a screen offering boot options. Select Safe Mode. Run a full system scan for viruses by opening the VirusScan Console, right clicking on Full Scan and then Start. McAfee should find the virus(es) and remove them. There is no need to watch the scan, but pay careful attention to the scan results. Scan again: repeat step 6 until the scan comes up clean. After the virus has been removed, reconnect your computer to the network. Run Windows Update to update your Operating System by clicking Start then Windows Update. This will open Internet Explorer to the Microsoft update page. Click the Express button. All priority updates will be downloaded and installed. Run Windows Update again to ensure all available updates are installed. Repeat until all necessary updates are installed. Ensure AutoUpdate is enabled in the VirusScan Console. Get all removable media that you use together and check every one (this includes any backups you have). Top of page Return to Virus Protection		Virus Symptoms Some common symptoms that may indicate your computer is infected with a virus are: • Unusual messages or displays on your monitor. • Unusual sounds or music played at random times. • Your system has less available memory than usual. • A disk or volume name has changed. • Programs or files are suddenly missing. • Unknown programs or files are created. • Some of your files become corrupted or suddenly do not work properly. • Your computer is crashing frequently or restarting spontaneously Are you kidding me???! If you don't feel comfortable following the steps on this page, or they don't seem to be working, please contact the Help Desk. Report Security Incidents Report stolen devices (laptops, PDAs, etc) and suspected computer break-ins to ITS immediately. The sooner we know about an incident, the sooner we can respond, potentially limiting any damage.