Expert: Lorry - 8/21/2009

Question
Hi Lorry..  I have a HP Compaq 6735s laptop with factory installed
windows vista home basic. During the last 3 months my computer has
been attacked twice by an unknown malware. The symptoms are :
1) My user picture which appears in the start menu and welcome screen is replaced by another picture from the computer itself and
I am unable to change it.
2)The taskbar icons next to the start button vanish.
3)My favorites list is messed up.

4)Some applications like FLV player and Catalyst control centre stop working.

On both the occassions I had to reinstall the operating system by
using the F11 recovery tool which restores the computer to factory settings.

My anti virus software which was Avast home edition version 4 and
my anti malware which is Windows Defender, both did not spot this attacker and kept giving all clear signals. Therefore I dont know
whether the attacker was a virus or a spyware.

Being a new computer user I was a bit liberal in downloading freewares on the first occassion but was quite conservative on the
second occassion.

I have now changed my anti virus software to AVG free 8.5.
My anti malware continues to be Windows Defender which is factory
installed and which I keep updated.

As I am a bit apprehensive about a third attack please advice about any further steps I should take, and if I am required to install another anti spyware will it work well  with Windows Defender?
Regards,
K.S.N.

Answer
Hi K.S.Narayan,

Both Avast and AVG are good and free anti-virus programs. No matter which one you use there are some important things to remember, keep it up to date and to run a virus scan one a week.

I would suggest installing Malwarebytes Anti-Malware 1.40 available from:

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Unless you pay for it, you will not have real-time protection. Most people will run a scan every 2 or 3 weeks with the free version - after they update it. Keep Windows Defender as that supports real-time protection.

Another thing would be to install a good firewall program. One of the best is ZoneAlarm, plus it is free. It is available at:

http://download.cnet.com/ZoneAlarm/3000-10435_4-10039884.html

To verify that there are no viruses or other threats on the computer, using Internet Explorer, go to:

http://security.symantec.com/sscv6/WelcomePage.asp

Click "Continue to Symantec Security Check", in the next window click No when asked if you want to close this window, that will bring you to a window where you should click Virus Detection.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Hope this helps!
Lorry