Saturday, December 6, 2008

Swatting pesky bugs with incomplete swatters

There's a reason why you haven’t heard from me in a few days. My computer got hit by a virus. Fortunately, it does not appear to be one that propagates by email. At least a friend who gets frequent emails from me hasn't complained about being hit.

Late afternoon on Thursday I got a popup window on my computer warning that a Trojan had been found and that the way to get rid of it was to go to a particular website and download the removal software. Since the price was $50, I balked. It is difficult for me to let go of dollars if I feel I can find the same thing for free. And the web is usually good at providing all kinds of free advice.

Several solutions to find and destroy the Trojan failed, including scanning my system for the file name and running the security system I already had. So I went back to the suggested website and saw the product could be downloaded before paying, licensing for important stuff to come later. It, of course, found the Trojan.

Before shelling out bucks I talked to a friend for advice (alas, out of his realm of expertise) and searched on the name of the fix program for recommendations. That's when I learned the true nature of things.

There was no Trojan. The popup warning me of the Trojan was the virus. The downloaded scanner program with the name Perfect Defender declared false positives to get me to license it so that it could steal credit card data.

Fortunately, the only effect of the virus was that every 15 minutes I got that popup warning of the virus and the first page my browser displayed (regardless of my homepage) was that I had better now browse unsecured and should go buy their product.

Then I started an odyssey. Through Thursday evening and much of Friday I tried THREE more security programs, each recommended by various sites describing how to eradicate Perfect Defender. The first of the three got rid of the pieces of Perfect Defender, but none of the three eradicated the popup. I even sent a note to the tech support of one of the products. They had me download and run their diagnostic tool. Since it finished after 5:00 on Friday and they need 48 hours to analyze the data I expect to hear from them on Tuesday.

Today, after one more scan of my original security program (which found pieces of what it said were Trojans apparently left over from the first security program I tried and deleted) I went web searching again and found a site that explained how to find and delete the offending program by hand. That worked. The way it works is to hide in local Google data and look like the Microsoft's own security program, which is called Explorer Defender.

I am not sending this out as a virus alert because emails shrieking about viruses can be as annoying as the virus itself.

No comments:

Post a Comment