Has anyone ever used identity theft protection? I think my computer has picked up a virus so I'm interested to  know what might be involved in preparing for the worst, even if it's overkill.

First things first if you think your computer has picked up a virus then don't bother installing anything to try get rid of it, simply reformat the full thing.

 

id suggest changing some of your important passwords on a different computer or device too.

 

i think my computer had that identity theft protection through Norton.

Edited 13 February, 20179 yr by LGM

Not sure I agree with reformatting. It's like demolishing the house because you find an ant on the kitchen floor. 

 

First step is don't use the machine for any banking or online shopping.

 

Don't use it to change passwords, or access accounts you've changed passwords on.

 

Next there are plenty of online scanners you can try to check for infections and identify what they are. You can then find out how easy or not it is to remove. 

 

Backing up now carries the possibility of backing up the infection to simply put back onto a rebuild. 

 

What security software are you currently using? 

I use what's built into Windows 10 - Microsoft defender? - and Malwarebytes free. Weirdly when I instigate a scan with MS defender (or whatever) it says the machine is clean, and there are no items in its list of quarantined files, but I've had two notifications from it out of the blue that it has found and terminated suspicious activity.

 

RTkill says it can't see any malware services. I tried an online one that seems mostly aimed at large businesses that checks your files against lots of AV providers; it found 6 that one or two out of 41 flagged as dodgy, but virustotal said they were all ok.

 

I use CCleaner to remove as much browser stuff as possible regularly and don't store passwords in the browser. I don't think I've  got any documents that could be a problem. I hope it couldn't have got my Steam or VPN password (nordvpn) though, as those are stored in the applications.

 

If anything had been there a long time it could have got google and/or Amazon which would be serious. I've got two factor enabled for google and now Amazon.

 

I'm inclined to copy any data I need onto a backup disk, reformat, and then scan the backup disk. I hope I can safely attach the backup disk without triggering anything dodgy on it. 

 

Next time round I'll normally use an account that's not an administrator. Any more advice welcome.

 

Edited 13 February, 20179 yr by wonkyewok
added more info

First thing is use a decent antivirus. Windows defender is rubbish. 

 

If you value your security and data, you have to pay for decent protection. Who you decide on is up to you. Most these days are pretty much the same, and the old issues of CPU hogging are long gone. Personally I use Norton. 

 

As for scanning, try this one which is pretty reliable 

http://www.eset.co.uk/Antivirus-Utilities/Online-Scanner

Just reread your reply. Are you sure it wasn't a firewall warning? You can find the error again from within defender/MSE logs 

If you're running two factor on most of your big things (banking and shopping)then that's a really substantial chunk of protection there. Done properly that is very difficult for your attacker to get round without it being an inside job.

 

Other advice...do what Gadgetman suggests. 

 

I think you've got reasonable protection in place if you're not doing anything silly you should be quote safe.

 

You might want to consider changing your brwser to something like Firefox with adblock and noscript. That can stop any nasties on a website from running, but it can also be a PITA.

 

You might want to invest in one of the paid for antimalware/av products out there. MS Defender is ok but something like Kasperski is better

Thanks. I've got adblock and noscript in firefox. It may be a false alarm that just has some scary-looking coincidences.

I was browsing when the whole screen went black, flickered and came back, but without the message about the display driver that I've  occasionally had from Nvidia.

Defender starts saying "Malicious activity was stopped". I've looked through the logs in Event Viewer and there's a 1013 at that time which is apparently the code for the history of scan results being deleted. But I found on Reddit that other folks have had this "Malicious activity" warning in the past few days too. So either it's a  really well-written conversation to put off the intended victims, or it's coincidence.

I use a VPN - this has just started asking for its password, which is baked in so it shouldn't need to ask.

and Steam has asked for its password; again this is baked in so it doesn't normally ask.

In future I might see if I can get virtualbox to  work with Linux inside. I've never really understood linux before.

 

I'm interested in knowing if anyone has ever signed up for identity theft protection with e.g. Experian - I think they maybe watch to see if any applications for credit are made in your name.

 

The dept I'm in does a lot of work on the safety of materials used in aircraft. I'm probably very risk averse.

http://www.urbandictionary.com/define.php?term=nuke it from orbit

Edited 20 February, 20179 yr by wonkyewok

Steam and other programs occasionally ask for passwords particularly after an update..

 

Flickering screens isn't a sign of a hack, that's Hollywood. If you were being hacked you wouldn't notice anything.

Computers slowing down is a sign and crashes but that tends to be from poor malware. The guys writing the good stuff don't get noticed.

Have you purchased a security software suite yet? 

had the pc off most of the time. Just switched on now and downloaded Kaspersky. running a full scan.

Sophos are giving their suite away free for home user as well.

 

I keep meaning to try it but I'm lazy, changing AV is a PITA.