16

Every now and then there pops up a question that boils down to something like this:

Help! I think my Windows home PC has a virus! How do I get rid of it?

Usually the person who asks the question is not an IT professional, but more likely a desperate home user in need of help. Here are some examples, but there are many more:

These question usually meet one of these two fates:

I know this site is not only here to create value for the persons asking the question, but none of these seems rather helpful. While the duplicate in theory gives the right answer - nuke from orbit - it is not very accesible to the kind of person who normally asks a question like this.

I think it would be a nicer experience both for the people that ask these questions and for us if there was a canonical answer to that question. The answer could explain what "nuke from orbit" means, why it is the only thing you can do, etc.

So my questions:

  • Is this a good idea?
  • If so, can I just proceed to post the question? Or should an already existing question be edited and used? (I think it is important that the question is clean and general, and not about a specific virus.)
  • Anyone who think they could write a good, easy to understand answer?
  • Is there perhaps already a good question/answer I have not found?
  • 3
    This is the canonical one on Super User. It is focused on home PCs. – Jan Doggen Jun 2 '16 at 14:14
  • I think, it goes into the right direction but I have some issues with the answer: The first part is optional imho - people that have an infection wont bother reading a wall of text about the current state of malware. They are scanning pages for solutions / hints and if they dont find it within seconds, they move on. The second part would be pretty good actually, but some things like explaining about the dangers of email-attachements, spear phishing etc. would be mandatory. – hamena314 Jun 3 '16 at 7:31
  • 4
    The first thing I usually ask is: "Why do you think your computer is infected?" Most of the cases they are not infected and the weird behaviour can be explained. I think it would be useful to include what do they need to check to confirm their computer is compromised/infected. – lepe Jun 10 '16 at 8:39
  • @lepe Obligatory xkcd xkcd.com/1180 – Duncan X Simpson Jun 10 '16 at 20:22
  • I finally got around to ask the question: security.stackexchange.com/questions/138606/… So start writing answers! :-) – Anders Oct 3 '16 at 12:12
9

I think this answer and this GrahamHill answer are very good. Both answers make a pretty good effort to explain the reason why a "standard" solution (antivirus, antirootkit, ...) is often not enough, and both answers use, at least in my opinion, a very clear language.

It is true that nuking from orbit is not a "very accessible" option, maybe for economic reasons or because the user doesn't have a clean backup of his personal data. However, there are a lot of situations in IT (not only related to security) for which a user calls tech support, only to hear that he should buy another computer. It is not pleasant, but sometimes it is the only way. Although we are not a tech support website, I feel we have the duty to answer honestly, even if the solution is, so to say, a bit brutal.

Of course, there are also cases in which nuking from orbit may not be required. There was a recent question (that I can't find now) in which the OP explained that a friend told him he had gained access to his phone. In my opinion, nuking from orbit simply because a friend told you that he hacked your phone is slightly an exaggeration (who would want to throw $500 or even more out of the window because of a potential prank?), although it may be actually necessary.

I don't know if a canonical answer should be written, but if it was, it should include in my opinion:

  • the fact that a weird behavior of your PC/MAC/smartphone is not necessarily due to malware;

  • basic ways to understand, or at least guess, where is the problem. For example, if you use Firefox and all websites redirect to a malicious website, but in Chrome everything works fine, you could run a complete scan and uninstall Firefox, and this might be enough. Of course,it may not work, which leads me to the next point

  • tests and suggestions in increasing order of difficulty and "brutality", for lack of a better word, where the most brutal suggestion is clearly nuking from orbit. For example, in the case of pop-up ads, or a malicious Chrome plugin, I would point to https://support.google.com/chrome/answer/2765944, which contains a lot of useful information, and explains how to run Chrome Cleanup Tool, reset browser settings, and so on. Only if these suggestions fail, we should tell the user to nuke it from orbit;

    • we should also include a basic explanation of why certain drastic measures, such as nuking from orbit, may be necessary;
  • possibly, the suggestion to seek advice from technical support. While this is a community of InfoSec professional (not including me), and there are really expert people here who I respect and admire, some of us might be tempted to say "nuke it" when we are not certain, and often we cannot be certain because we don't know the full story and/or because we don't have physical access to the device. An experienced technician with access to the device, and more time to ask questions to the customer, might find an alternative solution.

Just to be clear, I'm not saying that we should answer this kind of questions with "Go to tech support. Period", but I think that before making the ultimate decision to nuke it from orbit, the user should have the possibility to try for the last time.

Best-case scenario: the IT guy manages to repair the computer. Worst-case scenario: the IT guy tells the user to throw the computer away. In my limited experience, cost of repair < value of the whole computer, partly because, where I live, IT repair shops also sell computers, but YMMV. If this is the case, the user doesn't lose more money from calling tech support than he would from straight-up nuking the computer.

As I'm not a professional, I don't volunteer to write a community answer.

  • While the first answer explains perfectly how to deal with a compromised server, it falls a bit short when it comes to OPs mentioned Windows Home PCs with a virus. Someone adminstrating a server has probably a bit more tech-experience than someone who only uses a windows pc for office stuff. So this might be part of a canonical answer, but is missing out on the less tech-savy users imho. – hamena314 Jun 2 '16 at 13:32
  • @hamena314 Both answers are in my opinion very good given the corresponding questions (compromised server vs infected home PC), but I'm not saying they're perfect for a generic compromised machine. The first answer is more technical, but the sections "Don't Panic", "You have just found out...","Why not just "repair" the exploit or rootkit..." (useful for the home user who wants to learn stuff, but may make the situation worse), and "What steps can you take to reduce the consequences of a successful attack?" could be easily adapted to the home user case. – A. Darwin Jun 2 '16 at 13:55
  • As an example, the suggestion "If the system holds anyone's personal data, immediately inform the person responsible for data protection (if that's not you) and URGE a full disclosure" could be adapted for the home user. If the victim kept personal data of other people in his/her own breached device or account, he/she should tell the other involved people about it. Think about a Facebook account, or a compromised smartphone, or a personal tablet used for work, or a computer shared with other relatives. – A. Darwin Jun 2 '16 at 14:03
3

Strictly for the question

Help! I think my Windows home PC has a virus! How do I get rid of it?

the answer should be a 'panic button mode' one. In other words what should I do now?

This answer is: reinstall your PC (*). This is the only reasonable solution for someone who is not experienced -- and he is not as he is asking this question. A lot of pain can be avoided by reinstalling, even after accounting for the other pain of reinstalling applications and recovering data.


There is then the 'why this happened to me?', which brings in an encyclopedic answer about malware, firewalls, yada yada yada.

We should have both, the second one being rather a gift to humanity about the current state of malware and how much the security professionals disagree on them :).

I believe however that the first one is really what is interesting to most people. If they do not want to follow the advice and get rid of the malware on their own - this is a chance for them to learn a lot on during the process (and reinstall their PC afterwards)

(*) the 'how to recover your data, and which of them' is probaly the tricky part

  • 1
    +1 - Anyone who knows computers will try to remove it or google it, not ask on SE... – rahuldottech Jun 7 '16 at 15:52
3

A. Darwin and Jan Doggen have shed some light on the point what a possible answer should contain.

Therefore I would like to focus on the point, if we should give an answer at all.

In the helpcenter are two topics, that deal with "What topics can I ask about here?" and "What types of questions should I avoid asking?".

Reading both of them I think, a answer to the "Eeeek, a virus! Help?"-question would not be neither on- nor specifically off-topic. (If I am wrong or I am missing a point there, please feel free to correct me!)

It is a very trivial question to ask for help with a virus, that triggers trivial answers ("Nuke from orbit", ...) - so the question itself might or might not be valid to ask.

But there are 5 more important points to consider in order to decide, if we should write a canonical answer or not:

  1. It is trivial for us to give an answer (close as duplicate, point to the canonical answer)
  2. This site should be helping people, usually technical experts or people that want to learn more about information security - but also for people that are impacted due to non-existing security!
  3. If the question gets closed and then deleted after some hours / days anyway, why not close it with a link to helpful information? I see no downside for this (see point 1.)
  4. Having a canonical answer keeps people from wasting time by writing a serious answer, that mostly will contain the points from a canonical answer.
  5. The usually linked answer: How do I deal with a compromised server? contains a lot of steps, that are not possible or do not make sense for a personal computer.

Example: "If the system holds anyone's personal data, immediately inform the person responsible for data protection" ... if it is your own computer, there simply is nobody else to inform.

Are there any downsides to having a canonical Q&A for this very topic?

From the top of my head I cant think of any downsides to be honest. Even if there are, there would be some upsides that might outweigh the downsides.

In conclusion I vote for writing a canonical Q&A.

So, maybe we should work out a list, what the answer should contain?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .