Troubleshooting Security Issues

 

The following section reviews common causes and typical solutions for security issues. Use the tools in Table 9-10 to find and solve security problems.

 

Table 9-10 Discovery, Repair, and Prevention Tools for Security Issues

Tool	How Used
Antivirus software	Block virus infections and remove viruses.
Antimalware soft-	Block and remove various types of malware.
ware
Antispyware soft-	Block and remove various type of spyware.
ware
Recovery Console	Windows XP limited-function command line for repairing problem
	installations.
System Restore	Windows feature that resets computer to specified earlier date/time;
	can be launched from Windows Recovery Environment in Windows
	Vista/7.

	Chapter 9: Troubleshooting 193
Tool	How Used
Pre-installation	A minimal Windows environment that is the basis for the Windows
environments	Recovery Environment, Windows Setup (Vista/7), and deployment
	tools in Windows Vista/7. Also known as Windows PE. Third-party
	bootable discs such as BartPE also contain a customized pre-installa-
	tion environment that can be used for malware removal or diagnostics.
Event Viewer	Displays Windows events.

 

 

Use Table 9-11 to look up typical symptoms, problems, and solutions for security issues.

 

Table 9-11 Security Issues Symptoms, Problems, and Solutions

Symptom	Possible Cause	Items to	Typical Solution
		Check
Pop-ups	Website using	Pop-up blocker.	Enable pop-up blocker in
	them for ads	Antimalware	browser.
	Malware infection	settings.	Scan for malware and remove
			adware (a type of malware that
			displays targeted pop-up ads).
Browser redi-	Malware infection	Home page set-	Scan for malware and remove
rection		ting in browser.	Trojans (a type of malware).
Security	Attempted virus,	Check security	Quarantine or delete infected
alerts	adware, or mal-	settings in anti-	files.
	ware infection	virus or antimal-	If system is infected, disable
		ware programs.
		System Restore to eliminate
			restore archives that might
			include infected files.
	Fake alerts that try	Note the name	Assume the system is infected,
	to persuade you	of the program	and scan for viruses and mal-
	the computer is	listed.	ware immediately.
	infected	Close the	Check online for specialized
		browser win-	removal tools for the particular
		dow immedi-	fake program listed.
		ately using Task
		Manager.

 

Slow perfor-	Infection by mal-	Check the sys-
mance	ware (adware,	tem for infec-
	spyware)	tions.

Scan for viruses and malware immediately.

 

Use more than one program if needed to remove malware.

194 CompTIA A+ Quick Reference

 

Table 9-11 Continued

Symptom	Possible Cause	Items to	Typical Solution
		Check
Internet con-	Wireless: Incorrect	Check settings	Store settings for reuse.
nectivity	SSID, encryption	for your wire-
issues	key or encryption	less network.
	method
PC locks up	Overheating	Check and	Scan for viruses and malware
	Memory corrup-	resolve hard-	immediately.
	ware issues first.
	tion	Use more than one program if
	Infection by mal-	If problem	needed to remove malware.
	persists, check
	ware (adware,
	system for
	spyware)
	infections.
Windows	Infection by mal-	See if you	Some malware blocks access to
updates fail-	ware (adware,	can download	Windows Update.
ures	spyware)	updates on a	Scan for viruses and malware
		different system
		immediately.
		and install them
		manually.	Use more than one program if
			needed to remove malware.
Rogue anti-	Website infected	Note the name	Assume the system is infected,
virus	with malware	of the program	and scan for viruses and mal-
	Displays fake	listed.	ware immediately.
	security warning	Close the	Check online for specialized
	onscreen	browser win-	removal tools for the particular
		dow immedi-	fake program listed.
		ately using Task	Contact the website to warn of
		Manager.
		infection.
Spam	Emails pushing	Check spam fil-	Quarantine messages with
	fake drugs, money	ter settings.	attachments.
	scams, fake alerts		Report messages to supervisors.
	from banks and
	other financial		Adjust spam filter settings on
	institutions		email client or on email gateway.

			Chapter 9: Troubleshooting 195
Symptom	Possible Cause	Items to	Typical Solution
		Check
Renamed	Infection by mal-	Check system	Scan for viruses and malware
system files	ware (adware,	files.	first.
	spyware)		Download specialized tool to
			repair damage (if available), fol-
			low instructions from malware
			information sites to repair dam-
			age.
			Run sfc to replace renamed files.
Files disap-	Infection by mal-	Check system	Scan for viruses and malware
pearing	ware (adware,	files.	first.
	spyware)		Download a specialized tool to
			repair the damage (if available),
			and follow instructions from
			malware information sites to
			repair damage.
			Run sfc to replace renamed files.
File permis-	Infection by mal-	Check system	Scan for viruses and malware
sion changes	ware (adware,	files.	first.
	spyware)		Download a specialized tool to
			repair the damage (if available),
			and follow instructions from
			malware information sites to
			repair damage.
			Run sfc to replace renamed files.
Hijacked	Hijacked or infec-	Check email	Report the problem to the email
email	tion by malware	settings.	provider.
			If you can, change to new (stron-
			ger) password.
			Follow steps to reset the account
			security if the password has been
			changed.
			If the local account, scan for
			malware.
Access	Infection by mal-	Check the folder	Use the Security tab in proper-
denied	ware	or file security	ties sheet to regain access to file
		settings.	or folder.
			Scan for malware.

196 CompTIA A+ Quick Reference

 

Dealing with Malware

 

Use this section to review best practices for dealing with malware and helping to prevent future infections:

 

Identify malware symptoms —Most of the symptoms in Table 9-11 can indicate a malwareinfection, although some can be caused by other problems.

 

Quarantine infected system —To quarantine an infected system, disconnect it from thenetwork. Unplug the network cable or disable the wireless adapter. If you need to install software on the system, use write-protected media such as recordable CD or DVD that has been closed at the end of the recording process so it can’t be added to.

 

Disable system restore —System Restore not only stores system settings but can also storeinfected files and Registry keys. Disabling System Restore also removes restore points to prevent reinfection.

 

Remediate infected systems —First, update antivirus and antimalware software on thesystem. Second, use the full, complete, or long scan option to scan the entire system for problems. Third, if scanning is blocked or cannot find a problem, boot the system into Safe mode or with a pre-installation environment and then run the antivirus or antimalware pro-grams.

 

Schedule scans and updates —Daily updates and quick scans during downtimes along withcomplete scans weekly provide good protection.

 

Enable System Restore and create restore point —Reenable System Restore only aftercomplete eradication of the infection. Create a restore point right away and give it a name like “After removal of infection name ” to help explain why it was made.

 

Educate end user —Clicking emails from suspicious contacts, going to web pages (evenfrom trustworthy sources), installing programs from unknown providers, and using peer-to-peer file sharing services are four of the classic methods for virus and malware infection. Help end users to realize that avoiding these behaviors helps them keep their systems run-ning properly.