<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet href="http://feeds.datadoctors.com/rss20.css" type="text/css"?>
<rss version="2.0"><channel>
	<title>Data Doctors Alerts</title>
	<link>http://datadoctors.com/help/</link>
	<description>Virus, Bug &amp; Recall Alerts</description>
	<language>en-us</language>
	<lastBuildDate>Fri, 23 Oct 2009 14:07:51 +0700</lastBuildDate>
	<pubDate>Sat, 7 Nov 2009 04:05:01 +0700</pubDate>
	<item>
		<title><![CDATA[Is the Conficker worm making the rounds again or are the e-mail warnings a hoax? - Leslie]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21740</link>
		<description><![CDATA[The current crop of 'Conficker.B 'e-mail warnings that are purporting to be from Microsoft are in fact a hoax that's trying to infect computers with the fake 'Antivirus 2010' program.<p>This is just another example of the creative methods that are constantly being generated to trick folks into installing fake security software onto their computer, which then coaxes them to purchase the 'fix' for a fake infection.<p>A recent study claimed that over 250 different types of 'scareware' programs are in circulation and this is just the most recent attempt to get people to give up credit card information for a fake infection.<p>In general the subject line refers to a 'Conficker.B Infection Alert' and the body of the message reads:<p>Dear Microsoft Customer,<p>Starting 18/10/2009 the 'Conficker' worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected. To counteract further spread we advise removing the infection using an antispyware program. We are supplying all affected Windows Users with a free system scan in order to clean any files infected by the virus.<p>Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.<p>Regards,<p>Microsoft Windows Agent #2 (Hollis)<p>Microsoft Windows Computer Safety Division<p>_________________________________________________________________________________<p>The message is accompanied by a file attachment that has varying names, but usually has the .zip extension.<p>If you are paying attention, you should be able to spot many red flags from this message.<p>The first one is the date format (18/10/2009) which is not common in the U.S. and the second is the poor grammar (unusually rapidly).<p>What isn't as obvious to non-technical users is that Microsoft would never be contacted by your Internet provider if your network was truly infected.  If anything, your Internet provider would shut your connection down or disable your ability to send e-mail if your system was infected with many of the silent malware programs that silently spew out spam.<p>Microsoft would never send a file attachment (they always use links back to their website) and you should never trust any .zip files (compressed files that could contain virtually anything inside) unless you are absolutely certain of the contents.<p>Finally, I have yet to see any official Microsoft e-mail messages that had a salutation that started with 'Regards' and there is no such thing as the 'Microsoft Windows Computer Safety Division'.<p>The only security warnings that you will ever get e-mailed to you from Microsoft would come as a result of you pro-actively signing-up for their 'Security Bulletins' and the format of the messages always starts with  "Begin PGP Signed Message".<p>A good practice for the future whenever you receive any suspicious e-mail warnings is to copy the first paragraph and paste it into Google as a search.  If the information is legit, you will find websites that will confirm the information and if it's a fake, you will quickly get confirmation as well.]]></description>
		<pubDate>Fri, 23 Oct 2009 14:07:51 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21740</guid>
	</item>
	<item>
		<title><![CDATA[Should I be concerned using Twitter since they were attacked by hackers? - Julie]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21729</link>
		<description><![CDATA[The recent shutdown of Twitter by what is referred to as a Distributed Denial of Service (DDoS) attack should not concern Twitter users from a security or privacy standpoint.<p>A DDoS attack is generally used to render a website useless because the attackers have an agenda that is served by wreaking havoc on the site.  In most cases, it is financially motivated (blackmail) or cause motivated (we want you to change the way you do business, etc.), but we have yet to understand the motivation behind this attack.<p>Think of it as a very popular radio station contest that generates so many callers that no one can get through.  A DDoS is simply the ability to get a large number of computers to all simultaneously bombard a single website with thousands of requests, which makes it impossible for regular traffic to get through (we all get a 'busy' signal).<p>Since Twitter was not the only site attacked, it's very likely that someone was using this as a demonstration of a powerful 'botnet'.<p>As we have discussed in this column before, botnets are a collection of infected computers that can be remotely controlled by a single computer to perform any instruction that is sent out.<p>Many of today's viruses and worms are designed to slowly and silently 'recruit' agents for these networks as the larger the botnet, the more damage, spam, identity theft and other malicious activities it can generate.<p>This means that many of you that are reading this column are unknowingly participating in these attacks, because your computer has silently been infected and recruited as an agent on a botnet.<p>Once the network of compromised computers gets big enough, it's offered out to the Internet underworld as a 'rental by hour' weapon to do whatever the renter wants to do with it.<p>Unless you have built a business around your ability to use Twitter, you shouldn't really be too concerned about the attack as DDoS attacks of various forms have been going on for over a decade.<p>Past high profile DDoS attack victims include CNN, Yahoo, E-bay &#38; Microsoft just to name a few and these types of attacks will continue to plague the Internet.<p>The real awareness from this event should be that if we all made sure that our computers were kept up-to-date and avoided dangerous activities that expose us to becoming a silent agent, these types of attacks would be less likely.<p>Unfortunately, far too many Internet users are 'asleep at the wheel' when it comes to keeping their computer maintained and protected from the daily threats.<p>You are most likely to become infected by a botnet agent if you don't relentlessly keep your operating system (Windows, MacOS, etc.) and anti-malware programs up to date and especially if you are careless about what you click on or download (fake video scams are very popular at the moment).<p>Users of file sharing networks, adult content sites, crack code sites or any of the fringe activities on the Internet are at a much higher risk of being infected as what you think you are downloading or viewing is distracting you so the agent can slip in behind the scenes.<p>As I have said for years, if you live in a household with high-speed Internet and teenagers, you better make extra sure you understand what kind of activity is taking place on your computers.<p>Hackers know that teenagers are fearless on the Internet and the they always look to get something for nothing, so they plant infected files all over the Internet where they know teens like to congregate.<p>Botnet agents are very good at hiding from your security software, so in addition to keeping everything updated, if you notice that your computer's hard drive light or Internet activity lights are constantly flashing when you aren't doing anything, have a technically experienced person 'take a look under the hood' to make sure that you aren't unknowingly part of a botnet.]]></description>
		<pubDate>Fri, 7 Aug 2009 19:20:29 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21729</guid>
	</item>
	<item>
		<title><![CDATA[I have CA Anti-Virus and Windows XP with Service Pack 3 (SP3). My system keeps telling me that I have been infected with the Win32/AMalum virus and when I quarantine the files, Windows then tells me I need to replace needed system files and asks for my Windows XP CDROM. When the files are replaced, the "loop" starts over again with CA telling me I am infected! What gives?]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21724</link>
		<description><![CDATA[Over the last few days many users of CA Anti-Virus have been experiencing an issue with clearing a reported virus within the CA software called the <b>AMalum</b> virus. The fix detailed below was created by CA.<p>This information is relevant ONLY for customers who are running CA Anti-Virus AND are getting messages regarding a <b>Win32/AMalum</b> virus or if you are being asked to insert a Windows SP3 CD to repair some files.<p>This information does NOT impact anyone else and does not need to be followed if you are not having these symptoms.<p>To fix this issue, take the following steps:<p>1.       Open CA - You do this by double clicking on the CA Shield Icon in the bottom right corner of your screen down by your PC's Clock.<p>2.       Update CA - Click on the update button.  This will download the latest list of threats &#38; fixes.<p>3.       Open CA Anti-Virus advanced settings - Not anti-spyware... anti-Virus, you may have to click on CA-Anti-Virus to see the link.<p>4.       Open the quarantine - you do this by clicking on the button on the left, now the fun part,<p>a.       Look for items in the list dated AFTER JULY 4th, ignore any others.<p>b.      Identify the following files, there may be one or several of each:<p>i.      Net.exe<p>ii.      Netsh.exe<p>iii.      Verclsid.exe<p>iv.      Reg.exe<p>c.       We want to restore EACH of these files by clicking on the restore button above the file list for each file.  Leave the "attempt to clean... " tick box blank.<p>d.      Click OK to accept/confirm the restoration of these files... repeat for each file, we need to restore them one at a time.<p>5.       Run a Virus scan - Click on Overview and then scan my computer for viruses.<p>6.       Verify the scan found nothing.<p>This should bring your system back to normal operation. Additional information can be found at at <a href="http://www.neowin.net/forum/index.php?showtopic=794868">this website</a>.]]></description>
		<pubDate>Fri, 10 Jul 2009 10:05:42 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21724</guid>
	</item>
	<item>
		<title><![CDATA[I have a popup telling me that I am infected and to buy this software or that I need to run a scan when my current PC-Cillin is running a scan. What is this worm called and can you tell me how to remove it? - Jim]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21710</link>
		<description><![CDATA[Your description sounds like the long-running 'scare-ware' program generally calling itself AntiVirus 2009 (formerly AntiVirus 2008).<p>This family of scams has been very successful in fooling folks into paying for relatively useless software and the stakes are starting to get higher.<p>The most recent variations will attempt to convince you that your My Documents folder is corrupted and offers a free "fix" to repair the problem.<p>Once again, this is a scam to get you to install a rogue program that, in this case, actually 'encrypts' your My Documents folder and then will hold you hostage when you try to get back into your files.<p>The 'ransom' for giving you the key to unlock the encryption is $50, which is why the security community refers to this type of malware as 'ransom-ware'(if you get infected with this scam, DON'T pay the ransom! Unlock tools have been posted around the Internet or consult a professional).<p>The authors of these programs used a generic sounding name (AntiVirus 2009) which is used by many companies and boxes that look a lot like they were generated by the Windows operating system.<p>This combination is fooling a lot of users into thinking that the warnings are legit.<p>In your case, if the warnings are not coming from PC-Cillin (Trend Micro) then you know that you should be suspicious.  Likewise, users that have installed A/V software from companies like Norton, Webroot, McAfee, Panda or any of the major vendors should only heed warnings that are generated by the specific program that was installed as the protection system.<p>Paying attention to the details of the warnings is the best way to sidestep these types of scams.  In addition to making sure that a warning message is coming from your A/V program, look at the header (usually the blue bar at the top of the warning box) to see if it has the name of your program in it.<p>If you see things like FreeWebScanner or FreeScan or FreeAntiVirusScan or anything other than your security software's name, don't respond (click the X in the top right corner).<p>In order to get these pop-ups in the first place, someone has likely ventured into fringe websites (gambling, adult content, hacker sites, warez software key sites, etc.), downloaded files from a file sharing network like LimeWire or KaZaa or fallen for one of the many new e-mail or social media video scam messages.<p>If you get any kind of message saying that an embarrassing video of you is up on YouTube or checkout this sexy video of a girl, etc. and when you go there to see the video, you are prompted to update your Flash player or video 'codec', don't fall for it (unless you are just getting started with a new installation, you have everything you need to see online video already).<p>Your chances of getting 'infected' by the AntiVirus 2009 scam is exponentially higher than every getting infected by any of the Conficker worms that captured the world's attention last week because it relies on gullibility.<p>As with all infections, the more you pay attention to what you are clicking on and the more suspicious you are of everything that you see, the less likely you will become a victim of these scams.<p>The bad guys know that you aren't paying attention out there and they are getting better at distracting those that aren't constantly on their guard, so don't let them fool you.]]></description>
		<pubDate>Fri, 3 Apr 2009 15:58:47 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21710</guid>
	</item>
	<item>
		<title><![CDATA[What is the April 1st virus that everyone is talking about and how do I tell if I am infected? - Kevin]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21709</link>
		<description><![CDATA[A very stubborn Internet worm known as the Conficker (aka Downup, Downadup &#38; Kido) has been in circulation since late 2008 and specifically targets most of Microsoft's operating systems.<p>The third generation of this pest is being labeled Conficker C and it is far more dubious than the previous two versions.<p>The primary intent of the Conficker worm family is to infect computers with an agent that will turn them into a 'zombie' on a large network of infected computers referred to as a botnet.<p>Botnets are a collection of compromised Internet connected computers that can be remotely controlled by a single computer referred to as the command and control center to act as a group.<p>Once infected, any computer on a botnet can be given instructions from the command center to perform whatever function the remote hacker desires, including sending spam, infecting other computers or tracking keystrokes for the purposes of ID theft.<p>Conficker C is especially disconcerting because it is specifically designed to bypass and disable hundreds of popular security programs and websites and it has a trigger date of April 1st with a yet unknown payload.<p>To make things worse, Conficker C is very good at hiding from you and your security programs and has code that allows it to 'evolve' its ability to be detected and removed.<p>One of the first things it will attempt to do is turn off the automatic updates in Windows because it is exploiting a known hole in Windows.  If your computer has not been patched, Conficker can take advantage of the hole and make sure your system doesn't automatically download the patch by disabling your automatic updates.<p>To check if the automatic updates have been turned off, go to the Windows Control Panel and double click on the Security Center icon to get to the Automatic updates link.<p>If you find that your automatic updates have been turned off, it doesn't necessarily mean that you are infected, however, if you know that it was previously set to automatically update and now it's turned off, you would be wise to have a technically savvy person do a deeper evaluation of your computer.<p>The rest of the symptoms for detecting Conficker C requires a working knowledge of the Windows Registry and many of the anti-virus and security firms on the Internet have posted very detailed technical instructions for detection and removal (search Google for "Conficker C removal").<p>If you don't have a tech savvy resource available and are near any of our Data Doctors locations (www.datadoctors.com/locations), we provide free checkups to help those with concerns determine their computer's status.<p>One of the many ways that your system can get infected in the first place is from the usual suspects: e-mail attachments, rogue links in e-mails or on malicious websites and from downloading files from P2P networks such as Limewire and KaZaa, but a most recent exploit seems to be where many folks are getting infected.<p>The popularity of online video and especially YouTube has created a new trick for malware writers to get into your system.  If you click on a link that presents itself as a video, but when you go to play the video you get an alert stating that you need to update your "Flash Player" or you need a new 'codec', the chances are real good that it's a trick.<p>If you routinely view online video and you are suddenly told you need something new to view online videos, especially from a no-name website, be suspicious.<p>If a message comes up saying you need a new version of the Flash Player, don't accept the file that the website offers as an update.  Instead, go to http://get.adobe.com/flashplayer to install the latest version of the free video player, then go back and try viewing the video again.<p>If the same message comes up with a prompt to download an updated Flash Player, you will know it's a scam for sure.<p>In the same respects, if you get a message telling you that you need a new 'codec' to view a video, the safe response is to take a pass until someone technical you trust can see if you're video playback software is really that old.]]></description>
		<pubDate>Thu, 26 Mar 2009 12:05:18 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21709</guid>
	</item>
	<item>
		<title><![CDATA[How do you AVOID being part of a botnet? Is my Anti-Virus software enough? What software is there that will prevent unknowingly being part of a "Botnet"? - Brian]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21703</link>
		<description><![CDATA[Whenever the issue of "botnets" comes up, it creates lots of fear and uncertainty as well it should.  This form of malicious infection is responsible for just about all spam messages that we receive today as well as one of the most common methods of spreading infectious malware.<p>To review, botnets are a network of Internet connected machines that have been infected with a small program that allows a remote hacker to make use of the "zombie" computer at will.  Any system that is connected to the Internet could easily and unknowingly become one of these silent zombie computers.<p>Large botnets can be made of up 10,000 machines or more which gives the person in control the ability to wreak some serious havoc.<p>Spammers will routinely "rent" a botnet to send out millions of spam messages by getting infected machines to send out a small amount of spam each (10,000 infected computers x 100 messages each = 1 million spam messages).<p>By using botnets instead of a single machine to send out the million messages, not only can the messages get out quicker, it is nearly impossible to detect any one computer as a spammer (because of the low volume) and even if one is discovered, they are only responsible for a small amount of spam.<p>Avoiding the infectious programs is unfortunately not a function of a piece of software; no software will guard you against the biggest threat to becoming a zombie on a botnet... YOU!<p>Careless user behavior can easily allow these rogue programs to sneak past whatever security programs you have installed.  If you are an avid user of file sharing networks (Kazaa, aMule, BearShare, etc.), BitTorrent networks or fall victim to the various hoaxes that claim your computer needs a new program to view a video, you can become infected no matter how much security software you have in place.<p>Antivirus programs are pretty good at detecting the viruses that can introduce a botnet agent to your machine, but if they can sneak past your AV program (which can be easily accomplished by tricking you into installing a spoof program) then detecting the presence of an agent becomes much more difficult.<p>The malicious users that write the botnet programs have the upper hand because they know how today's antivirus, antispyware and other security programs function and can continually test their new creations until they figure out how to evade your security programs.<p>The key is in the clicks!  If they can get you to click on a link in an e-mail, a link on a rogue website, a link from a communication on your Facebook or MySpace page, a link from an instant message or download a file from a file sharing network that is pretending to be something that it's not, you don't stand much of a chance.<p>The standard advice applies to reducing your chances of an infection from a botnet agent:  Keep your Windows operating system up-to-date (the Apple OS is currently not a target of botnet infections because there aren't enough of them, YET), keep your anti-virus and anti-spyware programs up to date, make sure your software firewall is setup to stop any program from accessing the Internet from inside your computer without first asking for your  permission.<p>These types of complex attacks unfortunately require complex defenses to fend them off and the bigger problem is that the actual methods of infiltrating your computer continues to evolve.<p>This underscores the importance of having trusted resources for keeping up to speed on the latest attacks.  Those of us that are trying to help protect the general public are behind the curve because any new attacks are only discovered once they have been launched on the Internet.<p>The time between the discovery of a new threat and the likelihood of coming in contact with that new threat continues to decrease (often the same or next day), which is why keeping your protection programs up-to-date on an almost daily basis (all of them can be setup to check for updates every day) and finding resources that will keep you updated on the latest schemes designed to infect you is a good line of defense.<p>If you like what you read in our weekly columns, we provide weekly updates and warnings via our free newsletter which is located at: http://datadoctors.com/subscribe .]]></description>
		<pubDate>Fri, 13 Feb 2009 16:55:24 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21703</guid>
	</item>
	<item>
		<title><![CDATA[I heard that Dell settled a class action lawsuit and all Dell computer owners may have a claim in the settlement. I couldn't find anything on the Dell website, so how do we find out if we have a claim in this settlement? - Todd]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21699</link>
		<description><![CDATA[Computers have always been a much more complicated consumer electronics device to understand and purchase and the practices of various manufacturers and retailers that take advantage of the lack of understanding by the consumer has gotten worse over the years.<p>Dell has been embattled in allegations of misleading practices for years and it has finally come to a settlement on one of the larger cases.<p>On January 12th, 2009, the Attorney General's Offices of 34 states reached a $3.35 million settlement with Dell for allegedly misleading consumers about financing terms, warranties and rebates.<p>The states that participated in the settlement includes: Arizona, Arkansas, California, Connecticut, Delaware, Florida, Illinois, Iowa, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Montana, Nebraska, Nevada, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Washington, West Virginia, Vermont and Wisconsin.<p>According to the details, Dell will deposit $1.5 million of the $3.35 million into an account for the payment of restitution to consumers (and yes, the attorney's fees and legal costs outpace the settlement to the consumers once again!)<p>The Massachusetts AG's website posted this explanation: "Today's settlement resolves allegations by the States that Dell misled consumers about financing terms; failed to pay rebates in a timely manner, if at all; and failed to provide prompt repairs and other customer support that Dell promised to its customers. The representations occurred both verbally via telephone customer service and in writing on their website. "<p>Even though only 34 states participated in the group action, other states have also settled with Dell, including Texas where Dell is headquartered, so check with your state's Attorney General's website to determine if you are eligible and for instructions for downloading forms and filing a claim.<p>If you made a purchase from Dell after April 1, 2005 you must fill out a claim form and provide supporting documentation to be considered as a claimant.<p>Eligibility for restitution includes one or more of the following:<p>A problem with a Dell financing offer<p>A problem with a Dell rebate<p>A problem with Dell financing<p>A problem with a Dell repair, warranty or servicing<p>Filing a claim does not necessarily entitle you to restitution and having supporting documentation is not critical when you initially file the claim, however, the more documentation you have to support your claim (receipts, e-mails, phone records, etc.) the better your chances of getting some sort of restitution.<p>The restitution will be based on out-of-pocket expenses, not your original purchase amount.  If, for example, you had to pay a third party to perform service for something that Dell should have covered but refused and you have the documentation to support your claim, you may be eligible for reimbursement of the third party expense.<p>If the total amount of eligible claims exceeds the settlement amount, then those qualifying will get a prorated amount based on the total number of claims.<p>If you believe you qualify for restitution, I would highly recommend that you file sooner, rather than later as the logistics of getting the supporting documents reviewed could become an issue if you wait until the last minute.<p>The deadline for filing a claim are those postmarked by April 13th, 2009.]]></description>
		<pubDate>Fri, 16 Jan 2009 10:23:52 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21699</guid>
	</item>
	<item>
		<title><![CDATA[I have Norton Internet security, yet my computer has been infected with the Antivirus 2009 program. How can this happen and how do I get rid of it? - Glenn]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21698</link>
		<description><![CDATA[Your question underscores an often mistaken mindset of many computer users: If I have security software in place, I shouldn't get any infections.  Nothing could be further from reality.<p>Anti-virus/anti-spyware programs as well as firewalls are of no protection if the user of the computer decides to click on links that generate malicious code or download and run questionable files.<p>The user's interactions can easily override the installed protection and in some cases, actually disable your protection programs, but make it look like they are still running.<p>The fake antivirus program scams actually started last year as "Antivirus 2008" and it was so successful that it lives on as many variations including "Antivirus 2009".  A clever author of malware discovered a sneaky way to fool folks into installing malicious software into their computers, THEN extract money from them by posing as a legitimate program for removing the malicious software.<p>The reason that this approach has been so successful is that they very closely mimic Windows warning screens and legitimate antivirus programs.  Virtually every legitimate antivirus company has a product called Antivirus 2009, which further confuses the uninitiated.<p>The most common ways to come in contact with this infection include maliciously coded websites that popup a warning message that you are infected, e-mail messages that trick folks into clicking on a link, websites that claim you need to download software in order to see a posted video and links or downloads that are spread through social networking sites such as MySpace and Facebook as well as all of the Instant Messaging systems.<p>At this point in time, any form of popup or error message that refers to Antivirus 2008 or 2009 (including System Antivirus, Ultimate Antivirus, Vista Antivirus, Pro Antivirus or XP Antivirus followed by a number) should be considered extremely suspicious.<p>If you ever see any reference to a virus that is not specifically from the product that you have installed in your computer for protection, you should consider it to be a fake (Windows, itself won't ever alert you of a virus infection).<p>In the same token, any website that claims that you need to download a new video program or "codec" in order to view a video should be considered a threat.<p>Users of file sharing networks are at a high risk of contracting malicious software as it's often hidden within what appears to be a legitimate program (referred to as a Trojan).<p>The writers of malicious code count on users that are not really paying attention and at this point, they are fooling people by the millions around the Internet.  This type of infection is amongst the worst that I have seen in my 20 years of servicing computers.<p>Getting rid of the code once it has infected your system can be very involved and is different for the various versions of the infections, so don't attempt this without help if you are a novice.<p>Start by identifying the exact version of the malware that you have and placing it in quotation marks followed by the words 'removal instructions' in Google (Ex: "Antivirus 2009" removal instructions).<p>WARNING: There are so many people infected with this family of malware that many new scam programs that claim to specifically clean the code have popped up.  Some appear to be free programs that will only scan your system for free, but charge you to remove the code and often they don't even do that properly.<p>Since there are so many different variations of this infection, the exact steps are going to be based on the exact version of the malware that you have.<p>In our service business, we use a combination of several manual detection and removal processes (again, based on the exact version of the infection) along with multiple scanning programs to ensure that all potential re-infection avenues (temp files, restore points, modified dll files, etc.) have been removed or restored.<p>Depending upon how long and which version of the malware you have, you may also need to run a Windows repair after you remove the code as certain Windows files can become corrupted as a side effect.<p>If you know how to work with the Windows registry, operate in Safe Mode and have a current backup of your critical files, you should be able to find instructions online for removing the exact version of the infection that you have.<p>If not, consult a tech savvy friend or a professional as removing this infection properly (so that you don't re-infect) is not for the novice.]]></description>
		<pubDate>Thu, 8 Jan 2009 14:50:16 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21698</guid>
	</item>
	<item>
		<title><![CDATA[One of my nerdy friends told me that I should install a program called Threat Fire because it can do things that my anti-virus program can't do. Is this true and should I install it? - Samantha]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21678</link>
		<description><![CDATA[When it comes to protecting your computer from viruses and other malware (malicious software), there are two approaches to guarding your computer in the anti-virus arena; signature-based and behavior-based.<p>The most common programs use "signature-based" scanners that look for known signatures of malicious code in any file that is being scanned.  Most of the name brand anti-virus programs on the market (Norton, McAfee, CA, AVG, Panda, Webroot, etc.) are signature-based scanners.<p>Signature-based antivirus programs are very good at detecting malware because they are looking for the known signs at the code level for known malicious software.  The hole in the signature-based scheme is that new threats can't be detected until the infectious code has been discovered and added to the "signature" file of the anti-virus program (which is why it is so critical that you keep your anti-virus program up-to-date.)<p>This is also why anti-virus software can't always protect you from infections, especially when opening file attachments or manually downloading "free" software, because new threats have to infect systems before they become known.<p>Once the new threat has been identified, the 'race is on' to update the detection signature file and get it out to all the users before they come in contact with the new infection.<p>In the past, new vulnerabilities would be discovered and we would start to see exploits appear a couple of months later.  This gave the anti-virus companies ample time to create updated signature files and get them out to their users.<p>Today, it is very common to see "zero-day" exploits, which means as soon as a new vulnerability in any operating system or software program is discovered some bonehead on the Internet has written malicious code to take advantage of the hole the same day that the exploit was discovered.<p>In general, you shouldn't run two signature-based anti-virus programs on the same system because they will detect each other as potential threats and can cause various other system maladies (more is not better, in this case.)<p>The latest type of anti-virus protection is based on behavior-based scanners that look for specific types of behavior that are common with malicious software programs.  This behavior-based approach has a better chance of catching unknown threats that a signature-based scanner would not be able to detect until it was updated with the signature information.<p>The down side to behavior-based programs is that you're more likely to get "false-positives" on legitimate programs that you do want to have running on your system.<p>ThreatFire (www.threatfire.com) is a free behavior-based anti-virus program from the folks at PC Tools that can be added as an additional layer to systems that are already running a signature-based anti-virus program.<p>I would not recommend running it on its own and I would not recommend adding it to a computer that is already infected or is on a dial-up connection or that's experiencing performance issues.  ThreatFire's value comes from proactive protection against future threats, not current infections.<p>Generally speaking, if you have a signature-based anti-virus and you are very careful about what files you open and what websites you visit (heaven help all of you with teenagers in your house!) you will be just fine.<p>If you decide to add ThreatFire for additional protection, make sure your computer is completely clear of any malware before adding it (or any security software for that matter) or you could stand the chance of causing system lockups or reduced system performance as a result of the existing condition of your computer.]]></description>
		<pubDate>Thu, 21 Aug 2008 20:02:57 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21678</guid>
	</item>
	<item>
		<title><![CDATA[I keep getting phone calls from automated telemarketing systems even though I registered my number on the do not call list.. Can I look these numbers up on the Internet to find out who these people are and report them? - Allen]]></title>
		<link>http://datadoctors.com/help/questions/question.cfm?id=21671</link>
		<description><![CDATA[When the government announced the creation of a national "Do Not Call" registry ( http://www.donotcall.gov ) as a means to reduce the number of telephone solicitations, many cheered their efforts.<p>While creating this system helped in the beginning, the bad guys have been constantly looking for loopholes to get around the system.<p>Some are moving their operations off-shore and using inexpensive Internet based phone technology to continue to harass you.  In these cases (and at this point they are rare), the do not call list is a treasure trove of real numbers for those that have no intention of observing the US regulations.<p>U.S. based firms are skirting the law by setting up elaborate "affiliate networks" that exploit the provision in the system that allows businesses with a "previous business relationship" to contact you up to 18 months after the last contact, payment or delivery of a product or service.<p>Some have even setup complex contest offers in shopping malls and sporting events to get people to essentially sign away their rights to the Do Not Call registration.<p>Others are using call blocking so you can't figure out who they are and where they are calling from.<p>Legally, those conducting surveys, non-profit organizations or political solicitations are permissible even though you registered your number on the Do No Call list.  The latest scam is posing as an organization that is taking a survey in hopes of opening the door to a solicitation by asking if they can call you back.<p>Another area where they can still bug you is at your business.  The Do No Call list is designated for consumers only, so business-to-business calls are still going to occur and that may include your cell phone.<p>You can enter your personal cell phone number in the DNC registry, but if it's a business cell phone, it's not covered by the DNC regulation.<p>There are a number of Internet resources for determining who is calling you when the caller ID shows up, but be very careful where you go.<p>There are many websites setup that will charge you to determine who a phone number belongs to, even though you can get what you need for free.<p>I prefer sites where others have gotten the same call as you (based on the caller ID number being the same) and have already done the homework for you.<p>Checkout sites like http://www.CallerComplaints.com  and  http://www.800notes.com to quickly determine if you are getting the same calls as others and what they have determined them to be.<p>Another way to fight the automated telemarketing companies is to put a special tone that sounds like the "disconnect" sound at the beginning of your voice message greeting.  This will tell an automated system that the number has been disconnected via the tone and to remove it from their list, but humans will hear your answering message and realize that it is valid.<p>You can download the "disconnect" sound file from our site at:  http://www.DataDoctors.com/disconnect.wav .<p>You can report anyone that you think is violating the DNC registry parameters by clicking on the "File A Complaint" link at  http://www.donotcall.gov .]]></description>
		<pubDate>Thu, 3 Jul 2008 15:16:13 +0700</pubDate>
		<guid>http://datadoctors.com/help/questions/question.cfm?id=21671</guid>
	</item>
</channel></rss>
