• PC World
• »Computers

Security

Symptom: My computer is acting strangely--I think that it may have a virus.

Minor: If you don't have an antivirus package installed already, it's time to get one. When you think you have a virus, your first step should be to update your virus definitions and run a full scan. You should also drop by your antivirus software manufacturer's home page and check for fixes to all the latest creepy-crawlies; it can take antivirus companies 12 to 24 hours to respond to fast-breaking problems, though, so the update you need may not be available yet. As a stopgap--or for a second opinion--try one of the free antivirus scanners available online, such as Grisoft AVG Anti-Virus , McAfee FreeScan, Symantec Security Check, or Trend Micro.

Moderate: Two different virus scanners tell you that your system is clean, and you know you aren't uploading or downloading anything, but the light on your modem or DSL line keeps blinking like a firefly in heat. As long as you're running a firewall, such as ZoneAlarm or even the much-maligned Windows XP Internet Connection Firewall, you're probably okay. Chances are good that Windows is downloading patches automatically, without warning you. (To see whether ICF is running, first click Start, Control Panel, Network and Internet Connections, Network Connections. Then right-click your Internet connection and choose Properties. Finally, on the Advanced tab, check the first box.)

Dire: If your modem/DSL/cable connection light just won't go off, you may be in big trouble. There's always a lag of several hours--and sometimes up to a day--after a new worm appears before the antivirus software companies can update their scanners, and you may be under attack during that highly contagious initial period. Worse, some worms can block attempts to get to antivirus software manufacturers' sites--so if you're infected, you can't download the latest files to eradicate the problem. If you think that may be happening to you, unplug your Internet connection. Use another computer to check the U.S. Computer Emergency Readiness Team site to see if any debilitating worms or viruses are on the loose. CERT should have detailed instructions (or at least links to sites) explaining how to identify an infection and how to get your machine working again. Follow those instructions to the letter before you reconnect your computer to the Internet.