Tech Tip: How to clean out the Windows Hosts file if malware has tampered with it

Viruses attack computers not just by posting pop-up ads for phony software. They also cripple the computer's basic functions so that the virus is difficult to get rid of. One of the chief objectives of viruses is to prevent internet browsers from going to web sites chosen by the user. There are several ways that viruses steer a browser away from its intended destination. Sometimes they install a Proxy Server into the web browser (See Part 3 in this series, "How to clear the Proxy Server setting"). At other times a virus will insert unwanted IP addresses into the network settings (See Part 4 in this series, "How to reset Static IP addresses to dynamic IP addresses"). A third way that viruses hijack internet connections is rarer, but it does happen. If previous attempts at solving the problem do not work, it is worth investigating a Windows feature called the Hosts file.

The WindowsHosts file serves to map user-friendly and familiar web site addresses (such as Google) to the actual IP addresses that are behind such names (such as 216.239.51.99). The Hosts file is sometimes used by network administrators for managing fixed networks. Unfortunately, it is also a target for viruses that want to hijack a computer's internet connectivity. Fortunately, however, if the Hosts file has been attacked and unwanted material written into it, the file can be manually cleaned.

The Hosts file is located deep in the Windows folder. It is not easy to find, but following these steps will help you locate it, inspect it and-if necessary-clean it up.

First, you need to open up the Windows text editor called Notepad. (For Windows Vista, 7 and 8, this needs to be launched with administrator privileges.) Depending on which version of Windows you have, this is done differently:

1) In Windows XP:

• Click on the Start button
• Click the Run button in the menu
• Type notepad in the box, hit the Enter key
  
  

2) In Windows Vista:

• Click on the Start button
• Type notepad in the search box
• Right-click the Notepad program in the list
• Click Run as administrator in the drop-down menu
• Click Yes to allow the program to make changes (if this option appears on the screen)
  
  

3) In Windows Vista:

• Click on the Start button
• Type notepad in the search box
• Right-click the Notepad program in the list
• Click Run as administrator in the drop-down menu
• Click Yes to allow the program to make changes (if this option appears on the screen)
  
  

4) In Windows 8:

• Open the Charms menu and click on the Search Charm
• Type “notepad” in the Apps search window
• Right-click the program Notepad that appears in the results in the upper left corner
• In the taskbar that opens at the bottom of the screen, click Run as administrator
• Click Yes to allow the program to make changes (if this option appears on the screen)

When notepad is opened up, you will see a new window for the Notepad text editor that looks like this:

 

With the Notepad application open click on File in the menu bar, then click on Open in the drop-down menu (as indicated by the red arrow, above).

To locate the Hosts file, start with a double-click on the C drive in the left panel, then the Windows folder, the System32 folder, the drivers folder, and finally the etc folder. Once the etc folder is open, click on Text documents (*.txt) and drop down to the next option which is All files (*.*). If you are in the correct folder, you will see a list of 3 to 5 files in the window, as shown below. Now, double-click the Hosts file (circled) to open it up in the text editor.



The example below is of an actual hijacked Hosts file. All the lines of text that are preceded by the # sign are legitimate (comments). All the others were inserted by a virus to steer users in various countries to the unintended IP address of 74.50.127.5 (the web site designed by the virus author) instead of Google.



To remove the intruding instructions in the host file is simply a matter of deleting the lines that are not wanted. Using Notepad, move the cursor to the area (as highlighted, above) and delete those lines, leaving the original lines in the Hosts file.

A clean Hosts file will look something like this:

When finished editing, simply save the file, reboot the computer, and try to use your browser normally. Hopefully, the experience of being steered away from desired web sites will be gone, and you will be able to browse freely.

For more assistance contact Technical Support here.

Computer Viruses and How to Avoid Them

What is the difference between "malware" and a virus?

Malware is shorthand for "malicious software" and is used to describe an entire group of programs that includes advertising, tracking, key-logging, ID or credit theft or that cause other bad or undesirable activity. Simply explained, a "virus" is a computer program that invades or infects a user's computer by replication from another source (a disk, a USB flash drive, a network or the Internet), and then performs malicious functions on the new host computer. It's the malicious functionality that poses the problem, and for that reason viruses could be also called "malware."

 

A virus is just one type of Malware.


There are many different undesirable things that computer malware does. Earlier viruses simply performed mischievous tasks, such as deleting data or program files. But the authors of newer malware are driven by the desire to steal enough sensitive data in order to eventually steal money. Some are thus designed to scan and send information from a victim’s computer back to the author of the malware. Still others keep track of actual keystrokes typed by an unsuspecting user. Some plant annoying "popup" advertisements on a computer. There are a few types of malware that will perform any of the above, but also attach themselves to email addresses so that they get automatically sent to the user’s address list to replicate on an ever growing number of systems. Sophisticated malware might even install itself on the hidden "boot sector" of a computer hard drive, or try to make a network server vulnerable to a hacker (a person who gains unauthorized access to a computer network). But, the most common type of malware, by far, is the malicious program that deceitfully disguises itself as a good or useful program, seeking to get results which the user did not intend.

The fact is that malware has caused billions of dollars in losses to computer users. People have lost valuable data and have had personal and financial identities stolen. Whole companies have been compromised or crippled by malware infections. At the very least, the average user suffers from the slowdown or complete hijacking of their system through a malware infection. It is therefore imperative for computer users to know some basics about viruses, or "malware," in order to protect themselves.

Types of malware

1. Virus - The original malware. Malicious code attaches itself to other program files so that the execution of the host file also executes the malicious code. The malicious code also causes the virus to replicate itself by copying its code onto removable media or other computers in a network. Back in the 1980s, the first "in the wild" viruses spread themselves mostly through shared floppy disks, and performed everything from pranks to data destruction. By the 1990s, Internet "bulletin boards" were unwitting spreaders of viruses. Today, very little malware is of the virus type.
2. Trojan - These comprise 75% or more of all malware, according to security experts. As the name from classical Greek mythology suggests, Trojans operate by deceit, tricking a computer user to trust a fraudulent program. Most Trojans are actually a complex of files - pop-ups that steer the unsuspecting user to a harmful website, or just install more malware, even when clicked to shut down; downloaders that bring in supporting malware programs; hijackers that shut down operating system functions and security; bots that may use the host computer as a slave to the malware author’s intentions; backdoors that make an infected computer open to free scanning by the malware author. Trojans operate independently of other programs, and thus do not need to attach themselves to other executable files as a classic virus does. The most popular Trojans, these days, masquerade ironically as anti-virus programs. The user experiences sudden low computer performance, and then sees a pop-up offer with a phony virus scan report, urging the user to purchase the program offered as a solution to the computer problems they are experiencing. Naive and unsuspecting users then type personal information into the form provided (including name, address and credit card info). This information is never used to purchase the phony software. Rather, the Trojan authors use the stolen info to open new credit card accounts in the user’s name, and then sell those accounts on the underground market within minutes of receiving it.
3. Worm - A Trojan that has the capacity to infect computers from other infected systems by scanning for IP addresses on vulnerable computers on the Internet or within a network, then replicating itself. Many phony anti-virus programs start out as a worm infection. Worms are also notorious for attaching themselves to email address lists. Users falsely believe that Trojan infections come mostly from certain "dangerous" or risky websites. In truth, worms may employ any website that users visit as stepping stones to their computers.
4. Spyware - Software programs that "spy" on users, observing data, keystrokes, screens and/or web sites visited. This is a broad category of malware and includes everything from adware to keyloggers (see below). Unlike viruses, Trojans and worms, spyware typically does not self-replicate by infecting other computers or removable media, but is downloaded through Internet connections.
5. Keylogger - A particular type of spyware that is designed to steal "live" information. It secretly keeps track of such things as the user’s keyboard keystrokes, video screens, or streaming network data, and transmits that information back to the malware author. This malware attack is more rare, but it poses the serious risk of loss of private identity information, including credit cards, bank account info, Social Security numbers, and computer passwords.
6. Rootkit - A stealth program that allows continual unauthorized access to a computer by a person unknown to the user. This malware replicates itself on a victim’s computer usually as a worm or a Trojan. It quickly shuts down user account controls and security designed to prevent unauthorized access. It can then steal and transmit info or simply provide a "back door" for a hacker. Rootkits are usually quite sophisticated, and often include the ability to deflect detection from weaker and more modest anti-virus programs.
7. Phishing - Typically an email message that is "fishing" for personal information. The victim receives a randomly sent message that appears to be an official request from an Internet service provider, a bank or some other service or organization. The graphics in the message typically look professional and authentic, though the grammar in the message is sometimes suspiciously bad. An appeal is made to the user to provide "lost" information. However, NO organization or bank will ever seek information this way. Such fraud should always be reported to the organization or service that is being used as a cover.
8. Adware - The most benign of all types of malware, it can still annoy users with commercially-charged pop-ups and reduced system performance. Adware often gets installed without user’s consent, and often when downloading program updates, trial software and games or other services. Some adware functions as spyware by tracking the user’s favorite web sites and targeting the user with advertising that is likely to be the most appealing. Adware can hijack web-search functions. The most common form of adware is the browser "toolbar," which ostensibly provides services such as search windows and quick-access icons. These toolbars slow computer and Internet performance, take screen space from web pages, and can even be a conduit for more serious malware.

 

Prevent and cure

How to Prevent Malware Infections

The best way to be free of malware infections is to take preventative measures rather than relying upon removal after infection. Once infected, a computer is often very difficult to clean. Some malware will destroy a computer’s operating system, or make it so difficult to recover that wiping the hard drive and reinstalling the operating system, programs and data is the only solution. This is usually quite a chore, may be expensive if the user does not have the technical know-how and may be personally costly if the user’s own data has not been previously backed up. There are several preventive measures that every computer user can take:

1. Utilize a good anti-virus program. There is no substitute for this measure. Avoid the seduction of free anti-virus programs and the ones that come with Internet service providers, as they only do a mediocre job of prevention. A $40 to $50 investment in a good anti-virus program with an annual license to update itself regularly is pretty inexpensive insurance.
2. Manually scan your computer with an anti-virus program. All good anti-virus programs come with manual scanning features. Most will let you set a schedule for automatic scanning. This is good to do once a week, or every month, and especially if you see any suspicious activity on the computer screen.
3. Update key programs every time. The Ziff-Davis network cited a study done in Denmark earlier in 2011 utilizing results from half a million computers. The conclusion of the study was that some 99% of common malware infections could be avoided simply by updating Windows security patches, Internet Explorer, Java, Adobe Flash and Adobe Reader. The reason? Malware authors attempt to gain access to computers through weaknesses which the updates are written to prevent.
   (See: ZDNet - The Ed Bott Report, Oct 7, 2011. Summary: Want to avoid being attacked by viruses and other malware? Two recent studies reveal the secret: regular patching. A fully patched system with a firewall enabled offers almost complete protection against drive-by attacks and outside intruders.
   www.zdnet.com/blog/bott/if-your-pc-picks-up-a-virus-whose-fault-is-it/4039)
4. Use a hardware firewall. The SPI (Stateful Packet Inspection) firewalls that come with most newer routers is a great way to close unused ports and prevent hackers from intrusion. Even single computer homes and offices can benefit greatly from the use of a router. While utilizing a router’s hardware firewall, you may also use your operating system’s software firewall. Beware of using third-party software firewalls (such as those included with anti-virus software) which serve to slow down a computer. If you’re using a wireless router, make sure to encrypt your network with WPA or WPA2 level encryption, never the older and simpler WEP encryption.
5. Uninstall browser toolbars. Toolbars are the quarter-inch wide strips that layer near the top of a web browser. While some toolbars may be useful on a limited basis, they all steal screen space and clog up your Internet bandwidth only to provide revenue for the author. By definition, toolbars communicate with their authors, thus opening a vulnerability "hole" while the PC user is online. Utilizing the add/remove function in Windows machines is the best way to rid a computer of these browser plugins. Some of the most common toolbars include: AIM, AOL, Ask, Bing, Crawler, Dogpile, eBay, Google, My Way, My Search, My Web Search, Yahoo, etc.
6. Regularly delete browser cookies and "Temporary Internet Files." This is performed from within the browsers, themselves. Malware can hide amongst these files.
7. Do not click on pop-ups - shut them down alternatively. If you DO get a suspicious pop-up window, try using the "Alt-F4" combination to get rid of it rather than clicking on it and risking an unintended installation of a virus. If that combination does not work to close a window, use the Microsoft Windows "Task Manager" ("Ctrl-Shift-Esc") and the "Applications" tab. Simply click once on the listed application and then click the "End Task" button. After a forced-close, some browsers will attempt to recover the last page you were on the next time you restart. Select "No" or have it go to your Home Page instead.
8. Use an Anti-Malware application and keep it updated. While Anti-Virus applications will detect and block viruses, worms, and other programs that spread by design, they do not always detect or block programs that you allow to install on the computer. Clicking on pop-up advertising windows, opening, email or Instant messaging attachments, or downloading and installing games or other programs can trigger the installation of an undesirable application. Using a program to scan your computer periodically for programs your antivirus may miss is recommended. Programs like MalewareBytes, Spy Sweeper, or SuperAntiSpyware may catch and remove malware.

Security and Urban Legends

While it is important to be informed about the facts regarding malware, methods of infection, and methods of prevention, it is also just as important to know that there are some common public beliefs that are just not true. Here are some common "urban legends" that are patently false:

1. Anti-virus software companies conspire to write viruses so they can stay in business. Many computer users are tempted to believe this falsehood, but only because they do not understand how lucrative the criminal activity of malware authoring has become. If legitimate software companies were the actual criminals, someone would have blown the whistle years ago. The actual malware criminals enjoy both anonymity (they attack unseen from anywhere in the world) and impunity (there are limited resources and jurisdiction for prosecuting them, even when observed).
2. Viruses come mostly from questionable web sites. Computer users also typically believe that infections are the result of using social, illegal downloading or pornographic web sites. However, the fact is that malware infections such as worms and Trojans can attack from anywhere, and may use any legitimate and otherwise well-guarded web site as a stepping stone from one infected PC to another.
3. Free anti-virus programs are just as good as the paid-for programs. This is demonstrably not true. Observe the results of serious testing labs. If ever there were a good application of the "you-get-what-you-pay-for" principle, it would apply with anti-virus programs. Simply put, you pay for regular and effective program and virus definition updates. Licensed programs are anxious to push out good updates - often daily - to their customers. They want our business year after year, and therefore work hard to distribute good products, and largely succeed at it.
   (See: AV Comparatives - Independent Tests of Anti-Virus Software. www.av-comparatives.org)

Summary

Don’t let the threat of malware infections stop you from using the rich resources of computing. Just use your computer wisely. Utilize the measures outlined above. And exercise a healthy dose of suspicion about what you see on your computer screen, short of being paranoid. There is no reason why the careful computer user cannot buy things with a credit card, do banking and investments, and send critical business data over the Internet If possible, encrypt the data you are sending or utilize a VPN (Virtual Private Network). Certainly, you should never carry out financial transactions over a public wireless network. In spite of the risks - which are present primarily in the midst of carelessness - computers provide a powerful tool for use both on and off the Internet

For more assistance contact Technical Support here.

Installing ESET Version 5 on top of Version 4

This guide will show you how to install the new version of your ESET NOD32 Antivirus over the top of version 4. It is recommended that you print or bookmark this guide as the system might be rebooted during the process.

1. Open up Internet explorer, clear the address bar and type in www.eset.com to go to ESET´s webpage.
   
   


2. Click on Download on the menu bar, and then click on "Take me to my download"
   
   
   


3. Click on the download button for Antivirus 5.
   
   


4. Click on Run
5. Confirm English is selected, and then Click on the Install button.
   
   


6. A download window appears with a progress bar
7. Click on "I Accept" on the End User License agreement.
   
   


8. Put the check mark in for Detection of Potentially Unwanted Applications, click on Next.
   
   


9. Install window will appear, it will complete five passes to 100%.
   
   


10. Click on the Finish.
    
    


11. If the icon is orange for ESET on your system tray, open ESET
    
    


12. Click on start, all programs, ESET, ESET antivirus.
    
    


13. Click on the home tab, it will tell you what action is required next.
    
    


14. It will likely tell you that you need to restart the computer.
15. Once the computer is restarted, the icon should appear green and the process is complete.

For more assistance contact Technical Support here.

How to temporarily disable Antivirus and Antispyware in ESET NOD32 version 5

ESET NOD32 Antivirus and Antispyware can on occasion interfere with certain activities. This guide will walk you through how to temporarily disable Antivirus and Antispyware in ESET NOD32.

1. Open the ESET software by clicking Start » All Programs » ESET Folder » ESET NOD32 Antivirus folder » ESET NOD32 Antivirus.
   
   


2. Click Setup on the left.
   
   


3. Click on the Enabled link for Real-time File system protection.
   
   


4. Click on the drop down arrow key for Time Interval, select "Until next restart".
   
   


5. Click on Ok, and close the ESET window. ESET is now disabled until the computer is restarted, allowing you to continue with your activity.
   
   

For more assistance contact Technical Support here.

How to Download and Install ESET Version 5

This guide will show you how to download and install the new version of your ESET NOD32 Antivirus or ESET Smart Security. It is recommended that you print or bookmark this guide as the system might be rebooted during the process.

1. Close any programs, including the browser window that was used for the renewal process. Keep your printed copy of the username and password available.
2. Click the Start button in the bottom left corner of the screen.
3. Select All Programs, located just above the start button.
   
   


4. Locate and open the ESET Folder
5. Open the ESET NOD32 Antivirus or Smart Security folder.
6. Click on Uninstall to begin the removal of the old software.
   
   


7. On the new ESET NOD32 Setup Wizard, click Next
8. Choose the Remove option if prompted.
   
   


9. If prompted with a questionnaire, select the "I Am Uninstalling ESET NOD32 Antivirus Only Temporarily and Plan to install it again" option.
10. Click Remove on the next screen to begin removing the program.
11. If the ESET NOD32 Setup displays a screen titled "Files in Use", select the "Do Not Close Applications. (A Reboot Will Be Required)" option and proceed.
12. Wait a few moments as the program is uninstalled.
13. When prompted, reboot the computer.

Download New ESET Software

1. Click on the Start button in the bottom left.
2. Select All Programs located just above the start button.
3. Open Internet Explorer from that list.
4. In the address bar at the very top of the Internet Explorer window, erase what is in the bar, type in "www.eset.com" (without the quotes), and press enter.
   
   


5. Click on the Download button on the main menu.
   
   


6. On the ESET Download Page, click on "I have already purchased ESET security software. Take me to my download."
   
   


7. If you are using Windows XP or Windows Vista or Windows 7, click on the green Download link next to the ESET NOD32 Antivirus.
   
   


8. When prompted, choose Run instead of Save and wait a few minutes while the program downloads.

Install New ESET Software

1. Once the program finishes downloading, choose the Run or Open to start the installation. If there is a security message from Windows, choose the Allow or Run option to continue the installation.
2. On the new ESET NOD32 Installer, click on Next to begin the installation.
   
   


3. Read and accept the End-User License Agreement.
   
   


4. When prompted, enter the new ESET Username and Password, obtained after finishing the Activation process. The username begins with "EAV-".
   
   


5. Put a check for the Detection of Unwanted Programs.
   
   


6. Wait a few moments as the program installs. If prompted for permission to "Continue" or "Allow", always allow the setup to continue.
7. When the installer is finished, the ESET renewal has been successfully completed.
   
   

That is it. Your ESET security program has been renewed and updated.

For more assistance contact Technical Support here.

Creating a Strong Password

This document provides some simple guidelines for creating a user account or network access password which combines a higher level of security with a better chance of remembering it.

Why Do I Need a Password?
A personal computer system is very fast, but also very literal. It has no real means (in the human sense of the word) of distinguishing good data from bad or authorized commands from unauthorized. It simply does what it is told, for good or for ill.

With this fact in mind, it is not surprising that there are malicious entities (this writer hesitates to apply the word 'people') who are all too eager to force other peoples' computers to do things their owners would not wish them to do.

The Hack Attack!
Some computer users set up accounts with no password at all, or use a very simple password (a proper name, a simple number sequence or a string of repeated letters. Or, worse still, use their very user account name as their password! One technique used by malicious entities against such users is the dictionary hack. A computer is set up to transmit codes over a network, running through a list of words, names and number sequences.

If a match can be found with some other computer's user name and password, the "entity's" computer may then be able to transmit commands to the "victim's" computer, just as if it were a local user with a keyboard and mouse.

Piece of String vs. Combination Lock
Security experts typically recommend that computer user accounts should each be associated with a distinctive, strong password. The typical rules for defining a strong password are as follows:

• 8 to 16 characters in length


• Not a proper name or a "dictionary word"


• A mixture of uppercase letter, lowercase letters and digits.


• Optionally, includes "special characters (understroke, dollar sign, brackets etc.)

While it is true that a password such as "qqKJ_932vHc" meets the definition of a strong password, most computer users would probably have a rough time remembering it, until they had entered it many times from a "cue card". However, there is a technique which has been tested with a wide variety of Customers in a Micro Center Technical Support office, which may offer you a way to generate a strong, memorable password.

1. Begin with a word of your choosing. Example – sailboat


2. Separate the syllables. sail boat


3. Misspell the word in a phonetic way – for example, use a "q" instead of a "k", or a "y" instead of an "i". sael bowt


4. Place one or more numerals between, and / or on either side of the modified syllables. sael2bowt5


5. Substitute or insert at least one uppercase letter, somewhere other than the first character. sael2bowT5

You now have generated a strong password ("sael2bowT5") and a starting word ("sailboat") to use as a password hint. The password hint is designed to appear in a user account login window, to jog the user's memory and point the user toward the actual password.

Finally, if your operating system includes this feature, create a password reset file and write it to an optical disk, flash-drive or a memory module. This file will help you reset your own user password, should it be forgotten, mislaid or compromised.

How to run an ESET Scan in Safe Mode

This guide will show you how to run an ESET NOD32 or ESET Smart Security scan in Safe Mode. This is useful when you have a virus that ESET is not able to remove in Windows normal mode. It is recommended that you print this guide as the computer will be running in safe mode and the guide will not be accessible through the Internet.

1. Print this document and keep it available as it will be needed and it will not be accessible via the Internet for the duration of this guide.
2. Turn the computer all the way off. Do not restart the computer, leave it powered off.
3. Locate the F8 key along the top row of the keyboard.

4. Power on the computer and immediately start tapping the F8 key repeatedly about once per second. The Windows Advanced Boot Options menu will be displayed.
5. On the Windows Advanced Boot Options menu, use the arrow keys on the keyboard to select “Safe Mode” and press Enter.
   Note: The mouse will not work on this screen.
6. If prompted to "Choose an Operating System", press Enter on the default selection.
7. When the login screen appears, choose an account with Administrative Privileges. If you are not sure, choose the account that is normally used.
   - The colors will appear differently and the size may be different. This is normal for Safe Mode.
8. If using Windows XP, a screen with a Yes or No option may appear. Click Yes on that screen.
   If using Windows Vista or Windows 7, a screen titled “What Is Safe Mode” may appear. Close that screen, it is not relevant for this purpose.
9. Click on the Start button in the bottom left, and choose All Programs.
   
   
   
10. On the All Programs menu, select the ESET folder, and then ESET NOD32 or ESET Smart Security depending on the installed version.
    
    
    
11. The ESET NOD32 Antivirus – Safe Mode window will appear and prompt for a Yes or No answer. Click on the Yes button to being the scan.
    
    
    
12. The ESET Scan will begin.
    
    
    
    
    It is normal for the ESET program to be denied access to certain system files.
13. The ESET scanner may scroll through many lines of information. Once it is finished, it will display a status message inside this window. Reboot the computer to get back in to Windows normal mode.

Virus ALERT: Palladium Pro and System Tool

The "Palladium Pro" and "System Tool" are the latest versions of more fake anti-virus programs similar to  "Security Tool". Both programs pretend to operate as a virus scan, but in effect, install a computer virus which takes over your system’s processes.

Palladium Pro Program

The Palladium Pro virus works by launching a bogus Microsoft Security Essentials alerts and stating that the system requires a virus scan. Once the virus scan is initiated, Palladium Pro installs the malware onto your system. To remove the Palladium virus, you will need to terminate the application’s process and install Malwarebytes to remove the program.

To Remove Palladium Pro:

1. Start the Windows Task Manager by clicking Ctrl, Alt, Delete together.
   
   
   
   
   
2. Click on the Processes tab.
3. Locate the Palladium program named “palladium.exe”.
4. Select the palladium.exe process and click End Process. This will suspend the Palladium Pro software.
5. In the Windows Task Manager, go to File » New Task.
6. Type in “explorer.exe” in the Open field, then click OK. This will open your Windows desktop.
7. Download a copy of Malwarebytes software here » http://www.malwarebytes.org
   
   
   
   
   
   
8. Follow the instructions to run a system scan and file removal.

System Tools Program

The System Tools program is associated with the same family of fake anti-virus programs as Security Tool. This software floods the system with false virus alerts and instructs the user to run the virus scan.

To Remove System Tools:

1. Start the Windows Task Manager by clicking Ctrl, Alt, Delete together.
2. Click on the Processes tab.
3. Locate the program file. It is usually represented by a set of random characters followed by the ".exe" extension.
4. Download a copy of Malwarebytes software here »http://www.malwarebytes.org
   If your computer prevents you from downloading the file, you can download Malwarebytes from another system and copy the file to your infected system to install. Or, you will need to update the Internet Options in Internet Explorer by modifying the default LAN settings to NOT use a proxy server for your LAN settings.
5. Follow the instructions given by Malwarebytes to run a system scan and file removal.

IMPORTANT: Never install any program or run a virus scan without verifying the source. If you suspect that your system is infected, use industry-approved programs such as ESET, McAfee, Symantec or Webroot. If you need further assistance, contact Micro Center Tech Support at www.mctsol.com.


Reference:
Bleepingcomputer.com. Palladium Pro Removal
http://www.bleepingcomputer.com/virus-removal/remove-palladium-pro

Bleepingcomputer.com. System Tool Removal
http://www.bleepingcomputer.com/virus-removal/remove-system-tool

Microsoft Support Forum. Palladium Removal.
http://social.answers.microsoft.com/Forums/en/msescan/thread/6e837554-4374-4709-8e51-e878ac8817e1

Microsoft Support. Microsoft Windows Malicious Software Removal Tool.
http://support.microsoft.com/kb/890830

How to Run the ESET Online Anti-Virus Scanner

If a working Anti Virus program is not available on a computer, the ESET Online Scanner can be used to detect and remove virus infections. To use the ESET Online Scanner, take the following steps:

1. Go to the page: http://www.eset.com/online-scanner.
2. Click on the ESET Online Scanner button.
   
   
   
   
   
3. Check the box by "Yes, I accept the Terms of Use" and Click the Start Button.
4. Allow the program to run if prompted by Windows User Account Control.
5. The default setting is to remove found threats. The following Advanced settings are available:
   
   
   • Select the type of applications scanned
   • Select the target drive(s) to be scanned
   • Use Customer Proxy Settings
   • Show a list of other installed Anti Virus software installed on system
   
   
   
   
   
6. Once the desired settings have been made, Click on the Start Button.
7. During the scan, threats that are found will be displayed.
   
   
   
   
   
8. Once the scan is complete, there is the option to "Uninstall application on close" by placing a check in the box. This will require the files to be downloaded again the next time ESET Online Scanner is run.
9. Click Finish.

Reference:
ESET. Online Anti-Virus Scan.
http://www.eset.com/online-scanner

UPDATE: ESET Renewal Setup

This guide will walk through the first step in renewing the ESET NOD32 or ESET Smart Security program. First determining whether you have ESET NOD32 or ESET Smart Security, and then proceeding to purchase the renewal.

Determine the ESET Program Version:

1. Close all open windows and programs on your computer. Be sure to save any work in open documents or files.
2. Click on the Start button in the bottom left corner of your screen.
   
   
   
   
   
3. Open All Programs, located just above the start button.
4. Select the ESET folder and open up the ESET Antivirus program. Write down whether it says ‘ESET NOD32’ or ‘ESET Smart Security’, you will need this later.
   
   
   

Locate ESET Username or Serial Number:
Note that only one of the two is necessary. If you already have your “EAV” username or your ESET Serial Number, proceed to Step 3.

1. The ESET Serial Number located inside the ESET CD case, opposite the CD. If this information is not available, proceed to the next sub-step to find the username.
2. On the new ESET window, click Protection Status in the top left. A message will display detailing the expiration date and the ESET Username. Write down the case-sensitive ESET Username and include the dash when writing; this will be used later on.
   
   
   
   
   
3. The ESET Username begins with “EAV-“, followed by eight numbers.
4. If the “Your license will run out shortly” message does not appear and the Protection Status is green and on Maximum Protection, you do not need to renew your ESET program yet. The program will notify you when you are within 10 to 14 days of renewal.
5. Click on the link that says Click Here to Open the Purchase Page.

Choose Renewal Option:

1. On the new web page that appears, enter the ESET username in to the ‘Username’ field and click Submit.
   
   
   
   
2. If the username is not available, enter the Serial number. Do not enter both the username and the serial number.
   
   
   
   
   Note that the username and serial number in these examples are fictitious and will not work for renewal.
3. The next page contains renewal options for ESET NOD32 and ESET Smart Security, separated by program. Whether it is ESET NOD32 or ESET Smart Security depends on what you wrote down earlier.
   
   
   
   
   
   
4. Choose the license based on how many computers (listed as “Users”) the program will be used on and how many years the renewal will be good for. Example: If you want a one year license for three computers, get a 3 User, 1 Year item.
5. Once you pick the package, click Add to Cart for that item.

Buy Your Renewal:

1. On the Shopping Cart screen, click on Checkout on the right side.
2. Enter the information as with any online purchase.
3. Note that while it appears an item will be physically shipped, the digital download only copy of the ESET software does not ship a physical item.
4. Click the Accept button to finalize the order.

Once you’re finished here and you see the “Order Confirmation” page, keep that window open and go to the next part of the tutorial – ESET Renewal, Step 2.