What to do if you receive an attack from vulnerabilities with flash?

[Urzu 7]

Hello. My father has had some computer issues recently and we think it may be from the vulnerability in flash. Recently, his computer crashed and then would crash about every 3 or 4 minutes after reboot. He went to a restore point. I then helped him by updating to the latest version of adobe flash (which was supposed to remedy the problem, I believe, or it least it should have) and then we went a step further and I disabled flash on his computer.

Now today his computer crashed again and he chose another restore point. Last I knew the computer went for longer than 3-4 minutes without crashing again. That is the last I heard of any issues he has had.

We ran virus scans and found no viruses and I run malwarebytes and the program took care of all problems it had found.

What should he do now? What should people do if they get an attack from flash or suspect to have an attack from flash?

[Marcus H.]

You should also try running TDSSKiller, just in case. It would deal with rootkits.

What should he do now? What should people do if they get an attack from flash or suspect to have an attack from flash?

Adobe and I think Trend Micro have already said that Flash is safe for the meantime. You can opt to keep Flash disabled just in case, but always have the system scanned (a quick scan should probably suffice) once or twice a week regardless.

I didn't have problems on my end (even if my Chrome continued using its built-in Flash), and I just did a full scan using the programs I have.

[Renegade334]

You absolutely certain it's not a hardware-related crash (weakening PSU, faulty motherboard, defective RAM, CPU overheat) instead of malware wreaking havoc on the OS?

[sneaker]

Originally Posted by Urzu 7

What should he do now? What should people do if they get an attack from flash or suspect to have an attack from flash?

Flash is only one attack vector for the hackers to get in, it does not tell you what they do once they are on your computer. And updating Flash will not remove an already existing infection.

So far I see no evidence this crashing problem has anything to with Flash in the first place. Do a complete format/reinstall of the affected PC. If that does not fix it you may have a hardware problem at hand as suggested by Renegade334.

[-KarumA-]

Originally Posted by sneaker

Flash is only one attack vector for the hackers to get in, it does not tell you what they do once they are on your computer. And updating Flash will not remove an already existing infection.

So far I see no evidence this crashing problem has anything to with Flash in the first place. Do a complete format/reinstall of the affected PC. If that does not fix it you may have a hardware problem at hand as suggested by Renegade334.

I agree, I don't think Flash is the problem here because Malwarebytes had already found plenty of viruses etc. So most likely the computer was already plenty infected before this vulnerability was even brought out.

A reformat should do the trick, be sure to give gramps an addblocker on his browser that solves a lot of the problems when it comes to people going online who do not know much of computers.

[Urzu 7]

Could there really have been an infection there already if his anti-virus software didn't pick up any viruses with the latest updates? If there was something there for a month or more, how could an anti-virus software miss an older threat with the most current virus definition/database updates?

[larethian]

When you say crash, what do you mean? Did the OS screen hang up? Did you get some errors, a blue screen? You should also check your system logs, if there are dumps or error messages, it can provide hints.

[Urzu 7]

It was the BSOD. My father used system restore points. I think what happened is that he would get the BSOD, and then when rebooting, the computer would run for 3 to 4 minutes and then just reboot. It would keep doing that unless he chose a system restore point. So it did the BSOD a few times, him resorting to the system restore point option each time.

[larethian]

So it's now ok?
I have not done this for a long time. But if you are able to read your system logs for each crash event, it can give some hints to what went wrong (google how depending on your OS version).
But in any case, if it's working now, then it has to be a SW issue and it must have been due to the changes since the working restore point to the next point (though it might be meaningless if you dont have a schedule for it and the one that's working is a year or two ago...). Another useful date would be the first time it happened, and try to recollect what has been done before then. These are just some diagnostic methodologies and of course they are not exhaustive and can not cover every possibility.

For BSOD, the type of message that appears on screen is also useful (assuming if the OS couldn't capture the state and log/dump it). So take a picture or something if it happens again.

[demonix]

Originally Posted by Urzu 7

Could there really have been an infection there already if his anti-virus software didn't pick up any viruses with the latest updates? If there was something there for a month or more, how could an anti-virus software miss an older threat with the most current virus definition/database updates?

No anti-virus can remove or detect 100% of viruses that are out in the wild, and there are some that are nothing but glorified placebos and would do more damage to legitimate programs.

[Urzu 7]

Is McAfee one of those placebo anti-virus products?

I know that brand isn't too good. I tell my father "Hey, there are better ones out there, I'll help you pick one of the best ones" but he is attached to the McAfee brand nonetheless, just because they used to be one of the best back in the day. I try but he still thinks McAfee is a good and relevant anti-virus company. : \

[SeijiSensei]

Perhaps your father should do a bit of research into John McAfee. You can start with this article in Wired or the NBC documentary. Personally, even though he no longer owns McAfee Associates, I wouldn't touch anything associated with him with the proverbial ten-foot pole.

I highly doubt the vector that seems to have affected your father's machine came through FlashPlayer unless he spends a lot of time on questionable video sites.

I'd suggest giving Ubuntu Linux a try myself if he wants a safer platform. Download the 14.04LTS ISO image and give it a spin. I use Windows to do my taxes and play a few games, but that's it.

[jdennis007]

If you want him to switch to a different antivirus program tell him "that Macafee is one of the first programs hackers will try to get around since more people have it on their computers, they know if they can get around it they can infect more people".
When you explain to people that way they are more likely to listen.

[IceHism]

Originally Posted by Urzu 7

Is McAfee one of those placebo anti-virus products?

I know that brand isn't too good. I tell my father "Hey, there are better ones out there, I'll help you pick one of the best ones" but he is attached to the McAfee brand nonetheless, just because they used to be one of the best back in the day. I try but he still thinks McAfee is a good and relevant anti-virus company. : \

You can just go to those AV comparison sites and show him how its not the top of the line anymore.
Its not a placebo though, its just not that good
I like ESET the best

[Cosmic Eagle]

If you go by how cutting edge their anti-malware research and publications are, Kaspersky and Symantec are still the top.


Problem with Symantec though, is that Norton screws your comp quite badly I find and it tends to be over-zealous in auto protection. You have to manually set exclusions for most uncommonly used programs. Great protection over all but not very user friendly I find.


I like Malwarebytes as a complement to my main AV though

[Spectacular_Insanity]

Originally Posted by Urzu 7

Is McAfee one of those placebo anti-virus products?

I know that brand isn't too good. I tell my father "Hey, there are better ones out there, I'll help you pick one of the best ones" but he is attached to the McAfee brand nonetheless, just because they used to be one of the best back in the day. I try but he still thinks McAfee is a good and relevant anti-virus company. : \

Pretty much. Norton is trash because it slows your computer down like you wouldn't believe, and McAfee barely updates their definitions. If you're going to use free antivirus, AT LEAST use AVG or Avast. The paid versions of both McAfee and Norton simply aren't worth it: There are better internet security software options that are both cheaper AND more effective.

I personally use Webroot combined with MalwareBytes; I have used Webroot for about 7 years now, MalwareBytes for about 3 years. As far it can tell, together they get pretty much everything under the sun even if I accidentally download and install a virus manually. They're pretty awesome, IMHO.

Kaspersky and Trend Micro are also fairly highly rated. My mom uses Kaspersky and she likes it quite a bit, though both Trend and Kaspersky slow down computers while doing full system scans more than I'd like, which is why I prefer Webroot. I have an SSD and I've never seen Webroot take more than 2 minutes to do a full system scan. Of course, you need decent internet to make use of Webroot's speed (because the virus definitions are server-based). If you have slow or unreliable internet, you're better off with something other than Webroot. Trend Micro is very popular among businesses, though I'm not sure why. A coworker mentioned to me that it had something to do with Trend Micro being more suitable for custom firewalls or something along those lines. Not 100% sure.


All that being said, higher-grade Antivirus protection in general is advisable, though for some people (like myself) it's more about peace-of-mind rather than need. My friend Mark doesn't use antivirus at all; whenever he gets a virus, he just does a factory OS reset, lmao.

Edit: The reason I like Webroot is that it doesn't slow down your computer, can scan in the background, has a very small filesize (only approx 15MB or so, it's super tiny), and it doesn't interfere with other programs. Downside is that it doesn't give you much feedback unless it's quarantining something (some people prefer a more "talkative" antivirus, I personally find it a positive because it's not in my face all the time), and it requires a persistent internet connection to work as intended. Though if you're worried about viruses, then you're probably on the internet anyway, so the latter may be a moot point.

[Urzu 7]

Well, it might not have been a flash attack. My father has a Dell computer and he worked with Dell support and they went into his computer remotely and removed some software that the guy said was the source of problems and his computer has been free of those problems I mentioned since. Still, I'd like him to get better anti-virus software. I've tried to tell him McAfee is not the way to go. He very much likes things his way and tends to be stubborn, but I'll try to get him to get a better anti-virus software in the future.

[demonix]

If he continues to be stubborn about the anti-virus situation, then create a limited account (where you have no permissions to install new software) and lock out the main account with a complex password so only you can access it if any new software (or updates) needs to be installed.

Also, don't bother with AVG free since that is one of the placebos I was referring to.

[Renegade334]

BitDefender, Kaspersky and Avira are usually the best rated AVs, but two of them are software with (usually) a 1-year (somewhat pricey, a couple years back) update subscription. Avira has a free version around, IIRC, but that only includes its AV module and not its FW.

BitDefender and Kaspersky are recommendations I frequently get from my friends and acquaintances, but BD (which I had on my PC like, six years ago) used to be quite heavy on resources and considerably slowed down my PC due to its hefty real-time protection engine. Kaspersky was sometimes criticized for exhibiting similar behavior (albeit boasting excellent disinfection rates), on top of occasionally doing weird things to your PC files' alternate data streams, but that might have been fixed a long time ago. ESET's NOD32 is well-known for its ungodly speed (it's written in assembly code, hence why your PC's CPU zips through it like Lindsay Lohan goes through a hangar full of alcohol), but it tended to be hit-or-miss; either it caught malware like a champ or completely missed it; things might have changed in the meantime. Norton...is the software everyone loves or hates; either they will say it's a load of digital bull**** or they'll praise its first-tier detection rate (hard to say who's right, tbh); either way, Norton had the nasty habit of bogging your PC down like BitDefender.

Avast! and Microsoft Security Essentials (AKA Windows Defender in the newer Windows versions) are the current household names (AVG used to be right up there with Avast! but they seem to have fallen behind) when it comes to free offerings; they're light in resources and totally free. Despite that, MSE appears to have dropped in the AV efficiency rankings (see my caveat emptor below) lately.

P.S. Even though some sites like av-comparatives can be used to get an idea of what's working well nowadays in the antimalware landscape, always take the reports with a grain of salt. These companies use their own stocks of malware found "in the wild" and stuff they cooked up themselves, and thus it is often tricky to say whether a certain piece of software will perform well until you are confronted with one of these undesirable situations and you end up seeing things for yourself. Regardless of whether your AV is well-rated or not, your best protection is good common sense: don't go anywhere shady on the Internet, don't download suspicious stuff or leave your personal details around and you'll cut down the risks by a good margin.