Antivirus programs installed online are useful

Virus alarm on the PC? Do not panic!

Arne Arnold

Antivirus programs often scare the user with drastic sounding warnings. These are only in rare cases real virus reports. Here you can find out what is really behind most of the reports and how you should react to them.

Virus alert! A loud siren also sounds. Such threatening-sounding messages from the antivirus software can blow a user's blood pressure up. In other cases, the messages from the tools are so incomprehensible that you simply don't know how to react. For both cases, we provide specific examples and tell you how you can best react

Endurance test:39 antivirus tools put to the test

Virus found

The message: "Safety notice. Real-time scanner detected 2 viruses or unwanted programs. The access was denied. Please select the further action: Remove, Details ". This is a rather neutral virus warning from Avira Free Antivirus.

This is behind it: Your antivirus has found two viruses here and stopped processing them. Since the "real-time scanner" (virus monitor) has reported, the two virus files have only just been written to the PC. You are probably currently on the Internet or have copied data from external sources.

How to react correctly: Basically, your system should still be safe, because the antivirus software has become active. Nevertheless, you should take some time now, save and close open documents and click on the "Details" button provided. If your antivirus software does not offer a "Detail" button in a comparable message, then open the program and look for the area with the log files. Or you go to the quarantine area of ​​the antivirus software and look at the files found there. Make a note of all information provided by the program, the log file or the quarantine. Only in the rarest of cases will your program report a unique virus name such as Tesla-Crypt or Autolocky. In most cases, you will be given a pest class that was recognized by its basic characteristics. One such message from Kaspersky Internet Security is, for example, “Heur: Trojan.Script. Generic ". The message states that the program's heuristics have detected a Trojan that is trying to spread via a script file. Heuristic (Heur) means that the antivirus software has detected the malware in typical code parts. So that you can get more information about the pest from the Internet, you need as much additional information as possible about this name. What is the name of the file in which the malware is located? In which folder was it found, which other files are in this folder. Where does the file come from.

The point is to find the source of the virus files so that you can stay away from them in the future. You can check your antivirus website for additional information. However, there is often nothing more than the installed antivirus program itself. That leaves Google, which can often provide additional information.

Basically: If an antivirus program sounds the alarm, it is very reliable in blocking malware and can also easily undo any manipulations that have already occurred on the system. If you still have a bad feeling after a virus report, you can also decide to reinstall Windows. Of course, you must first back up your data. This checklist will help.

False alarm: However, anti-virus programs often report harmless files as viruses. If you suspect that your security tool has generated such a false positive, then you should have the faulty file investigated further. To do this, first free the file from the antivirus software's quarantine. Don't worry, as long as you don't double-click the file, nothing can happen. Then go to www.virustotal.com and click on “Choose One” to upload the file to the website. There it is analyzed by around 60 antivirus tools. This is how you can check whether a file is actually dangerous. It is best to repeat the test after a day in case you have a completely new virus that is not yet recognized by all tools. Some programs report files that they believe are potentially dangerous. The tools then indicate that you should only start the file if you are certain that it is safe. In such a case, you can also use the www.virustotal.com service.

Tip:This is how you protect your mobile device from viruses and other pests

PUA or PUP found

EnlargeThe Adwcleaner tool knows many unwanted programs and can eliminate them completely.

The message:Norton Security reports: "Auto-Protect handles security risk PUA.InstallCore".

This is behind it: Norton Security's virus monitor detected an adware and blocked it. PUA stands for “Potentially Unwanted Application”. Eset and other antivirus manufacturers call such programs "PUP", which is the abbreviation for "Potentially Unwanted Program", which means the same thing.

So it is not about destructive programs or spy tools, but code that displays advertisements. These modules often come on the computer together with freeware or are part of browser toolbars.

Actually, you can be happy about the message, because not all antivirus programs also deal with adware. Because an adware program is almost never wanted, but it is usually not clearly harmful code either. Because the software often has halfway useful functions on board. Some users, for example, appreciate the possibilities offered by a browser toolbar. These additional menu bars for the browser show, for example, the weather for a specific location.

Until a few years ago, most antivirus programs hardly bothered about adware. The reason was the often complainant distributors of adware. They emphasize that their programs also have desirable functions for some users. When an antivirus program blocked adware, the manufacturer of the protection software was often sued for it.

This is what happened to Kaspersky in 2007. The Russian antivirus manufacturer was sued by the company Zango in the USA because Kaspersky was blocking Zango's browser toolbar. While Kaspersky won this case, most antivirus vendors showed little interest in blocking adware. In Germany, Avira ultimately played a pioneering role, with the Avira software increasingly blocking adware and fighting subsequent legal disputes. This was the case with Freemium's adware programs, for example. Avira-Tools blocks the Freemium downloaders, for example. As a result, Freemium sued in court with the aim of no longer being blocked by Avira. Avira won this process in June 2015 at the Berlin Regional Court. This made it easier for Avira and other antivirus manufacturers to block adware, because they no longer have to expect to be sued by the adware manufacturers so quickly.

EnlargeThe Norton Security software criticizes a harmless Bechnmark program.

How to react correctly: If the adware got onto your computer along with a freeware, you should check whether the freeware is still running after the cleanup. If not, you will need to look for alternative software. If you want to be sure that your system is completely free from adware, you can use a special scanner. We recommend the free Adwcleaner tool. It knows most of the popular adware programs and removes them thoroughly. The tool runs without installation. However, you should close all open programs before starting, because the Adwcleaner will kill all running programs without comment during the cleaning process. Click on “Search”; to let Adwcleaner search for unwanted advertisers on your PC. Then remove all finds using "Delete". The adware is then first moved to the quarantine area, where it can no longer cause any damage. It stays there until you select “Uninstall” in Adwcleaner.

Subscription has expired

The message: “Subscription expires in 30 days. Renew, ”reports Bitdefender Internet Security.

This is behind it: Paid antivirus programs usually have to be paid for annually. Towards the end of the license period, the antivirus program usually issues a warning that the license is about to expire. But for a year at the latest, it will respond with pop-ups like “The subscription has expired. You are no longer protected ”. The program no longer receives updates with information about new viruses and can therefore no longer protect your PC from new viruses.

How to react: There is no need to rush for Windows 10 users. Because the current operating system from Microsoft activates its own antivirus program, Windows Defender, immediately if your installed antivirus program is no longer up-to-date. Since Windows Defender showed good virus detection in current tests, you are temporarily protected for the time being. When we played through this situation with Norton Security, the expired Norton comes up with special offers after a few days. One day we got 30 days for free if we would extend the annual subscription, three days later we were offered around 30 percent discount on the annual subscription price.

Basically: It is very convenient to extend the license for the antivirus software through the software itself. However, you will often find significantly cheaper offers in online shops or in the electronics store around the corner. You can buy these without hesitation. You will receive a license key, which you then enter into your installed antivirus program and then activate the full version accordingly.

If you cannot find the required input window for the license key in the software, google it. There are sure to be instructions on how to do this on the Internet, as other users have also faced this problem.

Malware Guide:These dangers threaten your PC