Basic Troubleshooting Antivirus Software.

If you are using any of the most popular AV (antivirus) software programs, including Norton AntiVirus, McAfee VirusScan, AVG Antivirus, BitDefender, Kaspersky Anti-Virus, F-Secure Anti-Virus, or Trend Micro PC-cillin, and you haven’t already run into problems, chances are, at least statistically speaking, you will soon enough. For most computer users, AV software is the first line of defense from viruses that rampage about, seeking to destroy data or simply make life miserable. AV software detects, identifies, and eliminates computer viruses and other malware that proliferate on the Internet. Life is good when your AV software is working and up-to-date. But when your AV software conflicts with other programs or refuses to remove or isolate a detected culprit, you’ll be tempted to disable the software because it’s not doing the job it was intended to do. AV software can also eat up precious system resources and make your computer lag like a snail, when you want it to work now.

AV software usually works behind the scenes, so there aren’t any obvious signs reporting everything that is happening while the software is doing its job. This is a good thing, because it lets you sit back, relax, and watch your AV software do the job you paid it to do. Virus Updates Windows makes it fairly easy for you to identify the type of AV software your computer is using. The best place to go if you are using Windows XP Home Edition, including Service Pack 2 (if you are still using Service Pack 1, it’s a good idea to run your Windows Update to download Service Pack 2), is the Windows Security Center. The Security Center detects and lists currently installed AV software (including third-party software). The Security Center also works behind the scenes, constantly checking the state of your AV software. To get to the Windows Security Center, click Start and Control Panel. Click the Security Center icon (in the Classic or Category view). The Windows Security Center dialog box opens. Notice the three security essentials: Firewall, Automatic Updates, and Virus Protection. To best protect your computer, Microsoft recommends all three of these security essentials remain on. Click the Virus Protection selection to expand a description of the AV software running on your computer. While the Windows Security Center can detect most types of antivirus software, it does not detect all antivirus types, as some antivirus programs do not report their status to Windows. If you are sure that your computer is running AV software and the Security Center is not detecting it, check with the AV software manufacturer to see if the software is supported. If the software is supported, you may need to uninstall and reinstall your AV software and update Windows to allow Windows to report your AV software properly. The Security Center isn’t the only place to find out what type of AV software you are using. Click Start and All Programs (or Programs if Windows is using the classic Start menu). In the list of programs, look for the word “antivirus.” (Refer to the first paragraph of this article for the names of some common AV software names.) One other way to find out what antivirus program you’re running is to hover your mouse pointer over the icons in the Taskbar’s System Tray area (the area in the bottom right of your screen that includes the system clock) and wait a brief moment for a yellow description box to appear. The box should include the word “antivirus.” Once you’ve found the antivirus program, right-click the icon, and a Properties menu appears. The menu should include choices to open the AV software or to activate the program options. AV software from most major vendors will download and apply updates, also known as virus definition files, on a regular basis. These updates are necessary to protect your computer from new threats that evolve on the World Wide Web.

Most computer manufacturers include a trial version of AV software on a new computer. And if you like the software you are using, you can renew (on an annual subscription basis) the software when the trial period expires. Identifying Problems Even if you have antivirus software installed on your PC, it doesn’t always mean it is functioning properly or getting regular updates from the Internet. The Windows Security Center makes it easy for you to verify that your AV software is functioning as it should be. To verify that your AV software is functioning properly, click Start and Control Panel. Click Security Center (in the Classic or Category view). The Windows Security Center dialog box opens. Check the Virus Protection category. If it’s shaded blue and includes a green light and the word ON, your AV software is reporting that it is up-to-date and that virus scanning is on. The Security Center will also report the name of the software your computer is running. If the Virus Protection category is shaded red, your virus protection is turned off. If this is the case on your computer, click the Recommendations button and follow the on-screen instructions. You can either turn on your installed AV software or obtain another antivirus program. If the status in the Security Center indicates that the antivirus program on your computer needs attention, but you know that it is installed and functioning correctly, you can override the Security Center’s monitoring by clicking the Recommendations button in the Virus Protection section (should be shaded red). Click the checkbox marked I Have An Antivirus Program That I’ll Monitor Myself. If you choose this option, be advised that Windows will not send any alerts indicating that the AV software is out of date. If you prefer to have Windows alert you (or not alert you) about your antivirus program, you can also modify the Alert Settings in the Windows Security Center. If you modify these settings, you are either telling Windows to stop alerting you altogether about the status of your AV software or you want Windows to alert you if your computer is at risk. To modify the Alert Settings, in the Resources section on the left side of the Security Center dialog box, click the last link in the list titled Change The Way The Security Center Alerts Me. Click the Virus Protection checkbox to have Windows alert you if your computer may be at risk because of your AV software settings. Uncheck the checkbox if you do not want Windows to alert you about your AV software. Common Problems & Solutions There are literally dozens of problems that can happen to AV software, and most are specific to the program you have installed. We’ve identified a few of the more general problems and outlined their solutions.

Problem: My AV software is conflicting with other programs.

Solution: It happens all the time. You are trying to install a program and you receive an error related to your AV software, and the installation stops. Or perhaps you have installed a program and all of a sudden that program stops responding, or your AV software stops working. AV software is powerful, and it can easily conflict with other software programs, including Office applications, drivers, and even Windows itself. To avoid further conflict, temporarily disable your AV software. When the AV software is disabled, you can finish installing your other program (or reinstall if necessary) or uninstall the program causing the conflict. Most AV software programs can be disabled by right-clicking the AV program icon on the Taskbar and selecting Disable from the menu. Just be sure to turn your AV program back on once you’re done installing or reinstalling the applications. You can also try running your AV software updates to check for a new version. Sometimes the manufacturer will discover a bug, so it updates the software to include the fixes for those bugs, which might resolve the conflict you are experiencing.

Problem: I am running two AV software programs on the same computer, but I’m still getting virus and malware alerts.

Solution: Most AV software manufacturers admit that their software isn’t 100% bulletproof. In other words, certain malicious code types can bypass some signature- and heuristic-based technology. Although it’s not recommended, you may be tempted to run two antivirus programs on the same PC. If you want to do this, be aware that there’s a difference between an AV monitor and an AV on-demand scanner. An AV monitor is the part of AV software that constantly checks files before they are executed. An AV on-demand scanner is the part of AV software that runs on a scheduled basis, checking all files for viruses. If you have two antivirus programs installed on the same computer, you shouldn’t run two AV monitors at the same time. AV monitors wire themselves deep into Windows and scan files before they load for execution. If two AV monitors are running simultaneously, they can interfere with each other, causing the computer to hang or slow down. The solution here is to disable one of the AV monitors. For most AV software, this is accomplished by right-clicking the Taskbar icon and then choosing to disable the AV monitor (for example, if you are using Norton AntiVirus, choose Disable Auto-Protect). Disabling the AV monitor does not mean you are disabling the entire AV solution; you’re only disabling the part that automatically scans files before they are executed.

Problem: My AV software has flagged something as potentially dangerous, but it can’t isolate or remove it.

Solution: As we’ve said before, not every AV program is bulletproof. Sometimes intelligent or brand new viruses can squeeze into your computer before your AV software gets a chance to automatically update itself with the latest virus definitions. Chances are your computer has contracted a virus, and your AV software does not know how to handle it. While the software detects suspicious activity, it needs the proper virus definition file to rid your system of what it has contracted. There are several possible solutions to this problem. The first thing you should do is manually update your virus definition files. Along with automatic updating, any good AV software will include an option to manually update the latest virus definition files. When you open Norton AntiVirus 2006, for example, there’s an option on the upper left of the screen to run a Live Update. This update will check for the latest virus definition files, as well as the latest Symantec products and components you have installed. After the latest virus definition files have been downloaded, run a full system scan on your computer to see if your AV software eliminates the culprit it found. If the AV software still fails to remove the flagged file or files (and you are already infected), or if the file your AV program identified is not a virus but is, for example, a worm, Trojan, or backdoor file, the file will most likely not be disinfected and will need to be removed by a program that deals with these types of culprits. Because viruses and other malicious code are becoming smarter, AV software manufacturers are continually developing softwarebased removal tools that do the tedious job of removing infections for you. Removal tools aid you in repairing the damage that may already be done. Check your AV software manufacturer’s Web site for a removal tool section. The AV program will also frequently tell you the name of the malicious program it found, even if it can’t remove it. Try entering the name of the malicious program into a search tool such as Google (www.google.com) to find a removal tool available online. If the flagged file still shows up, it could be that the infected file is one Windows is using. Make sure you shut down every program (other than your AV software) before you run a full scan on your system. If this fails to remove the virus, Windows will have to be run in Safe Mode, or at least be running in a minimum configuration to get rid of the virus. To get into Safe Mode, reboot your computer and watch the on-screen messages. You’ll be given a specific key to press to enter Safe Mode. Press the key when prompted. Some types of viruses automatically start on boot up and cannot be cleaned because the infected files are being used by the computer. Removing these types of viruses requires special procedures; consult your AV software manufacturer’s Web site for specific instructions on how to do this. A word of caution: This usually requires editing the Registry, so be sure to follow your manufacturer’s details explicitly.

Problem: My AV software is using too many of my system resources.

Solution: Some AV software programs are known to drag a computer down because they are resource hogs. It’s no fun when you expect good performance from your computer and the one program that you don’t want to care about actually bothers you. Some antivirus programs take more system resources to run than others, but sometimes your system may be lending itself to the problem. Verify that your system meets the minimum system requirements of the AV software. If you can’t find the information on the software packaging or instruction manual, you can usually find the same information on the manufacturer’s Web site. Be aware that system requirements typically increase with newer versions. Perhaps your hard drive is the cause of the problem. An almost-full hard drive will slow down any system. You should free up as much hard drive space as possible by removing unnecessary programs, deleting temporary files, and defragmenting your hard drive. You can use the built-in Windows Defragmenter or third-party software such as Diskeeper 2007 Home (www.diskeeper.com). You should also scan your hard drive for possible corruption. A hard drive with bad sectors will throw any program out of kilter. You also may want to consider buying more RAM. Adding more memory (make sure you don’t exceed your system’s capacity) can improve the performance of all your programs. As a last resort, if speed is your No. 1 priority and you can part with the AV software that is slowing you down, investigate other options that may not be so taxing on your system. A few of the lighter products available include those from BitDefender (www.bitdefender.com), Kaspersky (www.kaspersky.com), and F-Secure (www.f-secure.com).