Complexity Science in Cyber Security

1. Introduction

Computers and the Internet have become indispensable for homes and organisations alike. The dependence on them increases by the day, be it for household users, in mission critical space control, power grid management, medical applications or for corporate finance systems. But also in parallel are the challenges related to the continued and reliable delivery of service which is becoming a bigger concern for organisations. Cyber security is at the forefront of all threats that the organizations face, with a majority rating it higher than the threat of terrorism or a natural disaster.

In spite of all the focus Cyber security has had, it has been a challenging journey so far. The global spend on IT Security is expected to hit $120 Billion by 2017 [4], and that is one area where the IT budget for most companies either stayed flat or slightly increased even in the recent financial crises [5]. But that has not substantially reduced the number of vulnerabilities in software or attacks by criminal groups.

The US Government has been preparing for a "Cyber Pearl Harbour" [18] style all-out attack that might paralyze essential services, and even cause physical destruction of property and lives. It is expected to be orchestrated from the criminal underbelly of countries like China, Russia or North Korea.

The economic impact of Cyber crime is $100B annual in the United states alone [4].

There is a need to fundamentally rethink our approach to securing our IT systems. Our approach to security is siloed and focuses on point solutions so far for specific threats like anti viruses, spam filters, intrusion detections and firewalls [6]. But we are at a stage where Cyber systems are much more than just tin-and-wire and software. They involve systemic issues with a social, economic and political component. The interconnectedness of systems, intertwined with a people element makes IT systems un-isolable from the human element. Complex Cyber systems today almost have a life of their own; Cyber systems are complex adaptive systems that we have tried to understand and tackle using more traditional theories.

2. Complex Systems - an Introduction

Before getting into the motivations of treating a Cyber system as a Complex system, here is a brief of what a Complex system is. Note that the term "system" could be any combination of people, process or technology that fulfils a certain purpose. The wrist watch you are wearing, the sub-oceanic reefs, or the economy of a country - are all examples of a "system".

In very simple terms, a Complex system is any system in which the parts of the system and their interactions together represent a specific behaviour, such that an analysis of all its constituent parts cannot explain the behaviour. In such systems the cause and effect can not necessarily be related and the relationships are non-linear - a small change could have a disproportionate impact. In other words, as Aristotle said "the whole is greater than the sum of its parts". One of the most popular examples used in this context is of an urban traffic system and emergence of traffic jams; analysis of individual cars and car drivers cannot help explain the patterns and emergence of traffic jams.

While a Complex Adaptive system (CAS) also has characteristics of self-learning, emergence and evolution among the participants of the complex system. The participants or agents in a CAS show heterogeneous behaviour. Their behaviour and interactions with other agents continuously evolving. The key characteristics for a system to be characterised as Complex Adaptive are:

• The behaviour or output cannot be predicted simply by analysing the parts and inputs of the system
• The behaviour of the system is emergent and changes with time. The same input and environmental conditions do not always guarantee the same output.
• The participants or agents of a system (human agents in this case) are self-learning and change their behaviour based on the outcome of the previous experience

Complex processes are often confused with "complicated" processes. A complex process is something that has an unpredictable output, however simple the steps might seem. A complicated process is something with lots of intricate steps and difficult to achieve pre-conditions but with a predictable outcome. An often used example is: making tea is Complex (at least for me... I can never get a cup that tastes the same as the previous one), building a car is Complicated. David Snowden's Cynefin framework gives a more formal description of the terms [7].

Complexity as a field of study isn't new, its roots could be traced back to the work on Metaphysics by Aristotle [8]. Complexity theory is largely inspired by biological systems and has been used in social science, epidemiology and natural science study for some time now. It has been used in the study of economic systems and free markets alike and gaining acceptance for financial risk analysis as well (Refer my paper on Complexity in Financial risk analysis here [19]). It is not something that has been very popular in the Cyber security so far, but there is growing acceptance of complexity thinking in applied sciences and computing.

3. Motivation for using Complexity in Cyber Security

IT systems today are all designed and built by us (as in the human community of IT workers in an organisation plus suppliers) and we collectively have all the knowledge there is to have regarding these systems. Why then do we see new attacks on IT systems every day that we had never expected, attacking vulnerabilities that we never knew existed? One of the reasons is the fact that any IT system is designed by thousands of individuals across the whole technology stack from the business application down to the underlying network components and hardware it sits on. That introduces a strong human element in the design of Cyber systems and opportunities become ubiquitous for the introduction of flaws that could become vulnerabilities [9].

Most organisations have multiple layers of defence for their critical systems (layers of firewalls, IDS, hardened O/S, strong authentication etc), but attacks still happen. More often than not, computer break-ins are a collision of circumstances rather than a standalone vulnerability being exploited for a cyber-attack to succeed. In other words, it's the "whole" of the circumstances and actions of the attackers that cause the damage.

3.1 Reductionism vs Holisim approach

Reductionism and Holism are two contradictory philosophical approaches for the analysis and design of any object or system. The Reductionists argue that any system can be reduced to its parts and analysed by "reducing" it to the constituent elements; while the Holists argue that the whole is greater than the sum so a system cannot be analysed merely by understanding its parts [10].

Reductionists argue that all systems and machines can be understood by looking at its constituent parts. Most of the modern sciences and analysis methods are based on the reductionist approach, and to be fair they have served us quite well so far. By understanding what each part does you really can analyse what a wrist watch would do, by designing each part separately you really can make a car behave the way you want to, or by analysing the position of the celestial objects we can accurately predict the next Solar eclipse. Reductionism has a strong focus on causality - there is a cause to an affect.

But that is the extent to which the reductionist view point can help explain the behaviour of a system. When it comes to emergent systems like the human behaviour, Socio-economic systems, Biological systems or Socio-cyber systems, the reductionist approach has its limitations. Simple examples like the human body, the response of a mob to a political stimulus, the reaction of the financial market to the news of a merger, or even a traffic jam - cannot be predicted even when studied in detail the behaviour of the constituent members of all these 'systems'.

We have traditionally looked at Cyber security with a Reductionist lens with specific point solutions for individual problems and tried to anticipate the attacks a cyber-criminal might do against known vulnerabilities. It's time we start looking at Cyber security with an alternate Holism approach as well.

3.2 Computer Break-ins are like pathogen infections

Computer break-ins are more like viral or bacterial infections than a home or car break-in [9]. A burglar breaking into a house can't really use that as a launch pad to break into the neighbours. Neither can the vulnerability in one lock system for a car be exploited for a million others across the globe simultaneously. They are more akin to microbial infections to the human body, they can propagate the infection as humans do; they are likely to impact large portions of the population of a species as long as they are "connected" to each other and in case of severe infections the systems are generally 'isolated'; as are people put in 'quarantine' to reduce further spread [9]. Even the lexicon of Cyber systems uses biological metaphors - Virus, Worms, infections etc. It has many parallels in epidemiology, but the design principles often employed in Cyber systems are not aligned to the natural selection principles. Cyber systems rely a lot on uniformity of processes and technology components as against diversity of genes in organisms of a species that make the species more resilient to epidemic attacks [11].

The Flu pandemic of 1918 killed ~50M people, more than the Great War itself. Almost all of humanity was infected, but why did it impact the 20-40yr olds more than others? Perhaps a difference in the body structure, causing different reaction to an attack?

Complexity theory has gained great traction and proven quite useful in epidemiology, understanding the patterns of spread of infections and ways of controlling them. Researchers are now turning towards using their learnings from natural sciences to Cyber systems.

4. Approach to Mitigating security threats

Traditionally there have been two different and complimentary approaches to mitigate security threats to Cyber systems that are in use today in most practical systems [11]:

4.1 Formal validation and testing

This approach primarily relies on the testing team of any IT system to discover any faults in the system that could expose a vulnerability and can be exploited by attackers. This could be functional testing to validate the system gives the correct answer as it is expected, penetration testing to validate its resilience to specific attacks, and availability/ resilience testing. The scope of this testing is generally the system itself, not the frontline defences that are deployed around it.

This is a useful approach for fairly simple self-contained systems where the possible user journeys are fairly straightforward. For most other interconnected systems, formal validation alone is not sufficient as it's never possible to 'test it all'.

Test automation is a popular approach to reduce the human dependency of the validation processes, but as Turing's Halting problem of Undecideability[*] proves - it's impossible to build a machine that tests another one in all cases. Testing is only anecdotal evidence that the system works in the scenarios it has been tested for, and automation helps get that anecdotal evidence quicker.

4.2 Encapsulation and boundaries of defence

For systems that cannot be fully validated through formal testing processes, we deploy additional layers of defences in the form of Firewalls or network segregation or encapsulate them into virtual machines with limited visibility of the rest of the network etc. Other common techniques of additional defence mechanism are Intrusion Prevention systems, Anti-virus etc.

This approach is ubiquitous in most organisations as a defence from the unknown attacks as it's virtually impossible to formally ensure that a piece of software is free from any vulnerability and will remain so.

Approaches using Complexity sciences could prove quite useful complementary to the more traditional ways. The versatility of computer systems make them unpredictable, or capable of emergent behaviour that cannot be predicted without "running it" [11]. Also running it in isolation in a test environment is not the same as running a system in the real environment that it is supposed to be in, as it's the collision of multiple events that causes the apparent emergent behaviour (recalling holism!).

4.3 Diversity over Uniformity

Robustness to disturbances is a key emergent behaviour in biological systems. Imagine a species with all organisms in it having the exact same genetic structure, same body configuration, similar antibodies and immune system - the outbreak of a viral infection would have wiped out complete community. But that does not happen because we are all formed differently and all of us have different resistance to infections.

Similarly some mission critical Cyber systems especially in the Aerospace and Medical industry implement "diversity implementations" of the same functionality and centralised 'voting' function decides the response to the requester if the results from the diverse implementations do not match.

It's fairly common to have redundant copies of mission critical systems in organisations, but they are homogenous implementations rather than diverse - making them equally susceptible to all the faults and vulnerabilities as the primary ones. If the implementation of the redundant systems is made different from the primary - a different O/S, different application container or database versions - the two variants would have different level of resilience to certain attacks. Even a change in the sequence of memory stack access could vary the response to a buffer overflow attack on the variants [12] - highlighting the central 'voting' system that there is something wrong somewhere. As long as the input data and the business function of the implementation are the same, any deviations in the response of the implementations is a sign of potential attack. If a true service-based architecture is implemented, every 'service' could have multiple (but a small number of) heterogeneous implementations and the overall business function could randomly select which implementation of a service it uses for every new user request. A fairly large number of different execution paths could be achieved using this approach, increasing the resilience of the system [13].

Multi variant Execution Environments (MVEE) have been developed, where applications with slight difference in implementation are executed in lockstep and their response to a request are monitored [12]. These have proven quite useful in intrusion detection trying to change the behaviour of the code, or even identifying existing flaws where the variants respond differently to a request.

On similar lines, using the N-version programming concept [14]; an N-version antivirus was developed at the University of Michigan that had heterogeneous implementations looking at any new files for corresponding virus signatures. The result was a more resilient anti-virus system, less prone to attacks on itself and 35% better detection coverage across the estate [15].

4.4 Agent Based Modelling (ABM)

One of the key areas of study in Complexity science is Agent Based Modelling, a simulation modelling technique.

Agent Based Modelling is a simulation modelling technique used to understand and analyse the behaviour of Complex systems, specifically Complex adaptive systems. The individuals or groups interacting with each other in the Complex system are represented by artificial 'agents' and act by predefined set of rules. The Agents could evolve their behaviour and adapt as per the circumstances. Contrary to Deductive reasoning[†] that has been most popularly used to explain the behaviour of social and economic systems, Simulation does not try to generalise the system and agents' behaviour.

ABMs have been quite popular to study things like crowd management behaviour in case of a fire evacuation, spread of epidemics, to explain market behaviour and recently financial risk analysis. It is a bottom-up modelling technique wherein the behaviour of each agent is programmed separately, and can be different from all other agents. The evolutionary and self-learning behaviour of agents could be implemented using various techniques, Genetic Algorithm implementation being one of the popular ones [16].

Cyber systems are interconnections between software modules, wiring of logical circuits, microchips, the Internet and a number of users (system users or end users). These interactions and actors can be implemented in a simulation model in order to do what-if analysis, predict the impact of changing parameters and interactions between the actors of the model. Simulation models have been used for analysing the performance characteristics based on application characteristics and user behaviour for a long time now - some of the popular Capacity & performance management tools use the technique. Similar techniques can be applied to analyse the response of Cyber systems to threats, designing a fault-tolerant architecture and analysing the extent of emergent robustness due to diversity of implementation.

One of the key areas of focus in Agent Based modelling is the "self-learning" process of agents. In the real world, the behaviour of an attacker would evolve with experience. This aspect of an agent's behaviour is implemented by a learning process for agents, Genetic Algorithm's being one of the most popular technique for that. Genetic Algorithms have been used for designing automobile and aeronautics engineering, optimising the performance of Formula one cars [17] and simulating the investor learning behaviour in simulated stock markets (implemented using Agent Based models).

An interesting visualisation of Genetic Algorithm - or a self-learning process in action - is the demo of a simple 2D car design process that starts from scratch with a set of simple rules and end up with a workable car from a blob of different parts: http://rednuht.org/genetic_cars_2/

The self-learning process of agents is based on "Mutations" and "Crossovers" - two basic operators in Genetic Algorithm implementation. They emulate the DNA crossover and mutations in biological evolution of life forms. Through crossovers and mutations, agents learn from their own experiences and mistakes. These could be used to simulate the learning behaviour of potential attackers, without the need to manually imagine all the use cases and user journeys that an attacker might try to break a Cyber system with.

5. Conclusion

Complexity in Cyber systems, especially the use of Agent Based modelling to assess the emergent behaviour of systems is a relatively new field of study with very little research done on it yet. There is still some way to go before using Agent Based Modelling becomes a commercial proposition for organisations. But given the focus on Cyber security and inadequacies in our current stance, Complexity science is certainly an avenue that practitioners and academia are increasing their focus on.

Commercially available products or services using Complexity based techniques will however take a while till they enter the mainstream commercial organisations.

Save Your Computer From Dreaded Computer Viruses

When it comes to your business computers it is imperative that you protect yourself and your business computers from virus, malware and other threats that can harm your computers, servers and operating systems. This article will outline some tips on how to create an environment free of computer viruses.

Firstly, when your purchase new computers it is important that you have antivirus installed on it correctly. Make sure the antivirus is update to date and maintained to ensure that your computer can defend itself from viruses that try to access your emails, files and servers. There are more and more viruses appearing everyday now, setup your computer so that antivirus runs every day at a time when you are not working and it is updated automatically to prevent the newest of viruses from getting into your systems.

The most popular virus comes from human error. When employees open emails from unknown senders their computers can be infected which then can lead to the whole business network being infected. The rule of thumb when opening emails is to open emails that you are expecting or from people that you know.

It is important to keep your antivirus up to date, it is important to update your operating system as required. Microsoft will update your windows operating regular with updated security releases. You can automate this.

You can also add the windows firewall that will detect anything that is considered suspicious. If a virus, malware or hacker attempts to get into your system the firewall will prevent it. If a virus or hacker gets past a firewall it should still help protect the OS from having harmful programs from being downloaded.

When searching the internet make sure the browser privacy settings are turned on. This prevents websites from using your private browsing information and prevents fraud and identity theft,

Use a pop-up blocker along with the browser protection. Turning off pop-up windows will help create safer browsing although popups are usually advertisements that can contain files that can be infectious to your computer. Pop-up blockers eliminate the windows from appearing all together.

These steps help eliminate the possibility of a virus on your computer. Although you may apply all the steps above to prevent an infection for your computer, a virus might still get into your computer. If you suspect that your computer has an infection contact your local tech support guy or your local IT services company.

Six (6) Sure Signs You Have Been Hacked

There are several ways in which antivirus scanners try to detect malware. Signature-based detection is the most common method.

This involves searching the contents of a computer's programs for patterns of code that match known viruses. The anti-virus software does this by checking codes against tables that contain the characteristics of known viruses. These tables are called dictionaries of virus signatures.

Because thousands of new viruses are being created every day, the tables of virus signatures have to be updated constantly if the anti-virus software is to be effective. But even if the software is being updated daily, it usually fails to recognise new threats that are less than 24 hours old.

To overcome this limitation and find malware that has not yet been recognised, anti-virus software monitors the behaviour of programs, looking for abnormal behaviour. This technique is called heuristics. The software may also use system monitoring, network traffic detection and virtualized environments to improve their chances of finding new viruses.

Nevertheless, anti-virus software is never 100 percent successful and every day new malware infects computers throughout the world.

Getting hacked

There are three main ways you can get infected with malware.

These are: (a) running unpatched software, ie software that you have failed to update; (b) falling for a desirable freebee and downloading a Trojan horse along with the freebee; and (c) responding to fake phishing emails.

If you can manage to avoid these three failings, you won't have to rely so much on your anti-virus software.

Expecting that some day someone will release anti-virus software that can detect all viruses and other malware with complete accuracy is a vain hope. The best you can do is to keep your security up to date, avoid the three main ways you can get infected, and learn to recognise the signs that suggest your computer has been hacked so that you can take appropriate action.

Here are some sure signs you've been hacked and what you can do about it.

[1] Fake antivirus messages

A fake virus warning message popping up on screen is a pretty sure sign that your computer has been hacked-provided you know it's fake. (To be able to recognise a fake warning, you need to know what a genuine virus warning from your anti-virus software looks like.) The warning will reassure you by saying that it is can scan your system to detect the malware.

Clicking no or cancel to stop the scan won't help, because you computer has already been compromised. The purpose of the fake virus warning (which will always find lots of viruses that need to be eliminated) is to lure you into buying their virus removal service or other product.

Once you click on the link provided for that purpose, you will likely land on a very professional-looking website. There you'll be invited to buy and download the product by filling in your credit card details.

Bingo! As well as having complete control of your system, the hacker now has your personal financial information.

What to do: as soon as you see the fake virus warning message, turn off your computer. Reboot it in safe mode (no networking) and try to uninstall the newly installed software (which can often be uninstalled just like a regular program).

Then, whether you succeed in uninstalling the rogue program or not, restore your system to the state it was in before you got hacked. In the old days, this meant formatting the computer and reinstalling the operating system as well as all programs and data. Nowadays, you can normally revert to a previous state with just a few clicks.

Once you have turned back the clock, so as to speak, restart your computer in the normal way and make sure that the fake virus warning has gone. Then do a complete anti-virus scan to eliminate any traces of the malware.

[2] Unwanted browser toolbars

Finding your browser has a new toolbar is probably the second most common sign of being hacked. Unless you recognize the toolbar, and know that you knowingly downloaded it, you should dump it.

Very often these toolbars come bundled with other software you download. Before you begin a download, you should always read the licensing agreement which may contain a clause allowing other software to be downloaded with the software you want. Hackers know that people seldom read these agreements yet having these kinds of clauses makes the downloading quite legitimate.

What to do: Most browsers allow you to remove toolbars. Check all your toolbars and if you have any doubts about a toolbar, remove it. If you can't find the bogus toolbar in the toolbar list, check to see if your browser has an option to reset it back to its default settings.

If this doesn't work, restore your system to the state it was in before you noticed the new toolbar as described in the previous section.

You can usually avoid malicious toolbars by making sure that all your software is fully up-to-date and by being ultra-cautious when you are offered free software for downloading.

[3] Passwords changed inexplicably

If you discover that a password you use online has been changed without your knowledge then it is highly likely you have been hacked. If not, your internet service provider (ISP) has been compromised.

If you have been hacked, it is probably because you replied with your log-in details to a phishing email that seemed to come from the service for which the password has been changed. If so, the hacker used the information you gave him to log-in and change the password. Now he can avail of the service you were getting or, if it was your internet banking details you sent, steal your money.

What to do: report the change in your password to the online service provider who should be able to get your account back under control within a few minutes. If the log-in information you sent is used on other websites, you should immediately change those passwords also.

Above all, you need to amend your behaviour for the future. Reputable websites will never ask for you log-in details by email. If they do appear to do so, do not click on the link in the email. Instead go directly to the website and log on using your usual method. You should also report the phishing email to the service by telephone or email.

[4] Unexpectedly finding newly installed software

If you find new software in your computer that you don't remember installing, you can be fairly sure that your system has been hacked.

Most malware programs nowadays are trojans and worms which install themselves like legitimate programs, usually as part of a bundle with other programs that you download and install. To avoid this you need to read the licence agreement of the software that you do want to install closely to see if it comes with 'additional' software.

Sometimes you can opt out of these 'free' extras. If you can't, your only option, if you want to be sure you are not going to be hacked, is not to download the software you do want to install.

What to do: the first thing you should do (in Windows) is to go to Add or Remove Programs in the Control Panel. However, the software program may not show up there in the list. In so, there are plenty of programs available on the Internet (usually for free) which will show all the programs installed on your computer and enable you to disable them selectively.

This approach has two problems. Firstly, these free programs cannot guarantee to find every installed program. Secondly, unless you are an expert, you will find it hard to determine what are and what are not legitimate programs.

You could, of course, just disable a program you don't recognise and restart your computer. If some functionality you need is no longer working, you can re-enable the program.

However, your best bet in my view is to stop taking risks (and wasting time) by calling an expert technician at an online computer maintenance company who can scrutinise your system for illegitimate programs and delete them as necessary.

[5] Cursor moving around and starting programs

Cursors can move around randomly at times without doing anything in particular. This is usually due to problems with hardware.

But if your cursor begins moving itself and makes the correct choices to run particular programs, you can bet your last dollar that you've been hacked and that your mouse is being controlled by humans.

The hackers who can take control of your computer in this way can start working in your system at any time. However they will usually wait until it has been idle for a long time (eg, during the early hours of the morning) before they start using it, which is why it is important that you turn off your computer at night and disconnect it physically from the internet.

Hackers will use their ability to open and close programs remotely to break into your bank accounts and transfer money, buy and sell your stocks and shares, and do all sorts of other nefarious deeds in order to deprive you of your treasure.

What to do: If your computer suddenly swings into action some night, you should turn it off as soon as possible. However, before you do so, try to find out what the hacker is interested in and what they are trying to do. If you have a digital camera handy or a smartphone, take a few pictures of the screen to document what the hacker is doing.

After you have closed it down, disconnect your computer from the internet and call for professional help. To solve this problem you will need expert help from an online computer maintenance firm.

But before you call for help, use another computer that is known to be good, to change all your log-in details for your online accounts. Check your bank accounts, stockbroker accounts and so on. If you discover that you have lost money or other valuables, call the police and make a complaint.

You have to take this kind of attack seriously and the only option you should choose for recovery if a complete clean-out and re-installation of your operating system and applications.

But before you do so, if you have suffered financial losses, give a forensic team access to your computer so they can check exactly what took place. You may need a report from them to recover your monetary losses from your insurer, banker, broker or online merchant.

[6] Anti-virus program, Task Manager or Registry Editor disabled and won't restart

Stuff can happen, so one of these three applications could go wrong on its own. Two of them might go wrong at the same time in a million-to-one coincidence. But when all three go wrong together...

In fact, a lot of malware does try to protect itself by degrading these three applications so either they won't start or they start in a reduced state.

What to do: you cannot know what really happened, so you should perform a complete restoration of your computer system.

In conclusion

The above are just six fairly common signs that you have been hacked. There are plenty more.

These include: money missing from your bank account; your internet searches being redirected to places to which you do not want to go; being plagued by pop-up ads when you visit websites that normally don't generate them; and so on.

Once you've been hacked you can never really know for sure what's going on inside your system. A compromised system can never be fully trusted.

How to Remove TrojanADH2 Completely

What Is Trojan.ADH.2?

Trojan.ADH.2 is a malicious Trojan horse designed to have ability to do destructive activities on the infected computer. It can badly destroy a victim's computer system and steal the users' confidential information without any knowledge. Usually, it hides itself in websites which have been hacked by the rogue hackers. If users visit the hacked websites, it may be downloaded to the computers furtively. It can also enter into users' computers via spam emails. When users click on the suspicious links embedded in the spam emails or open the attachments (which look harmless but actually not), they would activate the malicious codes of the Trojan horse. Besides, freeware is also used by this Trojan horse to spread itself. It hides its installer in the freeware, and once user download and install such freeware to their computers, this Trojan horse is installed as well.

When installed, Trojan.ADH.2 will create and inject its registry entries into the Windows registry so that it can make changes to default system configuration such as Master Boot Record, one important part of Windows that takes control of the operating system's boot loader. By doing so, it is able to run automatically every time Windows boots up. While running in the background, this Trojan horse will try to do a series of malicious activities according to the commands received from the remote hackers. It randomly deletes some system files as well as folders, and disables certain programs or services without any permission, which causes some programs to be unable to start or the computer system to run abnormally. It also stealthily connects to certain websites and downloads other malware to the infected computer, which will put the system at great risk and greatly degrade the computer performance. Furthermore, it may create a backdoor in the system, allowing the remote hackers to access the files and data stored on the computer. Having this Trojan horse in their computers, users may end up spending much money to fix the problems caused by this Trojan horse and even encountering identify theft and data loss. It is no doubt that Trojan.ADH.2 is very dangerous and must be removed as soon as possible.

Effects of the Trojan Horse

1. It may significantly slow down the computer's performance.

2. It may generate a lot of pop-ups which may include fake alert messages and commercial ads.

3. It may damage some system files and disable certain programs, causing the system to malfunction.

4. It may cause the network speed to become slower and users have to wait for a long time to access the desired websites.

5. It may track users' online activities, collect valuable data stored on the computer, and then send them to the rogue hackers.

How to Remove Trojan.ADH.2?

There are two ways to get rid of the threat, the manual way and the automatic way. In the following, we will give the detailed steps of these two ways. You can choose one of them to deal with the Trojan horse, depending on your own situation.

Steps of the Manual Way (For Advanced PC Users):

Step 1: Reboot your computer into the Safe Mode with Networking.

a. Reboot your computer. When it starts loading up, you should keep pressing the F8 key repeatedly.

b. Use the arrow keys to highlight "Safe Mode with Networking", when the "Advanced Boot Options" shows up on the screen.

c. Press Enter to go ahead.

Step 2: Stop the process of Trojan.ADH.2.

a. Right click on the taskbar and select the "Task Manager" option. Then the Windows Task Manager will be launched.

b. Click "Processes" tab, scroll down to search for the Trojan horse related process.

c. Click on it and click the "End Process" button to stop it.

Step 3: Show all hidden files and folders.

a. Click Start menu and then select "Control Panel" option.

b. Click on "Appearance and Personalization" link.

c. Select "Folder Options", and click the "View" tab.

d. Under "Advanced settings", tick "Show hidden files, folders and drives", non-tick "Hide protected operating system files (Recommended)" and then click OK.

Step 4: Navigate to local disk C, find out and remove all the files related to Trojan.ADH.2.

Those malicious files may be found in the following folders:

Step 5: Delete all registry entries associated with the Trojan horse.

a. Open Registry Editor (Go to the Start menu, type "Reg" into the search box and click the program named "Registry Editor" from the result list).

b. Find out all Trojan.ADH.2 associated registry entries and remove them all.

Steps of the Automatic Way (For Novice Users):

The manual way should not be attempted by novice users, since it involves several complicated steps. If users make any mistakes during the process, the system would be damaged and malfunction. The automatic way is here for all users, especially the users who have less experience in computer operation. Please take the steps below to automatically remove Trojan.ADH.2.

Step 1: Download and install an advanced removal tool on the infected computer.

Step 2: Run the tool to start a full system scan. Now the removal tool will completely scan the hard drives and then show all detected threats in the system.

Step 3: Make sure that no any legitimate files are in the result list, check all malicious items, and then click the Remove button to remove all threats on the system.

Step 4: Reboot the computer after the removal. Run a full system scan again whether the Trojan horse and other related threats have been removed completely.

Conclusion:

Trojan.ADH.2 is a vicious Trojan horse designed by hackers to damage the infected computers and steal sensitive information or data from the users. This Trojan horse is often distributed by some free software downloaded from unreliable resources, spam emails with suspicious links and attachments, or websites that have been hacked by the rogue hackers. So, users should use caution when surfing online, if they want to avoid unwanted infections or loss. Basically, this Trojan horse will do many malicious things according to commands from the hackers. It can do many malicious things inside the infected computer and causes various unpleasant problems. To avoid unnecessary trouble, users should remove Trojan.ADH.2 as early as possible. Generally, users tend to use antivirus programs to remove threats on their computers. However, the Trojan horse is able to bypass the detection and removal by common antivirus programs. In this case, users can consider manually get rid of the Trojan horse, or download a more advanced removal tool to automatically remove it. It just depends on users' own situation.

Important Note: The manual removal is not for everyone. Sometimes, even the computer geeks have to rely on a removal tool when encountering malware threats. So, if you are a novice user, it is highly recommend using an automatic removal tool to deal with the Trojan horse.

Removing Fragmented Computer Files And Performing System Scans

When our car breaks down we can think of nothing other than getting it back on the road. We really heavily on automobiles and most people do everything they can to prevent them from needing to stay overnight in the repair shop. The same thing should be said about your computer.

When your computer breaks down you are not going to be able to play on the social networking sites that you know you love, or pay your bills online, or in many cases, do your jobs. You should be doing everything within your power to stop your machine from having an overnight visit with a repair technician.

One thing you can do to help prevent the trip to the repair shop is speed up your slow computer with antivirus removal and defragmenting all of those little bits of files left on there. When you browse online you look at a lot of pages that you are not really interested in. You may stay on the page only a few seconds and then go on to another one. Each of these little stops online leaves a little fragment of the page behind.

You must defragment your computer frequently to remove all of these little bits of data that are useless and tying your computer up. Newer computers automatically do defragmentation, but the older ones need you to go into the control panel and tell it to do this.

You also may need to run a full system scan using your antivirus program. These programs have the option of a quick scan that only takes a few seconds or the longer scan that can take several minutes to complete. You need the longer scan ran anytime you have been doing a lot of web browsing.

Each time that you stop on a new web page that you have never visited before, you offer virus senders the option to plant a bug in you. Each time you download a game, a song, or a picture, you give a Trojan the opportunity to live within the confines of your system. Use your firewall and your antivirus protection to stop these intrusions. You need to be careful about these things.

Protect your machine and prevent the trip to the repair man or the trip to the computer graveyard. You have control of what enters your system and the power to boot out anything you did not invite.

Speeding up a slow computer may mean removing some of the unnecessary file fragments [http://malwarefixfree.com/] that are on it. It may also mean removing malware [http://malwarefixfree.com/malware-removal/virus-removal/] that is dragging you down.

Your Online Habits Can Create Malware Risks

Malware risks are greater among people who visit adult only sites, XXX sites, or pornographic content sites. Looking at nude or sexually explicit websites will increase your chance of getting infected by roughly 99%. The best thing that you can do to stop this from happening is stay off of these sites, but when you feel you must visit them have antivirus software that can act as a condom for your hard drive.

Music downloads are perfect places for Trojans to hide and wait for unsuspecting individuals to allow them through the gates of their city. The Trojans hide among the seemingly innocent music that you love and wait to infect your computer with their germs of destruction. Teenagers are especially vulnerable to this type of intrusion on their systems.

Free games and gaming downloads are a breeding ground for infections to occur. One of the gamers gets a serious infection that is contagious and they share their disease with every gamer that connects to their computer. The illness becomes pandemic and spreads throughout computer land like a wildfire through the dry California brush.

Those cute screen savers that are absolutely free may come with a price that is higher than you wanted to pay. The adorable fish tank with the colorful tropical fish swimming in blue waters may carry bacteria like germ that can spread throughout your entire system in less than forty eight hours. You may not realize that the people who like to spy on other people's private information often get in by giving you something free first.

Reading emails that are sent from people you do not know and recognize can cause you to get a deadly virus. Many of the email bugs are simple adware programs that send you annoying spam messages continuously, but some of these bugs are deadly. As soon as you open the email they attack your system with a relentless energy and overtake your defense mechanisms leaving you unprotected and vulnerable. The best way to defend against malware attacks is to prevent them by using your computer wisely when you are online.

Have antivirus software [http://malwarefixfree.com/] and firewall protection [http://malwarefixfree.com/malware-removal/virus-removal/] active on your system when you connect to the internet.

Tips On Dealing With A Slow Computer

It can really be aggravating when you sit down at the computer to do something and it takes an eternity for the program you want to use to load. It is also aggravating when you have to wait so long for the next page to load that you cannot play the games on the social media sites, or get pictures your friends post to load without refreshing the page several times. When your computer starts to act like this it is tempting to throw it in the trash.

The problem you are experiencing is had by everyone that owns a computer at some time. It may not be your internet connection speed, or your internet provider, but it may be malware that is dragging your systems down and causing the programs on your computer to run slower than normal.

Malware, adware, spyware, viruses, and Trojans are all malicious programs placed on your computer by someone else. These software applications are used to gather information or to make your computer do the suspicious work they need done. When one of these programs are running in the background while you are trying to work another program then both of the programs will work at slower speeds than they should.

If your computer is running slower than you want it to, or slower than it once did, you need to first run your antivirus software scan to determine if there is a virus on your computer that it recognizes. Not ever virus will be recognized by your antivirus software, so just because your security program does not find a virus does not mean that there is not one there.

If your antivirus program reports nothing is found after a full system scan make certain that you have all of the latest updates installed. The updates may contain some new virus information that was not previously on your program. After you have updated your antivirus run the full system scan again to see if it detects something new.

If you do not discover the virus living in your backgrounds then you can purchase specialized programs for malware removal. These specialized software applications may be aware of virus threats that your original antivirus was not aware of.

When you absolutely cannot find the virus that has invaded your private space, and yet you are sure one is lurking there, you can go into the control panel of your computer and take your computer back to a time when it was working correctly. You can also remove the operating system that is on the device and replace it with another version that is not infected.

If you go as far as to remove your operating system then you must do this cautiously because if you do this incorrectly then you can render your computer useless. If you are uncertain about the process of removing your operating system, or of taking your computer back to an earlier time, then ask someone for help.

Antivirus software may be the solution [http://malwarefixfree.com/] if you have a slow running computer. You may need to get [http://malwarefixfree.com/malware-removal/virus-removal/] some advice from an expert if this does not solve your problem.

The Top 3 Operating System Computer Viruses

If you own a computer or have used one, you know that dangerous viruses or malware is out there to affect the operation of your operating system. A virus is an application that corrupts your files, terminates your hard drive, spies on you, or can permit someone on the other side of the Earth to control your system. Because there are many types of viruses lurking on the Internet, it will not take long before you fall prey to a virus attack. Everyone fears malware infection, but not everyone thinks of learning anything about them.

There has been a lot of research to find out the different types of computer viruses and similar security extortions in order to determine how they are programmed, how they normally damage your system, and how they spread. The significance of computer security has doubled in the previous years as people develop new methods to exploit various loopholes. It is now essential to keep your antivirus software up to date in addition to using exposure management. Although there are many viruses around, there are 3 computer viruses to look out for these days.

Here are 3 top operating system viruses that may threaten your computer:

Shamoon

This is the greatest threat to every person with a Windows computer. It is a Trojan virus which mainly attacks operating systems running Windows computers. At this time, recent attacks have been directed at businesses, but it has been known to spread to personal computers as well. It is proposed that the virus look for a certain data or file which is then forwarded to the creator. The virus covers its trails by overwriting files to cripple the operating system. It can also spread to other networks very easily

Ransomware

This one is particularly tricky because it can look very legitimate to the average user. A message is displayed in the screen which appears genuine. It says you must pay or you will not be permitted to operate your computer again. This is usually a virus and a scam. The developer hopes you will be scared and pay the counterfeit fine. Microsoft offers excellent advice on how to deal with the situation when you come across ransomware.

Email Viruses

Finally, public networks continue to be targeted as people increasingly open accounts. Facebook has the highest number of users hence you should always be watchful of scams related to this service. One of the newest viruses deceiving users is an email notifying you that a friend has added a new photo of you. Through clicking the attached zip file, you download a virus. The email seems legitimate because it uses a Facebook template. Facebook will almost never send an attachment through mail.

These 3 viruses are the biggest threats to most computer users right now. This changes pretty regularly, so it's important to have up-to-date information on the greatest viral threats. If you want to learn about the many different types of computer viruses, check out typesofcomputerviruses.net.

Protect Your Computer From Attack

Your computer is a waiting playground for viruses and malicious malware. The controllers of these evil entities would like nothing more than to get inside the confines of your hard drive and take over your domain. The virus creators are lurking in the shadows waiting for their chance to infiltrate your encampment.

You must protect your computer from attack by these evil entities. In order to protect your system and keep your computer running like it should you are going to need to have a firewall in place. A firewall will prevent a lot of the intruders. There will be some persistent threats that will find a way around your firewall, but for the most part you will be protected as long as your firewall is enabled and running.

Antivirus software was created to detect and capture any threats that make it past your firewall. The antivirus software that you have will keep threatening programs that slip past your firewall from doing harm to your system.

You can also surf the web responsibly and stop a lot of these threats from occurring. Your biggest chance of getting a virus will occur when you are downloading a game, a song, or a video. You have to make sure that a download is safe and free of viruses before you accept it on your computer.

Shareware web sites have more malware infections than almost any other web site has. Shareware happens when average people are allowed to upload video, music content, software applications, and movies, to a server for other people to come and download for no charge. These sites are very popular with music lovers because they can make CDs of their favorite music and not have to pay for the download.

The shareware sites are also a favorite place for malware distributors. All they have to do is get you to download the content that has their bug in it and they are inside your computer. You need to stay away from shareware sites.

Porn sites have the highest concentration of viruses of any other type of website. You can almost guarantee that when you visit a porn site you are going to find something ugly lurking in the shadows. Your best bet is to avoid porn sites completely.

When you have done a lot of surfing makes sure you run a full system scan with your antivirus to detect anything that might have followed you home.

Protection against malware [http://malwarefixfree.com/], and protection from attacks of foreign programs, starts with you installing the right security applications [http://malwarefixfree.com/malware-removal/virus-removal/], and using the internet wisely.

PC Locked by Ransomware - How to Remove Latvijas Policijas Virus

Latvijas Policijas virus description:

Latvijas Policijas virus is a dangerous and horrific ransomware that can lock the targeted computer for no reason. It is designed by cyber criminals to lurk into your compromised PC via exploiting system holes and other channels. Once installed, it will change your system settings and delete your important registry files. Terminate your several programs and block Internet access. Commonly, it will pretend to be the local government and then send you the bogus notification.

It claims that you have violated the law, such as visit prohibited and unauthorized websites, download adult-oriented and illegal materials and contents, etc. You are asked to pay a certain amount of fine within 48 to 72 hours in order to unlock your PC and restore your data. However, it is a total scam and they won't keep their promise. The only way is to find a surefire way to remove Latvijas Policijas virus promptly and fully from your PC.

How can you delete Latvijas Policijas virus manually from your compromised PC?

Follow the instructions to delete Latvijas Policijas virus as quickly as you can.

Step 1: If this ransomware blocks you into Safe Mode with Networking, you can try to start your computer into Safe Mode with Command Prompt by pressing F8 key many times. And then press Enter to proceed.

Step 2: Once the Command Prompt appears, type "explorer" and then hit Enter key to proceed.

Step 3: Then Windows Explorer will show up browse to:

Windows XP: C:\windows\system32\restore\rstrui.exe and press Enter.
Windows Vista/7: C:\windows\system32\rstrui.exe and press Enter.

Step 4: You can go to Start menu and launch Run, and then type regedit into the Run box and click OK to open Registry Editor.

Step 5: In the registry editor window, you should navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\Current Verson\Winlogon\

Step 6: In the right side of the window locate "Shell", right click on it. And then click on Modify.

Step 7: Find Shell in the right hand panel and then change its value into Explorer.exe by right clicking it if the value is different.

Step 8: Save the changes and then restart your PC normally.

Automatic removal:

In fact, it is not advised to get rid of Latvijas Policijas virus manually if you have difficulty in editing files and registry entries. Any mistake may result in irreparable PC damage. Why not use an automatic removal tool to remove this ransomware with a few clicks of the mouse. It can deeply scan your Windows PC, detect and remove the threat from roots. Keep in mind that you should keep it updated on a regular basis.

Spyware - The Snooper's Toolkit

Spyware is surreptitious software that gathers private information from your computer without your consent or knowledge and transmits the data it collects to someone else, silently in the background, using your internet connection.

Spyware can collect almost all types of data, including internet surfing habits, user logins, as well as bank and credit card information, along with your PINs, using key-loggers to record every stroke of your fingers. It can scan files on your hard drive, snoop on other applications (such as chat programs or word processors), install further spyware programs, and read cookies, relaying the information it gathers back to its author.

Spyware can also change the default home page on your browser or redirect your browser to web pages other than the ones you want. Some spyware can even change computer settings.

It is usually difficult to detect and is nearly always malicious in intent. Indeed recent surveys suggest that more than 60 percent of computers are infected with some form of spyware, and that more than 90 percent of users found to have spyware in their computers are not aware of it.

What are the dangers?

By monitoring your activity on the internet, spyware enables targeted advertising. In other words, it providers advertisers with the data they need to bombard you with ads based on your perceived preferences according to your internet activity. In this case, it is known as adware.

The result of tracking your behaviour in this way is a plethora of unsolicited pop-up ads. These can be really annoying, though hardly dangerous.

More seriously, because spyware is using memory and system resources as it runs in the background to gather and send information back to its home base via your internet connection, it can lead to system instability or crashes.

It can also have a negative effect on your computer's performance by installing additional software, redirecting web browser searches, changing computer settings, reducing connection speeds, changing the homepage or even completely disrupting network connection ability.

You can cope with all these problems. The real danger is the very strong possibility of financial fraud using your bank account and credit card details that, along with the related PINs, spyware collects when you engage in internet banking.

How does spyware get into your computer?

Spyware is usually installed when you download some free software or shareware you actually want... the spyware piggybacks on the installation. One of the commonest ways to become a victim of spyware is by downloading some of the peer-to-peer file swapping products that are available today.

The writers of spyware programs often simply repackage freeware and bundle it with their own spyware. Others may pay shareware developers to bundle their spyware with legitimate software.

Indeed, the licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the desired applications. Unfortunately, few people read these agreements before clicking I agree or Yes. But even if you read these agreements closely, you will notice that the reference to the spyware is usually couched in obtuse, hard-to-read legal disclaimers.

What can you do to prevent spyware getting in?

There are several ways you can try to prevent your computer from being infected with spyware:

• Don't download free programs or applications unless you are absolutely sure that they are OK. Think: why would anyone create a piece of valuable software and give it away free of charge?
• Read licensing agreements carefully and if they are couched in obscure legalese, forget about it.
• Be ultra-careful when using peer-to-peer file swapping.
• Undertake regular maintenance of your system.
• Ensure you anti-virus software is updated regularly and that it checks incoming software before it is installed.

But no matter how careful you are, you are bound to join the 60 percent plus of users who are the victims of spyware in some form or other.

How do you get rid of spyware?

Getting rid of spyware is more art than science as many writers of spyware make removing these malicious programs purposely difficult. Some of the code may be hidden from Windows.

But with a few free tools, plenty of time, some know-how and a bit of luck you can do it. First the tools... four free tools you can download online:

• Microsoft's Malicious Software Removal Tool... available free of charge from microsoft.com
• Microsoft's Windows Defender... available free of charge from microsoft.com
• SuperAntiSpyware... available as free edition and professional (paid) edition from superantispyware.com. The free edition does a decent job of removing spyware or viruses.
• Your anti-virus program... (You do have an anti-virus program installed, don't you?)

Note that some spyware can prevent you from downloading these tools or even from visiting the Microsoft website. If this happens, download the applications to another computer, copy the installers to a USB drive, plug that drive into your computer and install from the USB.

Spyware usually manifests itself as slower-than-normal performance. But poor performance can be due to other (unrelated) reasons, such as having a hard drive that has not been fragmented for some time or is full, running too many applications with insufficient system memory, or bugs in a program that prevent memory being freed up when you close it. Check these factors out first before deciding that you have spyware.

Then, follow these four steps:

[1] Run the Malicious Software Removal Tool first... making sure that you have downloaded the latest version before running it. Though this tool only searches for a small fraction of all the malware you can pick up, the ones it finds are the most serious threats. If this tool does not find anything, go on to the next step.

[2] Use Windows Defender, after first making sure you have the latest updates, to perform a full scan. If the program finds malware, follow the on-screen instructions to get rid of it. You may need to reboot your computer as some spyware does not let you uninstall it while Windows is running. If this tool also comes up empty, do step 3.

[3] Go to www.superantispyware.com and download and install the free edition of the software. Once the software is installed, click on scan your computer. The scan will take several minutes depending on HDD space and then remove any threats that have been found.

If Super Antispyware cannot find the problem, go on to the next step.

[4] Run a full scan using your anti-virus program. This will take several hours, perhaps overnight. The program should deal with any suspect files automatically.

It is unlikely that one of these three programs will not solve your spyware problem. However if that is the case then you have picked up new type of spyware that has not yet been included in the anti-spyware databases. Now you need to check every process running on your computer to see if any of them is spyware. This can be quite a daunting task.

Though there are tools that can help you by showing you everything that is running on your PC, enabling you to decide whether a particular program is legitimate or not, running them requires a certain amount of expertise. Caution: you should be aware that if you perform certain removal steps improperly, your computer could become inoperable. Thus it would be best to seek expert help.

Alternatively you could go nuclear... this entails backing up all your data onto external media, formatting your hard disk and then reinstalling your operating system using the DVD that came with the computer when it was new. You will then have to reinstall all the applications you have as well as all your data files. This will probably take hours, perhaps a whole day to re-install everything. But you'll end up with a super-clean machine that's as fast as the day you bought it.

Using online expertise

Removing spyware seems a scary task if you have never worked on your computer before. If you don't feel up to removing it yourself you will need outside help from expert technicians.

One solution is to bring your computer down to a computer repair shop or get a technician to visit your home or office. This can be expensive, probably costing at least €100.

A less costly solution, which is just as reliable, is to contact an online maintenance and repair service. The service will, with your permission, open a secure connection into your computer from a remote location and take care of your spyware problem while you watch the process on your screen or do something else. Expect to pay about €25 at the most for this kind of service.

A bonus with the online solution is that the technician who handles your problem will have a supervisor and plenty of back-up experts to hand for additional advice. Repair shops normally only have one or, at the most, two technicians on the premises.