Posted on

FBI, DHS Issue Warning On North Korea-Linked Malware

The FBI and the DHS issued a joint warning on the “Volgmer” Trojan malware, which has been infecting multiple organizations across industries over the past few years. The FBI has “high confidence” that the IPs linked to Volgmer belong to North Korea.

Volgmer Trojan

The FBI said that the Volgmer malware has been noticed in the wild since 2013 and has targeted government, financial, automotive, and media industries. The primary delivery mechanism for the malware seems to be spear phishing, a type of phishing attack in which a specific individual or organization is targeted. Through it, the attackers can gain higher privileges inside the network and then further infect the network with their malware.

The Volgmer backdoor is capable of gathering system information, updating service registry keys, downloading and uploading files, executing commands, terminating processes, and listing directories. The US-CERT Code Analysis Team also observed in one of the malware samples that Volgmer has botnet controller functionality, too.

According to the government agencies inspecting this malware, Volgmer has been seen in 32-bit executable form, as well as a dynamic-link library (.dll). The malware uses a custom protocol, often with RC4 encryption, to send back data to the command and control (C2) servers. Volgmer maintains persistence by randomly selecting a Windows service in which it can copy itself.

Mitigations

The FBI and the DHS recommend that organizations take a look at the Volgmer-linked IPs and analysis. If they find those IPs connecting to their networks, the companies should take measures to block them and then look for the malware and remove it.

The government agencies have also prepared a list of host-based rules and network signatures that companies can use to detect malware activity related to North Korea. They warned that despite the careful selection of those rules and signatures, some false positives may exist.

The DHS also recommended that organizations implement security best practices, such as:

The agencies would also like to remind companies that a successful network intrusion can lead to loss of sensitive and proprietary information, disruption to regular operations, and financial and reputation losses.

Posted on

US Government Details Procedure In Revealing Security Vulnerabilities

The U.S. government has detailed the guidelines it follows on revealing security flaws to companies.

Unveiled in its Vulnerabilities Equities Policy, the White House delved into the specific set of rules it follows while working alongside various government agencies, such as the National Security Agency (NSA) and the Department of Homeland Security.

The VEP Charter touches on how the federal government handles the process that determines whether they should inform a company about a cyber security flaw found in its service or product. But the document also mentions how they may also withhold showing the vulnerability so it can be used for “operational or intelligence-gathering purposes”.

In a blog post, White House cybersecurity coordinator Rob Joyce stressed the importance of transparency, with the release of the once-private rules being “important to establish confidence” in the government’s decision-making process.

A flow chart in the charter details how the board starts the process with analyzing how dangerous the security flaw is, as well looking at the amount of potential damage that could be caused and how easy it is for the vulnerability to be exploited by hackers.

The agencies will also consider using the vulnerability for their own benefit, as well as assessing the risks involved with how the U.S.’s relationship with other countries and companies will be affected should it be revealed that the government had knowledge of the security defect.

The review occurs in the space of five days but is expedited if attacks because of vulnerability are already being used. The board then must come to a consensus on whether to reveal the security flaw to the company or not. Should the board decide to disclose the vulnerability, it must alert the company in seven business days. However, if the powers that be determine that the discovered flaw should be kept a secret, the board will annually review it until they have a change of heart or it becomes known to the public.

The government has been criticized for keeping security exploits it’s discovered a secret from an affected company. For example, a vulnerability that was being exploited by the NSA led to the WannaCry/WannaCrypt ransomware global outbreak, prompting Microsoft to condemn the government’s insistence in keeping certain security flaws to itself.

Posted on

How To Fix Windows 10 Unsupported Disk Layout UEFI Error

A common problem that Windows users have encountered when trying to update Windows 10 is the “Unsupported Disk Layout for UEFI Firmware” error. This error basically means that the partition structure of your hard drive is not supported by the version of Windows 10 that you want to upgrade to.

This error can be resolved by creating a Microsoft Reserved Partition (MSR), which is used on Unified Extensible Firmware Interface (UEFI)/GUID Partition Table (GPT) disks. Without getting too technical, we will outline the steps to fix this error when attempting to update.

1. Run Command Prompt as Administrator

Go to Start -> Windows System. Expand Windows System and right click on Command Prompt ->More -> Run as administrator. This will open the Command Prompt in administrator mode. You can now begin to type in the commands that follow.

2. Run Diskpart.exe and Create the MSR Partition

a. Open Diskpart.exe by simply typing diskpart and Enter.

b. Type list disk. After doing this you will see all of your disks listed. If there is a * marked under GPT then your system is using the GPT partition structure, and you can proceed to the following steps. If not, then your hard drive will need to be converted to the GPT format, and you’ll need to perform a clean install of Windows 10.

c. Now execute the following commands in sequence:
• select disk # (where # is the actual disk number as displayed in list disk in step b)
• List partition – This will display all partitions on the selected disk
• create partition msr size=128 – This command will create a 128MB partition (a size recommended by Microsoft)
• list partition – Verify that that the partition was created
• exit – Leave diskpart.exe and close command prompt.

3. Try the Windows 10 Upgrade Again

You can now try to upgrade your system again. If for some reason you were not able to successfully complete the steps above, or you are still receiving the same error, then it’s better to back up all your data and do a fresh install and let the Windows installation format your disk to the recommended GPT format.

Posted on

Apple Releases iOS 11.1.2 Update: What Features Are Included?

Today Apple released iOS 11.1.2 for the iPhone, iPad and iPod touch. Apple did not release any iOS 11.1.2 betas to developers or the public before it was rolled out today. As iOS 11.1.2 is a minor point release, Apple did not add any major features in this update.

Apple is currently in the process of testing iOS 11.2 in beta, which is expected to support Apple Pay Cash and SiriKit for the HomePod with limited third-party developer support. iOS 11.1.2 is the sixth update to iOS 11 following iOS 11.0.1, iOS 11.0.2, iOS 11.0.3, iOS 11.1 and iOS 11.1.1. And this version of iOS is specifically a minor point update for the iOS 11.1 iteration with a couple of bug fixes.

iOS 11.1.1 contained a fix for the keyboard auto-correct problem that caused the letter “i” to be converted to an “a” with a question mark symbol next to it and a fix for a problem that caused “Hey Siri” to stop working.

iOS 11.1 included over 70 new emoji and it brought back the 3D multitasking gesture. iOS 11.1 also included bug fixes where Live Photo effects played back slowly and a problem that caused Mail notifications to reappear on the Lock screen.

iOS 11.0.3 fixed a bug that caused the audio and haptic feedback to become dysfunctional on a number of iPhone 7 and iPhone 7 Plus devices. And iOS 11.0.3 also fixed an issue that caused the touch input to become unresponsive on some iPhone 6s displays that were not serviced with genuine Apple parts.

iOS 11.0.2 contained fixes for bugs that caused crackling noises in the iPhone 8 earpiece, a bug that caused attachments in S/MIME encrypted emails to not be able to open and a bug that prevented photos from appearing on certain devices.

iOS 11.0.1 fixed a bug that caused synchronization issues in Outlook.com, Office 365 and Exchange Server 2016 running on Windows Server 2016 in Apple Mail. And it also had performance improvements for iMessage app Drawer, Springboard, and App Explorer.

The big iOS 11 release was on September 19th and it brought many new features. The new features in iOS 11 included Do Not Disturb While Driving, the new Files app, document scanning in the Notes app, the app drawer in the Messages app, a customizable Control Center, indoor airport and mall maps, lane guidance in the Maps app, Live Photos editing and new iPad multitasking tools.

In the release notes, Apple said that iOS 11.1.2 fixes two issues. The first issue that iOS 11.1.2 fixes is a bug that causes the iPhone X screen to become temporarily unresponsive to touch after a rapid decrease in temperature. And the second issue that iOS 11.1.2 fixes is a bug that causes distortion in Live Photos and videos captured with the iPhone X.

Apple confirmed the iPhone X temperature problem about a week ago and said that the issue would be “addressed in an upcoming software update.” I am impressed with that kind of turnaround time.

Posted on

FCC vote could force low-income households offline

Bootstrapping yourself out of poverty via the internet is about to get a lot harder in the US. The FCC, led by industry-friendly chairman Ajit Pai, has voted along party lines to reform the low-income Lifeline broadband subsidy program. Among the most contentious items are a proposal to tighten eligibility requirements and cap spending, and another to halt subsidies through internet resellers like Windstream. If voted through, the latter proposal could force over 70 percent of Lifeline enrollees to seek a new provider, and many would have no option at all.

Lifeline gives low-income households a $9.25 monthly credit towards discounted home internet service from 900 participating companies. Until last year, that could only be applied to landline and mobile voice service, but former FCC Chairman Tom Wheeler expanded the program to broadband early last year. However, Pai scrapped an FCC directive that came at the end of Wheeler’s tenure that allowed nine new companies to participate, and promised more cost-cutting reforms, supposedly to close the digital divide.

Some of the reforms are still in the proposal stages, but the FCC issued an order yesterday that directly affects Tribal land residents. Those folks used to receive a $25 monthly subsidy on top of the $9.25 discount, but in 90 days, they’ll no longer be able to obtain the $25 subsidy through resellers. That will give many Native Americans far fewer options for mobile internet. “This will be a travesty to Indian Country because it will turn back the clock to times when consumers had but one choice,” Joe Redcloud from the South Dakota Sioux Tribe told the Washington Post.

Another proposal suggests that the FCC eliminate Lifeline subsidies across the US through carriers that don’t operate their own networks, but resell services from AT&T, Verizon and other companies. Advocacy group Public Knowledge says that 70 percent of Lifeline subscribers use such resellers, so they would be forced to use AT&T, T-Mobile and other direct providers.

This is not real reform. This is cruelty. It is at odds with our
statutory duty. It will do little more than consign too many
communities to the wrong side of the digital divide.

However, those carriers are often more expensive than resellers, so switching could eliminate much of the $9.25 Lifeline benefit. In some instances, low-income users wouldn’t have any option at all. “In many states, facilities-based providers have opted out of offering Lifeline-supported service altogether and prefer to allow non-facilities-based wireless providers to serve Lifeline subscribers and the low-income segments of the wireless market,” Public Knowledge wrote.

Finally, the FCC is looking at a cap that could drastically reduce the Lifeline budget and institute more rigorous checks. “The reforms that we implement and propose today seek to … curtail the waste, fraud and abuse that continue to plague the Lifeline program,” Pai said ahead of the vote. That includes forcing subscribers — many of whom have their broadband bill entirely paid by Lifeline — into co-paying part of their bill.

That could effectively cut off a lot of the most needy Lifeline recipients from the internet altogether. “The co-pay requirement would create significant attrition in the program since most subscribers are on plans that provide no-cost service, and many Lifeline subscribers lack bank accounts and access to basic financial services,” Public Knowledge said.

The advocacy group notes that there is no support for the FCC’s plan in the 50-plus dockets filed since the proposal was issued. Meanwhile, dozens of others from veterans, seniors, Tribes, and even the wireless industry have urged it not to implement the proposed items. Commissioner Jessica Rosenworcel, who voted against the bill, put it succinctly. “This is not real reform. This is cruelty,” she said. “It is at odds with our statutory duty. It will do little more than consign too many communities to the wrong side of the digital divide.”

Posted on

Twitter’s 280 character tweets are rolling out for (almost) everyone today

After testing a new 280-character limit a couple of months ago, Twitter is rolling out the new limit to everyone, starting today.

Twitter says you shouldn’t expect to see an apocalyptic flood of massive tweets now, though. According to its data, the number of tweets with a higher-than-average character count was small after the initial novelty wore off. In fact, only 5 percent of tweets sent by testers were longer than 140 characters.
According to Twitter’s Product Manager Aliza Rosen:

We saw when people needed to use more than 140 characters, they Tweeted more easily and more often. But importantly, people Tweeted below 140 most of the time and the brevity of Twitter remained.

I’m not sure whether that means Twitter is actually committed to the 140 character limit long term, or whether we’re just conditioned to self-edit and will grow out of that when all of us have the option.

The new character limit will be available to all languages that have problems with cramming. According to a spokesperson, Japanese, Korean, and Chinese languages don’t require a higher limit due to the languages inherently having more meaning packed into every character than in, say, English. As such, those who tweet primarily in those languages don’t have as much of a problem with cramming.

Posted on

The Windows 10 Fall Creators Update Is Here

The Windows 10 Fall Creators Update is here. Microsoft’s latest major upgrade to its desktop OS brings with it plenty of changes, from new visual styles to the dawn of Windows Mixed Reality, and you can now install the update to see how things have improved from the Creators Update.

Much of the focus on the Fall Creators Update, at least among enthusiasts, will be on Windows Mixed Reality. This is Microsoft’s attempt to prove that mixed reality headsets will soon be one of the primary ways we interact with our devices instead of luxury items used mostly for entertainment. Dell, Samsung, and several other companies have prepared headsets for launch alongside the Fall Creators Update.

But that doesn’t mean the only thing worth paying attention to in the Fall Creators Update is Windows Mixed Reality. The release also sees the debut of Fluent Design, improves central utilities like Action Center and Task Manager, and introduces new features that expand upon Windows 10’s capabilities. Yet some of the update’s standout features—Story Remix and new Windows Timeline prime among them—are missing.

Windows Mixed Reality

In case you’ve missed our flurry of coverage over the last year, Windows Mixed Reality is the new name for Windows Holographic. Microsoft believes wearing a mixed reality headset will soon become just as common as using a desktop or laptop PC, and it wants its OS to be ready for that shift. Now it’s finally here, and that means you’ll be able to see for yourself how it compares to platforms like Oculus and HTC Vive.

First, you’ll have to make sure your PC meets the minimum requirements for Windows Mixed Reality. The base platform isn’t all that taxing—you can get away with a modern CPU with integrated graphics—but Windows Mixed Reality Ultra requires more powerful processors and dedicated graphics. (Windows Mixed Reality Ultra offers improved performance, support for more software, and other benefits over the base platform.)

You can learn how to check if your PC supports Windows Mixed Reality here. Once you’ve done that, just head to the Mixed Reality Portal from the Start menu, agree to Microsoft’s terms, and then follow the setup process, which should be quite simple.

Fluent Design, New Features, And What’s Missing

The Windows 10 Fall Creators Update also features some obvious changes to Windows 10’s design. Microsoft has implemented a new Fluent Design system that emphasizes textures, lighting, and motion to make it easier for people to use Windows apps and services. Fluent Design also appears to have been influenced by HoloLens, and it seems poised to prepare Windows for use across both traditional PCs and mixed reality headsets.

The Fall Creators Update is more than just a new coat of paint, however. Microsoft also introduced some new features, such as a GPU monitor in Task Manager, ransomware protections via the Windows Defender Exploit Guard, and expanded PDF support in the Edge browser. These won’t lead to monumental shifts in how you use Windows; they’re simply quality-of-life improvements meant to refine Windows 10’s base experience.

Similar changes were made to gaming on Windows 10. Microsoft will now let you toggle the performance-enhancing Game Mode right from the Game bar (where you can buy a Game cocktail and watch a Game game on the Game TV) instead of having to rifle through the Settings app. You can also check on network quality issues via an Xbox Networking section in Settings, and you should notice improved Mixer broadcasting.

All of these changes, as well as the many improvements Microsoft made to Windows 10’s accessibility, are welcome. But it seems like the Fall Creators Update lacks any single marquee feature that will compel everyone to upgrade. Windows Mixed Reality is the main attraction, but how many people will actually be purchasing one?

It wasn’t supposed to be this way. Microsoft showed off new apps at Build that would’ve made the Fall Creators Update seem like a much bigger deal. Perhaps the coolest was Story Remix, an app that lets you combine photos, videos, music, and 3D objects into one AI-generated video. Story Remix was stunning, but it’s nowhere to be found in the Fall Creators Update. Many of its features were instead added to the existing Photos app, with the notable exception of the support for 3D objects, which is said to be coming at a later date.

The new Windows Timeline, which promised to make it easy to access backups of your files or pick up where you left off in an app, is also missing. Its omission comes as less of a surprise because Joe Belfiore, corporate vice president of Windows, said in July that it wouldn’t debut alongside the Fall Creators Update. Instead, Microsoft told us that features announced at Build would merely start to roll out with this release.

You can find a full list of the changes coming in the Fall Creators Update in Microsoft’s blog post about its release.

How You Can Get It

If you’re itching to give Windows Mixed Reality a whirl, or if you simply like to use the latest version of Windows as soon as it’s available, you can download it starting at 10am PT today. There are two ways to update—Microsoft’s preferred way, and the impatient way. Both are easy to do.

Microsoft would prefer for you to wait for the Fall Creators Update to roll out to your device. The company is staggering the release of new Windows updates to select hardware to ensure the best experience on as many systems as possible. If you have a newer system, you’ll be prompted to install the Fall Creators Update before those with older systems. You can also go to the Windows Update section in the Settings app to see if you’re part of the first group to receive the update. If you are, it will start to download immediately.

But waiting is for squares. That’s why Microsoft will also let you manually install the Fall Creators Update by heading to its Software Download Site (its capitalization) and clicking “Update now.” Once you do that, the Update Assistant will help you get things rolling. Easy-peezy.

Posted on

FTC Asked To Investigate Hackable Kids’ Smartwatches

The Norwegian Consumer Council and Mnemonic, a security company, revealed that several brands of smartwatches made for children are easily hackable. In response to these findings, U.S. privacy groups have asked the Federal Trade Commission (FTC) to investigate the products’ makers.

These watches are equipped with GPS capabilities that are supposed to let parents keep track of their children’s locations. The Norwegian Consumer Council and Mnemonic tested the security of four of these watches; three had serious flaws. Mnemonic said in its announcement that the vulnerabilities are “not technically difficult to exploit, and in two cases, allow a third party to covertly take control over the watch.”

“It’s very serious when products that claim to make children safer instead put them at risk because of poor security and features that do not work properly,” says Finn Myrstad, Director of Digital Policy at the Norwegian Consumer Council. “Importers and retailers must know what they stock and sell. These watches have no place on a shop’s shelf, let alone on a child’s wrist.”

Yet at this point, the fact that these watches are easily compromised shouldn’t come as a shock to anyone. Here’s the common sequence of events: An internet-connected product is released, purchased by a bunch of people, and then hacked. It’s gotten to the point where the FBI warned parents not to buy internet-connected toys without vetting them first, and Mattel preemptively canceled a kid-focused IoT device called “Aristotle.”

There were more concerns about some of the devices. In addition to putting children’s data at risk of being hacked, several of the companies’ terms and conditions violate the Norwegian Marketing Control Act and the Personal Data Act by not allowing accounts to be deleted, or they were simply lacking terms and conditions. That means the data collected by these watches is just waiting to be abused to suit the companies’ own purposes.

That’s why the Electronic Privacy Information Center (EPIC), The Center for Digital Democracy, and other U.S. privacy groups asked the FTC to investigate the Norwegian Consumer Council and Mnemonic’s findings. In a letter, the groups said “this is a real risk to children’s safety” and urged the regulator to be more proactive in protecting kids from companies like this.

 

Posted on

Google’s rolls out new, crazy-secure, email

SAN FRANCISCO — Google on Tuesday rolled out a nasty-complicated but insanely secure version of its Google accounts aimed at “those who need it most,” such as journalists, politicians and activists. It’s not pretty but stands a good chance of keeping the bad guys out.

Called the Advanced Protection Program, it requires users to jump through a series of hoops most Internet companies have worked for years to make go away — dongles, extra passwords, locked-down systems that can’t talk to anything else and a non-intuitive sign-up procedure.

This is so not plug-and-play.

What it is, however, is safe. Not “I work for the National Security Agency and print out the nuclear codes every time they change” safe, but more “I’m working on a Senate campaign and we really don’t want the Russians, or anyone else, to get into our email system” safe.

Signing up requires a Google account and then linking not one but two dongles, or small devices that connects to a computer’s USB port or via Bluetooth. Each produces a highly secure code key that uses the standards of the international FIDO Alliance (for Fast IDentity Online.)

These plastic keys are about the size of a regular door key but instead hold codes Google uses to verify that you’re you and that you should have access to the account. The key can go into the USB drive on a computer or via Bluetooth to a mobile device such as a phone.

While the secure accounts are free, the hardware to make them secure costs money. A USB security key runs about $25 while the Bluetooth-enabled keys are about $18.

Once you’ve tied these keys to your Google account, you’ve got to have one of them present in order to access your mail and files.

Otherwise — take note — it’s Do Not Pass Go, Do Not Collect Your Email.

“What I think has changed is that people recognize they may never be able to ‘learn’ how to act optimally in a defensive sense, so this program literally eliminates many sources of humans messing up,” said Joseph Lorenzo Hall, chief technologist with the Washington D.C.-based non-profit the Center for Democracy & Technology.

That means using a locked-down Gmail account which may not have all the functionality a more open one could have, though Google does say it’s exploring adding access to some trusted partners as time goes by.

And about that dongle? You really, really don’t want to lose it, or forget your password. Google hasn’t even said what the recovery process will look like, but it is expected take three to five days.

This isn’t an email system for everybody, Hall said. Those who are considering it should think carefully about the threats they face before they sign on. For most regular email users it will be overkill.
But if someone’s possibly being targeted by a nation state attacker or very determined attackers or organized criminals, the answer is a clear yes, he said.

“Sexual assault and domestic violence victims, billionaires, finance employees, judges and law enforcement officers — they certainly face these threats and should use it,” he said.

The system also doesn’t allow users the freedom that non-secure Google accounts have. Once signed up, their Google account is only able to gather data from a few secure apps so that miscreants can’t get to their inbox or Google drive via them.

In a way, this is an admission of defeat but also of reality. The Holy Grail of online security has long been a system with serious security that was as easy to use as any other program.

With the launch of Advanced Protection, Google is acknowledging that while no one has come up with something that’s both easy to use and secure, there are enough people out there who really need protection that even a somewhat gnarly program is going to find users.

Posted on

Five signs your laptop is in trouble — and how to fix them

Catch laptop trouble as early as you can.

When something goes seriously wrong with your laptop, you usually receive an advance warning. A virus might alter your security settings, for example, or a failing hard drive might start making funny noises. If you catch these signals early, you can quickly diagnose and fix your computer.

Many of our recommended solutions involve a thorough malware scan. If you haven’t already installed antivirus and antimalware programs on your system, do that now. You cannot rely on the build-in Windows or macOS programs, and should talk to an IT professional about another security suite. Just make sure to put in the research: Check out an online buying guide for Windows or macOS, read up on user and professional reviews, and find the right set of tools for your needs. Don’t let price deter you—solid computer security is worth the money.

In addition to your primary suite, consider getting a second opinion. You can employ a less-intensive scanner, one that requires you to install fewer files, alongside your main one. Instead of running regular checks, the secondary program would work on an on-demand basis: You only need to fire it up when you need it. We like ESET Internet Security and Malwarebytes for Windows and Malwarebytes and ESET CyberSecurity Pro for macOS.

With so many computer systems out there, problems may manifest differently on each type of machine. But by the time you’ve finished reading this guide, you should have a much better sense of what various issues look like. And the earlier you spot them, the earlier you can fix them

1. Sluggish and unresponsive performance

If your laptop begins slowing down, this doesn’t necessarily mean it’s caught a virus. However, sluggish performance can be a tell-tale sign that a hacker has hijacked your machine for secret activities such as sending spam or mining for cryptocurrencies.

Start with a thorough malware scan. Then check the programs that may be running in the background. On Windows, open the Task Manager (to find it, search for the program’s name via the taskbar), and on macOS, the Activity Monitor (search for it in Spotlight). You’ll see a list of currently-active programs, including some familiar names and some strange ones. Don’t expect to recognize everything here—active processes you haven’t seen before aren’t necessarily bad. Just try searching for those processes online to learn more about them.

If a malware scan comes up blank, and you can’t find anything suspicious in the list of running applications, the culprit may be a non-malicious buggy program. Try shutting down your open windows one by one and then restarting those programs. Or, if you notice that one of the active programs in the list is using up a lot of memory, you can try uninstalling it.

The slow performance may simply be a symptom of your laptop’s age. But all is not lost: We have tips for speeding up old computers, whether they’re Windows or macOS.

2. Persistent error messages

All computers get the occasional error message. It’s when you start seeing these alerts regularly, over and over again, that you should start to worry.

Because the culprit could be anything from failing hardware to a virus to a corrupted program installation, you’ll need to put in some detective work to discover the root cause of the messages. Start with the text of the error message and any codes it includes. Then go online and type that information into your favorite search engine. You should find some pointers on what’s going wrong and how you might be able to fix it

If your results indicate that errors are related to one specific program, then you have a relatively easy fix: Uninstalling and reinstalling that application is one of the most effective ways to make everything run smoothly again

You can’t diagnose every issue this easily. When you’re receiving shorter error messages, the text may turn up fewer search results, which can make them harder to troubleshoot. For more information, look at the message’s timing. When viruses and malware are causing issues, for example, they often trigger errors that appear when your computer is booting up or shutting down, or when you’re trying to configure your security programs. Alternatively, if you tend to see messages while you’re attaching a Bluetooth keyboard or another peripheral device, that gadget’s outdated software may be to blame. Check online to see if you can find updates for the device

If your online sleuthing can’t uncover the culprit, try running through the most comprehensive virus scan you can. As a last resort, back up all of your applications and files and then reinstall Windows or macOS. This should fix most error messages—unless they’re related to failing hardware. In that case, you may have no choice but to buy a new machine.

3. Unrequested changes to settings

If your applications start behaving strangely or reconfigure their settings without your permission, your machine has probably caught a virus. After gaining access to your system, malware will often alter your settings for its own purposes, such as preventing you from removing it.

Often, you’ll first notice these changes in your browser. The infection might disable certain features, change your homepage, or reset your default search engine. Sometimes, new extensions that want to push their own services, rather than viruses, will alter your browser settings. You can check by uninstalling any recent extensions.

Also watch out for other suspicious changes: New icons, which you didn’t ask for, may appear on your desktop, or an invisible hand might reconfigure your security programs. Viruses can trigger a wide variety of different changes, so keep an eye on your applications and don’t ignore major modifications to your software setup

As we’ve mentioned before, this activity might be innocent—programs reconfigure your system all the time in order to work properly. Just be wary of changes that seem to happen without warning or that involve your browser or security applications.

To fight a potential infection, first roll back the changes—for example, set your browser’s homepage back to its original location. Then run a full virus and malware scan on your system. If you find out that a legitimate program or browser add-on is the one that keeps making changes, you can uninstall it.

4. Random web pop-ups

Everyone has to deal with pop-ups while browsing online. But if you’re seeing more than normal—and they’re pushing suspicious content rather than prodding you to sign up for a newsletter—then you might have a problem. What sort of pop-up content should set off alarm bells? Look out for messages that claim you’ve won a competition or a reward, flash a malware alert, or nag you to play games, especially if they also make it difficult for you to return to the original page. These can signal that a browser extension is behaving badly or that some kind of malware has taken root on your machine.

To fight the intrusions, first find a list of browser extensions you’ve installed. In Chrome, for example, they sit under the More tools entry on the main app menu (open it by clicking the three vertical dots on the top right). In Firefox, they’re behind the Add-ons entry in the main app menu (launched via the three horizontal lines on the top right). In Safari, access them through Preferences on the Safari menu. Finally, in Microsoft Edge, open the main app menu (the three dots on the top right) and choose Extensions.

Next, uninstall as many of these add-ons as you can, stripping your browser down to the bare minimum to see if this fixes the problem. If that doesn’t tame the pop-up epidemic, try uninstalling and reinstalling the browser. In addition, as always, run a thorough virus and malware scan to see if something outside your browser is causing issues.

5. Strange noises

As a computer’s internal components begin to wear out, it can grow too old to function properly. Refusal to switch on is a sure sign of hardware issues. But you should also keep an ear out for strange and repeated noises coming from the depths of your laptop, because these can indicate that hardware failure is imminent.

When you hear these sounds, immediately save your data to an external machine or a cloud service. (This task will be easier if you’re already backing up your files on a regular basis, a habit that everyone should cultivate.) Even if the noises prove to be inconsequential, it never hurts to back up your data. And in a worst-case scenario, an archive of this information will preserve your digital memories and ease the process of switching to a new computer.

Once you know your files are safe, you can start figuring out just what the problem might be. Consider your laptop’s age: The older it is, the more likely hardware failure is to blame. Have you ever dropped your machine or spilled a hot drink on it? Accidents like these can speed up a computer’s aging process. If your machine is relatively new, a foreign object could be gunking up the works. Try cleaning out your laptop’s sockets and ports with a small can of compressed air to make sure it’s not carrying some small, easily dislodgeable item.

If the weird noises persist, run a systems diagnostics program to figure out whether your laptop really is on its last legs. For example, software like CrystalDiskInfo for Windows (free) and DriveDx for macOS ($20 with a free trial) can report on the health of your hard drive. And if an internal component is on its last legs, it may cause other symptoms such as overheating, random crashes, and particularly slow performance.

Unfortunately, if a part of your laptop is failing, you can’t do too much about it at home. So go to the experts: Visit your local computer repair shop to see if they can replace the component. Or, depending on your computer’s age, you may want to invest in a new laptop instead of trying to resuscitate an old machine.