You realize that your computer is infected by a virus. There’s a tip circulating online that you should disconnect from the internet immediately in this case. You should unplug the network cable and deactivate the Wi-Fi in Windows in order to have time to remove the malware, this wisdom says.
A reason for this strategy is usually not given. This raises the question of whether it really makes sense or is even necessary to disconnect the PC from the internet? The answer is not quite simple, because there are two good reasons for disconnecting the internet connection.
First, it is conceivable that the malicious code could give an attacker complete access to the system. This is the case with so-called Remote Access Trojans (RATs), for example. This malicious code gives the attacker complete control over the infected system.
But attackers can also use other types of malicious code to access users’ personal data. Here it can make sense to pull the plug in order to remove the malicious code at your leisure.
The second reason is that ransomware viruses often not only encrypt your data, but also upload it to the attackers’ servers beforehand. The criminals can threaten to publish this data if you do not pay the ransom. In this case, it also makes sense to disconnect from the internet quickly.
The bootable Avira Rescue System finds PC malware even if Windows can no longer or should no longer start.
IDG
On the other hand, the virus detection of most antivirus programs works much better when you are connected to the internet. This is due to the large databases with fingerprints of dangerous files that the antivirus manufacturers keep on their servers.
Virus detection based on the reputation of a file also requires internet access for some antivirus manufacturers. The reputation of a file includes where it comes from and how often it has already been recognized on other PCs. This data is also often more up-to-date on the manufacturer’s servers.
The AV-Comparatives tests reveal the extent of the difference in detection between an offline and an online scan. For example, the Avira antivirus program detects 99.1 percent of malware with internet access, and 92.5 percent without. The difference is even clearer with Microsoft Defender: In this test, 95.8 percent are detected online and only 77.0 percent offline. With McAfee it is 99.2 percent online and 65.2 percent offline.
With these figures, it does not seem sensible to start a virus scan without internet access. However, because a complete scan of all hard drives can take several hours, we recommend running a quick scan if a virus is suspected. This is completed in just a few minutes.
In the meantime, you can download an up-to-date second scanner for the USB stick and copy it to the stick. We recommend Avira Rescue System, for example. Restart your PC with the finished stick and carry out a complete scan.
Many antivirus programs detect malware on the PC much better if the internet is accessed during the scan.
IDG
If you suspect that there is still malware on your system, you should disconnect the internet connection for a detailed analysis. This will allow you to examine the system in peace and quiet without having to worry about data leaks during this time.
This article was translated from German to English and originally appeared on pcwelt.de.
