Google
 
Web bcot1.com


Virus and Spyware Protection

 

If you have cable or DSL internet service, please read this entire page

Let me first say that I'm not trying to sell anything on this page. I'm not profiting in any way and I'm not trying to get you to buy any software (most of the software I recommend here is free for personal use).

Protect Your Computer and Your Personal Information from Theft

As most computer users know, it's very difficult to surf the web without annoying pop-ups or other distractions. This page is to help you have a better experience on the net and to help keep your computer healthy. Some of the malicious software (malware) can actually cost you money. Automated dialers can call chat lines without your knowledge. If you use a computer that is in any way connected to the internet or other computers, you are at risk of identity theft, theft of passwords, loss of important files and spying.

Different Types of Malware

There are many different types of malicious software. The following are the most common types:

Virus:
Many people refer to all types of malware as viruses. To be more precise, viruses are malicious code that are designed to do damage. Some delete or corrupt files. These are the most damaging type of infection because you will, many times, lose important information.

Macro Virus:
If you've used spreadsheets or software like Word, you know that there are 'macros' that allow you to do common, repetitive tasks more easily. While these tools may be helpful, they are also a danger to your computer. If you open an infected document into a program that supports macros, the macro could perform some malicious task and cause you grief. If you don't know who sent you the document, don't open it.

Worm:
A worm is a self replicating piece of malware that copies itself onto as many computers as possible. This type of software can bog down networks but usually doesn't purposely damage or delete files.

Trojan:
Trojans are malware the arrive within a seemingly benign piece of software or code. The malicious code can come in as a screensaver or even as an image file. They are designed to do several things but generally, they provide access to your computer to a hacker. Many times, the trojan will open a backdoor and allow access to information including passwords, personal information or any other information on your computer.

Hybrid:
Hybrids are malware that are a combination of one or more of the previous types of malicious code. These will likely become more and more common as the malware writers seek to inflict the most damage possible.

Adware:
Adware is software that is used to place ads on your computer. Typically, they are in the form of pop-ups. These are commonly loaded when you visit sites where you expect to get something (bootlegged/illegal software, free music...) for nothing. Some of offending software includes music download software (kazaa, grokster...), smiley face animations, screensavers, search bars (with a few exceptions), fancy cursors and in many circumstances codec packs. When you unpack/install the software, the installer program loads additional software onto your computer that spies on your surfing habits and loads ads to try to sell you something. These can easily overwhelm your computer and render it unusable.

To avoid problems with ads or undesirable tracking that are associated with any 'free' software, read the EULA (End User License Agreement) to learn the terms of use of the software you're downloading. The EULA is the text that you typically blindly agree to when loading software. If the software manufacturer/author is honest, they will spell out all of the terms of use associated with the software. They should tell you what information is gathered and how it's to be used. It should also tell you if other software is to be bundled with it. If other software is in the package, you may need to find the EULA for the respective software.

Dialer:
A dialer is a piece of software that uses your modem* to call very expensive sex chat lines. It can do this without your knowledge (until you get your phone bill).

*: Even if you have broadband service, you may still have a modem. Many people have the ability to send faxes with their computer. The fax software would require a standard phone line hook-up to be able to dial the other fax machines. If this is the case on your computer, be very careful about what software you download from the internet.

Keyloggers:
Malicious keyloggers (a form of trojan-horse malware) monitor and report keystrokes (on your keyboard) to a third party. Typically they are used to capture passwords and other sensitive information. The information collected is often used for credit card fraud. Some of the software recommended on this page detects a few keyloggers. If you want the best protection against this type of malware, you need to use a dedicated anti-keylogging program. A Google search should turn up quite a few. If you find one you think you want to use, do a search for it specifically to see if it's a legitimate program. Check Major Geeks for applicable software.

Toolbars

Many sites will will ask you if you want to install their fancy-pants toolbar to help you better search the net. In most all circumstances, do NOT do it. Most are adware/spyware infected and will cause more problems than they solve. One of the few exceptions is the Google toolbar (http://www.toolbar.google.com/). When it asks if you want to allow anonymous usage statistics, tell it no.

Note:
The Yahoo toolbar and the eBay toolbar are also good, safe toolbars.

The following is an example of a toolbar that was 'bundled' with undesirable software. This one is the 'mywebsearch' toolbar. This is only one variant of this software 'package/bundle' so anything similar should be carefully examined. On the Fun Web Products web site, they state that the web search toolbar doesn't contain any malware and that may be 100% true but every time I've seen the toolbar offered, it was bundled with other software. If you have this toolbar, run all of the software recommended throughout this page to check for problems. In the following Flash Graphic, you can right click and zoom in on the toolbar to better see what's on it. Use the left mouse button to move the desired area to the center of the window (after zooming). Notice the screensavers, smileys and cursors. These are common hooks to get younger people to download crapware.

During testing to see what was installed on a computer when a particular piece of software was downloaded, I loaded the previous toolbar from a random internet site. After the toolbar was loaded, a dialer appeared in the next scan of the machine (even though the machine was previously scanned and was clean and no other software was loaded between the two scans). I believe the dialer was bundled with the toolbar. Since I didn't remember where I downloaded the first copy, to be fair, I went directly to the Fun Web Products site and downloaded a copy from them. The new copy did NOT include a dialer. It did, however include the MWSOEMON.EXE program that ran in the background. From researching this, it looks to be some sort of malware. You can search for yourself to come to your own conclusions.

If you need to download software, only download from reliable/trusted sites like computercops.org (the name has been changed to CastleCops). If you're downloading bootlegged software from warez type sites, you are VERY likely to get infected.

If your browser or a web page asks you to download a piece of software in order to do something on a web page and it's not a from a well known company (Microsoft, Macromedia, Adobe...), it's possibly infected with spyware, a trojan or browser hijacker (this is very common on adult sites, free mp3 download sites...). If you absolutely have to download a piece of software, do several Google searches (web and groups). In the search, include the name of the software and one of the following words virus, spyware, trojan or worm in each search. If you include all of the key words in a 'single' search, you may not get reliable results. If any of the searches returns information that indicates that the software may include malicious code, don't download it.

Don't download anything that offers great deals or better web searching. If you want a good deal, go directly to a well respected web site. If you want a good search engine, use Google. Many of the smaller search engines use Google anyway.

Pre-emptive Measures

Avoiding Trouble:
If you have a broadband connection (cable/DSL), you are at risk of being infected. Many virus and trojan infections can be aquired by simply having your computer on. There are programs that do nothing more than search for open ports on a machine and then try to infect that machine. After a machine is infected, it too may become one of those machines looking for other vulnerable computers. There are several ways to protect a computer.

Hardware Router/Firewalls:
A router is a device that connects between your broadband modem and the LAN card in your computer. It helps to block infection by preventing other computers from directly accessing your computer. When you access the internet, you use an IP address. This address identifies your computer. If some malicious software pings your IP address and gets a response, it may try to access your computer. A router breaks this link by giving your computer a different IP address. When a computer pings the router it will not be given access to your computer. This is called a Network Address Translation firewall but it can typically only protect against incoming threats. It monitors the requests that you send to retrieve files. If the incoming packets don't match something that you requested, it drops them.

Software Firewalls:
As was stated above, most routers act as a firewall but you also need a software firewall. The software firewall prevents access to your computer or access to the internet by setting up a set of rules that determine which programs have access to the internet (incoming and outgoing). My favorite is ZoneAlarm from Zonelabs.com. The free version works well and is relatively flexible. Download and install this program to help prevent infection and re-infection. If the firewall asks if a particular program should have access to the internet and it's not a piece of software that you're using or installing at the moment, tell it that it can not access the internet (it could be a trojan or similar piece of malware). If you accidentally block a piece of software from accessing the net, you can change the permissions easily in the firewall control panel. If you can't use or don't like ZoneAlarm, Kerio and Sygate are also good firewalls.

Anti-virus Software:
Anti-virus software protects your computer from virus infection. Some also protect against other infections but they are primarily designed to protect your computer from malicious, damaging software. The AV software is designed to run automatically when you boot your computer. If you don't want to spend the money on AV software, I've had good luck with Anti-Vir. You can download it from computercops.org. After you install it, run the internet update (right-click on the icon in your systray). Anti-Vir will automatically remind you to update the software. If the AV program doesn't run a complete search on your machine when it's initially installed, do so manually (right-click on icon in systray).

Cleaning Infected Machines

To clean infected machines, I recommend that you run the following software. All can be downloaded from computercops.org. It's a good idea to run them on a regular basis to see if you're computer is infected (even if it's not currently showing signs of infection). Be sure to update them each time you use them. There is usually a link in the window that allows easy updating.

Ad-Aware

Spybot Search and Destroy (use the immunize function after cleaning your machine)

Anti-Vir

Hi-Jack This (for advanced users or those working within a forum of computer experts)

CWS Shredder

Trojan Hunter (not free but seems to be very good)

Pest Patrol (not free but seems to be very good)

Note:
When you run any of the above software, you need to do so in SAFE MODE. This prevents the malware from protecting itself. For XP users, you also need to turn off the SYSTEM RESTORE function (do this only after you've found that you're actually infected and the software can't get rid of the problem). This will prevent the malware from being automatically repaired when you reboot. Remember to enable system restore when you have completely cleaned your system. If your machine has multiple user names, I'd recommend deleting all of them except the main user. Sometimes, having multiple users makes it difficult to get a machine completely cleaned. There is an option to save all of the files from each user so nothing will be lost. After the machine is clean in safe mode, run the scans again in normal mode. You may have to run all of the software I recommend on this page several times to clean a badly infected machine. Remember that the people that write the malware are very knowledgable about computer systems and know how to avoid being removed. It may take several tries and several Google searches to be able to remove some of the worst offenders.

If you are knowingly infected, the following software may be able to help. If your computer is infected with some viruses, you will not be able to run it from your hard drive because it will become corrupted by the virus. Burning it to a CD on a clean machine will allow it to run on your infected machine.

McAfee AVERT Stinger

Tips to Prevent Infections and Other Problems

* When you visit some sites, they will tell you that you need to allow the installation of software to continue. On well respected sites, the option is entirely yours. If you decide not to download the software, you will still be able to browse the page but the functionality may be reduced. On less well-respected sites, the problem is that the only apparent choice you have is to click on the dialog box to allow the software to be loaded onto your computer. On those sites, you can not go 'back' and the dialog box is 'locked' on top of the browser window. One option you have is to hit ctrl-alt-delete. This will bring up the task manager. Click on the 'processes' tab and end all of the IEXPLORE.EXE processes. This will close the browser windows. After all of the windows close, you can re-open the browser and visit a different site. If you download the requisite piece of software, it's likely that you will have downloaded some sort of malware. Of course, downloading software from companies like Microsoft, Macromedia and Adobe is perfectly fine. It's when you're 'forced' to download software from less well known companies that you run into trouble.

* Do not use the computer with broadband service without the firewall AND virus software running. Both Zonealarm and Anti-Vir will have pop-up reminders about every 2 weeks asking if you want to update the software. You need to allow the software to update itself so that you have the best protection against the most recently produced malware.

* Do NOT click on any flashing banners that say that you've won a prize. This includes all of the little games that ask you to see if you can hit a target. Most of these 'games' are nothing more than gateways into the world of spam.

* Do NOT enter your email address anywhere except for legitimate sites (wal-mart and other major retailers may be OK but you will likely be added to their mass mailing lists if you don't opt-out -- look for a 'check-box' that allows you to opt-out). When you enter your email on most sites, they will be added to a huge database that will email you with significant amounts of spam (undesirable email).

* Do NOT enter your email address or passwords into any email forms in unsolicited email. If it seems to be from a business you deal with, go directly to the business' site and log in to see if there is a request for information. If you think the email is from an unscrupulous source, forward it to the business that it appears to be from. Most of the time the proper address for this type of reporting is 'SPOOF@business.com' (i.e. spoof@ebay.com, spoof@paypal.com...). Most businesses want to know when this type of email is being sent out and will respond quickly to it.

* When you see an address on a web site like ebay.com it will generally have 'ebay.com' in the address. Even if it has a link to a different section of the site, you will see the 'ebay'com'. If you receive an email that contains what is supposed to be an ebay address and looks similar (i.e. www.ebay.subscribe.com), you see that the 'ebay.com' is broken up and the address is likely not an ebay address. Also, when you receive an unsolicited email from a company, you should look at a couple of things. When you position your mouse over a link, look at the status bar (at the bottom of your browser window) to see if the link matches the text in the link. Try it with the following examples:

http://www.ebay.com/

http://www.ebay.com/

* Many times, the address will have a number instead of a name. In virtually all of the cases, these are sites to avoid. Most legitimate sites want you to be able to remember their names so they use a name.com/name.org/name.net type address. Sites that use an IP address are more likely to have malicious intent.

* I strongly recommend against filling the 'auto-fill' forms such as those offered in the Google toolbar (or in any other software). Having this information on your computer in a location that's going to be common to many computers means that it will likely be targeted by trojans. In my opinion, it's best to take the time to fill in forms manually when it's needed on a web site.

Reducing Unsolicited Email

As you know, spam in email can be very frustrating. It takes time to go through it and find which emails are legitimate and which are ads. While many of the more respected merchants follow the rules that allow you to be removed from their mailing lists, most others don't. There are a few things you can do to help reduce spam in your email.

Filters:
Most email services and email software have filters. The filters are set up to send email containing certain words or phrases to a given folder (usually the trash). For example, if you don't want any email containing offers for mortgages, you can set up the filter to send all emails with the word mortgage to the trash. Although many spammers get around this by changing the spelling or adding characters between the letters (m*o*r*t*g*a*g*e*s). Unless you see a word disguised a certain way many times, filters won't help and you'll have to delete them manually. In my opinion, you should NEVER deal with a company that tries to avoid filters. I've never seen a legitimate business employ such practices.

Address Blocking:
Many email services offer an address or domain blocking option. This means that, if you receive spam from someone using a particular address or from a particular domain like real-coupons.com or marketing4pros.com, you can simply block all email from anyone sending email from that domain. This doesn't work for many spammers because they use harvested emails as their address but it is another tool that will help keep your inbox clear.

Turning Off Graphics:
Many spammers will use dynamically generated file names to find active email addresses. One such tool is to see when graphics are loaded from a given email. The file name generated for the graphics are linked to your email address. When that particular graphic file is called from their server, it tells them that your email address is active. If they know your email is active, they're more likely to send you even more email. If you have the option to turn off the graphics (as you can in Yahoo mail -- and likely other web based email services), use it. If you see that the email is from someone you deal with (someone who is not a spammer), you can then tell the browser to load the graphics. Otherwise, you can simply delete it and they will not know that you received it.

Not Responding:
For respected merchants, you can usually follow the removal instructions at the bottom of the email to be removed from their mailing list. For other merchants and spammers, that's the worst thing you can do. For spammers, if you follow any link on the email (even the removal link), you will be telling them that your email is an active address. In the off chance that they actually remove you from their mailing list, there's a good chance that your email address will be put on a different list or sold to another spammer as a known active address. If you see a spammer using techniques to get around filters, you can be pretty sure that they are not very reputable. For those types of spammers, many times the best thing to do is to just delete the email.

‡: When you look at an image file name, you will notice that they end in .jpg, .gif .bmp or .png (there are others also). When someone is trying to get you to open a piece of malware, they may use a similar looking name but it will have an additional extension. For example, a file name like coolcar01.jpg is an image file name but a file name like coolcar.jpg.com or coolcar.jpg.exe would likely be malware.

The following extensions are a small sample of possibly dangerous file extensions. Note that .com is in there. This is not the .com on a web address. This is a Microsoft DOS program extension. You also see .zip. While .zip files are not dangerous, the files contained within them may well be dangerous. Some virus scanners may not be able to scan within the zipped archives so be very careful opening them. After unzipping them, scan them with virus scanning software to make sure that they're safe.

  • .pif
  • .exe
  • .scr
  • .com
  • .cmd
  • .bat
  • .zip
  • .dll
  • .hta
  • .vbs

Helping to Prevent Malware Propagation

The best way to prevent propagation is to prevent getting infected. This can be done if you always use a firewall and 'up_to_date' AV software. To prevent malware such as worms from sending themselves out to other computers on the net, you can help by removing their source of email names. When certain types of malware try to spread themselves, they look for all email addresses on your computer (in address books, html files, text files...) and they use those addresses as the next targets. While you can not prevent them from accessing all of the different types of files, you can help prevent them from using the addresses in your address book (in Outlook Express and other email clients). You should modify the addresses in your address book by adding a single letter or a short string of easily recognizable letters to all addresses. For example babin_perry@yahoo.com would become babin_perryxxx@yahoo.com. The xxx is easily noticed and removed when you need to send an email. If you don't modify the addresses and you get infected, a worm may send out infected files to all of the people in your address book. Since the recipient will know you and will likely trust you, they will likely open the file without thinking and will themselves become infected. Using an email service like Yahoo mail or Hotmail will help you to stay virus free (from those viruses that are delivered via email). I know that Yahoo uses AV scanning software on all incoming and outgoing email. The automatic scanning of the mail and the on-line address book prevent hackers from getting new addresses. Please note that scanning software is not foolproof. If something looks suspicious, don't download it.

Note on Faked Email Names:
If you are like me, you get a lot of infected email. Many times, the apparent sender did not actually send it. There are many robots that do nothing more than search the internet harvesting email names. Virus software can use those names in their efforts to propagate. If you receive an infected email from someone, it does not necessarily mean that that person is infected. If it's from a good friend, you may want to let them know that you received an email that appeared to come from their computer but it does not absolutely indicate that they're infected.

Recommended Sites

Computer Cops This site has software reviews and forums that are very active. If you're having problems with a virus scanner, firewall or any other type of security software, this site will likely have the answer. This is a safe reliable site where you can download security and utility software to help keep your computer safe from malware.

Note:
If you simply search the net for virus/spyware cleaning software, you will get hundreds of hits. Much of the software is bogus or is actually mal/spyware. I strongly recommend that you only download software from respected sites (computercops.org, majorgeeks.org and others listed on this site)

Freeware Programs This site has a list of the most popular freeware programs. I've never had a problem with spyware or other malware from any of the programs that I've downloaded from the site.

 

 
 
 
 
 
 

If you have any suggestions for this page or for the computer pages in general, please Email me.
If you're interested in electronics or car audio, you may be interested in my car audio site. It has lots of graphics and covers virtually everything associated with car audio.
If you're interested in macro photography basics or want to see lots of close-ups of insects and spiders, you may be interested in my macro-photography site.

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Contact Me


Copyright:
Perry Babin 2005
All Rights Reserved