![]()
![]()
Virus and Spyware Protection
|
Let me first say that I'm not trying to sell anything on this page. I'm not profiting in any way and I'm not trying to get you to buy any software (most of the software I recommend here is free for personal use).
As most computer users know, it's very difficult to surf the web without annoying pop-ups or other distractions. This page is to help you have a better experience on the net and to help keep your computer healthy. Some of the malicious software (malware) can actually cost you money. Automated dialers can call chat lines without your knowledge. If you use a computer that is in any way connected to the internet or other computers, you are at risk of identity theft, theft of passwords, loss of important files and spying.
There are many different types of malicious software. The following are the most common types:
Virus:
Macro Virus:
Worm:
Trojan:
Hybrid:
Adware: To avoid problems with ads or undesirable tracking that are associated with any 'free' software, read the EULA (End User License Agreement) to learn the terms of use of the software you're downloading. The EULA is the text that you typically blindly agree to when loading software. If the software manufacturer/author is honest, they will spell out all of the terms of use associated with the software. They should tell you what information is gathered and how it's to be used. It should also tell you if other software is to be bundled with it. If other software is in the package, you may need to find the EULA for the respective software.
Dialer:
*: Even if you have broadband service, you may still have a modem. Many people have the ability to send faxes with their computer. The fax software would require a standard phone line hook-up to be able to dial the other fax machines. If this is the case on your computer, be very careful about what software you download from the internet.
Keyloggers:
Many sites will will ask you if you want to install their fancy-pants toolbar to help you better search the net. In most all circumstances, do NOT do it. Most are adware/spyware infected and will cause more problems than they solve. One of the few exceptions is the Google toolbar (http://www.toolbar.google.com/). When it asks if you want to allow anonymous usage statistics, tell it no.
Note: The following is an example of a toolbar that was 'bundled' with undesirable software. This one is the 'mywebsearch' toolbar. This is only one variant of this software 'package/bundle' so anything similar should be carefully examined. On the Fun Web Products web site, they state that the web search toolbar doesn't contain any malware and that may be 100% true but every time I've seen the toolbar offered, it was bundled with other software. If you have this toolbar, run all of the software recommended throughout this page to check for problems. In the following Flash Graphic, you can right click and zoom in on the toolbar to better see what's on it. Use the left mouse button to move the desired area to the center of the window (after zooming). Notice the screensavers, smileys and cursors. These are common hooks to get younger people to download crapware.
During testing to see what was installed on a computer when a particular piece of software was downloaded, I loaded the previous toolbar from a random internet site. After the toolbar was loaded, a dialer appeared in the next scan of the machine (even though the machine was previously scanned and was clean and no other software was loaded between the two scans). I believe the dialer was bundled with the toolbar. Since I didn't remember where I downloaded the first copy, to be fair, I went directly to the Fun Web Products site and downloaded a copy from them. The new copy did NOT include a dialer. It did, however include the MWSOEMON.EXE program that ran in the background. From researching this, it looks to be some sort of malware. You can search for yourself to come to your own conclusions. If you need to download software, only download from reliable/trusted sites like computercops.org (the name has been changed to CastleCops). If you're downloading bootlegged software from warez type sites, you are VERY likely to get infected. If your browser or a web page asks you to download a piece of software in order to do something on a web page and it's not a from a well known company (Microsoft, Macromedia, Adobe...), it's possibly infected with spyware, a trojan or browser hijacker (this is very common on adult sites, free mp3 download sites...). If you absolutely have to download a piece of software, do several Google searches (web and groups). In the search, include the name of the software and one of the following words virus, spyware, trojan or worm in each search. If you include all of the key words in a 'single' search, you may not get reliable results. If any of the searches returns information that indicates that the software may include malicious code, don't download it. Don't download anything that offers great deals or better web searching. If you want a good deal, go directly to a well respected web site. If you want a good search engine, use Google. Many of the smaller search engines use Google anyway.
Avoiding Trouble:
Hardware Router/Firewalls:
Software Firewalls:
Anti-virus Software:
To clean infected machines, I recommend that you run the following software. All can be downloaded from computercops.org. It's a good idea to run them on a regular basis to see if you're computer is infected (even if it's not currently showing signs of infection). Be sure to update them each time you use them. There is usually a link in the window that allows easy updating.
Ad-Aware Spybot Search and Destroy (use the immunize function after cleaning your machine) Anti-Vir Hi-Jack This (for advanced users or those working within a forum of computer experts) CWS Shredder Trojan Hunter (not free but seems to be very good) Pest Patrol (not free but seems to be very good) Note: If you are knowingly infected, the following software may be able to help. If your computer is infected with some viruses, you will not be able to run it from your hard drive because it will become corrupted by the virus. Burning it to a CD on a clean machine will allow it to run on your infected machine.
* When you visit some sites, they will tell you that you need to allow the installation of software to continue. On well respected sites, the option is entirely yours. If you decide not to download the software, you will still be able to browse the page but the functionality may be reduced. On less well-respected sites, the problem is that the only apparent choice you have is to click on the dialog box to allow the software to be loaded onto your computer. On those sites, you can not go 'back' and the dialog box is 'locked' on top of the browser window. One option you have is to hit ctrl-alt-delete. This will bring up the task manager. Click on the 'processes' tab and end all of the IEXPLORE.EXE processes. This will close the browser windows. After all of the windows close, you can re-open the browser and visit a different site. If you download the requisite piece of software, it's likely that you will have downloaded some sort of malware. Of course, downloading software from companies like Microsoft, Macromedia and Adobe is perfectly fine. It's when you're 'forced' to download software from less well known companies that you run into trouble. * Do not use the computer with broadband service without the firewall AND virus software running. Both Zonealarm and Anti-Vir will have pop-up reminders about every 2 weeks asking if you want to update the software. You need to allow the software to update itself so that you have the best protection against the most recently produced malware. * Do NOT click on any flashing banners that say that you've won a prize. This includes all of the little games that ask you to see if you can hit a target. Most of these 'games' are nothing more than gateways into the world of spam. * Do NOT enter your email address anywhere except for legitimate sites (wal-mart and other major retailers may be OK but you will likely be added to their mass mailing lists if you don't opt-out -- look for a 'check-box' that allows you to opt-out). When you enter your email on most sites, they will be added to a huge database that will email you with significant amounts of spam (undesirable email). * Do NOT enter your email address or passwords into any email forms in unsolicited email. If it seems to be from a business you deal with, go directly to the business' site and log in to see if there is a request for information. If you think the email is from an unscrupulous source, forward it to the business that it appears to be from. Most of the time the proper address for this type of reporting is 'SPOOF@business.com' (i.e. spoof@ebay.com, spoof@paypal.com...). Most businesses want to know when this type of email is being sent out and will respond quickly to it. * When you see an address on a web site like ebay.com it will generally have 'ebay.com' in the address. Even if it has a link to a different section of the site, you will see the 'ebay'com'. If you receive an email that contains what is supposed to be an ebay address and looks similar (i.e. www.ebay.subscribe.com), you see that the 'ebay.com' is broken up and the address is likely not an ebay address. Also, when you receive an unsolicited email from a company, you should look at a couple of things. When you position your mouse over a link, look at the status bar (at the bottom of your browser window) to see if the link matches the text in the link. Try it with the following examples:
* Many times, the address will have a number instead of a name. In virtually all of the cases, these are sites to avoid. Most legitimate sites want you to be able to remember their names so they use a name.com/name.org/name.net type address. Sites that use an IP address are more likely to have malicious intent. * I strongly recommend against filling the 'auto-fill' forms such as those offered in the Google toolbar (or in any other software). Having this information on your computer in a location that's going to be common to many computers means that it will likely be targeted by trojans. In my opinion, it's best to take the time to fill in forms manually when it's needed on a web site.
As you know, spam in email can be very frustrating. It takes time to go through it and find which emails are legitimate and which are ads. While many of the more respected merchants follow the rules that allow you to be removed from their mailing lists, most others don't. There are a few things you can do to help reduce spam in your email.
Filters:
Address Blocking:
Turning Off Graphics:
Not Responding:
‡: When you look at an image file name, you will notice that they end in .jpg, .gif .bmp or .png (there are others also). When someone is trying to get you to open a piece of malware, they may use a similar looking name but it will have an additional extension. For example, a file name like coolcar01.jpg is an image file name but a file name like coolcar.jpg.com or coolcar.jpg.exe would likely be malware. The following extensions are a small sample of possibly dangerous file extensions. Note that .com is in there. This is not the .com on a web address. This is a Microsoft DOS program extension. You also see .zip. While .zip files are not dangerous, the files contained within them may well be dangerous. Some virus scanners may not be able to scan within the zipped archives so be very careful opening them. After unzipping them, scan them with virus scanning software to make sure that they're safe.
The best way to prevent propagation is to prevent getting infected. This can be done if you always use a firewall and 'up_to_date' AV software. To prevent malware such as worms from sending themselves out to other computers on the net, you can help by removing their source of email names. When certain types of malware try to spread themselves, they look for all email addresses on your computer (in address books, html files, text files...) and they use those addresses as the next targets. While you can not prevent them from accessing all of the different types of files, you can help prevent them from using the addresses in your address book (in Outlook Express and other email clients). You should modify the addresses in your address book by adding a single letter or a short string of easily recognizable letters to all addresses. For example babin_perry@yahoo.com would become babin_perryxxx@yahoo.com. The xxx is easily noticed and removed when you need to send an email. If you don't modify the addresses and you get infected, a worm may send out infected files to all of the people in your address book. Since the recipient will know you and will likely trust you, they will likely open the file without thinking and will themselves become infected. Using an email service like Yahoo mail or Hotmail will help you to stay virus free (from those viruses that are delivered via email). I know that Yahoo uses AV scanning software on all incoming and outgoing email. The automatic scanning of the mail and the on-line address book prevent hackers from getting new addresses. Please note that scanning software is not foolproof. If something looks suspicious, don't download it. Note on Faked Email Names:
Computer Cops This site has software reviews and forums that are very active. If you're having problems with a virus scanner, firewall or any other type of security software, this site will likely have the answer. This is a safe reliable site where you can download security and utility software to help keep your computer safe from malware. Note:
Freeware Programs This site has a list of the most popular freeware programs. I've never had a problem with spyware or other malware from any of the programs that I've downloaded from the site.
|
||||||
Contact Me | ||||||
Perry Babin 2005 All Rights Reserved
|