| What
|
Malware
Threats
|
||||||||||||||||||||||
| Why
|
Malware is all malicious
program code or unwanted software, including worms, viruses, adware and
spyware....anything that you did not ask
for that attempts to harm your computer data, operating system,
applications; steal your personal information, financial accounts or
identity.
|
||||||||||||||||||||||
| How
|
You must have protection
software installed: AntiVirus, AntiSpyware and keep it updated to
identify and thwart the latest threats as they emerge.
|
||||||||||||||||||||||
Detailed
Information
One sign of an infection in your computer is when it is slow to boot up...slow to open and use applications and slow to browse the internet. When a remote controlling zombie bot-net takes over your computer, you are not the only one using it! See ZOMBIES for disturbing news of this growing threat. [There are other reasons your PC is slow, see Sluggish.] There is a dangerous and growing menace worldwide with web gangs intent on infiltrating your home computer for their malicious purposes. See Domestic and International Threats to National Security. AntiVirus and AntiSpyware protection is both preventative and reactive. A good program provides a shield and monitors files that you access over the internet, attached in emails or access on external media like CDs, floppy diskettes or memory sticks. When a threat is detected, you are alerted and the file access is halted. Automatic scans are also scheduled to regularly search your hard disk files for suspicious files that you may have but have not yet been access to activate. There are 3
basic types of antivirus software techniques used today:
At this time, the heuristic and sandbox types aren't strong contenders for your security baseline. That said, make sure you use a good Anti-Virus application and make sure it is set to automatically look for and update itself to the latest signature data. Many Antivirus
programs also protect against spyware as well. Key
Criteria: Track record in ability to detect all viruses, how often
it auto updates, cost, full featured, memory requirements – especially
on a system with <256mb installed. Considerations:
Make sure your antivirus program is regularly updated for the latest
signature and configured to provide the optimum security settings.
1. RECOMMENDED AntiVirus Program:
Suggestions:
Configure your
Antivirus program to run scheduled scans automatically. Have the scans
automatically run daily, during low or non-use hours. Although antivirus
scanning can be performed while logged in as a limited account, you need
to be logged in as admin to remove any infection that has embedded
anything into the protected operating system or program settings or
files. Scanning as an admin also scans all locations for multiple
accounts that scanning as a single account holder will not have access
to. So you should
weekly - log in as the admin
- and let a scheduled scan occur, such as overnight. Keep your
Antivirus Program updated with the latest detection signatures as well
as upgraded and patched when new versions are released. An
out of date virus scanner is only marginally better than no virus
scanner at all Virus
scanners work by comparing the data on your computer against a
collection of virus "signatures". Each signature is
characteristic of a particular virus, and when the scanner finds data in
a file, email, or elsewhere that matches the signature, it concludes
that it's found a virus. However, a virus scanner can only scan for the
viruses it knows about. It's vital that you keep your virus scanner's
signature file up to date, as new viruses are created every day. Typically, a new
virus will do the greatest amount of damage during the early stages of
its life, precisely because few people will be able to detect it. Once
word gets around that a new virus is on the loose and people update
their virus signatures, the spread of the virus falls off drastically.
The key is to get ahead of the curve, and have updated signature files
on your computer before the virus hits. Virtually
every maker of anti-virus software provides a way to get free updated
signature files from their website. In fact, many have "push"
services, in which they'll send notification every time a new signature
file is released. Use these services. Also, keep the virus scanner
itself—that is, the scanning software—updated as well. Virus writers
periodically develop new techniques that require that the scanners
change how they do their work. There are many, many, pests and serious threats out there to shield your computer from. See CA's extensive Spyware database.
2. Upgrade to Internet Explorer 7 or use Firefox browser alternative. Microsoft Internet Explorer 7 provides great security improvements to protect you against malware threats. See Browser for details.
3. RECOMMENDED AntiSpyware Program
Webroot web site claim: "While Vista (includes IE7) does offer some security enhancements, the default malware blocking application does not adequately protect you. In a competitive analysis, Webroot blocked 100% of spyware compared to only 16% on Windows Vista." Source (pdf) Spy Sweeper
Features Enhanced Smart Shields:
I like Spy Sweeper because
it provides proactive blocking
shields which defends against the most common exploits and protects known
as spyware entry points. These 12 Shields prevent highly developed spyware programs from ever installing on your PC. You'll receive valuable action alerts to any changes in your computer's core functions, including startup, memory and Internet security settings.
The shields summary page makes it simple to see at a glance which shields are on or off.
There
are 12 items that are blocked by the Smart Shields:
Enhanced Rootkit Discovery Methods: Malicious spyware uses rootkit technology to bury its files deep within your PC. Spy Sweeper finds and destroys these programs with robust rootkit discovery methods, a feature many other anti-spyware programs lack. Easy To Use: The Spy Sweeper interface
makes it easy for users of all technical abilities to stay protected. Advanced users continue to have the power to configure the program to suit their unique needs, while new users can breeze through the straightforward setup and menus. Action Alerts: Spy Sweeper sends clear, easy-to-understand notifications when new spyware threats are detected that require my attention and response. Quarantined
Items: When
you run a sweep and items found are quarantined, Spy Sweeper does not
permanently delete the found item. The quarantine process first encrypts
each item, removes it from its original location (so it will no
longer run), then moves it to the Quarantined folder. If
you find that a program you need will not work properly after
quarantining a found item, you can restore it. If you find that all of
your programs run properly after removing the found item, you can
permanently delete it. This deletes the found item from the Quarantine,
and you will not be able to restore the item. If
you reinstall the program or visit a Web site that has the same spy
ware, it could be installed again. If you find that some items keep
showing up in your sweeps, you can tell Spy Sweeper to always quarantine
that item automatically. Using the Always Apply function reduces the
number of items you have to evaluate during sweeps. By default (the
automatic setting), Spy Sweeper sets all found items to Always Ask. This
means that Spy Sweeper lists found items in the Quarantine and asks you
what to do with them during a sweep. If
you find spyware on your computer that you need to keep to make another
program run properly or that you always want to quarantine, you can tell
Spy Sweeper to always ignore or always quarantine that item. Spy Sweeper
will still detect the item and include it in its count of found items
and traces, but it will not include it in the list of items to
quarantine. You
can do two things to automatically handle found items: Finally, the "More Details" button will send you to a website that
provides further information on most spy ware and adware
programs—allowing you to make the most informed decision possible
about your spy ware removal. NOTE:
With
ZoneAlarm firewall and Webroot Spy Sweeper shields installed on my
computer, I found I could not browse to some web sites, like
Drudgereport.com or Youtube.com. I finally figured it out, that when I
turned off Spy Sweeper, they worked. I researched further and found out
that I could leave Spy Sweeper running but just turn off the ad-blocking
feature and my sites can be browsed now. I go to Shields Summary - Host
File Shields - and UNCHECK the COMMON AD SITES. I am not sure if perhaps there is too much
blocking of ads going on with Spy Sweeper blocking common ad sites,
Internet Explorer's Tools - Pop-up Blocker, or Google Toolabar's pop-up
ad blocker. But at least I can tweak Spy Sweeper and it all works fine
now.
4. RECOMMENDED Symantec Norton AntiVirus
One prominent gold-standard testing group provides their test results of the top antivirus protection programs, summarized below: Source [ZoneAlarm was not submitted to them for testing.]
Details about Windows Defender - free - supports XP, 2003 and Vista operating systems: Windows Defender
can now be run by all the users who use a particular computer, whether they have administrator-level privileges or not. This helps ensure that all the people who use a computer are able to benefit from the protection features offered by Windows Defender. Spyware
Infestation - My
Tests with a Badly Infected PC 5/05: I obtained a badly
infected computer recently that was consumed with spyware. I used 8
antispyware/adware programs and they discovered and successfully removed
45 threats located in 614 locations (registry, infected program files,
dll system files, temporary files). Spyware, Adware, a few Trojans, a
Porn Dialer and a Worm were discovered. They were causing an immediate
CPU utilitization rate of 100% upon Windows Start Up that would not
subside. Below are the results of my tests. (I provide the program’s
company name in the top chart and the program’s version I used in the
bottom chart): (Note: Since my
tests, SpySubtract by Intermute is now Trend Micro Anti-Spyware)
Warning: BEWARE of fraudulent anti-Spyware programs being advertised and pushed to users, or found in Google search hits or sometimes via popup ads. Install only trusted, well-known and tested programs.
How to remove Malware Threats? Your Antivirus and AntiSpyware programs can detect most threats and disable them. Here are some additional threat detection and removal tools:
|
|||||||||||||||||||||||
| Resources
|
Trend
Micro Encyclopedia of Virus, Scams, Hoaxes, Spyware
Spyware warrior comparisons and tests CA's extensive Spyware database Microsoft Malware Protection Center:
|
||||||||||||||||||||||
|
|
|
||||||||||||||||||||||
