Togo wrote:
Lux, we *ALWYAS* disagree on computers.
While it's true that over 3/4 of the malware come from illegal sites and 18+ ones, it's also true that there are literally thousands of other ways to get it. Pishing, trojans, archives, spam, infected sites (it's more likely than you think) or simply malicious cookies. And most of the sites which have this stuff appear in a normal Google research, so it's impossible to avoid viruses. A computer without anti-malware is like a person with AIDS: no protection, and we know the conseguences. "the chances of successfully acquiring a virus in your system are next to zero", as you say, is true only if you always visit the same 4 websites for the whole life of the PC: Youtube, BS, Gaia Online and DA. And you don't check your emails. And you don't use any messenger nor web chat.
Phishing is the act of tricking people into giving away their personal details, account information, etc. =P Sometimes accompanied by keyloggers, which are rarely stopped by anti-virus software as in most cases, you need to click and confirm the installation of an ActiveX component. The most common phishing is through e-mails where, by making a convincing post content, you are asked by "your bank" to fill out account details for some purpose. Sometimes, these will include scripts that open the bank's website and a popup window without an address bar from the phisher's own server, where the victim types in account details. Usually, the e-mail is written to incite the Fight-or-flight response.
Third-party software is almost never used for this purpose.
Trojans have to be physically downloaded to your computer, which is the only way they can get to your computer as the firewall would likely block them if they were automated downloads. Most commonly acquired through trying to download software illegally.
How you get it:
* Software downloads (e.g. A Trojan horse included as part of a software application downloaded from File sharing networks)
* Websites containing executable content (e.g. A Trojan horse in the form of an ActiveX control)
* Email attachments
* Application exploits (Flaws in a web browser, media player, messaging client or other software which can be exploited to allow installation of a Trojan horse)
* Social Engineering (e.g. A hacker tricking a user into installing a Trojan horse by communicating with them directly)
Additionally, there are compilers that are Trojan horses themselves. In addition to compiling code to executable form they also insert code into the output executables which cause them to become Trojan horses. This is still distinct from self-replication as the process is not automatic.
Source: Deconstructing SubSeven, the Trojan Horse of Choice, written by Jamie Crapanzano and published 2003.
Infected websites are a huge threat, but that is mostly because the coders have been slacking. It is practically impossible to inject a website with malicious code without exploiting weaknesses in the coding language (and mistakes on the coder's end). A competent coder will use a language he is most proficient in and he will also know the weaknesses of that language/those languages, allowing him to avoid them. But... since there are always discovered new weaknesses, I suppose it's rather futile >>
Then again, most of the injected websites are those that condone and encourage illegal activity, which people shouldn't browse
in the first place. I've come across two 'legit' websites in ten years of Internet browsing that were injected with malicious code, trying to infect my computer with malware. The admins quickly corrected the error, though.
But it's relatively easy to fix many of the weaknesses. These are some ways:
* Input validation
* Escaping dangerous characters. For instance, in PHP, using the htmlentities() function to protect general inputs into your web application, and mysql_real_escape_string() to protect inputs which will be included in a SQL request, to protect against SQL Injection.
* Input encoding
* Output encoding
* Other coding practices which are not prone to code injection vulnerabilities, such as "parameterized SQL queries" (also known as "prepared statements" and sometimes "bind variables").
You can also greatly improve the safety of PHP included files by leaving the PHP setting "magic_quotes_gpc = On" (which should be on by default on every web host so not using it is asking for your website to be compromised). You can, however, put it to "OFF" if you know what you're doing. According to the official PHP site, you should write scripts securely so that they don't need magic_quotes_gpc to be ON. That's the ideal result, and starting with PHP 6 it will be the only way to do it. Until then, if you have scripts that doesn't validate input values at runtime (always a bad thing), you are safer with magic_quotes_gpc ON.
It wouldn't have been such a big problem if people didn't slack when they make websites, but few coders realize the pits before the damage occurs and then fail to prevent it in the future
As for e-mails, any person that has a basic understanding of the Internet knows to use a software that doesn't automatically open/show attached files, be it of any extension. If they don't, they're not getting my sympathy - and especially not if they physically clicked and opened the file.
As for cookies, no anti-anything can stop them from entering your computer without messing up half the Internet (maybe even more) as it would require denying the use of cookies entirely (which would be severely limiting). The only way to combat it is to regularly delete your cookies and be alert (or setting your browser to delete them whenever you close it).
And spyware is unavoidable; every company uses it. Heck, even Google uses a type of cookie that could easily be called a form of spyware. What it does is to look at the kind of websites you search for and browse and then display relevant ads. The ads on this site are also perfect examples of Google's use of bots to monitor and map the discussions we have on the forums so that it can display advertisements relevant to our more frequent discussions.
The best you can do to combat the cookies is to run anti-spyware software regularly. For dealing with these things (and trojans as well - cool, huh?) I recommend Malwarebytes Anti-Malware:
http://www.malwarebytes.org/mbam.php . "ANTI" AND "MALWARE" COMBINED, CAN YOU TAKE IT?! I also recommend IObit's "Advanced System Care" (
http://www.iobit.com/advancedwindowscareper.html ) which will help greatly in this. Advanced System Care is a utility that performs an in-debth cleaning process of your computer, much more accurate and powerful than CCleaner (yes, I went there, Togo!). Here is a list of what it does when you press 1 button:
1) It creates a backup file so that you can restore the system to how it was prior to the cleaning process in case something goes wrong (when it finished cleaning after that, it will also identify the threats it found and fixed and isolate them in the backup, completely incapacitating them).
2) It scans your computer for spyware and adware, then swipes them completely.
3) It scans your registry for keys that are no longer associated with any programs, folders or functions in your drive and deletes them to increase system performance. It also optimizes existing keys by checking them for errors and fixing them (for this, it uses a nearly inaccessible registry logfile hidden deep within the WINDOWS folder [you probably won't be able to find it; I know I haven't] - so it basically reverts broken registry keys to the state they were in upon installation).
4) It does a privacy sweep, removing all cookies and traces of your surfing history (that includes passwords, usernames, typed account information, etc.). When it is done with this process, you shouldn't be able to find any evidence of you ever visiting that Hello Kitty Island website.
5) It cleans junk files from your computer. Everything you have ever installed to your computer and uninstalled leaves logfiles in your computer (in the case of Vista, it is in a hidden folder in the C:// drive called "ProgramData". To show hidden folders in Vista, follow these directions:
http://windowshelp.microsoft.com/Window ... f1033.mspx ). You'd be surprised at how large these logs can be. In my case, I had over 2gb of information about programs I had uninstalled a year ago.
6) It optimizes your system by repairing system configurations and optimizing them.
7) It detects 'holes' in your system that makes it easier for spyware to insert itself into your computer and fixes them. It is very effective against that problem, but it should be done regularly.
8 ) It speed defrags the most important parts of your hard drive to increase performance. It also frees out RAM which might still be occupied by closed applications. This defragmentation is powerful and takes roughly 2-3 minutes, but the difference is very noticeable. It's perfect for when you need to make your computer run faster but can't afford to spare 6-7 hours of deep defragmentation.
9) The last thing it will do is to analyze Windows for hijacked settings. It looks for unauthorized changes in the system configuration and processes and corrects them. While it does that, it also tracks down the source of this change and 'notes' it so that it can cross-check the source with the constantly updated list. The software will also try to shut down unnecessary processes and potentially malicious programs running in the background. If the program can't identify one or more of the processes, it will open a window that displays which programs belong to which process, the time and date of the program's installation, the process name, etc. From there, you can close and permanently delete the processes yourself, but don't do that. Instead, save the logfile, as it is HijackThis compatible. You can then copy-paste it into this page:
http://www.hijackthis.de/ , and it will help you identify each process and its function.
Basically, Advanced System Care is a more powerful version of CCleaner, outperforming CCleaner's functions by far while providing additional utility, automated system optimization, process analysis and logging, while also being 100% compatible with HijackThis. And all of this is done by clicking one button.
If you don't have it, get it ^^ You will not regret.
CCleaner is a pretty good program, though. It does one thing that Advanced System Care doesn't. ASC isn't merciless; if it finds a program it can't determine whether or not it is safe to delete, it will leave that file alone. This is where CCleaner is better; it frees up more disk space than ASC (which is why I recommend using the two together).
Malwarebytes' Anti-Malware is also a very powerful application which will take care of pretty much any threat (including any viruses your anti-virus may have missed). It is 100% compatible with anti-virus programs, because it does not use the default database types that most (if not all) anti-virus programs use. It actually looks at the way each program works to identify malware. Any unauthorized activity is registered and analysed, so if the file is self-replicating or sending information to a third party without authorization (to mention two of the most obvious things), it is isolated and the process killed. You are then given the option to pick and choose between programs you'd like to keep and remove when the scan is done. After the program finishes deleting the malware, there will be no trace of it left on your computer. I said that Anti-Malware also takes care of viruses, but don't think of it as an anti-virus program. It merely looks at the file's behaviour to identify it as a virus (and viruses have a tendency to self-replicate and/or move around in your system to avoid detection), so it will not conflict with your anti-virus at all (it won't even slow your PC down). Use together with ASC and CCleaner (you should have all 3 programs) for maximum security.
But in almost all cases of malware infection, it's the user that is at fault (be it through incompetence, stupidity or stubbornness and similar); not lack of protection. And in the case of application exploits, the developers are at fault. It's impossible to review the entire code and be 100% sure there aren't any flaws in it, but actively fixing them as they occur is vital.
Having an anti-virus is not a requirement, but I would never ever recommend that you run without one. You can if you want and if you know to be careful online, but I advise against it. Keep your anti-virus up-to-date, as it does add some protection against already known threats (and it can be preventive).
And yes, we always disagree when it comes to computers, Togo =P It's our nature, 'cause we're cool like that!
Quote:
Also, this is the way crackers work, at least the good ones: they have a script which automatically search on the internet for weak computers (aka ones without protection, like yours); when they find one they save the data they can collect in a database, so the cracker can easly access your system with a spyware whenever they want to.
That's not really how it works.
What the script actually does is to scan the Internet for connected computers that have an open port which they can exploit. This is (mostly) a firewall related issue and is in no way related to anti-virus or anti-malware programs in general. With a properly configured Firewall, their script is left useless until you begin browsing the Internet.
I can use myself as an example (as I am henceforth referring to my Windows PC; my computer is configured in such a manner that every application I have that requires an Internet connection have a dedicated port, which is automatically opened and closed depending on which application I'm using. For instance, if I do not have any Internet applications running, my computer is not connected to the Internet. It's only connected to my LAN. When I open a program such as MSN, though, my computer opens the port(s) necessary to connect to the Internet
and to use MSN. This takes a minute or two and another thirty-odd seconds before I am able to get online and log into MSN.
When I close it, I disconnect from the Internet and all open ports close. The same applies for all my IT applications.
I have also disabled absolutely ALL autorun functions, the only exceptions being crucial system components, antivirus and firewall. This means that any software or components designed to run automatically upon booting (or the moment it appears on the hard-drive for that matter) will have to be started manually. This means that even if I get a virus or any type of malware on my computer, it will not be able to run unless I physically click the file.
This does not mean that I'm entirely safe, though. I always take my sense of security with a grain of salt. I'm not perfect and Windows isn't perfect either, so I'm always alert.
The absolutely best advice is to use common sense when browsing the Internet. You'd be surprised at how much it helps.
