Maximum PC spyware RSS Feed

Murphy's Law: The Post-Windows-7 Freeware Survival Guide

David Murphy — Fri, 23 Oct 2009 12:00:00 -0500

What's the first thing you're going to do after installing the Windows 7 operating system? If you live in Japan, perhaps you'll go celebrate your new, wallpaper-shifting desktop with some cardiac arrest. If you're one of the stalwarts still clinging to your XP or Vista operating system, well, you're probably going to spin your chair around in smug defiance of Microsoft's latest bit of software. And if you're a Maximum PC reader, I would hope that you're going to treat your fresh new installation of Windows 7 as an October spring cleaning of-sorts.

In fact, I urge you to. One doesn't often get a chance to reinstall an operating system from scratch. Or, rather, it's always easier to think of the hundreds of reasons why it's just not the right time to wipe-and-reinstall the contents of your primary hard drive. Resist the temptation to take the easy route. Backup your drive, give it a good format, and install Windows 7 onto your clean-as-a-whistle partition.

And once you've done that, read the rest of this article. While my colleagues at Maximum PC have given you some good first steps into your new Windows 7 world post-installation, I'd like to go one bit further and list out my typical post-installation routine for any Windows operating system. There are a number of key freeware choices that you'll want to slap onto your system to establish a baseline environment that's as efficient as it is secure--that, and you should really take this time to establish preventative measure that will keep your PC as clutter-free as can be throughout its new Windows 7 lifespan.

After all, bloated systems make Kylie sad.

Step One: The Interwebs

After I've gone through the various Windows 7 settings and tweaked them to my personal preferences (I like my hidden folders shown, damnit), I fire up Internet Explorer for its first and last time... to download Mozilla Firefox. I'm not a Firefox fanboy through and through--especially given the memory leaks that continue to plague the browser in various ways. However, just about anything is more useful, less cluttered, and better secured than Internet Explorer. The helpful IE View extension ensures that I'll always be able to load up the IE rendering engine if I'm in a jam (or navigating Microsoft's Windows Update site). Better still, I can immediately grab all my cherished bookmarks from the Cloud using the much-loved Xmarks add-on.

Step Two: Security

Before I start downloading programs and files en masse, I like having some kind of virus scanner either running in the background or easily available through a context menu. When's the last time I actually had a virus? I couldn't tell you. But I could tell you when the next time is that a virus is likely to infect my PC: never. There's been a lot of chatter about Microsoft's free Security Essentials application. I haven't honestly tried the scanner myself. I'm a time-tested fan of good ol' Clamwin, the open-source virus scanner that's quick to install, easy to run (and update), and relatively scare in its footprint. Whatever your choice, an antivirus scanner is worth its weight in easing your own personal stress over potential computer infections... even if it never ends up finding a virus at all.

Step Three: Decrapping

Just so I can get a good habit started before I forget, I make sure to grab the latest version of Spybot S&D and set the program's advanced configuration so that it always runs on my machine at particular intervals. I like Spybot S&D for this very fact: You can literally "set it and forget it," as the popular infomercial saying goes, and have a constantly updating, spyware-free system without having to worry about starting the application manually. Another nice feature of Spybot S&D is its ability to "immunize" your system against certain spyware "infections." In short, the program adjusts your browser's settings to block out known problems before they occur--a nice bit of preventative maintenance that you don't always find in a typical "scan and delete" application.

Get ready for steps Four and Five on page two!

Step Four: Isolating and Removing

If you're one of the lucky users to get your hands on Windows 7's XP Mode, congratulations--you've just acquired a wonderful virtualized operating system for testing new files you've downloaded. If not, don't sweat it. XP Mode is merely a free, virtualized version of the Windows XP operating system that's designed to run on Microsoft's Virtual PC application. You can download Virtual PC for free and install a version of Windows all by yourself (or grab VirtualBox if you want to run non-Microsoft operating systems). It's not a complicated task by any means, and you'll receive the same virtual functionality as those fancier Windows 7 users and their XP Mode.

The bigger question remains: Why bother? Well, a virtualized operating system running overtop your Windows 7 client is a perfect sandbox for testing new applications without having to gunk up your main operating system. Unsure of whether a piece of freeware is really a fit for you? Worried that something you've downloaded might be more problematic for your PC than good? Do you only need to install a particular application for a single use (like, say, obtaining a screenshot)? These are all scenarios where the sandbox environment of a virtual operating system becomes a useful tool. If your virtual OS gets too cluttered, you can always delete it and reinstall... while still going about your daily activities in your normal Windows 7 environment.

If you're still not convinced, or if you've already found yourself with some unwanted applications on your Windows 7 OS, don't uninstall them--not using their default uninstallation routines, that is. Grab Revo Uninstaller, a third-party freeware application that goes to great lengths to eliminate all traces of a program from your machine. Included in this elimination are leftover files in the installation directory, registry settings that were somehow overlooked by the normal uninstaller application, and anything else that's been introduced into your PC by said program. Using the program is no more difficult than Windows' "Add/Remove Programs" option in the Control Panel, but it's many, many times more thorough than the uninstallation routines you'll find on most apps.

Step Five: Saving

I'll hand it to Microsoft, their built-in "Backup and Restore" feature for Windows 7 ain't half bad. If you're sick of installing freeware at this point, then it's worth your while to fire up this Windows 7 application and schedule a drive backup to run on whatever interval you're most comfortable with. If you're a gambling person (or otherwise too impatient to wait for a full system restore should your primary drive hit the fan), you can select the individual files and folders you want Windows to copy over to a new location per your schedule. You can also bundle this piecemeal approach with the creation of a full system image. You won't be able to pick and choose files to restore should you, say, erroneously delete a folder that you didn't include in your piecemeal backup. However, if your computer goes haywire, you'll be able to restore the full. working contents of the your drive elsewhere.

I prefer to use Syncback Freeware for my backup needs--here's why. The program comes with a strong set of filters for the inclusion or exclusion of files or folders, as well as a solid list of "if this file does/does not exist on the backup drive, what should I do?" options for further specificity. I use both of these elements to customize a file synchronization between my primary hard drive and a secondary drive.

Why's that? I don't really want to waste time backing up files I'm never going to need in the event of a complete system meltdown. I'm the kind of guy who opts for the format-reinstallation of an operating system when danger arrives. It's the easiest way to turn back to a blank slate of perfection for my system, and I really don't mind copying the contents of my music, picture, and video folders from the backup drive to the primary. Well, that and all those program reinstallations... but, really, a meltdown is kind of like a forced spring cleaning to me. Consequently, I only want to back up the files that I'm going to need to copy back to the drive. I'd much prefer to reinstall everything else.

Step Six: Your Turn

Of course, these five topics are the first steps I take when my system's brand-new desktop screen pops up for the first time. This list is hardly comprehensive, however--there's much more I install after-the-fact, mostly programs that are less critical to my system's general operations than those represented by these five categories. What about you? What are some of the first steps on your Windows post-installation to-do list?

Ten bonus points and a traffic cone if anything with the word "plants" and "zombies" shows up within the first five items.

David Murphy (@ Acererak) is a technology journalist and former Maximum PC editor. He writes weekly columns about the wide world of open-source as well as weekly roundups of awesome, freebie software. Befriend him on Twitter, especially if you have an awesome app or game you're dying to recommend!

New Malware Rewrites Bank Statements to Cover Its Own Tracks

Paul Lilly — Wed, 30 Sep 2009 11:15:27 -0500

Have you checked your bank account balance online lately? If so, you may want to consider verifying the numbers with a paper statement, because what you see on your computer screen might not be indicative of banking activity that's occurring right under your nose, according to a new security report.

Hackers have a new piece of malware to play with, one which not only picks your online pocket, but also hides the evidence of any wrong doing by rewriting online bank statements on the fly. Once the Trojan horse infiltrates a user's PC, it goes to work by altering the HTML coding before it's displayed in the victim's browser, making sure to erase any evidence of money transfers or other unauthorized transactions.

"The Trojan is hooked into your browser and dynamically modifies the text in the HTML," said Yuval Ben-Itzhak, CTO of computer security firm Finjan. "It's a very sophisticated technique."

A gang targeting customers of leading German banks first began employing the ruse in August and managed to steal Euro 300,000 (about $440,000 USD) in just three weeks. Finjan estimates that the gang using the scheme could potentially steal about $7.3 million annually.

While so far relegated to German banks, Ben-Itzhak warned that this technique is likely to spread to other countries.

Cybercrime Intelligence Report, Issue No. 3, 2009 (PDF)

Image Credit: Finjan via Wired.com

Google Thought Michael Jackson Traffic was an Attack

Justin Kerr — Sun, 28 Jun 2009 15:28:41 -0500

Google has confirmed that the error messages people received on Thursday when searching for details of Michael Jackson’s death, was initially perceived as an attack. Searches between 2:45 and 3:15pm were returned with "We're sorry, but your query looks similar to automated requests from a computer virus or spyware application. To protect our users, we can't process your request right now."

The error messages lasted for about 25 minutes on Thursday, just long enough for Google to confirm what was actually going on. The search giant noted that the amount of traffic it saw on this topic was unprecedented, as millions around the world scrambled for accurate information, seemingly all at once. Yahoo has also confirmed that it hit an all-time record for unique visitors with over 16.4 million following the story. This blows away the previous record held by the Obama election day, with a paltry 15.1 million uniques.

The outpouring of sympathy online has been astonishing, and I’m sure Google will learn its lesson on this one.

Image Credit (google.com)

Panda Offering Free, Cloud-Based AV

Paul Lilly — Wed, 29 Apr 2009 08:41:58 -0500

After nearly three years of development, Panda Security today released the public beta of its Panda Cloud Antivirus, which the company claims is the first free cloud-based antivirus thin-client. By taking AV duties to the cloud and combining it with local detection technologies, Panda says it can do a better job at protecting your PC than a traditional virus scanner.

"Thanks to Panda Security's Collective Intelligence malware and goodware online database, Panda Cloud Antivirus detects more malware than traditional signature-based solutions which take longer to detect the most recent, and therefore most dangerous, variants," Pedro Bustamanta, Panda Senior Research Advisor, wrote in a blog entry.

The local portion of the program takes up roughly 50MB of hard drive space while consuming about 17MB of RAM, according to a Cnet report. By the time Panda Cloud Antivirus exits the beta stage, Bustamante hopes to have the RAM consumption down to 12MB.

One potential downside to relying on the cloud for antivirus protection is that your PC would be left vulnerable without an internet connection. But not to worry, says Bustamante, who clarified that a local cache copy of Collective Intelligence is kept on the PC for just such scenarios.

Panda Cloud Virus Download (Beta)

Image Credit: Panda Security

Ultimate Malware Removal Guide -- Purge Your PC of Junk Files!

Josh Kampschmidt — Thu, 29 Jan 2009 09:00:00 -0600

Malware is everywhere. You can't browse on any Internet tech forum without someone mentioning this word (with disdain), usually in search of a remedy after being infected with spyware. No matter how careful you are, we’re guessing that many of you have had malware inadvertently installed on your system and may have even ended up reformatting your computer as a last resort. While that may have been the most thorough solution, it is in a sense admitting defeat. Or worse yet, you took your computer to get cleaned and was charged anywhere from $50-300 -- a high price for humiliation. But don't fret, because you can actually purge your system of malicious software for free! Just follow our comprehensive guide.

Time = About 4 hours

What You Need:

SUPERAntiSpyware
Free, http://www.superantispyware.com
Malwarebytes Anti-Malware
Free, http://www.download.com
Combofix
Free, http://www.combofix.org/
Panda Activescan 2.0
Free. http://www.pandasecurity.com
Pocket Killbox
Free, http://www.bleepingcomputer.com
CCleaner
Free, http://www.ccleaner.com/
Comodo Registry Cleaner
Free, http://registry-cleaner.comodo.com

1. Scrub your system with SUPERAntiSpyware

SUPERAntiSpyware is a great program to start with since it has such a high detection rate and can remove most of what it finds. Depending on how infected your computer is, you may want to run this program in Safe Mode.

To start downloading SUPERAntiSpyware, download the program from their official website. Download the file to your Desktop or wherever you choose. Keep all the default installation parameters to ensure it installs correctly. Just click the next button along the installation wizard. Choose your language, English is normally the default. After this screen, a new definitions window will pop up click Yes to download the updates.

On the initial setup window, click next. You don't need to enter your e-mail address on the next screen since you aren’t purchasing this program, but on the screen that asks if you want to automatically check for updates, make sure you leave that box checked. Having the program automatically scan for updates saves you time in the future. Do not send a diagnostic report to the company, so uncheck the box. Eventually you will be presented with a window wanting to protect your homepage.

If it is your homepage, click Protect Home Page, otherwise, don’t. When the program opens, click Preferences. Make sure your Preferences matches the following screenshot and select Close.

Click the Scan Your Computer button and then start a Complete System Scan of all your fixed drives. Remove everything that is found.

2. Scrub your system with Malwarebytes Anti-Malware

Similar to SUPERAntiSpyware, Malwarebytes Anti-Malware is a great scanning utility with excellent removal capability. You might also need to run this program in Safe Mode.

Download Malwarebytes Anti-Malware from this site. Save the file to your Desktop. Installation is relatively simple, just follow the installation prompts. At the end of the installation, you will be presented with a Finish window. Uncheck Launch Malwarebytes Anti-Malware.

The program will update and not launch until you request it to do so. Launching the program directly after the update could temporarily crash the program because of the malware present on the system. Double-click the Malwarebytes Anti-Malware icon on your Desktop. Set the program to do a full scan and press the Scan button. Malwarebytes Anti-Malware may look like it froze, but do not do anything, just let it scan.

3. Combofix the malware

We are normally a very big advocates of Combofix since the program works so well, but there is a possibility that the program can cause damage to your computer. Download Combofix from the following link and save it to your Desktop.

You may be requested to update the program when you open Combofix, please do so. After the update, the program will restart. Don’t restart the program yourself. On the next start you may get a warning if you have active security software on your system <insert Combofix_Warning.jpg> disable your antivirus or other security protection since it may interfere with Combofix.

You will get an EULA pop-up from Combofix. This EULA explains the basic terms and conditions of using the program. Make sure you read this and understand the terms and conditions.

Combofix will now create a system restore point and start scanning, don’t move the program window. Your taskbar may disappear several times as it goes through the various stages and you may lose network connectivity temporarily. If it asks if you want to clean the registry, please allow it to do so.

The program will try to generate a logfile. Do not move or close the window.

After the reboot, if necessary, a logfile will have opened automatically on your screen. Please close the logfile. Altering any files that Combofix displays could cause serious, irreversible damage to your system if you don’t know what you are doing.

4. Get a second opinion with Panda Activescan 2.0

Panda Activescan 2.0 is a general malware scanner, but runs through a web browser instead of natively on your hard drive. It has a good detection rate, but does not remove the malware it finds, so you will have to do this yourself. This scanner is primarily used with Internet Explorer, but also works with Firefox.

To start scanning with Panda Activescan 2.0, go to their official site. Click the big Scan Now button. If you are using Mozilla Firefox, you need to download the appropriate plug-in to run the scanner.

Let the program update and install temporary files to your computer. The temporary files allow Panda to scan your computer’s hard drive. Panda should start automatically scanning your computer’s physical hard drives.

If malware is detected, it will alert you and allow you to see a logfile. Save this logfile, you will need it later. You can close Panda Activescan 2.0 after you save the logfile.

5. Delete files with Pocket Killbox

In order to get these malware files off of your computer, you need to delete them yourself. Since Panda is a pay program, it won’t be able to remove these for free.

Open the Panda Activescan 2.0 logfile. Locate the full pathway. A pathway looks similar to C:\Windows\System32\sdfhl.exe. Copy and paste that entire line starting with the "C:" from your logfile and paste in a new Notepad file. Please do this for every file or directory that has been identified as malicious.

When you are done, you should have a list of files and directories. Do not close this list of files.

Download Pocket Killbox from the following link. Extract the files to your Desktop or wherever you choose.

Double-click the Killbox red Killbox file. Go back to your list of files and highlight all the pathways and copy them to your clipboard.

Set the program to Delete on Reboot and make sure it is set to All Files. If it is set to Single File, it will only delete the first file in the list and leave the rest.

Now click File and select Paste from Clipboard. If no text appeared in the Full Path of File to delete, then try again. Click the Red X. Pocket Killbox will automatically restart your computer.

6. Advanced Registry Editing

If you happened to luck out and get a list of registry entries that were infected, then you can go through this more advanced step. This particular step is not required as long as the computer is mostly disinfected since the entries will only be remnant registry entries. When we do the final cleanup, it should also get rid of most of the entries. But if the entries are causing problems right now, then you can remove them here.

Launch the Registry Editor. You can do this by pressing the Windows Key and then pressing r simultaneously. Type regedit into the run window and press Enter.

You should get a list of five registry hives to the left of your screen. Each hive is similar to a pathway on your hard drive, such as C:\Program Files\Microsoft Office. In this example, you would double-click C, then double-click Program Files, and then find the Microsoft Office directory. The same process works in the registry editor. The only difference is you are not working with files and directories. You navigate through the left pane of the screen.

Navigate through the tree of entries until you find the exact one you are looking for. Make sure you select the right entry because many of them look similar. Then delete that entry from the left side of the window. Don't touch the right side, since that side just contains information related to that key. You may also use .reg files to do this, which may be simpler. If you are interested in this, see this Microsoft KB article.

7. Cleaning up the computer

Often-times malware removal leaves the computer with some junk files (.dat, .txt, etc) on the hard drive and some invalid registry entries which may produce errors. There are two programs you can run, CCleaner and Comodo Registry Cleaner. CCleaner will get rid of temporary files and Comodo Registry Cleaner will get rid of the registry entries.

Download CCleaner from the following link. Save the file to your Desktop.

Install the program like any other program; make sure to keep the default settings.

Double-click the CCleaner file on your Desktop and click the Analyze button and then the Run Cleaner button. Close the program.

Download the Comodo Registry Cleaner from the following link. Save the file to your Desktop.

Install the program like any other program; make sure to keep the default settings.

Click the Scan My Registry button and wait for the results. Click the Clean Registry button.

8. Prevention and Concluding Advice

The ultimate goal of malware removal is to prevent it from re-occurring. By following simple steps you can help ensure that you won’t be infected again.

Make sure Windows is up to date; otherwise you will get infected from the exploits that the patches are supposed to fix.
Run security software. If you don’t, you will get a malware attack again. The software you run may not effectively clean the computer after you are infected, but it will stop you from getting infected in the first place.
Run browser security software. Our favorite extension is WOT, this extension alerts you to risky websites. If you don’t want something like this, you can always use McAfee SiteAdvisor. It also warns you of risky websites, but does not block the malicious pages first.
Remove your old versions of Java. The older versions of Java are heavily exploited by Vundo. When you install a new version of Java you are not removing the old version, it stays on your computer.
Don’t pirate software. Software pirating is a big cause of malware. Many torrent sites secretly have malware downloads waiting for people to download.
Don’t search for porn. Porn websites typically have malware on them since a lot of people browse these types of websites. Not all of them are infected, but if you browse around enough you will get infected.

Blackhat Exploiting Lax URL Redirects

Pulkit Chandna — Mon, 29 Dec 2008 14:26:42 -0600

An anonymous blackhat hacker is unabashedly exploiting an unattended vulnerability in URL redirect notifications to redirect internet users to malicious websites. As most websites, including the major ones, merely issue a notification to users that they are being redirected to another URL without scrutinizing that particular website, users remain sitting ducks to such attacks.

The nefarious attacker has gone a step further by employing SEO techniques to increase the standing of his spyware-bearing websites with search engines. Security analyst Gary Warner says that the threat can be rooted out, if redirects are tempered to only accept referrals from verified websites. However, he expects the threat to persist due to regulatory inaction.

Image Credit: Enor

Antivirus Software Roundup -- Protect Your PC From Guys Like This!

Paul Lilly — Mon, 22 Dec 2008 12:00:00 -0600

Behind every piece of malware—be it a virus, spyware, or any other form of hostile, destructive code—is a sneaky, scheming scoundrel, oftentimes someone you’d never suspect. Antivirus suites promise to defend your PC against all the baddies. We test 10 of the leading products to see which ones are best at keeping your PC safe.

You don’t need a military background to recognize that the Internet has turned intoa war zone. Not only are you always under attack, but the bad guys possess a seemingly endless arsenal of weapons that are constantly changing. Set foot in the wrong website and you might be stepping into a booby trap of malicious Javascript code. Toolbars and greeting cards come laced with spyware, hackers are finding new exploits faster than software vendors can patch the old ones, and rootkits have given virtual villains a way to stealthily penetrate deep into your system at the kernel level.

And if all that weren’t enough, social networking continues to sweep the web, making it even easier for morally bereft miscreants to spread their foul files. Can you really trust that MySpace page you’re viewing not to contain some hidden element ready to do you harm? You even need to be suspicious of IMs, and that includes messages seemingly originating from contacts on your buddy list. It’s enough to make you want to wave the white flag—and if you plan on going into battle alone, you probably should.

But you don’t have to fight the fight all on your lonesome. Several security vendors offer software packages that not only promise protection against viruses, but also purport to run off rootkits, stop spam dead in its tracks, and even circumvent websites from loading hidden malware before it has a chance to run amok on your PC. This got us wondering, just how much protection is actually necessary?

To answer that question, we hit up all the major security vendors and asked them to send us their most robust packages. We also gathered the most popular free antivirus programs for comparison. After all, power users know how to practice safe computing habits, which can go a long way toward PC safety. We’ll cut through the hype to tell you if the protection you get with a paid app is any better than what you can get for free—or if the paid programs, which have become so huge as of late, are too unwieldy and ultimately more troublesome than the viruses they’re meant to combat.

Our Testing Methodology

It doesn’t matter how effective an AV app is at catching viruses if it means we have to suffer through constant nagging or performance degradation in our day-to-day computing. We’ve identified the five criteria by which security apps should be judged.

System Performance and Scan Speed

We know you spent time researching components and toiling over your system build, so why let a poorly optimized program transform your hot rod into a horse and buggy? To gauge each AV package’s performance impact, we loaded up a series of action scripts in OSMark (http://tinyurl.com/OSMark), paying close attention to both memory and CPU activity. We then compared the results to that of a clean install.

We’re also interested in how long it takes to complete a full system scan. In today’s dual- and quad-core landscape, you no longer have to sit idly by waiting for a scheduled scan to finish, but if you suspect your system has become ill, you won’t want to do much of anything until your virus scanner produces a clean bill of health. With stopwatch in hand, we measured the time it took each program to run through its routine.

Annoyance

Whether we’re using our PC for work or play, we don’t want to be bothered with near-constant nagging from our security software. An AV app should integrate seamlessly with the OS and be able to do its job with minimal interaction from the end user, while still offering at least some level of customization. Otherwise, it’s no less obtrusive than the viruses it’s supposed to be protecting against.

In order to assess how much each app intrudes on our day-to-day life, we performed a variety of common tasks to see how the AV software responds, if at all. This includes web surfing, downloading files, running executables, playing games, and everything else you’re likely to do with your PC.

We also took into account how much harassment we can expect to receive when the subscription runs out.

Features and Implementation

Anyone who’s ever shopped for a new car knows what it’s like to be pressured into paying extra for all kinds of upgrades. And just because the salesman is attempting to increase his profit margin doesn’t mean you can’t both benefit from tacking on useful additions, but that only works if you’ll actually use the added amenities. Do you really need six cup holders in a two-seat sports car?

Likewise, there’s no point in owning a security suite stuffed with apps if most of them suck. Not only that, but you need to consider whether this added functionality is easy to use and how much pestering you can expect from disabling unused features. We take all this into consideration.

Pricing

Let’s be honest, nobody likes to pay for software utilities. It doesn’t matter that we spent an entire week’s pay on two of the hottest videocards so we can squeeze a few more frames per second out of Crysis or that we took out a loan to fund the fastest processor money shouldn’t buy (hey, it comes with an unlocked multiplier!), there’s just something about paying for security software that feels sacrilegious. Maybe it’s because the free alternatives have done so well in the past. Whatever the reason, these paid apps have to prove their worth in the bang-for-buck department. Higher-priced suites should come with a bevy of useful features, offer a high level of customization, be easy to navigate, and, above all, perform competently.

Virus Detection

We don’t care what method each AV application uses to identify and disinfect viruses, so long as it gets the job done. The only way to find that out is to bombard each package with a multitude of payloads representing the thousands of viruses running rampant in the wild. Rather than scour the web trying to build up a repository of infected files, we turned to the experts to lend us a hand.

Virus Bulletin (www.virusbtn.com) is an independent testing lab whose certifications are sought after by antivirus vendors. We scrutinized the latest detection results for each AV app and paid attention to the percentage of viruses caught, which includes Trojans, polymorphic viruses, worms, bots, and more, and then we punished each app with our own collection of malware.

Malware Terminology 101

A computer virus is a piece of software or code capable of reproducing itself and spreading to other systems, but the term is often used to describe a multitude of threats. The effects of malware can range from mildly annoying to completely debilitating, sometimes costing corporations thousands of dollars in downtime and manpower to heal the outbreak. Let’s have a look at the different types of infections.

Trojan horse: Named after the mythological wooden horse used to sneak Odysseus and other Greek heroes into roy, a Trojan horse will masquerade as a legitimate program but will unleash a harmful payload once installed.
Worm: Computer worms are self-replicating programs that burrow into systems, seeking out vulnerabilities to exploit. The ability to spread all on their own makes worms particularly dangerous.

Spyware: Ever feel like you’re being watched? If your PC is infected with spyware, you just might be. Even worse, spyware not only monitors your activities but can also hijack your system with redirected web searches and other annoyances.

Polymorphic: To avoid detection, polymorphic malware constantly changes its own code, often using encryption with a variable key. This stealthy technique poses a problem for typical scanners.

How To Avoid Viruses

Captain Obvious says that the best way to prevent infection is to avoid viruses in the first place, but what he doesn’t tell you is how to do it. And even though hackers continue to get more cunning in both delivery and execution, you can tip the odds considerably in your favor by practicing safe and sane computing.

If you receive an unknown or unexpected attachment, don’t open it no matter who it came from. Not only are some viruses capable of emailing themselves to everyone they find in an infected user’s address book, but inexperienced computer users are just as guilty of passing along payloads as hackers are of distributing them.

BitTorrent sites and peer-to-peer networking clients are also common modes of spreading infection. When attempting to download a legitimate program—a Linux distro, for instance —use the link provided at the vendor’s website. Pirated software is a particularly popular source of malware, so if your moral compass doesn’t steer you toward the straight and narrow, the risk of infection should.

And finally, get in the habit of regularly checking for software updates. New exploits are always being discovered in Windows, QuickTime, web browsers, and other common programs.

McAfee Total Protection 2009

A mishmash of features leaves us with mixed feelings

Most enthusiasts view McAfee as just another resource hog often found in OEM systems alongside performance-pillaging bloatware. Fair assessment or not, this is the perception McAfee’s up against in trying to win over the PC elite. It helps that the company isn’t blissfully unaware of the importance placed on performance; its latest edition promises to raise the bar with a more efficient engine that won’t drag your system down.

In our testing, McAfee fell in the middle of the pack instead of leading the charge. RAM consumption crept above what we’d consider lean, and while scanning for malware, CPU utilization often hovered around 40 percent. That in itself isn’t criminal, but we felt swindled when all it bought us was the second-slowest scan time of the bunch—although, remarkably, we didn’t see much of a drop in gaming or day-to-day computing performance.

McAfee’s list of features ranges in practicality from the beneficial to the unlikely to ever be used. Occupying the former camp are spyware protection, a highly configurable firewall, email and IM guards, basic parental controls, and a file shredder. But we just can’t get stoked about the virus map, which displays global viral hot spots, or the HackerWatch module, which looks for patterns of attack around the world to report to ISPs. And still other features, like Active Protection for real-time safeguards, will be made available only through future updates—boo!

Living up to its name, McAfee Total Protection 2009 proved a formidable adversary against all types of malware and stopped malicious websites from loading. We also dig McAfee’s SiteAdvisor tool, which not only identifies questionable search results but also gives a detailed report on why the URL is suspect. But no matter how good it protects, we’re not willing to endure slow scanning performance or wait for features that should have been available at release.

Verdict: 6
www.mcafee.com
$70 (3 PCs)

Norton Internet Security 2009

Could this be the luxury sedan of antivirus suites?

For the latest version of its AV suite, Symantec went back to the drawing board and completely rewritten the program from the ground up with a focus on speed. Even the installer has been revamped; in an attempt to reduce setup time to less than a minute (we clocked it at 55 seconds), Symantec coded its own proprietary installer instead of using Microsoft’s, as it has
in the past.

This year’s release adds a smart scheduler that monitors task utilization in real time and queues up its task if the system is busy. This means if you’re lining up a headshot in your favorite shooter, NIS will take a backseat until system resources are freed. But if a task qualifies as critical, it will run regardless of what you’re doing, so you can continue to crunch

Folding@Home without being a sitting target. And to keep itself honest, Symantec integrates a system monitor showing what percentage of CPU cycles NIS is consuming—nifty!

Live Update has been rewritten too, and in addition to regular updates, Symantec sends out micro updates. These pulse updates ensure that when a new threat is discovered in the wild, you’ll have the necessary signature definition within minutes instead of waiting up to 24 hours for the next refresh.

The program swept through our test system in less than 10 minutes, and subsequent scans completed in less than two minutes! NIS accomplishes this by discerning between trusted and untrusted files and by default won’t rescan files that haven’t changed.

NIS 2009 leaves virtually no security stone unturned. Our biggest knock is that not all features work under Vista x64, such as right-click scanning. Still, if security suites were cars, consider NIS 2009 a decked-out Lexus.

Verdict: 9
www.symantec.com
$70 (3 PCs)

Kaspersky Internet Security 2009

Why pay more when you can get the same or better for less?

At $80 for a one-year subscription, Kaspersky charges more than any other suite we tested. If you buy the downloadable version instead of a retail boxed copy, the license is good for up to three users—that’s little consolation to single-PC
households.

Kaspersky also holds the undesirable record for longest install time. What started off as a pokey two-minute install ballooned into an agonizing eight minutes composed of a tediously long update and no less than two reboots.

Once we were finally up and running, Kaspersky began to atone for its pricing and installation sins. Like Norton’s package, Kaspersky significantly shortens subsequent system scans by skipping files already determined to be clean. During an initial run-through, Kaspersky’s iChecker algorithm makes note of certain files’ digital signatures and saves them in a special table. If the signature matches the next time a scan takes place, the file will be skipped over. The result is that a 12-minute system scan was reduced to a blazing one minute and 14 seconds, finally setting a record Kaspersky could be proud of.

Like the other full-featured suites, Kaspersky crams a multitude of tools into a neatly organized package and manages to set itself apart in some areas. Rather than limit email scanning to Outlook and POP3, Kaspersky also analyzes IMAP traffic. It boasts a banner-ad blocker and, through parental controls, the ability to limit how much time children can roam the web. Finally, road warriors will appreciate the option to automatically disable scheduled scans when running on battery power.

Kaspersky provided a formidable wall of defense against both viruses and spyware, keeping our test bed protected against Trojans, dialers, and other Internet-bound ills. But so did some of the less-expensive suites.

Verdict: 6
http://usa.kaspersky.com
$80 (3 PCs)

AVG Internet Security 8.0

An old favorite gets a new look

Now in version 8.0, AVG’s latest release appears to have taken a page or three from Vista. A redesigned interface sports high-resolution icons and a more colorful palette, and even the system tray icon feels borrowed from Microsoft’s newest OS; turn off one of the security modules and the icon turns red, alerting you of impending doom, even if you’ve only disabled the spam filter. That’s just wacky. Thankfully, you can turn off the ominous notification.

No other AV application we tested consumed more RAM, and our performance benchmarks took the biggest hit with AVG installed. During a system scan (which, while not the slowest, dragged along at the tail end of all the suites), CPU utilization averaged 25 percent with sporadic spikes reaching as high as 84 percent. We didn’t know if AVG was scanning or having a seizure.

AVG provides one of the more feature-rich packages of the bunch. In addition to the new scanning engine, you’ll find spam and spyware protection, a firewall, safeguards against drive-by downloads, immunity against IM-bound attacks (IQC and MSN only), a customizable scheduler, and a rootkit scanner. Tying it all together is a back end brimming with options to satiate even the most demanding security connoisseur.

We especially like the concept behind AVG’s web protection; we just wish it worked better. The Active Surf-Shield component scans visited web pages for malicious code and the Search Shield checks Google, MSN, and Yahoo search results for active threats, but enabling them slows down web surfing. And at the time of this writing, Search Shield was not working with Firefox 3.0.

AVG’s detection rate dips below that of the best-performing AV apps during Virus Bulletin’s extensive testing but still earned a VB100 award, meaning it caught all of VB’s in-the-wild viruses with no false positives. ANG also excelled in our own tests. Just make sure you have a modern system to run it on.

Verdict: 7
www.grisoft.com
$55 (2 yrs)

Avast! 4 Home Edition

You won’t find many diamonds in this rough

It’s almost as if Czech-based developer ALWIL intentionally designed Avast! to be annoying, starting with the exclamation point in the program’s title. We can forgive the name, but we’re not so quick to offer amnesty for the program’s other failings.
Despite being offered as a free download for home use, you’re required to register the product, after which you’ll be sent a product key. Without it, the program will stop working after 60 days. Worse yet, you have to re-register every year just as you do with a paid program, which doesn’t instill confidence that ALWIL won’t one day decide to stop offering Avast! gratis.

What starts off as a ridiculously fast install time turns into a 20-minute endeavor if you choose to perform a boot-time scan during the required system restart. Scanning our test system from within Windows was even slower, taking 24 minutes, making Avast! by far the pokiest of the pack. The slow-footed scanner was also the second-largest system hog.

We’re not sold on the gimmicky main menu, which deliberately resembles a media player complete with a play, pause, and stop dial for controlling system scans. We’re grateful the On-Access Scanner menu takes a more mainstream approach, and it’s here where you’ll spend time customizing the several shields. In addition to the usual suspects—web shield, Outlook/Exchange module, Internet mail controls, system and network shields—you’ll find support for nearly every IM and P2P client you can think of.

It’s a shame so much about Avast! annoys us because the scanning engine, despite bogging down our system, had us strutting across the web with reckless abandon. Avast! cut off all forms of malware at the knees, preventing us from downloading various forms of pestilence and blockading their websites of origin. But ultimately you’re just trading one inconvenience for another.

Verdict: 5
www.avast.com
Free

AviraAntivir

A superbly high detection rate makes up for paltry options

At first glance, you might be inclined to dismiss Avira’s AntiVir as nothing more than a run-of-the-mill virus scanner with a feature set that’s as meager as its price. The sparse interface certainly won’t wow any power users, but it would be a mistake to cast AntiVir aside based solely on appearance. A tiny checkbox in the upper-left corner of the configuration screen unlocks the program’s Expert mode, and with it a heap of options previously unavailable. This still doesn’t put the program on par with the more robust packages in our roundup, nor is the menu system laid out as intelligently as some of the other programs’. Nevertheless, you’re given enough control not to feel cheated, even for software you didn’t have to pay for.

You can choose between three levels of heuristic scanning (low, medium, or high) or turn it off completely. Likewise, enabling the Macrovirus heuristics option will ensure that all macros are deleted in the event an infection necessitates a repair. AntiVir will also rummage for rootkits and examine emails for suspect files, and it even proved surprisingly successful at killing off keyloggers, a feature Avira doesn’t list for any of its security products. What it won’t do is combat most forms of spyware or prevent hackers from exploiting your browser.

AntiVir’s biggest strength lies in its detection rate. It’s the only scanner in our roundup to triumph with a near clean sweep during Virus Bulletin’s latest testing, and it did so without reporting any false positives. That’s impressive. AntiVir performed equally well in our Lab, as long as we didn’t attempt to install spyware or hijack the browser.

If you can live with the popup ad AntiVir forces you to view each time a scheduled update is performed, you’ll be rewarded with a potent, no-cost AV scanner. Move over AVG, we have a new favorite freebie.

Verdict: 8
www.free-av.com
Free

FRISK Software F-Prot Antivirus

Power users not willing to concede an ounce of performance during day-to-day computing will get exactly what they bargained for in F-Protect, whose small footprint should be its calling card. After a stupid-fast 35-second install routine (plus a reboot), our test system raced along just as zippy as it did with no AV software installed. This will come as a boon for anyone falling short on system resources or still trying to get by with an older rig.

Performance comes at a price, however, in the form of a stripped-down interface and limited options that often carry caveats. For instance, you can instruct F-Protect to scan your email through Outlook, but not any other email client. And while heuristic scanning comes as part of the bargain, you’re not able to tell F-Protect how aggressively it should zone in on unknown files. Don’t look for any extras, either—like a separate spyware scanner, phishing protection, spam controls, or identity safeguards—because you won’t find anything more than the bare essentials.

We’d be OK with this if F-Protect built up an impenetrable wall, but this one’s easily breeched. We tried downloading a test virus from the European Institute for Computer Antivirus Research (EICAR) website using Internet Explorer, and F-Protect promptly vaporized the imposter before it could reach the desktop. And while we got further with Firefox, F-Protect nixed our attempt to execute the fake virus. But when the threat became real, things took a dramatic turn for the worse.

Repeating the same test with a dirty executable we knew contained a real payload, all hell broke loose. Opening the virus-laden .exe unleashed a fury of fiendish files that nuked our desktop background, killed our Internet connection, took our system hostage with sluggish performance—and whisked away our confidence in F-Protect’s bare-bones approach to security.

Verdict: 5
www.f-prot.com
$29 (up to 5 PCs)

AVG Free Edition

Like its paid version, AVG’s free edition pounces on viruses before they have a chance to hamstring your PC. It didn’t matter what payloads we clicked because AVG acts like an assassin whenever it detects a tainted file. Indeed, where AntiVir proved futile in keeping our browser from getting hijacked and preventing potentially unwanted applications (PUPs) from running, AVG swooped in to save the day, sans goofy looking tights.

That doesn’t mean you can completely let down your guard. AVG’s freebie app trades in the paid suite’s decked-out utility belt for one with less gadgets, ultimately leaving you less equipped to defend yourself against a wider variety of threats. The free edition doesn’t come with an anti-rootkit scanner, and if you plan on strolling through seedier sections of the web, you’ll have to do so without AVG’s Web Shield, which provides real-time protection against hidden malware. IM protection gets axed in the free version too, as do the anti-spam controls and firewall, neither of which give us cause for concern.

What you’re left with is a basic but powerful scanner with a few extras thrown in. Configuring POP3 and SMTP settings ensures you’re guarded against email bound malware, the resident shield can be set up to seek tracking cookies, and AVG’s LinkScanner analyzes your web search results so you don’t fall prey to a trap.

If that were the end of the story, AVG would remain our free scanner of choice, but this latest version adds another chapter that we’re not so fond of. While it doesn’t come with a price tag, you pay dearly for AVG’s multi-faceted protection. AVG chews on system resources like nobody’s business, and we don’t recommend playing games during a scheduled scan, lest it’s your FPS that gets fragged.

Verdict: 5
www.free.avg.com
Free0

PC Tools Antivirus

We suspected PC Tools of cutting corners after we recorded an insanely fast 8-second install routine, and that includes the time it took to download the latest virus definitions. We grew even more leery after the company’s program turned in the fastest initial system scan time of every AV app we tested. Either PC Tools Antivirus is harboring some serious horsepower under the hood or we call shenanigans on the scanning engine. In our opinion, it’s the latter.

The reason PC Tools beat all the competition is because it took a shortcut to the finish line, scanning only about 15 percent of the files on our hard drive. We’d be OK with that if, like some of the other applications tested, it had raced through a qualifying lap and determined which files could be skipped, but this happened during a first run.

Still, it wasn’t until we test drove PC Tools on the web that we lost faith in the program. Downloading the same contaminated executable as we’d been using for each application, PC Tools remained in a near comatose state as Trojans and downloaders took control of our system. It did manage to catch a small handful before they could do harm, but the dozens it missed left us conceding defeat. Our system was in such bad shape that neither an online scan nor an antispyware sweep could restore our test bed to anything resembling a healthy PC.

With a little digging, PC Tools’ sparse-looking interface hides a handful of options to make you feel as though you’re fine-tuning your security. You can turn heuristic scanning on or off, configure specific ports for email scanning, and force the scanner to dig through all levels of an archive, but why bother? The time you spend setting up rules would be better spent downloading a different antivirus program, preferably one that works.

Verdict: 3
www.pctools.com
Free

ESET Smart Security

Independent test labs consistently rank ESET’s Nod32 antivirus program as one of the top performers, so how has company gone about improving its product? For starters, the Smart Security suite builds on Nod32’s core by stuffing a personal firewall, antispyware module, web access protection, and spam controls into a tidy 22MB package. But that’s just the beginning.

From first click to finish, you’ll be up and running in less than a minute with no reboot required. The default settings will have you ready to romp around the web, but should you decide to dive into the interface’s advanced section, you’ll find a truckload of options at your disposal in plain English.

In addition to scouring your local drives, the real-time file protection homes in on removable media and network drives too. And when it comes to safeguarding your email, if you’re not using Outlook, simply expand the POP3 tree and put a checkmark next to your email client of choice, or click the Add button if you don’t see it listed. It doesn’t get any easier than this.
Parental units and IT admins alike will appreciate the ability to block specific web addresses, and support for wildcard entries save you the time of inputting every subdomain. Once you have everything configured, export your settings to an XML file for effortless configuration of your entire home or work network.

Given the bevy of options and stellar track record, we were determined to uncover an Achilles’ heel, but we just couldn’t find one. ESET’s Smart Security thwarted our attempts to download infected files, making the scant 7 minutes and 54 seconds it took to scan our system feel as though we were just going through the motions.

Only the lack of identity protection and the inability to create a rescue disk prevent this from being the perfect package. As it stands, it will have to settle for near-perfect.

Verdict: 9
www.eset.com
$59 1 yr ($89 2 yrs)

Correction: PC Tools AntiVirus does include both heuristics and email scanning.

ESET Threat Report: Dramatic Upsurge in Gaming Malware, Gangs Target Second Life

Paul Lilly — Fri, 08 Aug 2008 13:58:58 -0500

Gamers have enough trouble trying to come up with a game plan to beat pesky end bosses and single-handedly defeat armies of mutant soldiers. Saving often gives gamers an endless advantage and cheat codes can help in a pinch, but neither of these tactics will do any good against an increasing amount of real-life threats the online gaming scene.

More than just an annoyance, time spend in virtual worlds like Second Life can translate into real currency and it's attracted the attention of organized criminal gangs. According to security software vendor ESET (best known for its NOD32 Antivirus products), "high volumes of malware intended to steal passwords for online gaming and virtual worlds" have been detected since 2007, resulting in a "dramatic upsurge."

The alarming news comes courtesy of ESET's mid-yearly Global Threat Report, which focuses on broad trends in malware over the past six months. In addition to an upsurge in attacks against gamers, ESET notes that malicious software that tries to use the Windows Autorun facility to self-install from removable media continues to flourish.

On the opposite end of the spectrum, the company reports email bound malware is in "dramatic decline," at least when it comes to dirty attachments. Malicious URLs passed through email messages have taken the place of attachments.

Further reading to keep yourself (and your virtual self) protected: