Protecting Your Windows Computer


generalnmx

Playful/Fascist Mod
Joined
Apr 18, 2003
Messages
2,128
Age
43
Location
Maryland, USA
Website
www.matts-hosting.com
For those of us that must maintain Windows computers with Internet Explorer installed, and must use IE on a regular basis, there are still ways to help protect our computers, even if you are not an experienced user. However, just in case you don't know what a virus or spyware is:

"A virus is a piece of software designed and written to make additional copies of itself and spread from location to location, typically without user knowledge or permission. Such stealth qualities are now found in both viruses infecting files and those infecting boot areas. There are computer viruses that were written for several operating systems like DOS, Windows, Amiga, Mac, Atari, and UNIX. Macro viruses are a new class of viruses that do not infect boot areas or files with the .EXE or .COM extensions. Instead, they infect documents; when Word loads the document, it executes any "autoexecute" macro in the file. (see Macro Virus) Some viruses cause damage, but not all do. More than 20,000 have been identified, and 250 new ones are created every month, according to the International Computer Security Association. With numbers like those, it’s safe to say that most organizations will deal regularly with virus outbreaks. No one who uses computers is immune from viruses." ( http://www.google.com/search?hl=en&lr=&ie=...&q=define:virus )

"[Spyware is] a general term for a program that surreptitiously monitors your actions. While they are sometimes sinister, like a remote control program used by a hacker, software companies have been known to use spyware to gather data about customers. The practice is generally frowned upon." ( http://www.google.com/search?hl=en&lr=&ie=...=define:Spyware )

You may want to pass this on to your computer-illiterate friends, as it is made especially for them, from my experience with my parents and their computer (which was so malware-ridden that I had to use my last resort - reformat). All the links shown are free solutions.

Brief Summary for a more secure Computer
- Get a Virus Scanner (recommended free solution: Avast)
- Get a Firewall (recommended free solution: Sygate Personal Firewall)
- Visit WindowsUpdate frequently, don't enable Automatic Updates
- If you have Windows XP, download and install Service Pack 2
- Download, install, and run Ad-Aware Personal SE
- Download, install, and run Spybot: Search and Destroy (w/ TeaTimer)
- Download and install SpywareBlaster
- For NT/2000/XP/2003, don't use an Administrator Account for normal use


1. Get a Virus Scanner dammit.

If you don't want to buy one, I suggest using Avast. If your computer is too slow to handle a virus scanner always running in the background, then use Trend Micro's web-based solution (which only scans your computer when you go to the site).

Avast (recommended): http://www.avast.com/eng/down_home.html

AVG Anti-Virus Free Edition: http://free.grisoft.com/freeweb.php/doc/2/

Tend Micro's House Call (single computer scan from Internet for slow computers): http://housecall.trendmicro.com/housecall/start_corp.asp


2. Get a Firewall.

Why You Need A Firewall: http://www.cisco.com/univercd/cc/td/doc/pr...ser/scf4ch2.htm

There are two different ways firewalls can protect you - outbound traffic (going from your computer to the Internet) and inbound traffic (going from the Internet to your computer). I recommend Sygate's Personal Firewall for all outbound traffic (also called "blocking applications from accessing the internet"). Routers give restrictions on inbound traffic through NAT, so if you are using a router, you don't need to worry too much about inbound taffic (also called "blocking ports"). If you don't have a router, try XP's built-in Firewall or ZoneAlarm.

Sygate Personal Firewall (with router or Windows XP Firewall): http://www.sygate.com/firewall/

ZoneAlarm (no router): http://www.zonelabs.com/store/content/comp...d=staticcomp_za


3. Visit Windows Update frequently.

Don't activate Automatic Updates - you know one day they're going to hack it.

http://windowsupdate.microsoft.com


4. Download and install SP2 if you have Windows XP.

This gives a nice Pop-Up Blocker, allows you to disable/uninstall IE Plugins, notifies you when programs are downloading or want to run, etc. You don't need the Firewall or Automatic Updates - in fact, you should disable checking for Firewall, Automatic Updates, and Virus Scanner (since you already dealt with them per these steps).

http://www.microsoft.com/downloads/details...&displaylang=en


5. Download, install, and run Lavasoft Adaware SE Personal.

Run it every now and then, updating your definitions before so. First time downloading it, run a "Smart Scan" and delete/quarantine everything it finds. Don't worry, your computer won't die if you delete spyware.

http://www.lavasoftusa.com/software/adaware/


6. Download, install, and run Spybot Search & Destroy.

Use "Immunize", and enable TeaTimer (just place a shortcut to TeaTimer.exe in your Startup folder). TeaTimer protects against malicious processes (programs running "silently" or "in the background") and registry changes (the registry is like "where Windows stores what it remembers about your computer").

http://www.safer-networking.org/en/download/index.html


7. Download and install SpywareBlaster.

It protects against IE's ActiveX exploit problems and Tracking Cookies (type of Spyware).

http://www.javacoolsoftware.com/spywareblaster.html


And finally, don't use an Administrator account for normal use!

- Under XP Home, make a Limited/User Account and run all programs under that. Install programs in C:\Documents and Settings\Username\Program Files instead of the default path. If the program must be installed and run as an Administrator, then right-click the shortcut and use "Runas" when you need to run it. There are also "Runas" scripts you can use.

Now under a Limited Account, there may be stuff (like moving files) that you want to do as an Administrator. You can use an alternative Command Shell for this, using "Runas" to run it as an Administrator. I prefer Total Commander, but that's not freeware.

- Under NT/2000/XP Pro/2003, use a Power User account. Although for full security, you may want to use a Limited/User account.

Be safe :)
 
Since SP2 is a huge download, get a firewall like sygate's personal free one http://www.sygate.com/firewall/

A question though.. I know WHY you should use a limited acount but HOW does it protect the computer (I have a rough idea but would appreciate more info :) )

Edit: Also read the agreement when installing software (especially freebies) as some have spyware/adware as part of it. Typical example is MSN Messenger Plus where it asks you whether to install it or not, lots of people miss this (heck even I missed it on a repeat install)
 
yaustar posted on Sep 29 2004 at 11:14 PM said:
Since SP2 is a huge download, get a firewall like sygate's personal free one http://www.sygate.com/firewall/

SP2 offers a hell of a lot more features then just an upgraded Firewall. In fact, I suggest you disable it (I forgot to edit my post about that, thanks for mentioning it).

yaustar posted on Sep 29 2004 at 11:14 PM said:
A question though.. I know WHY you should use a limited acount but HOW does it protect the computer (I have a rough idea but would appreciate more info :) )

It will block malicious programs that rely on administrator-level access (placing themselves in C:\Windows, deleting system files, etc.) It also helps stop your own stupidity.


yaustar posted on Sep 29 2004 at 11:14 PM said:
Edit: Also read the agreement when installing software (especially freebies) as some have spyware/adware as part of it. Typical example is MSN Messenger Plus where it asks you whether to install it or not, lots of people miss this (heck even I missed it on a repeat install)

Good point.
 
Last edited by a moderator:
Good Topic ;) Especially now when I'm dealing with this kind of BS. I'm using a free firewall called Tiny Firewall. It has got excellent reviews from the LeakTest people and everytime an application asks for network access you can either "trust" it or just blatantly deny, quarantine, etc... This is then coupled with mcaffee which monitors changes to the registry and scans for known trojans and worms etc.

I think the best setup could in fact be to have one firewall to monitor inbound/outbound connections and another one to purely act as a "rule based" firewall and only let specific files access to the internet. (so in the future a worm cannot compromise based on the premise you're using just one product or brand)

The next step however will be when these trojans and worms can exactly spoof or manipulate MS files to do what they want to do. (so negating the rule based system).

I have since realised that the Windows XP Firewall is adequate for incoming requests to a degree, but has absolutely no protection for outbound connections.

Do NOT use System Restore!! This is how some of the annoying worms can reinfect, also auto update and auto download should be switched off.
 
For those who want a windows firewall, I would reccomend 'Kerio' over Zone Alarm; much more customisable. ZA used to be pretty good, but it's starting to drift more towards the lowest common denominator; ma and pa with their computer in the living room.
 
Avoid Zone Alarm; I also suggest Sygate (not Sysgate). It's free. http://soho.sygate.com/download/download.php?pid=spf

For a free virus scanner I use avast ( http://www.avast.com/ ) which checks p2p, mail, msn/icq/aim/yim (even works with Trillian) and does the standard checking of exes as you open them.

Don't bother with SP2. It offers little that can't be found elsewhere, but also breaks a whole load of applications and some drivers. Not a good idea to use it until it, or your applications, get patched.
 
How of your Processor is used by running all that???

I just run Sygate Personal Firewall PRO
 
Wasnt there some problems with SP2 and appplications?
Another free virus scanner is AVG Free edition

edit: reread Rico's post.. yes it does
 
Rico posted on Sep 30 2004 at 09:01 AM said:
Avoid Zone Alarm; I also suggest Sygate (not Sysgate). It's free. http://soho.sygate.com/download/download.php?pid=spf

For a free virus scanner I use avast ( http://www.avast.com/ ) which checks p2p, mail, msn/icq/aim/yim (even works with Trillian) and does the standard checking of exes as you open them.

Don't bother with SP2. It offers little that can't be found elsewhere, but also breaks a whole load of applications and some drivers. Not a good idea to use it until it, or your applications, get patched.
What's wrong with zone alarm?
 
Last edited by a moderator:
It stopped my computer from booting, I've heard other similar stories. It's incompatible with a huge range of applications. The toolbar it installs is buggy. It's a bloated mess. There are smaller, faster and better alternatives.

As for CPU usage... avast! and Sygate are using 0%. To put it into perspective, iTunes uses 2% and Firefox up to 5% depending on what it's doing.
 
This is mainly aimed at computer illiterate people, who don't use applications that would conflict with SP2 anyway :D

Do NOT use System Restore!! This is how some of the annoying worms can reinfect, also auto update and auto download should be switched off.

Yeah I already mentioned Auto Update should be turned off. Both Spybot and Spywareblaster have handy registry and file backup features that are superior to System Restore.

I think the best setup could in fact be to have one firewall to monitor inbound/outbound connections and another one to purely act as a "rule based" firewall and only let specific files access to the internet. (so in the future a worm cannot compromise based on the premise you're using just one product or brand)

TinyFirewall only has a trial demo available. Are there any free solutions to JUST block outbound connections, which aren't nearly as bloated as ZoneAlarm? (I know TinyFirewall does more then just block outbound connections, but with it's name you hope it's far less bloated then ZA!)
 
Last edited by a moderator:
Its 4MB in download. I don't know if thats bloatware or not. I like the fact that it starts off in "supreme Nazi everything is a threat" mode, and you build "trust" with your applications.

What I found particularly interesting was a spyware labelled "mcinfo.exe" which is part of the mcaffee security centre - Tiny Firewall just kills it like the dog it is. ;)
 
lizard808uk posted on Oct 1 2004 at 02:52 AM said:
Its 4MB in download. I don't know if thats bloatware or not. I like the fact that it starts off in "supreme Nazi everything is a threat" mode, and you build "trust" with your applications.

What I found particularly interesting was a spyware labelled "mcinfo.exe" which is part of the mcaffee security centre - Tiny Firewall just kills it like the dog it is. ;)

Although a little OT, just to clarify, the size of a program has little to do with how much resources it takes up. In fact, smaller programs have just as much chance to use up more resources as larger programs because of the hacky methods to keep program sizes down.
 
Last edited by a moderator:
Another tidbit (blantatly obvious but still happens) alawys use a firewall when using P2P software

I turned it off twice (once to play a LAN game and another due to Zone Alarm not liking eDonkey) and got the same virus both terms (shutdown in 45 secs one).
 
that annoying LSASS thing? I had it last week. Rule based firewalls work well in those situations since you can kill anything wanting 'net access and only let what you want to go through.

Anyone have experience of the jpeg exploit yet? Pictures have sufaced on Usenet with the code embedded in the jpeg. When you go to view the image in explorer it connects to an IP address somewhere on the 'net and then auto-downloads a "payload" (e.g. spam engine etc..) In this way a rule-based firewall would be breached since explorer.exe is considered "trusted". However the payload would still be stopped by the firewall, so explorer would then reconnect to said IP and redownload the worm and then ..... arrrrrghgh I'm going cross-eyed.. :blink:
 
yaustar posted on Oct 1 2004 at 03:13 PM said:
Another tidbit (blantatly obvious but still happens) alawys use a firewall when using P2P software

I turned it off twice (once to play a LAN game and another due to Zone Alarm not liking eDonkey) and got the same virus both terms (shutdown in 45 secs one).
Patch your system then. The RPC and lsass vulnerabilities have been patched on Windows Update.

My setup is a hardware router/switch which controls inbound ports. Only a handful are open - MSN, web, identd, shareaza/edonkey2000, irc dccs, etc.

Then Sygate blocks outbound ports on a per-application basis. Generalnmx, it's pretty much what you're looking for. There's a few extra features thrown in - it warns when applications change or call other ones that access the internet, and logs repeated attempts of attacks, such as the Code Red worm. But not much extra stuff.
 
Last edited by a moderator:
Some people are waaaaaaaaay too paranoid

I download shit liads and the only problem i have with my computer is that i have a TINY computer

i have no anti-virus software

actually come to think of it, on my other PC the only time i ever had problems was emmidiatley after i installed AVG
 
Back
Top