AntiSpyware & AntiVirus - new tools

Following up on the discussion under another topic, I opened a newsletter from PCWorld today, and they sent me to this very interesting list of protection tools. One of the most difficult attacks to deal with is a rootkit, and this page has a tool I haven't seen before from Kaspersky. http://www.pcworld.com/article/2021326/turn-your-flash-drive-into-a-portable-pc-survival-kit.html#tk.nl_pcwbest

There are a bunch of other great tools for carrying around on your USB stick. I'm impressed to see SpyBot's latest offering. Some of these tools are for use after you've been attacked, which is where I DO believe in them.

Sounds sweet - but two problems. A lot of the viruses/malware effect the boot sector. If the flash runs windows, how is it going to bypass windows if the damage is already done? This is why so many techs run linux on the flash - you then have access to ALL Window files. There are a lot of Linux fixem utilities now - to fix Windows, while running in Linux. The second problem is that not all computers seem to have the ability to boot from a USB flash drive. Some public computers block access to the bios, they get nervous when they see customers accessing that menu. Keep a CD version of your software too.

This is all Helpful stuff Helper Guy - doing what you do, since 1982!

I haven't checked it out, but anything that I've used before that looks at rootkits always bypasses the startup BIOS to avoid that problem.

And you are correct, older BIOSes don't have the ability to boot from USB, but pretty much everything in the last 5 yo 7 years does. No one product can be all things to all people, I guess. When the Computer Forum is ready, this topic will be moved over, and the geekazoids among us are more attuned as to what to look out for. This won't stop me from offering assistance on the General forum for computer questions.

CHILLIN wrote:Sounds sweet - but two problems. A lot of the viruses/malware effect the boot sector. If the flash runs windows, how is it going to bypass windows if the damage is already done?
This is all Helpful stuff Helper Guy - doing what you do, since 1982!

Helperguy did a good job explaining most of this. I think he kind of left out one part. A separate copy of windows can be placed/ran from the flash drive (or CD). By doing this, it does not run the corrupt windows files on your HD (by-passing the HD boot sector). Thus allowing it to fix the users copy of windows located on the HD. However. it can not bypass the BIOS.

HelperGuy wrote:Following up on the discussion under another topic, I opened a newsletter from PCWorld today, and they sent me to this very interesting list of protection tools. One of the most difficult attacks to deal with is a rootkit, and this page has a tool I haven't seen before from Kaspersky. http://www.pcworld.com/article/2021326/turn-your-flash-drive-into-a-portable-pc-survival-kit.html#tk.nl_pcwbest

There are a bunch of other great tools for carrying around on your USB stick. I'm impressed to see SpyBot's latest offering. Some of these tools are for use after you've been attacked, which is where I DO believe in them.

LOL I just looked at the article and "PortableApps" looks VERY similar to a (linux) program I have been using for a couple of years now. I think someone borrowed some "open source" code. lol It is a great tool!!!

Don't know, really. Portable Apps hit the scene back when USB keys arrived, 15 years or something like that. Can't remember when I bought my first 8Meg USB memory stick for $75... and that was discounted.

HelperGuy wrote:Don't know, really. Portable Apps hit the scene back when USB keys arrived, 15 years or something like that. Can't remember when I bought my first 8Meg USB memory stick for $75... and that was discounted.

Ya tech is hard on the wallet. I STILL can't stop laughing thinking about all the people who stood in line for the iphone (2 I think) only for it to get heavily discounted months later...

I'm dealing with a lot of virus now that just can't be removed from within the Windows system. I'm actually pulling the infected hard drives and scanning them from a bench computer using Malwarebytes, Avast & Avira and another software tool for Tech guys only (someone who does not know what they are doing can really screw up their computer with it so I won't name it).

It works very well but there is the occasional computer where the damage to Windows is so great that wipe and reinstall is in order.

Yes, I generally find two levels of spyware: smart and dumb. The dumb ones can be removed within an hour; the smart ones block all attempts to do so, preventing msconfig, sysrestore, Task Manager, and so on. Sometimes rootkits, and when this happens, a reinstall of the OS is the only thing to do. I remember the days I would spend 8, 12, 16 hours working on fixes. Just isn't worth it.

That is very true HelperGuy. If I'm not as busy in my little shop, I do spend those extra hours learning how a new virus loads and from where, changes to the registry, etc. It's a constant educational process.

Slight Drift

So now thanks to the crooks we have to turn Java off and we don't know whether
our machine have trojans and such on it? Is it time to give up and get a UNIX/Linux box? Sigh.
It sounds like no tools for this stuff that the average to moderate user can use. I never had
problems like these on UNIX/HPUX/Linus systems. Mac is starting to have its own problems
so can't go there. Maybe we have to have a lockdown machine to do banking on. At the least
we maybe should have a locked down browser only used for banking. Back to X windows? LOL

Comments? How do we secure our online banking systems? Beginning to sound impossible on MS PC.

Z

Good question, Zed. There is always sandboxing, but what a pain, because it doesn't represent the "real world".

Perhaps more apropos is the knowledge that the majority of people never get attacked; the problem sounds a lot worse than it is.

Yes but not knowing is not one of my/our strongpoints. I want to know I don't have keystroke stuff for example. If it were not for the banking issue I wouldn't care. I doubt if I have worry about email as I use a UNIX box for the secure stuff with a logon I only use for secure stuff. I use gmail for the normal wide communications. Banking....I don't know anymore other than make a braindead browser for banking and that won't help with the keystroke trojans situation will it?

Z

I know whenever my IP address changes I need to answer all my security questions again on my banking sites so a keystroke recorder would not help the hacker.

If you haven't been keystroked, then your banking information is safe, because you don't put in your account number every time, so there is nothing to capture.

I remember now the other software I use: SpyShelter I don't recall the difference between the free download and the paid version, but it works extremely well.

CanuckBob wrote:I know whenever my IP address changes I need to answer all my security questions again on my banking sites so a keystroke recorder would not help the hacker.

It's actually the cookies that you are dealing with in cases like these, not the IP address, so there must be another reason.

Yes, you are correct, because now that I think about it, I get a new IP address every time I shut down and it doesn't ask me after that. It is whenever I use a different computer, that doesn't have the cookies installed, that it asks the security questions. Thanks for the clarification.

I know my account is safe but what if I make a word document with all my accounts
on it to put in a safe place for backup. Keylogger could nail that unless
I did a boy scout code added to it like turning G into H or 1 into 2. Not knowing
whether you have problems limits the usefulness of the computer to me.

Z

Generally speaking, email thiefs are not trying to get into your computer. You are not an important person to them, any more than I am. If you were the CEO of a wealthy corporation, or the government, or some other worthy target, sure. But for the same reason that lack of resources prevents email hackers from sifting through your many messages, they also do not look at your computer contents.

Note also that keylogging relies on discovery of the "@" symbol, to indicate to the recipients just when an email address is turning up. It is even difficult for them to review strings of numbers, because without the associated information (of say, bank accounts, requiring banking sites, full account numbers, passwords and pins), they just don't have the resources.

I just want to point out that the newer keyloggers also run screen capture. So your information is collectible...

Protect your self and be safe.

Oh and stop clicking on all the porn
What is the internet for... NWS

Very good point, and software like SpyShelter prevents screen caps, clipboard capture, gettext, anti kernel logger, webcam, sound recorder, network spy... pretty much everything we'd need.

Hey, I know you're joking about the porn (why stop?), but I should reiterate that gambling and porn sites are the safest of all, because they have to protect their reputations. This is NOT to say you can click on all the ads that are associated with those site. And the porn sites will nail you with popups, but not in a vicious way.

Yesterday a customer who's just arrived back in town, and who uses an email address and client from a private service provider, was notified by the company that her email had been used to send out a couple of thousand spams. I did a thorough trace on her system, which interestingly enough had the full version of SpyShelter I installed last year, and could find no trace.

A call to the service provider revealed that it had happened at their end, through a series of server attacks. So don't always blame yourself, people.