REVscene Automotive Forum - Security FAQ (Updated Sept '07)

***Updated version of RCJS's old thread, he get's all the credit, I just updated it.***

The 3 Basic Principles
1. Keep all your softwares up-to-date.
2. Update Microsoft Critical Patches.
3. Watch what you download.
_________________________________

FAQs
Note: The softwares that I refer to varies by the administrator of the computer. However, these are some of the softwares that I recommend. If you use Norton Antivirus, please read this article before reformatting.

Q: "Everytime I reformat my harddrive, I tend to encounter a lot of viruses."
A: *ethernet cable unhook = no internet connection.
- Be sure to have one antivirus, three to two anti-spyware programs, and one firewall program. Be sure to back up in a blank CD for installing after reformatting the hard drive without internet connection.

Checklist:
- All programs are to be in a back up cd.
- Installing the programs offline without internet connection = no update. Be sure to download the latest reference (definitions), in order to detect the latest variants.

1. Unhook the ethernet cable (internet plug/connection)
2. Reformat your hard drive*
3. After the computer has been reformated, immediately install the following programs*
- Antivirus / Free versions are listed, If you have an antivirus yourself, use it and update immediately (Use only one antivirus - using more than one can cause corruption).
(Avast AV and AVG Anti-Virus FREE Edition).
- Anti-Spyware / Free versions are listed (Install all four programs). (Ad-Aware SE, Spybot S&D, Microsoft Anti-Spyware, and Spyware Blaster).
- Personal Firewall / Free versions are listed. (Use only one firewall - using more than one can cause corruption). (Home PC Firewall Guide).
4. Hook up the internet.
5. Microsoft Critical Patches.
6. Follow the 3 Steps (Keep all your softwares up-to-date, Update Microsoft Critical Patches, and Watch what you download).
7. Use an alternative to Internet Explorer. This step may be last, but is still very important!
(Firefox *Best choice/Recommended*)

Q: "I keep on scanning my hard drive and I always find at least one or more viruses still lurking on my computer, help!"
A: If you still find one or more viruses in the hard drive, even though you scanned and cleaned every single file in your computer, try to empty the temporary files.

Q: file it infected - C: \System Volume Information\_restore{241238A0-E690-49B9-8046-100FE9422EE0}\RP1\A0000013.exe »UPX v12_m2 - Win32/TrojanDownloader.IstBar.ER trojan
anyone know how to remove it ?
A: If it does involve "C: \System Volume Information\_restore." You will need to turn off and turn on your system restore and that will remove it.
How to disable or enable system restore
__________________________________

Virus Anxiety
What is the difference between viruses, worms, and Trojans?
__________________________________

Antivirus Software
Some programs are not listed, since some programs are not worth using.
Note: There is no single 'best' antivirus product available they all have pros and cons.
Best Anti-Virus: Article
Why you should ditch Norton Antivirus: Article

Free
AVG Anti-Virus FREE Edition *Best choice*
Avast Home Edition*Best choice*
BitDefender Free Edition

Commercial
NOD32 *Best choice*
Kaspersky Antivirus *Best choice*

Norton/McAfee Removal Tools
Norton Removal Tools
Viruses have become increasingly complex and virus infections involve more system elements than ever before. Symantec Security Response has developed tools to automatically conduct what would often amount to extensive and tedious manual removal tasks. If your system has become infected, the tools listed below should aid you in repairing the damage.

McAfee AVERT Stinger
Stinger is a stand-alone utility used to detect and remove specific viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system. Stinger utilizes next generation scan engine technology, including process scanning, digitally signed DAT files, and scan performance optimizations.

Online Virus Scan
Note: Most if not all will require the download of a few files, but not a full antivirus program.
House Call (Trend Micro) *Best choice*
Panda Active Scan
BitDefender Free Online Virus Scan

Test your AntiVirus
Important note: Cannot be held responsible when these files or your AV scanner in combination with these files cause any damage to your computer. You download these files at your own risk. Download these files only if you are sufficiently secure in the usage of your AV scanner. cannot and will not provide any help to remove these files from your computer. Please contact the manufacturer/vendor of your AV scanner to seek such help.
EICAR
__________________________________

Trojan Software
Trojan Hunter *Best choice*
TDS-3

Online Trojan Scan
Note: Most if not all will require the download of a few files, but not a full trojan program.
Trojan Scan
Sygate Trojan Scan
__________________________________

What is Spyware and Adware?
Has some sleazy web site taken over your browser? Are you getting pop up ads even when your browser has been closed for some time? Are you infected with a spyware program that refuses to go away?
Full article

Never pay for anti-spyware programs
It is a scam! Its spyware built-in to trick you!
Full article

Spyware Software
Ad-Aware SE *Best choice/Recommended*
Spybot S&D *Best choice/Recommended*
Microsoft Windows Defender *Best choice*/Recommended
Spyware Blaster *Best choice/Recommended*
Spy Sweeper
SpywareGuard
HijackThis

Hijackthis
If you have any hijackthis logs, please create your own thread.
http://www.hijackthis.de
Hijackthis.de is a website that provides information of your hijackthis log, it is quite useful, however, it is not as accurate. Since it will display well known variants, but not the unknown ones. So it is better to use http://www.hijackthis.de, then post your hijackthis log here.
_________________________________

Security Tweaks (Windows Only)
How to disable "Messenger Service", NOT "Windows Messenger" OR "MSN Messenger."
Should a pop up box appear on your screen with the words "Messenger Service" in the title bar such as the one below, chances are that you have Windows Messenger Services enabled.
Note: This page does not address, nor is it intended to address, problems associated with services involved with Instant Messaging.
How to turn off Windows Messenger Service

How to remove/disable Windows Messenger in XP
Remove Windows Messenger
Disable Windows Messenger

Java Sun (Virtual Machine)
Disabling Java Caching is important, considering that many trojan and spyware attacks execute from java applets.

Advanced Windows XP Optimization
Windows XP has a lot of extra services running by default that most people will never use. By disabling these services you will increase available memory and processing power thus improving system performance.
Full Article
_________________________________

Alternate Internet Browsers
DO NOT USE IE!
Firefox *Best choice/Recommended*
Opera

Pop-up blocker Programs (Internet Explorer Only)
Pop-ups can lead to spyware installations and a good pop-up blocker can prevent that in some way.
Google Toolbar *Best choice*
_________________________________

Other Links
Home PC Firewall Guide
Optimize XP

Questions? Well PM if you want to ask questions about anything that is related to this thread or anything that I should add..