BOOT CAMP 363 (08/02/05)

THE MALWARE MENACE, part 1

Over the years the Faqs! Facts! Fax! Inbox and postbag has provided us with a unique snapshot of the state of health of the nation’s PCs and I have to say that it’s not a pretty picture!

I suspect that most Windows computers currently have, or have recently experienced a ‘Malware’ infestation of some kind. We’ve covered this topic several times but in light of recent developments, including a big increase in the number of readers reporting infections over the past few months, I feel it is time for a more in depth approach. Over the next two weeks we’ll bring together all of the latest advice, tips and solutions to show you how protect your PC, and what to do if you get caught.

Malware is a blanket term for malicious software that gets into your PC via web pages, pop-up ads, email attachments and file downloads. These unwanted intrusions vary in severity from relatively innocuous things like home page hijackers, adware, tracking cookies and ‘data miners’ to Premium Rate diallers, spyware and trojans that run up huge phone bills or extract and send sensitive or personal information, such as passwords and online banking details, to fraudsters.

No PC with an Internet connection is safe -- and yes, even Macs and Linux computers are becoming targets. Another common misconception is that anti-virus programs will protect you. Most don’t since a lot of malware is hidden inside web pages and these are not routinely scanned; just clicking on a link or closing a pop-up ad window is often all that it takes.   

So what can you do about it? Fortunately quite a lot and you can reduce your chances of catching something simply by changing your browser since the vast majority of malware infections are designed to exploit loopholes in Internet Explorer. Microsoft has improved the security of IE but it will always be susceptible because it’s what most PC owners use. Switching to Mozilla Firefox not only protects you against most types of malware, it’s also a better browser. It won’t cost you anything and you can still use IE for the very small number of web sites that may not display properly; if you haven’t done so already visit: www.mozilla.org/products/firefox/

Firefox and the latest update of IE have pop-up ad stoppers but if a web page or window appears unexpectedly never click on any links on the page or buttons marked ‘Close’. Instead use the Close window ‘X’ icon to get rid of it and if that doesn’t work use Ctrl + Alt + Delete to close all browser windows and run a malware scan immediately -- more on that in a moment. This is a common pathway for premium rate diallers (see Tip of the Week). Never respond to ads that suggest your computer is infected or offer to check for spyware. They are almost always scams and like as not will spike your PC with malware.

Do not open unexpected email attachments or click on links in email messages unless you are 100 percent sure of their authenticity. Be very careful when downloading programs, files and images from the Internet. Commonsense says you should stay well away from web sites of dubious nature or offering cheap or pirated software and music, you are just asking for trouble! Take no chances, make sure that your anti-virus software is always up to date and manually scan files that you are not sure of.

Take control of cookies. These are small text files left behind by web sites. They are mainly used to store login or password information and most are usually harmless but some can be used to track your web surfing activities. A freeware utility like Cookie Monster from: www.ampsoft.net/utilities/CookieMonster.php. lets you preserve the useful ones, and delete the rest with a couple of click of the mouse.

Even if you take every precaution malware can still get through so you should scan your PC at least once a week with a spyware cleaner program. The two that I have always recommended are AdAware and Spybot; both are free and can be downloaded from:

www.lavasoftusa.com and  www.safer-networking.org.

However, be very careful when entering those web addresses, there’s a lot of really iffy anti-spyware programs doing the rounds, including some that will deliberately infect your PC or generate ‘false positives’ to scare you into buying them. There’s some useful advice and list of rogue and suspect products at: www.spywarewarrior.com/rogue_anti-spyware.htm

AdAware and Spybot continue to do a good job but there’s a new kid on the block, from Microsoft. AntiSpyware, which we first mentioned a couple of weeks ago is currently in the Beta testing phase, prior to a full release later in the year. So far the results have promising and we have received a lot of useful feedback we first mentioned it a few weeks ago and it manages to catch nasties that other cleaner utilities leave behind or ignore. It’s also fast and easy to use and hopefully the final release will remain free but if you want to give it a try now -- at your own risk -- go to: http://www.microsoft.com/athome/

security/spyware/software/default.mspx.

Next week – The Malware Menace, part 2

JARGON FILTER

BETA

Pre-release version of a program or application, made available to testers and volunteers on an at-their-own-risk basis, to help identify any last remaining bugs, glitches and conflicts

DATA MINER

Program or software that collects information on a PC -- usually relating to web surfing -- and sent from the PC to a marketing company

TROJAN

Hidden program on a PC, usually installed surreptitiously or by an email attachment that allows an external 'client' PC to access files stored on the hard disc drive when it is connected to the Internet or a network

TIP OF THE WEEK

Premium Rate diallers work by forcing the PC to dial up expensive premium rate lines. The good news is that they do not work on broadband connections, however, if you have recently switched from dial-up to broadband you should disconnect the phone cable from your PC’s modem. If you have a dial-up connection you should constantly monitor your PC to make sure that it doesn’t log onto the Internet without your say so, and you should ask BT or your phone provider to put a block on premium rate numbers.