Tabris:DarkPeace - Information Technology

Protecting your PC from Virii / Virus Infection:

(Self replicating code designed to damage PCs, and corrupt the software and data contained on them)

My current recommendation, if you do not currently have a up-to-date Anti-Virus solution, would be to perform the Symantec Online Virus Scan via the link below every week :

If you do have an Anti-Virus solution, make sure that is has not been 'disabled' (even though it appears to be working fine) by a new virus or malware designed to bypass it.

Currently the best way to do this is to scan your PC using a web-based Anti-Virus file scan, as, assuming it works, such scans are going to contain the most recent Virus Signature available, and as they are downloaded each time, they can not be corrupted.

In many cases I have seen, the currently installed Anti-Virus product, which was kept up-to-date as well, failed to detect an infection but otherwise appeared to be scanning the PC normally, both real-time and manual file scans. Upon running a web-based Virus Scan it was found the PC(s) where infected, and the Anti-Virus product in question had been partially disabled and was not getting a working update when updates where applied.

Symantec Firewall Security and Virus Scan (Active X Internet browser required):

You may need to open this link from Microsoft Internet Explorer for ActiveX to work.

http://security.symantec.com/sscv6/default.asp?productid=symhome&langid=ie&venid=sym

If your PC is unable to run the ActiveX Virus Scan via Microsoft Internet Explorer Web-browser then chances are it is already infected with a, or several, virii and/or malware applications.

Just so it is 100% clear.... Having a Anti-Virus product with Virus Definitions older than 2 weeks on a PC that is connected to the Internet (directly, or via another network) is pointless. In fact the PC has a much higher chance of infection, as the (outdated) Anti-Virus product and/or Virus Definitions would give a false sense of security to the user.

Ensure that Automatic Updates (not just of Anti-Virus software) is not being blocked by a Application Firewall:

Another possible misconfiguration I highly recommend people double check for, is that their (overzealous) Application Firewall (see below) is not blocking the Anti-Virus product from receiving its updated virus definitions and other Virus related security updates. As if the Application Firewall in use is stopping your automatic software, security, operating system, and other updates being installed then the PC in question eventually opens itself to an infection or attack, as the user is less likely to perform manual updates if they believe automatic updates are being performed to keep there system protected.

The Application Firewall should be configured to let in the Anti-Virus and Critical OS updates as a minimum.

My reason for recommending PCs be equipped with Malware protection, scanning & removal tools:

Virus infection is no longer the 'sole' form of malicious software, thus you can no longer just run Firewall and Anti-Virus products and expect the PC to remain safe.

Quoted from website (5 Dec 2004):

"Spybot - Search & Destroy can detect and remove spyware of different kinds from your computer. Spyware is a relatively new kind of threat that common anti-virus applications do not yet cover. If you see new toolbars in your Internet Explorer that you didn't intentionally install, if your browser crashes, or if you browser start page has changed without your knowing, you most probably have spyware. But even if you don't see anything, you may be infected, because more and more spyware is emerging that is silently tracking your surfing behavior to create a marketing profile of you that will be sold to advertisement companies. Spybot-S&D is free, so there's no harm in trying to see if something snooped into your computer, too :) "

The common term for this new software threat is 'malware'. The 'Malware' term covers Spyware, Trojans that are not covered under anti-virus, and other misc software that the user did not knowingly install. Malware is usually software running on a PC that appears to have installed itself without containing code that would class it as a virus, (by tricking the user, or exploiting a software bug, etc).

There is no black and white line between Trojan virii and malware, it is a grey area, they are both forms on unwanted software, that modifies the way a PC operates, or changes the way software acts, or adds 'unwanted' features or hidden user tracking 'features' to already installed software.

In a biological sense Malware could be thought of as a parasite, instead of an infection, as it tries to change the host in normally undesired ways, without the host knowing.

The good news is Spybot-S&D (which is freeware/donationware) can immunize a PC from several known bad websites that initiate malware installations, as well as scan for, and attempt to remove most the 'malware' that (is know about) and not covered by conventional Anti-Virus software. This may include many 'Trojans' that Anti-Virus software does not detect as there is a grey area between the two forms of protection.