RyanMeray
12-04-2008, 03:41 AM
Every day, I get asked a question I still haven't found an answer to. "How do I stay safe?"
They usually ask me after I've returned their formerly virus-ridden computer to them. A year ago, I'd have said frankly, "Stop browsing porn, clicking links in spam, and downloading music on Limewire."
But nowadays, you don't need to do that to get infected. The most common stuff I see, it seems like there are dozens of infection vectors. It gets in through compromised ad networks located on legitimate websites. It gets in through hacked websites that show up in the top 20, 10, even top 5 search results for common stuff on Google. They get in through legit-looking "ecard" emails, or infected PDF files.
Virus software constantly lags behind the threat. There's at least a 3 to 7 day Window on the vast majority of threats, and these malware mavens are constantly updating their software to avoid detection.
Tools like Virustotal don't just help us identify malware, they help the makers themselves make new strains that can't be detected. Every tool we have becomes a tool for them.
So what do you tell people? Do you tell them that Anti-virus software is the only band-aid they need, or that the Internet is a Typhoid Mary and the best you can do is reduce their risk marginally?
There's the obvious:
1. Run up-to-date Anti-virus. I think we all agree than almost anything is better than McAfee and Norton, even we'll argue which of our boutique products is the best until the cows come home.
2. Run spyware scans frequently and keep up to date.
3. Don't click on anything from popup ads, or download anything from an untrusted website.
4. Run Firefox, since the malicious domain blacklist gets updated faster than virus definitions do.
Stuff I did in the past I've given up on. Active protection software like Teatimer and Spyware Terminator are great for an expert-level user, but a novice is just going to click "Allow" on everything that pops up. Ditto for Firewalls that require user input.
What else can we tell people? What else can they do that doesn't involve becoming intimately familiar with the inner workings of their computers?
Or can we do nothing better than preparing them for the worst?
I may do a ton of business in spyware removals, but I'd rather it be from new clients. I hate nothing more than to have to go back onsite 2 months later to fix them because they got infected again.
They usually ask me after I've returned their formerly virus-ridden computer to them. A year ago, I'd have said frankly, "Stop browsing porn, clicking links in spam, and downloading music on Limewire."
But nowadays, you don't need to do that to get infected. The most common stuff I see, it seems like there are dozens of infection vectors. It gets in through compromised ad networks located on legitimate websites. It gets in through hacked websites that show up in the top 20, 10, even top 5 search results for common stuff on Google. They get in through legit-looking "ecard" emails, or infected PDF files.
Virus software constantly lags behind the threat. There's at least a 3 to 7 day Window on the vast majority of threats, and these malware mavens are constantly updating their software to avoid detection.
Tools like Virustotal don't just help us identify malware, they help the makers themselves make new strains that can't be detected. Every tool we have becomes a tool for them.
So what do you tell people? Do you tell them that Anti-virus software is the only band-aid they need, or that the Internet is a Typhoid Mary and the best you can do is reduce their risk marginally?
There's the obvious:
1. Run up-to-date Anti-virus. I think we all agree than almost anything is better than McAfee and Norton, even we'll argue which of our boutique products is the best until the cows come home.
2. Run spyware scans frequently and keep up to date.
3. Don't click on anything from popup ads, or download anything from an untrusted website.
4. Run Firefox, since the malicious domain blacklist gets updated faster than virus definitions do.
Stuff I did in the past I've given up on. Active protection software like Teatimer and Spyware Terminator are great for an expert-level user, but a novice is just going to click "Allow" on everything that pops up. Ditto for Firewalls that require user input.
What else can we tell people? What else can they do that doesn't involve becoming intimately familiar with the inner workings of their computers?
Or can we do nothing better than preparing them for the worst?
I may do a ton of business in spyware removals, but I'd rather it be from new clients. I hate nothing more than to have to go back onsite 2 months later to fix them because they got infected again.