How much "protection" needs to be running all the time?

[louise]

I'm wondering whether it is ok not to keep an anti-spyware
program running all the time - seems like a lot of overhead.
I was running Spyware Doctor for a short time and it
seemed kind of intrusive and maybe over-zealous? Or is it
really just doing it's job?

I'm now running:

Nod32
Sygate Firewall Pro
Linksys router (have cable connection)

I run Adaware, Spybot and Spyware Doctor , alternating
programs, at least once a week.

Is this enough or do I really need to keep one of these
spyware programs running all the time?

TIA

Louise

 

[Jim Byrd]

Hi Louise - There isn't a really single simple answer to your question - it
depends on a number of variables including your OS, whether you keep it
updated with ALL critical hotfixes, which anti-malware programs you run on a
regular basis (you mentioned AdAware and SpyBot S&D which I certainly
recommend, although I would suggest running both of them at least weekly
rather than alternating - each can sometimes find things that the other
doesn't. However, there are a number of others that you can usefully run on
a regular basis such as A² Personal, here:
http://www.emsisoft.com/en/software/free/, and Stinger.exe, from the link on
this page: http://vil.nai.com/vil/stinger/, just to name a couple - there
are others.), which brower you use, what your surfing habits are, how you
handle your emal and with which client, how conscientious you are about
UPDATING things, etc. I would suggest that you take a look at my Blog,
Defending Your Machine, addy below in my Signature, especially doing some
reading of the references in the first section.

In the meantime the following, taken from that Blog's Preventive Measures
section identifies several essentially non-intrusive steps you can take
which will add substantial protection assuming you don't already employ
them. (It assumes that you're using a Microsoft OS and Internet Explorer):


PREVENTIVE MEASURES TO TAKE


? Next, courtesy of Mike Burgess, edited by me:

"--Recommended Minimum Security Settings--

Close ALL instances of IE and OE. In Control PanelInternet Options click on
the "Security" tab. Highlight the "Internet" icon, click "Custom Level". Set
the following:

1) "Download signed ActiveX scripts" = Prompt
2) "Download unsigned ActiveX scripts = Disable
3) "Initialize and script ActiveX not marked as safe" = Disable
4) "Installation of Desktop items" = Prompt
5) "Launching programs and files in a IFRAME" = Prompt (Added by JB - See
more below about this.)

Click on the "Content" tab, then click the "Publishers" button
Highlight and click "Remove" for any unknowns, then click OK

Click on the "Advanced" tab, then uncheck: "Install on demand (other)",
click Apply\OK

Prevent your "HomePage" setting from being Hijacked
http://www.mvps.org/winhelp2002/ietips.htm

Mike Burgess
Information isn't free if you can't find it!
http://www.mvps.org/winhelp2002/"

Note the Publisher setting - this vector is often overlooked. See here:
http://mvps.org/winhelp2002/restricted.htm#Setting

Then, from me:

Disable BOTH "Install on Demand" options on the IE6 Advanced tab. Disable
BOTH "Launch Programs and Files in an IFRAME" and "Navigate sub-frames
across different domains" in IE6SecurityInternetCustom Level in the Misc
section. (Be sure that you install hotfix 889293, also.)

Another set of not unreasonable (although much more severe) security setting
recommendations is available here:
http://www.infinisource.com/techfiles/surf-safe.html And here:
http://www.techbargains.com/hottips/hottip13/index.cfm Also, see here for a
comprehensive discussion of this (very highly recommended):
https://netfiles.uiuc.edu/ehowes/www/btw/ie/ie-opts.htm


? There's a reasonable test of your Browser's secuity here:

Jason Levine's Browser Security Tests
http://www.jasons-toolbox.com/BrowserSecurity/ and another extensive and
Recommended one here: http://bcheck.scanit.be/bcheck/


? You might want to consider installing Eric Howes' IESpyAds, SpywareBlaster
and SpywareGuard here to help prevent this kind of thing from happening in
the future:

IESPYAD - https://www.spywarewarrior.com/uiuc/resource.htm "IE-SPYAD adds a
long list of sites and domains associated with known advertisers, marketers,
and crapware pushers to the Restricted sites zone of Internet Explorer. Once
you merge this list of sites and domains into the Registry, the web sites
for these companies will not be able to use cookies, ActiveX controls, Java
applets, or scripting to compromise your privacy or your PC while you surf
the Net. Nor will they be able to use your browser to push unwanted pop-ups,
cookies, or auto-installing programs on your PC." Read carefully. Tutorial
here: http://www.bleepingcomputer.com/forums/tutorial53.html

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs, blocks spyware/tracking cookies, and restricts the actions of
potentially dangerous sites) (BTW, SpyWareBlaster is not memory resident ...
no CPU or memory load - but keep it UPDATED) The latest version as of this
writing will prevent installation or prevent the malware from running if it
is already installed, and, additionally, it provides information about and
fixit-links for a variety of parasites. Tutorial here:
http://www.bleepingcomputer.com/forums/tutorial49.html One additional
feature of SpywareBlaster is the ability to add your own supplemental Custom
Blocking CLSIDs. Some directions for manually adding these can be found
here: http://www.wilderssecurity.com/showthread.php?t=13684 A good source
for a pre-compiled list of these as well as directions for adding them can
be found here at dak's site: http://customblockinglist.cjb.net/ This list is
irregularly updated, so you should check on it ever-so-often or use the
ChangeDetection service, mentioned below.

IMPORTANT NOTE: A good additional source of preventive blocking for ActiveX
components is the Blocking List available here:
http://www.spywareguide.com/blockfile.php While smaller than the
SpywareBlaster list, it contains some different malware CLSIDs and appears
to be updated with new threats more frequently. Strongly Recommended as a
supplement to SpywareBlaster. Read all of the instructions in the Expert
package download carefully. You might want to consider using:
http://www.changedetection.com/monitor.html to monitor and notify you of
changes/updates to this list and/or to dak's Custom Blocking list (or other
programs, for that matter, including this Blog which is updated fairly
frequently).

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Tutorial here:
http://www.bleepingcomputer.com/forums/tutorial50.html

All three Very Highly Recommended


? IESPYAD and SpywareBlaster (and the other malware-ActiveX blocking lists)
are probably the best preventive tools currently available, expecially if
supplemented by using the Immunize function in SpyBot S&D and a good HOSTS
file (see next).


? Next, install and keep updated a good HOSTS file. It can help you avoid
most adware/malware. See here: http://www.mvps.org/winhelp2002/hosts.htm (Be
sure it's named/renamed HOSTS - all caps, no extension) Additional tutorials
here: http://www.spywarewarrior.com/viewtopic.php?t=410 (overview) and here:
http://www.bleepingcomputer.com/forums/tutorial51.html (detailed)


? Lastly, with regards to cookies: The following overview of the approach I
recommend is courtesy of Mel's Spyware Tools: XML-Menu for IE6 -
(http://www.spywarewarrior.com/uiuc/main.htm, click on IE6 Tools on website)

"This package contains a full menu of custom Import XML files that can be
used to manipulate IE6's handling of cookies in the Internet and Trusted
zones (the Privacy tab controls only the Internet zone). The files are
divided into three sets: one "short list" of recommended files, and two
"advanced" lists containing a wide range of possible Privacy configurations.
The ReadMe covers the basics of using custom XML Import files and details
all the files that are available. A .REG file that can be used to restore
the default Privacy tab settings is included."

This is the technique that I use and, while I do very infrequently have to
override on some sites that don't have a Privacy Policy in place, I've found
it almost infallible in stopping bad cookies (I use 1-e, BTW) FWIW, MVP Eric
Howes' site here: https://netfiles.uiuc.edu/ehowes/www/main-nf.htm is one of
the very best on the net with regard to anything having to do with security.
Very Highly Recommended.



Sorry for the long reply, but perhaps you'll find it helpful.

 

[Art]

I'm wondering whether it is ok not to keep an anti-spyware
program running all the time - seems like a lot of overhead.

Then practice safe hex and get rid of the stupid thing

I was running Spyware Doctor for a short time and it
seemed kind of intrusive and maybe over-zealous? Or is it
really just doing it's job?

I'm now running:

Nod32
Sygate Firewall Pro
Linksys router (have cable connection)

I run Adaware, Spybot and Spyware Doctor , alternating
programs, at least once a week.

Is this enough or do I really need to keep one of these
spyware programs running all the time?

You should be asking instead, "How does one get hit with spyware?"
You then correct your behaviour accordingly.

Many get hit by "driveby" spyware because they use IE
with activex and/or scripting enabled. The use of a alternate
browser such as Firefox for general browsing will practically
cut the risk to near zero. Such a Gecko based browser (or Opera)
should be set as the default browser because of clickable
links.

The other way people get hit is by indiscriminate installations
of software. In fact, some alleged anti-spyware contains
spyware There are some black lists and white lists that
are helpful in this regard, and it pays to be very careful
about what you install and/or allow to run. If you're a
freeware fanatic, you should follow alt.comp.freeware
and learn what apps others have black listed and white
listed.

Art
http://home.epix.net/~artnpeg

 

[Duane Arnold]

I'm wondering whether it is ok not to keep an anti-spyware program
running all the time - seems like a lot of overhead. I was running
Spyware Doctor for a short time and it seemed kind of intrusive and
maybe over-zealous? Or is it really just doing it's job?

I'm now running:

Nod32

I run NOD32.

Sygate Firewall Pro

I only use a PFW on the machine on the laptop while I am on the road.

Linksys router (have cable connection)

Are you using Wallwatcher (free) to watch inbound and outbound traffic
coming to and leaving the router?

I don't use a NAT router and use a FW appliance for the cable connection
at home and don't have any personal FW(s) running or the FW active on
the Linux machine behind the FW appliance.

I run Adaware, Spybot and Spyware Doctor , alternating programs, at
least once a week.

I one Adaware once in a blue Moon to remove cookies as that's all it's
ever done and the machine cannot be attacked by cookies. However, I do
use other tools like Active Ports, Process Explorer and review FW logs
to see what's happening.

Is this enough or do I really need to keep one of these spyware programs
running all the time?

If you're comfortable and happy with your situation, then you should do
what you think is best for your situation -- no one can do it for you.

Duane

 

[optikl]

I'm wondering whether it is ok not to keep an anti-spyware program
running all the time - seems like a lot of overhead. I was running
Spyware Doctor for a short time and it seemed kind of intrusive and
maybe over-zealous? Or is it really just doing it's job?

I'm now running:

Nod32
Sygate Firewall Pro
Linksys router (have cable connection)

I run Adaware, Spybot and Spyware Doctor , alternating programs, at
least once a week.

Is this enough or do I really need to keep one of these spyware programs
running all the time?

TIA

Louise

NOD32 can be configured to provide some protection against potentially
dangerous programs and scripts. That should cover most spyware.
Generally, the best approach is to run least possible number of security
programs all at the same time. Ask any Industrial Engineer about the
merits of introducing numerous variables all at the same time .

 

[optikl]

Sorry for the long reply, but perhaps you'll find it helpful.

Jim, I'm truly not trying to be argumentative, but some of your
recommendations are redundant (if everyone were to be implemented) and
seem like overkill to a degree. Clearly, some combination of them is a
very good idea, particularly your recommendations about controlling
active scripting.

 

[Jim Byrd]

Hi optikl - Thanks for the comments. I'd be interested in knowing just what
parts of what I posted you found redundant, if you wouldn't mind following
up. You can email me at: jrbyrd @ adelphia.net , if you would,
please.

 

[optikl]

Hi optikl - Thanks for the comments. I'd be interested in knowing just what
parts of what I posted you found redundant, if you wouldn't mind following
up. You can email me at: jrbyrd @ adelphia.net , if you would,
please.

Just my opinion, but IESpyAd and Javacool's Spyware Blaster basically
provide the same kind of protection. When you add a HOSTS file to the
mix, I'm just trying to see the real incremental benefit you get from
all 3. The problem I think I see with loading up on multiple,
overlapping security programs is that, like a patient who loads on on
multiple medications to control a problem, there's a sense that this
will solve the problem and minimizes any incentive to change behavior.

Spyware and other malware problems aren't like weeds. You treat weeds by
proactively administering preventative applications of chemicals. This
generally keeps them from showing their ugly heads. There is no
necessary behavior change you can make to keep from having a weed
problem, other than by administering preventative applications (perhaps
changes in mowing *might* help.

With malware, there are behavior changes you can make that are
optionally desirable to loading up your system with all kinds of
security applications. In the absence of any safe computing regimen,
loading up on security utilities gives users a false sense of security,
much like the high blood pressure patient who loads up on medication so
that they can keep eating chicken fried steak and Big Macs.

Maybe redundant was a poor choice of wording on my part. Maybe
superfluous would have been a better choice?

 

[Jim Byrd]

Hi Optikl - Thanks for replying. Just a couple or three comments.

First, IESpyAd and SpywareBlaster are totally different approaches to
malware. MVP Eric Howes' list essentially places known malware sites into
the Restricted Zone which still allows access but severly restricts the
activities possible there, while SpywareBlaster turns on the "kill" bit to
disable and/or prevent the installation of known malware ActiveX components
and is very definitely one of the very best proactive solutions currently
available. BOTH should definitely be used in my view, since there is NO
overlap in either function or content between them.

I'll agree that there is often some degree of overlap between IESpyAd and an
HOSTS file, the degree being determined by which particular blocking list
one uses for the HOSTS file. However, more importantly, there is also
usually considerable independence between them so that using both better
serves the naive user (who is my principle concern), particularly using Mike
Burgess' HOSTS file, here: http://www.mvps.org/winhelp2002/hosts.htm, IMO.
In addition, a well designed HOSTS file adds considerable protection against
Ad servers, etc. which IESpyAd in general does not (although Eric does
provide a version of a related list, Agnis, which can be used with AdShield
for ad blocking.)

FWIW, I agree with your sentiments regarding the need for responsible user
behaviors; however, that's something that the user must educate him/herself
about and take responsibility for - it can't really be imposed from outside
very successfully in my experience. The best I can do without the kind of
personal contact I have with my clients is to provide the links to the
appropriate learning materials in Section 1 of my Blog.

Thanks again for you comments, and I'd welcome any further thoughts you
might have that will help me make my Blog more useful to folks.

 

[rjtrembgeologist]

You absoluely have to run a virus program and have spyware or adaware
protection at all times. The problem with the programs you ae running
is that they are run and detect critters after they are on your
computer. You need to go to microsofts website and download and
install the Microsoft antispyware program. This program is really a
firewall that keeps things from intruding onto your computer in the
first place.

 

[louise]

Then practice safe hex and get rid of the stupid thing




You should be asking instead, "How does one get hit with spyware?"
You then correct your behaviour accordingly.

Many get hit by "driveby" spyware because they use IE
with activex and/or scripting enabled. The use of a alternate
browser such as Firefox for general browsing will practically
cut the risk to near zero. Such a Gecko based browser (or Opera)
should be set as the default browser because of clickable
links.

The other way people get hit is by indiscriminate installations
of software. In fact, some alleged anti-spyware contains
spyware There are some black lists and white lists that
are helpful in this regard, and it pays to be very careful
about what you install and/or allow to run. If you're a
freeware fanatic, you should follow alt.comp.freeware
and learn what apps others have black listed and white
listed.

Art
http://home.epix.net/~artnpeg

I do use Firefox about 90% of the time - some things just
wont run on it - thus the other 10%

One other person uses this machine who has very little
computer awareness and not much interest in learning. It's
bad enough that I had the IE icon so that this person can't
just casually open up IE because that's what he's used to
doing on his own machine Nevertheless, I can't control
everything.

I have to use Outlook for email. I have a good spam filter
and nothing gets opened without being recognized by me, or
at least thought about for a while..

I don't tend to go to questionable sites, but sometimes you
run into one while following search engine links etc. - it
does happen very occasionally.

I use very little freeware

Nevertheless, my system was completely crashed this summer
and I think it was a trojan - I don't know from where.
I've become much more "paranoid" since and I now use NOD32
and I do run the various spyware programs mentioned on a
much more frequent basis.

Louise

 

[louise]

NOD32 can be configured to provide some protection against potentially
dangerous programs and scripts. That should cover most spyware.
Generally, the best approach is to run least possible number of security
programs all at the same time. Ask any Industrial Engineer about the
merits of introducing numerous variables all at the same time .

I'd really appreciate it if you could let me know how to
configure NOD to gain that protection. The only thing I
recognize for that purpose is an option to use a list of
known websites containing only malicious files; I do have
that checked.

Are there other things?

TIA

Louise

 

[Beauregard T. Shagnasty]

You absoluely have to run a virus program and have spyware or adaware
protection at all times. >

Not really. Given some knowledge and common sense, you don't need to do
that.

The problem with the programs you ae running is that they are run and
detect critters after they are on your computer.

The object here is to practice safe hex and not allow them on your
computer in the first place.

You need to go to microsofts website and download and install the
Microsoft antispyware program. This program is really a firewall
that keeps things from intruding onto your computer in the first
place.

It's a firewall? <LOL> No, it is not a firewall.

 

[Ian Kenefick]

You absoluely have to run a virus program and have spyware or adaware
protection at all times.

I disagree. I think at this stage anti-virus programs should be renamed
antimalware program and include detection for non viral threats
including but not limited to - Spyware & Adware. Kaspersky do it,
Symantec do it, ESET do it, Bitdefender etc. do it. Anti-Spyware
standalone programs have no future I think. I know this ideology might
strike a few nerves... but I think this is the way it should be.

This program is really a
firewall that keeps things from intruding onto your computer in the
first place.

Yikes :-/ MS Antispyware is a standalone program for detecting malicious
software such as spyware. This is not a firewall!! Examples of a
firewall are: The one included with Windows XP SP2, Zonealarm, Sygate
(RIP), Sunbelt Kerio etc.

 

[Art]

I do use Firefox about 90% of the time - some things just
wont run on it - thus the other 10%

One other person uses this machine who has very little
computer awareness and not much interest in learning. It's
bad enough that I had the IE icon so that this person can't
just casually open up IE because that's what he's used to
doing on his own machine Nevertheless, I can't control
everything.

I have to use Outlook for email. I have a good spam filter
and nothing gets opened without being recognized by me, or
at least thought about for a while..

Why do you _have_ to use Outlook???

I don't tend to go to questionable sites, but sometimes you
run into one while following search engine links etc. - it
does happen very occasionally.

I use very little freeware

Nevertheless, my system was completely crashed this summer
and I think it was a trojan - I don't know from where.
I've become much more "paranoid" since and I now use NOD32
and I do run the various spyware programs mentioned on a
much more frequent basis.

Well, Louise, you know what happens when a irresponsible driver
is behind the wheel. I hope that person at least doesn't have
administrator rights. Limited rights can reduce damage.

I'm obviously not a fan of the various means used by some to
help improve a bad situation. People use block lists (which require
endless updating), and additional realtime protections of various
kinds. You can select from a variety of apps which will attempt
to block software installs. However, once malicious code gets
past your realtime av/Trojan scanner(s) all bets are off since
it can potentially do whatever it wants, including the disabling
of your second lines of defense (as well as your first lines).
Similarly, there are apps and modules which attempt to do a
variety of proactive defenses such as blocking buffer overruns
used by hackers, etc. (I'm thinking of Prevx here, for example).

If I had to administer a PC used by a irresponsible user, I'd
be inclined to purchase Kaspersky version 6 when it's available.
I have no facts I can present concerning the effectiveness
of its proactive modules. I know of no tests of any kind, good
or bad, which indictate its ability to block unknown malware
and spyware. I'm simply a KAV fan who has developed a high
regard for the reliability and effectiveness of their scanners
over the years, and I'd place bets that they aren't just
whistlin' Dixie with their new proactive modules. The only
facts I have are that their Beta v6 KAV is extremely
unobtrusive ... and that after the first scan of a main drive
it doesn't slow down my 1.6 ghz 256 RAM PC at all that I
noticed. I had no false alerts whatsover during my checks of
various v6 Betas. So it should meet your unobtrusiveness
requirement at least, while it still remains to be seen just
how effective it is for helping protect users from their
ignorance and stupidity ... which is really "mission impossible".
Just back up and backup and make sure you have a cloned
hard drive so you can recover from the inevitable easily

Art
http://home.epix.net/~artnpeg

 

[Duane Arnold]

You absoluely have to run a virus program and have spyware or adaware
protection at all times. The problem with the programs you ae running
is that they are run and detect critters after they are on your
computer. You need to go to microsofts website and download and
install the Microsoft antispyware program. This program is really a
firewall that keeps things from intruding onto your computer in the
first place.

What does a FW do?

http://www.firewall-software.com/firewall_faqs/what_does_firewall_do.html

Duane

 

[Shane]

I have to use Outlook for email. I have a good spam filter

Why do you _have_ to use Outlook???

Spambayes? It's the only reason I use Outlook. The filter works really
well - unfortunately it requires downloading everything first. The pop3
proxy version doesn't seem reliable, but the Outlook plug-in is excellent.

Shane

 

[Duane Arnold]

Spambayes? It's the only reason I use Outlook. The filter works really
well - unfortunately it requires downloading everything first. The pop3
proxy version doesn't seem reliable, but the Outlook plug-in is excellent.

Shane

With Pop3 Cleaner or Mailwasher, one doesn't have to download
everything and you can delete them at the pop3 server.

Duane

 

[Peter Seiler]

Duane Arnold - 29.01.2006 20:32 :

With Pop3 Cleaner or Mailwasher, one doesn't have to download
everything and you can delete them at the pop3 server.

SpamCombat

 

[optikl]

I'd really appreciate it if you could let me know how to configure NOD
to gain that protection. The only thing I recognize for that purpose is
an option to use a list of known websites containing only malicious
files; I do have that checked.

Are there other things?

TIA

Louise

Louise, do go to : http://www.wilderssecurity.com/showthread.php?t=37509
There's quite a bit of reading involved, but If you want or think you
need maximum protection follow Blackspear's advice.