Category: Compgeeky

It’s been my firm view that malware doesn’t infect folks’ computers. Folks infect their computers with malware as a result of laziness or carelessness.

Well, I still hold that view. Properly patched computers with up-to-date anti-malware from a well-respected anti-malware software vendor, operated by users who practice safe surfing and generally safe computing practices are… safe.

But folks get careless or lazy and don’t keep their OSes and applications up-to-date, don’t run regular full scans with their anti-malware, do visit “risky” sites (and don’t have or don’t pay attention to link scanning software), etc.

Recently two very (very) smart people I know did infect themselves with some malware by CLICKing on a popup “warning” that looked very much like a Microsoft Security Essentials window. One told me he thought as he clicked on it, “Oh, no! I shouldn’t have done that!” but by then it was too late. Took about an hour and a half to fully clean his system (only about 15 minutes on my part, since I could trust him to do the rest of the procedure himself, after having it lined out for him). The other person? Knew she’d infected herself and what she’d done to do so but had no clue how to extricate herself from the problem.

OK, I’m going to give some general Windows guidelines for avoiding infection from the kinds of fake anti-malware infectors these folks(and many less smart folks who had NO idea where or how they’d “been infected”) infected themselves with, and a couple of hints on manual fixes if you’ve gone ahead and infected yourself anyway:

1. No! Do NOT click on that warning! Not anywhere! No, don’t do it! Continue reading “Cutting Users a Slight Bit of Slack”

Adrian Kingsley-Hughes weighs in on The sorry state of antivirus software.

All the ideas in the article for improving anti-malware softwares are worthwhile. I’d disagree with his simplistic sneer at “experts” who tell folks they’re to blame for their own infestation of malware. Ed Bott’s problem mentioned in the article, as well as most of the otherwise smart folks whose systems I clean from time to time, is that he was simply not careful enough. Scheduling regular full scans, doing manual scans with different anti-malware softwares and even regular, scheduled times to visit respected online scanning services aren’t enough in today’s Windows computing world. Firefox and Internet Exploder–the two most common browsers–are sadly lacking as secure browsing platforms. Out-of-the-box, I’d not use either one as a browser. With add-ons, they can both become a bit more secure (a link scanner like AVGs, WOT, whatever), but even then, “smart folks” sometimes unthinkingly do risky things on the net. Both Chrome and Opera, as two examples, are more secure in a fresh install and can be made more secure with add-ons. A sandboxed browser is even better for protecting one’s computer during browsing–and sandboxing other internet applications isn’t a bad idea, either.

And those are just the surface things one can do to become more secure using a Windows computer. More important is developing commonsense habits that make one more secure. One habit I’ve mentioned already: NEVER neglect regular full scans with a well-respected, fully up-to-date anti-malware, etc. Another is mentioned in the article: keeping one’s system (and that doesn’t just mean the OS but also one’s applications) up to date, fully patched. Others are harder to get many–even “smart” users–to adopt.

Use secure passwords and change them on a regular basis. Sure, remembering a 16 to 64 character string of semi-randomized characters is hard for some folks, and typing them in all the time is cumbersome, but there are good utilities to save them in encrypted form and enter them given one master password. The better ones cost money, though, and some otherwise smart folks are too cheap to cough up for them.

And then there are the folks who unthinkingly simply CLICK through the security prompts in Windows Vista/7. *sigh* A Very Good Habit to develop is to STOP THAT!!! *heh*

View all emails in plain text mode. Seriously. Hard to get folks to do, but nowadays it’s just the smart thing to do.

NEVER install ANY application from ANYWHERE without FIRST manually scanning it with a well-respected, up-to-date anti-malware. No, never. Period. Is this simply paranoia? Probably, but I’ve not infected any of my own systems, yet, going all the way back to the DOS “stone age”. Have I been sent infected files by smart people? Yes. Even from some Very, Very Smart People. Installed them (or in any way let them be close to executed)? No.

Good hardware/software firewalls (on devices protected with strong passwords and data encryption), Regular Backups (!!!) and good general security habits are still just about all one needs, IMO, to be pretty darned safe. Is there room for improvement in security softwares and the Windows OS? Yes, and there always will be. Is the even more room for improvement in users’ habits? Yes. Always will be. Both of those things keep my pockets jingling. 🙂

…if that’s not entirely redundant. 😉

For a long time now, I’ve chosen passwords based on a topic-subtopic-specific, misspelled and then with added characters and numerals and upper/lowercase letters interspersed to make a word (preferably longer than 12 letters) or phrase sort-of-halfway-kinda resemble the original word or phrase in a manner that’s memorable to me.

Recently, though, somehow my gmail account became vulnerable despite what several online password checkers from reputable companies thought was a “strong password” so…

I’ve begun changing my passwords again, this time using lyrics to songs I know–some that are even “semi-unpublished” *heh*

Here’s the trick:

Write out (if you’re a little unsure of the lyrics) the lyrics to a song–the older and less likely to be common knowledge among the illiterati the better. Now, select the first letter of each word of the first (or second or third… ) verse. Assemble those into your “rough sketch” for a password. Now, in some way that makes sense to you–all the letters from the first half of the alphabet, all vowels, all “voiced” consonants, etc.–capitalize some of the letters. Substitute numbers for other letters. Add characters like “@!%#” at places within the string of letters in ways that make some loose sense to you.

I recently changed out my first (of more than a few) email passwords with a 40-character password devised this way. Yes, I have my passwords saved on hardcopy in place that’s accessible to family only, and yes I have them saved in an encrypted, password-protected zipped text file.

It’s not all that hard, and it beats putting your birth date or wedding anniversary on a sticky note slapped on your monitor… *heh* By quite a lil bit.

Oh, my computers’ passwords are considerably less complex, because

1. They’re in a fairly secure environment and
2. Anyone wanting to crack ’em can probably do so with Ophcrack or other tools, anyway.

If you want to be at least minimally responsible in your surfing but don’t want to put a lot of thought into it, here’s a quick lil tutorial on avoiding unsafe sites. The writer’s preferred solution, WOT, is better than not half bad, and with a javascript implementation, it’s even useful cross-platform and cross-browser. Here’s a WOT-enabled Google search on “free” (the red circle says, essentially, “Click this link only of you are really stupid”):

WOT’s not to like?