Guide T2W - Security and Virus Information

There have been a number of postings recently concentrating quite heavily on the on-line security, virus/trojan area, and as such I have decided to start another "sticky" thread which gives links to the most up-to-date Virus checks, virus information, etc.

I know some of this is covered in both the First Steps Guide and the Techies Corner guide, but it might be more easily accessed here.

I will try to keep this updated regularly. However, if I have missed something or you know of an update or product that is not on here that you feel merits a mention, please let me know.

Thanks to ilia king for the suggestion, and of course Oatman for his tireless efforts in unearthing all this stuff, and keeping me and this thread updated!

1. Virus Related Links
2. Spyware Related Links
3. Firewall Related Links
4. Windows Startup Information
5. Other PC Problems



-------------------------------------

Gibson Research – Internet Security Site
AVG- Free AntiVirus Download
AntiVir -Free AntiVirus Download
Avast Anti Virus - Free AntiVirus Download
Ewido Anti Virus - More Free AV software.
TrendMicro Housecall - Online Virus Scanning
Trojan Online Virus Scan
Pandasoft - Online Virus Scan
RAV AntiVirus - Online Scan
McAfee FreeScan
McAfee AVERT Stinger - NOT to be used as a substitute for virus software - Updated!
Security Updates Calendar




-------------------------------------

Ad Aware SE – Free Spyware Detector- New Version!
Spybot Search & Destroy - Latest Version
Javacool - Spyware Blocker & Spyware Guard - New Version!
Doxdesk - Browser Parasite Remedies / Removal Instructions
ActiveX Spyware / Adware Scanning
WinPatrol- Keeps an eye on your PC settings, and warns when new programs are installed
Pest Patrol- Descriptions of Pestware/Adware
Pest Patrol - Online Scan
Kephyr - Database and Scanning
Bogus Spyware - A list of what NOT to install
More Bogus Spyware
PC Pitstop Spyware Effectiveness Report - An impartial report on the effectiveness of all the anti-spyware programs around.


-------------------------------------

Excellent Firewall Descriptions and Downloads
ZoneLabs - ZoneAlarm free, excellent Firewall
Sygate Firewall - again, an excellent Firewall.
Agnitum Outpost Free Firewall - not all that effective imo.
Free Firewall Information


Its worth testing all Firewalls with the facilities available at GRC - Shields Up!.

Due to some firewall issues of my own recently, I've gone through a number of installations and tested a variety of firewalls this weekend, at the following test sites:

Audit My PC
Gibson Research
Symantec Security Test
PC Pitstop
Hacker Whacker

One notable thing that has come out of the testing is this. No matter what firewall or AV software you are using, the Symantec site will no doubt tell you that a) your firewall responds to a ping request, b) port 22 is open c) port 80 is open and d) you have no AV software. I suspect this is somewhat of a marketing ploy on Symantec's part, and that the only circumstances under which this would be different are if they detect that you are using thier own Firewall/AV software. All the other sites give identical results on the testing.

The results of the firewalls themselves have been varied and quite interesting. The following free firewalls have performed well :

ZoneAlarm - under testing, shows all ports as "stealth", and does not leak.

Sygate Personal Firewall- like ZoneAlarm, shows all ports as stealthed, does not respond to GRC's Leak Test.

Windows XP Firewall - This was my biggest surprise - shows total stealth under all independant scans, but agan fails the Leak Test. GRC verifies that the standard Windows XP firewall is effective from the outside, but does not manage outbound connections at all.

Kerio Free Firewall - Shows all ports except 1025 as being "stealth", but failed Leak Test.


However, in my own unprofessional opinion, the firewalls listed below are not worth installing, as they perform poorly under all conditions:

WyvernWorks Firewall
Bartware Personal Firewall
Agnitum Outpost Firewall

In order to test the performance of these three firewalls, I ran the test at the companies above both with and without a firewall operating. The differences in testing between the two are not worth worrying about. If you run WyvernWorks, Bartware or Agnitum, you may as well switch it off - its that ineffective.




-------------------------------------

Want to check what all the little programs are that Windows loads at startup? Here's the definative glossary.

Windows Startup Online



--------------------------------------

PC Pitstop - PC Testing for reliability, performance, etc
Gibson Research - Firewall Testing, Popup testing, etc
Audit My PC - More PC Testing
Hacker Watch - Port Testing, etc
Tune XP - Excellent piece of kit for WinXP users. Speeds up page loading, boot times etc. Freeware.


EDITORS NOTE : All the programs and links suggested above are given in good faith. Neither T2W nor its members can be held responsible if you damage your system, accidentally remove important files or fail to detect Viruses, Adware, Pestware or intrusions into your own internet or network security as a result of these recommendations. It is your responsibility to check for updates to your software regularly and maintain your own hardware.

Thanks Rossorod for this thread.

May I ask members how often they run various tests and what they run. Is it necessary to run something daily?-minimum what?My computer is on broadband and on all the time. Please suggest what should be my daily/weekly/monthly routine.Thanks.

Personally I run a virus test and an adware test once at the beginning of each day, having downloaded any overnight updates. My firewall is configured to automatically check for updates.

I wouldnt say once a day is too much - set up Task Scheduler to run the test automatically at a time of day when you know you wont be busy, or run them whilst you make a cup of tea .

Also important to remember to run defrags regularly.

I update and run my virus check at 6am every morning.

I use to have 2 virus checkers, one for on demand, one for on access. At the time I worked for NAI (aka Dr Solomons and McAfee). And found that if a virus got past the On Access scanner the On demand scanner usually caught it. The reason for this was at the time 100% of in the wild virus were only caught by any single virus checker 2 months in the year meaning you put yourself at risk for the other 10 months while the virus checker catches up.

osho, run one of the online scans when you're bored.
Check for updates twice daily on your AV.
Ad-aware can update twice daily, the others not so often.

Thanks for the info.
At least THAT ones not out to get me.
As if the market wasn't enough of a problem.
I,ve downloaded Adaware as well. All that found was some low risk items, which I think from the descriptions are actually useful.
Or should I get rid of them anyway?

There is one cookie parked in the system that I can't bear to part with.
It's the one for the metoffice aviation forecast site. The problem is finding which one it is so that I can delete the rest.
I think the AIS Notam site also use a cookie to save re-registering every time.
You see my dilema.

Delete them all then go to that site. You should get one cookie.


or try this http://www.karenware.com/powertools/ptcookie.asp

as a matter of interest, is it fair to suggest that W95 is now safe from these latest viruses because of its different architecture ?
i.e 16bit

Safer maybe, but a quick check revealed this http://securityresponse.symantec.com/avcenter/venc/data/w32.arcam.html
You just can't afford not be up to date.

oatman said:

try this http://www.karenware.com/powertools/ptcookie.asp

Click to expand...

Excellent looking site oatman, just downloaded about 10 'power toys'!

I was going to ask where you find the time to look for them, but from the time you posted, I can see you don't sleep. :cheesy:

Thanks, Oatman.

Have today added results of testing several firewalls due to some firewall issues of my own this week.

Look under the "firewall" section for results. Feedback/comments welcome.

I've run the Symantec security and AV checks. I'm completely stealthed and clean as a whistle :cheesy:
I'm running Sygate and Antivir, both free versions.

Thats interesting Oatman - I run the same AV and firewall as you, yet Symantec showed the ports I've listed in the guide as being open, and says I have no AV software installed. Odd.

Rosso, here's another AV etc programme. It looks OK but I don't of anyone who's used it yet.
http://www.ewido.net/en/
Have a look. I think the other anti troj and spyware progs that we use probably take care of the extras it offers.

SpyBot-Search & Destroy 1.3 Final

http://www.majorgeeks.com/download2471.html

Internet security

There are various free spyware removers such as Ad-aware, however have found that Norton Internet Security 2004 (£18 on E-bay) makes your computer invisible on the web and as a result I have no attacks by Trojan viruses and no spy ware. The most important thing is to get software that keeps up to date, which Norton does everytime you log on.

Actually, Norton gets a bit of a slating in some reviews. The free ones are just as good .

Rosso, here's another rogue spyware list. I don't know whether you want to replace the one listed here or just add this. http://www.spywarewarrior.com/rogue_anti-spyware.htm
Cheers