Yesterday I received an email from a reputable company which included the following statement:
“…new viruses and worms are being identified every day, a current anti-virus subscription is imperative to keep your computer clean of these threats… “
Really.
Ironically, we’ve had a number of PC’s over the last 15 years and none of them have had a current anti-virus (AV) subscription. In fact, none of them have ever had AV software installed on them. Nor have we had a virus on any of them. I’ve never considered it imperative.
A virus is just one type of malware. But, of all of the current flavours of malware, viruses are the easiest to avoid. Malware is the word created to refer to malicious software. Depending on who is classifying malware you might get a variety of types of malware. I’m going to divide malware into the following list:
- worm
- trojan horse
- adware
- spyware
- virus
Worm stands for Write Once Read Many. Worms rarely cause damage to systems. Generally, they copy themselves around. They get their name from the fact that after each is written to a system once it is copied many times to other systems (or to the same system). Almost all worms currently in circulation rely on security holes in Windows and/or instant messaging systems for windows (eg. ICQ, MSN Messenger, AIM).
A trojan horse is an innocent looking piece of software that has a hidden malicious component included in it. Most of the trojan horses I’ve had to deal with (personally and professionally) relied on worm methodologies to spread themselves.
If you have hi-speed internet, the simplest and surest method of preventing a worm implementation from finding your system is to install a router (~$30-50) between your computer and the internet. The router will connect to the internet and provides a firewall between your computer and the internet. Unless you reconfigure your router, your computer(s) cannot be accessed from the internet side and to a worm your computer(s) are invisible.
Adware and spyware are often lumped together into a single group because the most of it is authored by the same people. If they are writing both adware and spyware, why not combined the two purposes in a single program. In other words, most adware is also spyware.
If you have UBE‘s (Unexpected Browser Events) like homepage changes or random popups, it is likely that you have adware. It is adware that does the popup windows or url redirects. Adware existed before the current implementations of spyware. Spyware was created in hopes of making adware more effective. Spyware reports back to a server information on where you have browsed. This information is then used to target adware toward companies providing similar products or services to the ones you viewed (or to products or services which are statistically bought more often by people who bought things you looked at).
Last night, I took the liberty of saving the terms of use agreement for the MSN Toolbar. Here is an excerpt:
10. PERFORMANCE AND USAGE INFORMATION
Microsoft may automatically upload performance and usage information for evaluating the MSN Software and the MSN search services associated with it…
As part of their terms of use you have to agree to allow the toolbar to spy on you. Do MSN sites advertise? Yes they do. Do they try to target their advertising? Yes, they do.
To the best of my knowledge, all of the current spyware and adware has been written to work with Internet Explorer. There are 2 reasons for this. The most important is that IE is installed on the vast majority of computers that browse the internet. Secondly, IE allows extensions called Browser Helper Objects (BHOs). The thing is, once you’ve approved a BHO to be installed, you have also given the BHO permission to download and install ‘components’ that it ‘needs’ to function.
I recently cleaned a system that had over 70 of these ‘components’. The person who brought it to me said the popups were so bad that they couldn’t browse with it. The simple solution to adware and spyware is to use a browser other than IE. Spyware and Adware written for IE do not function in other browsers. The browser we use is FireFox (Open Source).
Finally, viruses need to be executed to infect a system. Most of the viruses being developed today rely on active content in email clients. If you use an email client that has active content enabled and you cannot disable the active content, uninstall it from your system. The email client we use is Thunderbird (also Open Source).
