Free Spyware: extinct?

[bigred]

You'll need more than one to get a serious mess cleaned up.

Not true. In fact you don't need any, necessarily.....friggin "Mirar" was the worst I'd ever seen and I got rid of it w/o any. Royal PITA though.

 

[bigred]

I usually find myself recommending Microsoft's Defender.

Thought I heard that was a beta version only.

Using a beta version of anything MS is scarier than any spyware.

 

[scribble]

It is possible to surf the net daily without ever having to run an anti-spyware program.

I've been doing so with four systems for months and months with no ill effects.

No spyware/adware, no viruses/trojans/worms,

Rhetorical question: how do you know?

It's rhetorical because there's only one possible answer. You don't. Even if you change your policy, install adware and virus scanners and run them, you STILL don't know.

Not all viruses cause visible performance degradation. The newest crop of viruses don't even run in your operating system... which means that you can run Norton or McAfee or your scanner of choice all year long and you'll never find it.

If you don't have any idea what I'm going on about, try a google search for virtual-machine or "vm"-based rootkits.

 

[nescafe]

Rhetorical question: how do you know?

Well, in my case, it is because I am really paranoid, and surf only with Firefox + Adblock + adblock settings I have been building for a couple of years now.

It's rhetorical because there's only one possible answer. You don't. Even if you change your policy, install adware and virus scanners and run them, you STILL don't know.

Using Linux as my primary OS for the last 7 years doesn't hurt either.

Not all viruses cause visible performance degradation. The newest crop of viruses don't even run in your operating system... which means that you can run Norton or McAfee or your scanner of choice all year long and you'll never find it.

Not exactly. One of my duties at work is to be the local expert for trojans, worms, viruses, spyware, etc. There are a couple that can run outside the OS, but they are proof-of-concept more than anything else -- most "uncleanable" malware uses kernelspace rootkits to cloak itself.
[/quote]

If you don't have any idea what I'm going on about, try a google search for virtual-machine or "vm"-based rootkits.

It is an interesting development, but still a proof-of-concept thing -- it looks fairly fragile.

 

[RayG]

Well, in my case, it is because I am really paranoid, and surf only with Firefox + Adblock + adblock settings I have been building for a couple of years now.


Using Linux as my primary OS for the last 7 years doesn't hurt either.


Not exactly. One of my duties at work is to be the local expert for trojans, worms, viruses, spyware, etc. There are a couple that can run outside the OS, but they are proof-of-concept more than anything else -- most "uncleanable" malware uses kernelspace rootkits to cloak itself.

It is an interesting development, but still a proof-of-concept thing -- it looks fairly fragile.

Beat me to it. Bought my first computer in 1982 and I've been playing with them ever since. My wife thinks I'm uber-paranoid when it comes to the computers. I presently have five computers connected to net, four of them 24/7, and my wife, myself, and our eight children use all four of the 24/7 systems. Four are XP systems, one is a Linux box. I run them all as limited user accounts, have the XP systems behind both software/hardware firewalls, have locked down IE on all XP systems (to the point it cannot access the net), I only open email attachments I have asked for, OE is not used on any of the systems, I don't engage in P2P networking, and basically I try to put that little spongy thing between my ears to good use when it comes to the computer.

It never ceases to amaze me the amount of spyware/adware/virus/trojan/worm problems people complain about on the geeky tech forums I visit. A few simple preventive measures, and most of those complaints would have been non-existent.

sribble: How do I know for certain I don't have some malicious tidbit hiding in the inner sanctums of my computer? I don't, though I'm reasonably certain there's nothing there. I do know all my systems run smoothly, any test HJT logs I run on the XP systems come back completely clean, and any malware wishing to install has to somehow grant itself administrative authority.

Any suggestions on how I might better lockdown my systems?

Also, please explain how an unauthorized vm-based rootkit can infiltrate my system and install the virtualization software to begin with.

There's a nice paper over here that goes into great depth about vm-based rootkits. Section 3.1, page 4, second paragraph, about the requirement for VMBR installation is especially interesting.

To install a VMBR on a computer, an attacker must first gain access to the system with sufficient privileges to modify the system boot sequence.

That seems to be saying no privileges = no access.

RayG