Do you have any questions that I can help you with?
Cyber Self Defense
Note: The Information on this page is designed to assist you in understanding, and preventing infections, and exploits. However if you are already infected, and need access to the right tools to clean up the infection you should try the following link:
Advanced Cyber Self Defense! Be mindful that the tools listed in Advanced Cyber Self Defense are not for novice users
Cyber Self Defense!
Almost every clients I visit in person or online, asks the same questions: What happened? How did I get infected, and how can I prevent it from ever happening again?
My answers to these questions is usually followed by a roll of the eyes, and obvious signs of frustration. It is quite obvious how frustrated some have become with the burdens of computer security.
To put it simply, people want an "easy button" installed on their PC... Unfortunately a technology like it, that actually really works does not yet exist!
As a side note, if a simple anti virus, and anti spyware software solution worked properly to keep you safe, I would not be employed as a "Technical Janitor" cleaning up after infections, and struggling to mop up the mess they left behind! If you are serious about pre emptive security instead of hiring me to clean up after the fact, do yourself a favor, and read on...
While today's users are more computer literate they still remain for the vast majority, only but vaguely aware of the actual risks they face online, as well as what effective counter measures may be available to them.
Our computers allow for a wide range of tasks, from multimedia entertainment to gaming, education, and business. As a result, when users gradually become more comfortable with the technology, they do more, and expose themselves to greater risks while online with their home computers than in the past. Often while lacking adequate knowledge of appropriate security measures. Also many remain convinced that their antivirus is all they need to stay protected. This in turn allows hackers many opportunities to exploits those left vulnerable due to ignorance or complacency. All while online threats continue to increase in complexity and diversity.
The results are now becoming obvious. A rather large, global increase in web site installations used solely for the purposes of exploiting anyone vulnerable, such as installing exploits or hostile active X controls, or simply trying to distribute the latest Trojans or the ever more complex, and blurred distinction now broadly termed as malware.
As new breeds of well organized Cyber criminals now inject hacks via paid PPC advertising on popular web sites, and in search engine results, and control computer zombies to broadcast massive amount of SPAM distracting home, and business users alike, not to mention the varied types of hackers who control huge Bot networks, and cost online businesses massive losses.
The effort of those trying to breach our defenses by exploiting the multitudes of vulnerabilities discovered almost daily are relentless. The job of securing one's system active on the Internet is by no means simple. Anyone who claims otherwise is either misguided or misleading.
These facts alone should motivate today's online computer users to really keep focused, sharp and alert on all matters related to computers, and online security, and not simply mindlessly delegate to a single product or a single company's line of products.
I believe that brand loyalty in this case can often prove counter productive as developers tend to downplay vital weaknesses in their product, and much too often chose to over hype useless features that actually provide little real security benefit to end users while they use far too many system resources slowing everything down.
Currently the best approach is to use multiple layers in our approach to securing the computer. Each layer covering a specific or small group of attack vectors. Also using the right specialized tool or utility covering a specific known threat vector is far superior in my opinion than a huge software suite trying to do it all, as large suite have a tendency to cause problems and usually fail in the end as criminal types eventually figure out it's weakness and successfully bypass its defenses...
Instead I would strongly recommend users take full control of their security, educate themselves, and consider a multi layered approach such as we describe here, and to not only once, but at regular intervals research, re asses, and over haul their existing setup for optimal benefit.
Following I have included in point blank what I think is currently the preferable security protocol to follow. By the way for those curious to know why I am able to connect to infected systems and clean them up without getting infected myself, it is simply that I actually am practicing what I preach and use these on my own systems...
We recommend our clients implement the following: Note: More Info on tools recommended here are available in: Anti Exploit Resources
You should begin by seeking to harden your setup. Upgrade the Windows default firewall with a firewall like Outpost Free v1.0, and use a H.I.P.S. or Host Intrusion Protection System like PREVX or Threatfire . These are usually able to protect against the sophisticated malware missed by anti virus and anti spyware software. A note of caution on HIPS: They are far superior as an anti malware than Antivirus and anti spyware as they can block any executable from, well... Executing. However they do require some user intelligence, in making decisions on events taking place within the system which in some cases can prove somewhat difficult for less technically apt users... However H.I.P.S. are among the preferable defenses for those who really like to be "In Control" and want to lock down their system against intrusions of any kind... Also they are usually designed to work with your Firewall, Antivirus & Anti spyware software so they all complement each other. The short learning curve required to use them effectively is well worth the effort.
Also Important is to use protection such as the "Current Best" Anti Virus, and Anti Spyware. You can ascertain this by doing the appropriate product research yearly. We currently recommend NOD 32 v.3.0 and AVG Antivirus Freeas the best choice. Always suspect those who say to disable or remove such security for any reasons.
Do not purchase the "Continued or extended" update period to your anti virus products. Instead purchase the entire product upgrade, and uninstall the previous version and then install their latest one. This guarantees you have the latest scanning engine, and not only access to the latest database only. New engines offer new features, and functionality not found in earlier generation. Thus increasing effective defenses instead of extending the life of already obsolete ones.
If your anti virus or anti spyware software fails you, which happens rather often, we, and other professional technical support firms provide well... "professional " remote cleaning services. It is better to pay for a service such as this than loosing all or some of your data, and productivity which can cost just as much. One caveat however, when using such a service, confirm the company "and" the "expert" is well qualified, and located within the United States, Canada or Britain as many "Foreign Interests" lurk for unfeathered remote access to your personal, and business data as gaining full remote access is incredibly valuable to them and for obvious reasons. Using local isn't fool proof but at least there are legal (Criminal, and civil) remedies available in the advent of bad behavior in the part of the service provider. Also be very concerned when companies offer to gain access to your computer, and "Clean" things for free. No self respecting business would offer such a service for free...
The next logical step to protect yourselves should be to inspect your operating system, and other installed software for insecure versions, and for missing security updates. Keep in mind Microsoft products are not the only weak links in your setup. So the windows system update feature is not the only tool you should depend upon, Scan for other applications as well. You must do this regularly due to the ever changing state of software. Our favorite tools are the Secunia software Inspector and the filehippo.comUpdate checker. These tools are free, simple and very useful.
Never trust email attachments just because they came from someone you know. Scan all file attachments for viruses. When in doubt scan them at virustotal.com as well. Data file extensions are usually safe however you should instantly suspect attachments with file names that end in .exe .bat .vbs .jvs .src .com (or any other program extensions) when in doubt contact the sender to confirm he/she actually sent the file in question.
Keep all your important document inside Time Lapsed Encrypted Containers. Use strong encryption and make sure the container is set to close itself when not in use. Set the timer to 15 Min. Containers can be over 25 gigs in most decent products, and once shut, even if a creep cracks your firewall and browse around they cant read the data. We currently recomend softwinter Sentry 2020
Use a password manager that allows you to use multiple login name and passwords, together with secured form filling. We recommend Roboform . Never use the same login name and password for every site you log on. Always use strong passwords something that looks like this: sZT7uRpDO42 (56bitstrength) as a rule, and automate the task whenever possible to reduce errors. Also if you keep passwords in a file make sure it's encrypted and not just password protected. Never use common names and words as passwords. They are far too easy to crack. Do not keep your passwords on sticky notes stuck to your monitor.
Use Firefox for your web browser and keep it up to date. Also Install a few add ons to kill scripts as most cross server exploit are installed on your system using scripts interpreted by your web browser. The NoScript Add on is a Free premium security tool that will allow you to dynamically select which scripts can, and cant run in your web browser in individual web sites.
Always Scan URL links to web sites you do not recognise before you click them to inspect them for exploits. Check them against a database of known hack sites whenever possible. Be most specially careful when doing Yahoo or Google searches, since many of the returned results look safe but are in fact sites designed with a hack for the sole purpose of infecting unprotected visitors. Also clicking on adds in search engine returns is often the infection vector. Many cyber criminal pay unsuspecting web site owners to host ads leading to sites infected with exploits. Several Free Browser based link scanners are available to do this. McAfee SiteAdvisor & Linkscanner Pro work as an effective early warning system against many of those and we strongly recommend using them. Browser Defender is also currently under development and looks promising.
Install a good anti key logger or some type of Scrambler, as it will help prevent hackers getting your passwords using sophisticated keyloggers. Crooks love to install tools that monitor your keyboard and allows them to view exactly what you are yourself viewing on your own monitor while they remain undetected. We currently recommend KeyScrambler Personal it is Free, a simple yet powerful Key logger scrambler protection that works with your web browser and help prevent tools that intercepts keystrokes from working properly.
Install a good sandbox software, Sandboxie is our first choice It is not free but it's a simple nag-screen shareware, as in wait 4 seconds before it loads to save $25.00. (Please do register it if you can) Run your web browsing sessions from within the sandbox, as this will allow you to undo any, and all changes taking place within the sandbox at will. Most viruses opening in a sandbox cant infect other parts of your system as they are contained within the sandbox and are dead on next reboot... Also most cross server scripting type of infection, should also be ineffective, and fail to work. Just delete the sandbox and recreate a new one every day... Each time you load your browser all changes made to it by hacks are replaced by a clean fresh session. It takes only a few minutes each day but it will save hours in recovery time, and dramatically reduce your risks of infections.
On all Internet downloads you should always seek and use the provided file MD5 & SHA1 Ash codes to verify if the file was tampered by someone other than the actual creator of the file whenever they are available, and before trying to run the program. Never assume the file is clean because of branding. or rely blindly on your own anti virus software since none can detect 100% of all viruses. When in doubt scan the file at virustotal.com It's not perfect but it is far more reliable than any single anti virus software available on the market for single file scans. Better be safe than sorry!
Disconnect or turn off your microphone when not actually in use. There are some who have reported finding tools that monitor sound input on sound cards in order to listen to private conversations during meetings in offices, and even at home. Unfortunately I am unaware of security software designed to scan, detect and block these. The only available defense is simply to disconnect the microphone or turn it off. Also keep in mind that many devices such as web cams, and VOIP phones do not require your sound card to operate the microphone integrated within the device as they often have a built in sound driver as well. As a result they can also be tapped, and used to listen to all, and any conversation taking place within the room where the computer is located. If in doubt you look for unexplained data streams, and investigate all unexplained connection to your pc. Disabling those devices own drivers at software level from the device manager control panel or physically disconnecting them when not in use may be the simplest way to control this potential problem.
Backup Regularly. But when you backup encrypt it, and password protect it. Often the easiest way to experience a breach of security is simply for someone to steal a CD or tape packed with unencrypted backups. What could be more convenient than to have someone backup the entire content of a company's private data, and keep it nice and available on the desk clearly Advertised as "Backup". I have seen this in so many offices it's hilarious! Often with the password on a yellow sticky stuck to the disk or written on the CD itself!
If you think your computer has programs secretly connecting to sites on the Internet, or perhaps you would like to figure out why your computer is inexplicably slowing down. You can use Netstat to investigate.
Type CMD in Windows "Run Box" (click on "Start" then "Run")
Type "netstat -b 5 > netscope.txt and press enter key.
After a few minutes, press Ctrl+C
Type netscope.txt on the command line to open the log file in Notepad
This netscope.txt file will have a record of everything that has made an Internet connection in the last couple of minutes; you can then check your task manager to find out where it is and take care of it.
or you can also use the Free yet powerful, and increadibly simple but effective TCP-View End point viewer from Systeminternals.com
TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, NT, 2000 and XP TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.
All the tools mentioned above actually play nice with each other and with your existing security tools. So you can use them without worry...
Attention!
Probably the single most important skill anyone should learn on a computer is to recognize legit processes from rogue ones running in live memory. Also everything from default Windows services to Spyware must be invoked from somewhere on your hard disk, or pulled from the Internet, and loaded into memory in order to run. Identifying these key areas is also important.
Several tools have been developed to provide visibility, and user access control on all registry loaders, and the many other program startup and invocation methods. The best tools also provide access to Google search, and have their own database of process, and services combined with a rating system to assist you in making better decisions.
As with all things we also have our favorites, and in this case I use two very powerful tools. Both Free! RunScanner is my personal choice and is a powerful tool to identify rogue processes, and kill them right in their original loader location. It also offers an online analysis tool, and it can easily push suspected files to virustotal.com for a quick scan or check MD5' ashes at several security sites, saving us a lot of time, and it sure helps a lot with the guess work. This powerful tool also provides the ability for our clients to pass on the scans to us for further analysis. We love this tool!
Get RunScanner from http://www.Runscanner.net
RunScanner is a freeware windows system utility which scans your system for all configured running programs, and autostart locations.
You can use runscanner to detect autostart programs, spyware, adware, homepage hijackers, unverified drivers and other problems. You can import and export your results and let other people help you to solve your problems.
The other tool we like is Autoruns from systeminternals.com
This utility, which claim it has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond the MSConfig utility bundled with Windows Me and XP.
Woaaa.... Now You Know Cyber Kung Fu!
Note: No hamsters was harmed in the making of this web site! His kung Fu is strong!
You should also read our other security articles (Some overlap exists but it's good read)
DISCLAIMER: It is assumed that users are familiar with the operating system they are using, and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.
Browse the Web Safely!
Skype = Hermes.Computers
Get Expert Technical Help When You Need it Wherever You Are
If our Toll Free number is unavailable in your area, simply click on our "Call Back" Button when visible just above, or E-mail us, and request us to call You back at our expense.
or Try the Free International SKYPE to SKYPE Call with SKYPE Now! Operators available!
hermes.computers
live.tech.support
live.computer.help
hermes.computers.usha
Don't have Skype? Want to call us right from within your own Web Browser!
Then Click Here!
Application Vulnerability Audit
Important Perform Applications Vulnerability Assessment
Most computer systems have many programs with exploitable vulnerabilities installed...
Get the Insecure or End of Life Application programs, patched before they can be exploited by the bad guys...
