Essential Security Tools

[glc]

With all the viruses, trojans, and hacks that are prevalent on the Internet today, I thought I would give my opinions on what is essential for proper security and protection. These suggestions are for Windows-based machines (9x, ME, NT, and 2K).

First of all, you need a quality antivirus program, and you need to keep it updated WEEKLY with new signature files. The commercial program that I prefer is Norton 2001, because it can be configured to real-time scan your e-mail as it is downloading (this applies to "standard" e-mail programs such as Outlook/Outlook Express, Netscape Messenger, Eudora, and Pegasus - it can NOT work real-time with AOL because that is a proprietary client). A good FREE choice is InoculateIT PE from http://antivirus.cai.com . There are other decent programs available, but (and remember, this is my OPINION) I do not care for McAfee at all. I have seen McAfee destabilize a system too many times. Whatever you use, set it to check files when downloaded, opened, accessed, whatever. This may slow down your system somewhat, but it's a tradeoff like everything else. If it has a scheduler, set it to do a full system scan weekly or more often.

Next, you need "Trojan Horse" protection. Antivirus programs are not very good at handling a lot of these. Trojans are programs that install themselves and allow someone to do nasty things with and to your machine remotely over the Internet. The best defense against these is "The Cleaner" from http://www.moosoft.com . It is a free 30 day trial, and to purchase is $29.95. It sits quietly in the background monitoring for Trojan behavior, and has a manual scanner and removal tool. This needs to be updated weekly also.

The last "tool" you need is a good personal firewall. There is only one out there that truly works, and it just happens to be FREE. That would be Zone Alarm from http://www.zonelabs.com . If you have networked machines, the free version has to have its security settings reduced to work properly, so Zone Alarm Pro at $39.95 is a better bet here. Without a firewall, your system is wide open to "denial of service" attacks, and can be controlled by a hacker to attack others - this is how they are bringing down the big sites.

You should visit "Windows Update" frequently, and download all "critical updates" that are available for your system. Most of these updates are security-related. If you are on a network, make sure to disable "file and print sharing" over the Internet connection, and use NetBEUI whenever possible for sharing over your LAN, as it is a non-routeable protocol.

The best site for security-related information written simply is Steve Gibson's site at http://grc.com .

[HAL9000]

I think I can back every choice there GLC. I ran McAfee for a couple of years and eventually switched to Norton. I find that Norton isn't nearly as much of a resource hog and since I run my computers 24/7, I let the Windows Scheduler check for updates EVERY night. This way, I KNOW I'm updated.

ZoneAlarm is awesome and free as well. If it's within budget, get a Linksys router, it's a real cool piect of equipment.

[Statica]

I don't like Norton one bit, nor am I a fan of MacAfee. I run Trend Micro's products on our servers as well as on desktop computers. As a server solution Trend Micro is fast becoming a force, with a large number of ISP's using it too.
As a desktop solution, Trend Micro's PCCillin leaves the least amt of footprint on a system, I compared it with Norton as well. That includes registry entries and unuseables.
They even have a very useful online scan tool.
And on dealing with in-the-wild virii, I've found that our PCCillin running comps get updates much faster than Norton sends em.
In other comparisons, the antivirus itself is $10 USD cheaper than Norton.
Pattern & Engine Updates are by itself wayy smaller than Norton [2.4MB vs ~800K].
And the most annoying of Norton, is that it is Symantec through and through - proprietary!

On another note, if your engines are old, Norton has a bad bug in the POP scan! That doubles as a vulnerability.

<HR>
To add to GLC's 'cellent writeup, I gotta add the following as the Zeroeth law perhaps [thermodynamics anyone?]

The first defense you have against virii, trojans, hacks etc etc are:
<B><FONT COLOR="Red" SIZE=+1>COMMON SENSE</B></FONT>
<LI>Avoid warez, crackz, gamez and other suspicious sites and software, it'll eventually catch up
<LI>If you have a doubt about something dont run it. If the email source was in fact addressed to you, or if your antivirus gave in a warning and you badly badly need that file, run it through at least 2 different anitivirii. No it doesnt mean having to buy them, there are a lot of options, like http://housecall.antivirus.com/ or simply forwarding the file as an attachment to a yahoo or hotmail email account and trying to download it from there.
<LI>Do not run any servers any longer than you need them, FTP Daemons etc etc, are easily taken down.
<LI>Do not respond to spam mail, its just a confirmation of your mailboxes' existence
<LI>Be aware of the risk that you entail with any gateway software. Anything that opens a port is potentially at risk, so try to read up whether the current version of the s/w u are running has any vulnerabilities that the developers are addressing. Good sites are aplenty starting from <A HREF="http://www.google.com/">Google</A> to <A HREF="http://packetstorm.securify.com">Packet Storm</A>
<LI>If you are a system administrator, download a port scanner and scan your ports yourself.
<LI>Do the simple things, like looking through preference menus of various software you may run.. for example if you have Yahoo, look in the preferences and say YES to Do not Reveal IP address. If you're using ICQ, set it to send messages through the server ALWAYS. Only chat with people you trust. [The reason being that if you sent even a msg through a direct connection, it takes longer PLUS invariably your IP is transmitted thru]
<LI>Always use a proxy server if you have a static IP, your ISP has a provision for it, not just for speed but also for concealing your internet identity.

Remember, software like antivirii, port blockers etc etc only go so far, ultimately it is usage trends that bring the system down.

Cheers

[Parangles]

I networked the 2 PCs at home, and installed a Linksys sr41 router to new roadrunner cable service on Monday.
By Wednesday the Napster Library on the machine attached to the router, had been filled with dozens of country and Western songs. Nothing on the 2nd unit which had Zone Alarm on it.
a) Is this a prank/hack? or just some glitch at Napster stemming from the new ISP/IP that came with the service?
( Previously on dial up with different server)
b)How can delete them? I get 'cannot be deleted' with every attempt.
I have not tried to 'play' these songs for fear I may weep,
and intend to back up some stuff before messing with them further.
c) Why did the router not protect it, with its supposed 'built in firewall'? I will put the Zone Alarm on it too.
d)I disabled my anti virus software as I was told that it destroys the hard drive.ie wears it out prematurely. Not true?

[Statica]

Have u tried checking the file attributes? If that doesnt work, make sure that the file is not currently under use aka being served out to someone else etc.
http://www.napster.com/help/win/faq/#lp-3

It doesnt sound like a hack, [Napster & hack are redundant], check your config settings.

[reboot]

Opinion time.
If you're running a firewall (Sygate or ZoneAlarm, I don't care for Black Ice), and you're using common sense (I know, oxymoron), don't download junk from crap overseas unknown sites (use C|Net or Tucows, a few others), you don't NEED any anti-virus program.
You can't get a virus from email if you use a text email client (In other words, get rid of Outlook!!!!!!), turn off MS scripting (that's the VBS stuff everyone is WAY too paranoid about) if you don't know what you're being sent, don't click on it!!!!!!!!!!!!!!!!!
Email trojans are infectious because when you get an attachment it's like a kid in a candy store, who just got his allowance. Resist the urge to see that "nakedteen.jpg" file you got sent, and you probably will never get a trojan.
As for having an anti-virus scanning web pages, it's a total waste of resources. A firewall should prevent any malicious attack embedded in java or HTML, so why are you running both?
I keep an anti-virus on my machine (InoculateIt), but ONLY open it, and scan downloads that may be suspicious. I don't use Outlook, just a text based email reader (Eudora Light 3.01) (You could use the new Eudora 5.2, but disable the "Use Microsoft Viewer" portion).
I don't believe in the "trade off" position. If I can't control my software (and hardware) I get rid of it, and get something I can control.
Norton (yes, anything by Norton), McAfee, Panda, PCcillin, and most others (that are NOT free, BTW) are junk. PCCillin being the best of the worst.
The absolute best protection is a Router. Once configured correctly, you don't need any other firewall.
The next best protection is removing your finger from the mouse button before you click on it.