Gah! Need better anti-bug stuff

[Beirut]

I'm a freaking, man. I'm a freaking.

I have AVG 9.0 installed but my machine keeps getting redirected from a Google search to all these other useless "search sites' instead of the place I wanted straight through Google. And I'm getting ****** off.

I tried to get superantispyware but after I finally make it to the site and click on the free download, Google pops up saying the site is busted or something like that.

I used to run Ad-Aware and Spybot and AVG but this machine gets flipped around so much I don't know where that stuff went, and I think I had an AVG vs. Ad-Aware problem as well.

Happy to hear all suggestions. Thanks.

[Beskar]

Use another computer to get the software., using a USB stick.

Also, once you computer is fine, make sure your USB stick is clean, so you don't spread your virsuses and other things to peoples machines.

Also, if you got anything important backed up, you could always schelude a re-format and install.

[pevergreen]

SUPERantispyware
http://www.superantispyware.com/down...NTISPYWAREFREE

Free and good.

[Beirut]

SUPERantispyware
http://www.superantispyware.com/down...NTISPYWAREFREE

Free and good.

GRRRRR!

Google, in its infinite wisdom, has decided, reapetedly, that the DL page for that program is corrupt and closes it. Even when I use the Yahoo search engine and click to DL the file, Google, in it's infinite ****** wisdom, still decides that the page is corrupt and still closes it. I remember this happended the last time as well months ago.

I;m going to get mad and even.

[Xiahou]

What browser are you using?

[Whacker]

Stop using IE. IE is garbage.

Install Firefox, then install the Noscript and Adblock Plus plugins.

[Crazed Rabbit]

As in the other thread, my parent's desktop got fried by viruses recently, and then their laptop came under attack.

In both cases they used IE as their main browser. I heavily recommend Firefox 3.5 with Adblock plus and no script. I've used it since I made this computer and had no viruses.

Also, Antivir works well; it was right after my brother removed it from the start up processes that the desktop got infected. I use Spybot Search and Destroy as well.

Google, in its infinite wisdom, has decided, reapetedly, that the DL page for that program is corrupt and closes it.

It's not google, it's the virus, most likely.

CR

[Lemur]

It's not google, it's the virus, most likely.

Yup, the virus/malware has probably hijacked your Hosts file.

[CrossLOPER]

Avast and spybot search and destroy. You really don't need more...

[Sevis]

GRRRRR!

Google, in its infinite wisdom, has decided, reapetedly, that the DL page for that program is corrupt and closes it. Even when I use the Yahoo search engine and click to DL the file, Google, in it's infinite ****** wisdom, still decides that the page is corrupt and still closes it. I remember this happended the last time as well months ago.

I;m going to get mad and even.

Care to explain why you blame all your problems on Google?

[Beirut]

Care to explain why you blame all your problems on Google?

Because it's convenient and Google is easy to spell.

[Beirut]

Yup, the virus/malware has probably hijacked your Hosts file.

You just might be right. (You usually are.) Whatever is friggin' with my riggin' is not letting me DL superantispyware or update Ad-Aware or Spybot. I appear to be in the clutches of an evil madman.

Since our learned and most excellent members suggest a browser other than IE, which is of course what I use, how does one safely - meaning without killing myself or my software - change from IE to Firefox?

And is it easy to change over, or does it require a brain? Cause, you know...

[naut]

And is it easy to change over

Yep.

http://www.mozilla.com/en-US/firefox/personal.html

Download. It'll ask if you want copy your bookmarks etc, tick yes, install. Search for the add-ons Noscript and Ad-Block. Safety.

[pevergreen]

Yeah, thats a nasty one. Do it quick.

I had that problem earlier in the year, wouldnt let me access C drive (had to go into explorer, [delete your recycle bin in C:\ base]) or any antivirus stuff. I ended up reformatting.

[Beirut]

Well, I am Firefoxed.

Not that it helps, I'm still kazood up the wazoo and can't seem to update or install any new anti-virus stuff or Google straight to a page without running into endless useless search engine pages.

In any event, this is beyond what I'm prepared to deal with. This machine is a crazy conglomeration of my woman's French programs and my English ones, as well as having been subjected to my kids various live chat programs and online games, so I think it's time for The Big Flush. I was going to do it anyway, but this situation just seems to beg for it.

Aside from whether I should re-install XP or go for the newer W7, since I'm going to backup my stuff on an external HD, re-install some form of Win and then retrive my stuff, what is the ultimate Must have list of stuff I should install prior to retrieving my old stuff off the external HD (and inspecting it with)?

I'm guessing:

AVG 9.0 Free
Superantispyware
Spybot

Any other programs I should have or steps I should take?

Thanks for the help.

[Lemur]

I would definitely move to Win7.

[pevergreen]

Be careful, a virus (possibly the one you have) did the rounds through external USB devices, infected them, then everything they touched.

[Beirut]

Be careful, a virus (possibly the one you have) did the rounds through external USB devices, infected them, then everything they touched.

But if I scan everything I intend to reload (before reloading of course) with Spybot, Superantiyaddah-yaddah, and AVG 9, do ya think that will clear things out?

[pevergreen]

Not sure.

[Xiahou]

Just avoid backing up executables or configuration files. If you stick to things like documents, photos, ect, you're probably safer. Still- scanning them can't hurt.

[Sevis]

I would suggest getting an Ubuntu live-boot CD, booting from that, then inserting and formatting a USB (with gparted, it's fairly straightforward), before copying over whatever files you want to keep. For scanning, you can use either Avast! or ClamAV, they may even happen to be in the repositories.

All files with the extensions .jpg, .jpeg, .png, .gif, .mp3, .ogg, .mp4, .wma, .avi and .mkv are safe to copy over without scanning. I am not quite sure about .pdf - probably safe. .doc, .xls and .ppt, as well as any other Office files are possible to infect with various rather nasty scripts - either scan those, or open them in OpenOffice and save as .html (and hope that the translation borks the malware). .exes can generally be assumed to be infected, so I'd advise not taking those at all, even if scans show them as clean.

EDIT: Oh, and if your computer can run it, go for Win7.

[Beirut]

Thank you, all.

[Tellos Athenaios]

All files with the extensions .jpg, .jpeg, .png, .gif, .mp3, .ogg, .mp4, .wma, .avi and .mkv are safe to copy over without scanning. I am not quite sure about .pdf - probably safe. .doc, .xls and .ppt, as well as any other Office files are possible to infect with various rather nasty scripts - either scan those, or open them in OpenOffice and save as .html (and hope that the translation borks the malware). .exes can generally be assumed to be infected, so I'd advise not taking those at all, even if scans show them as clean.

I do not know where you got that idea from. But in short: it is wrong. First of all: many of those are container formats (thus: containing fairly arbitrary data by design). Secondly some of these formats (e.g. GIF) are actually a relatively well-known attack factor: these formats can act as a mask for download scripts for instance.

But even if the other 2 arguments are not a concern: by design a file on an NTFS partition contains an *arbitrary* amount of *arbitrary* data streams. You can access them socket-style: \\path\to\file:streamId. So it is the easiest thing in the world for a piece of malware to simply attach another, arbitrary data stream to given data.

This is the actual reason why it would indeed be a bad thing to copy DLL's or EXE files. Not because those file formats themselves are so insecure (indeed, these formats take more data-integrity precautions than most; embedding checksums for instance) but because these formats contain executable code -- which combined with the NTFS idea of a file means that it becomes possible to inject *executable* code in other files. A decent AV kit should check for such attached data streams though.

[Beirut]

So what, be it freeware or payware, is the uber-anti-virus/spyware program?

[Pannonian]

Out of interest, how does this site look to you?

[Beirut]

Out of interest, how does this site look to you?

6 on 6 good.

At least that's something.

[Sevis]

I do not know where you got that idea from. But in short: it is wrong. First of all: many of those are container formats (thus: containing fairly arbitrary data by design). Secondly some of these formats (e.g. GIF) are actually a relatively well-known attack factor: these formats can act as a mask for download scripts for instance.

But even if the other 2 arguments are not a concern: by design a file on an NTFS partition contains an *arbitrary* amount of *arbitrary* data streams. You can access them socket-style: \\path\to\file:streamId. So it is the easiest thing in the world for a piece of malware to simply attach another, arbitrary data stream to given data.

This is the actual reason why it would indeed be a bad thing to copy DLL's or EXE files. Not because those file formats themselves are so insecure (indeed, these formats take more data-integrity precautions than most; embedding checksums for instance) but because these formats contain executable code -- which combined with the NTFS idea of a file means that it becomes possible to inject *executable* code in other files. A decent AV kit should check for such attached data streams though.

The fact they are container formats - and thus they are supposed to contain arbitrary data - is a reason to consider them safe. They are not supposed to be executed under any conditions. A viewer that runs any sort of script from a .gif is highly insecure and should not be used, period.

I didn't know about the NTFS data streams (and I still see very little point in such a function), but what would trigger those streams? Are they opened at the same time as the main file (in which case, they can do as much damage as the file itself - thus, in the case of a .dll or .exe, lots, but none as a plain text), or must they be called separately? And, if they must indeed be called separately, what would call them on a freshly installed system?

EDIT: And would copying the files over to the tmpfs, before moving them over to a FAT32 not get rid of these streams? Does FAT32 even support them?

[Beirut]

Sevis,

Sounds like you have the tech-stuff down cold. What's the best anti-everything setup to have, freeware and/or payware, in your opinion?

[Sevis]

Beirut,

That's actually not really my field of specialisation, seeing as I've using things other than Windows for some time now. My general setup whenever I install XP to play games or whatnot is:

• Avast!
• Firefox
  
  • Adblock
  • NoScript
  • CookieSafe
• No flash

I am behind a router, which acts as a firewall, and I've not had any viruses with it for quite a while - however, this is with very sane browsing. Whether such a system could hold up to a stress-test is hard to say.

There is a method that I intend to try out next time I install, which works by "freezing" your files into the state they are, and only allowing the changes you want to actually be saved. For instance, any changes to .exe files can immediately be considered bad - those files just aren't meant to be modified.

[CrossLOPER]

• Avast!
• Firefox
  
  • Adblock
  • NoScript
  • CookieSafe
• No flash

Apart from CookieSafe, this is pretty much my set up. No flash is a bit annoying, but it has its uses. I can't imagine why people still use IE, let alone look at me like I'm a freak when I suggest Firefox.