5/13/10
In the aftermath of the recent attacks on my site, and reports of other high profile sites that have been compromised, I felt that it might be helpful if I put together a checklist of useful tips to help visitors protect their own computers from "Rogue" malware infections (viruses, trojans, keyloggers, rootkits, spyware, adware, etc.) which are designed to assault you with pop-ups, steal your passwords, compromise your personal information, crash your computer or just take over your entire system. A lot of this information should be common sense for most people by now, but a few of these techniques may be new to some of you.
I firmly believe in the concept of "layered security", which is the practice of employing various defensive measures to protect your computer systems. It isn't good enough to just run anti-virus and think you're safe. There are various ways to get around a single line of defense, so I recommend following most, if not all, of the steps listed below to keep your computers and data safe and secure.
- Keep your computer updated - Make sure that your operating system and all of your applications are always updated with the latest security patches. Use autoupdate features whenever possible to keep your computer constantly updated. Periodically, you should manually check for the presence of important updates to make sure that they're being properly installed.
- Use a current anti-virus/anti-malware program - Always use a current anti-virus/anti-malware program to protect your computer, making sure that it's set to scan in the background, frequently update scan definitions and perform scans daily. People will often use the default anti-virus that came with their computer until the trial license runs out, and never bother to update the scan definitions or install any other programs to replace it. Uninstall that defunct anti-virus and replace it with a current anti-virus/anti-malware program. Also, never try to run multiple anti-virus programs at the same time, as that will only create system conflicts, causing your computer to be even less secure.
- Use a dedicated software firewall - Install a dedicated software firewall to block anything that might try to slip past your defenses. The default firewall that comes with Windows isn't nearly as effective as other dedicated firewall programs. Also, make sure to diable the Windows firewall once you've replaced it with a better firewall program. If you're worried about the performance impact that will result from installing some of these programs on your system, then you may want to check out my recommendations for upgrading your computer. You can find several recommended firewall programs listed further below.
- Avoid installing or running unsafe or unknown applications - Unsafe applications that you should generally avoid installing include peer-to-peer filesharing programs, browser "helpers" and any program that claims to make your computer or web browser run faster or "fix" your computer in some way. Also, be wary of security software that you don't recognize. If you ever see any pop-ups stating that some unknown program is trying to scan or clean your system, or do anything you don't trust, click the "X" in the top right corner to close it immediately. Newer types of malware pretend to be applications that will clean or protect your system when in fact they are malware themselves.
- Use strong passwords - Your accounts are only as safe as your weakest password. If your computer is ever infected with malicious software, you should immediately update the passwords to all of your online accounts (e-mail, banking, social sites, etc.) from a safe computer. Make sure that your passwords are sufficiently complex (8+ chars, mixture of upper case, lower case, numbers and symbols) but easy enough to memorize. Try not to use the same username/password combinations on each of your accounts so if one account is hacked it won't lead to others getting compromised. Permanently delete all "password change e-mails" you receive (past, present and future), as they can expose your other accounts if your e-mail is hacked. Some attackers have been known to re-open previously closed e-mail accounts belonging to victims in an effort to receive automatically generated password change e-mails, so review your accounts for e-mail notice settings. Also, check your "password reminder" or "forgotten password hints" settings for each of your accounts as they may contain easily guessable information that can be harvested from social sites (favorite food, high school, etc.)
- Practice safe web browsing - I recommend using Firefox + NoScript for general browsing. NoScript has often been referred to as a "condom for the internet". When visiting sites using NoScript, all script-based elements will be blocked. If you trust a site and want to enable scripts, just click the "S" icon in the bottom right corner of your browser and select the script or scripts you want to allow (temporarily or permanently). NoScript saved my computer from being infected by my own website the very morning it was hacked the first time when it warned me of a new, unknown script that had been injected into the site.
- Use safe site checkers on unknown sites - If you're ever unsure of a website, just copy and paste the site's URL into the search box of one or more dedicated "safe site checkers" (see below) to find out if it's safe or not.
Listed below are security tools, most of them free, that I recommend for use in protecting your computer from malware:
ANTI-VIRUS
Highly rated, free anti-virus programs as determined by AV-Comparatives.org:
Microsoft Security Essentials
AVG Anti-Virus Free Edition
avast! Free Antivirus
Avira AntiVir
FIREWALLS
Highly rated, free firewall programs as determined by Matousec Proactive Security Challenge:
Comodo Internet Security
Online Armor Personal Firewall
Privatefirewall
Outpost Firewall Free
SAFE SITE CHECKERS
Norton Safeweb
McAfee Site Advisor
Web of Trust
MALWARE REMOVAL
Ad-Aware
Spybot Search & Destroy
Malwarebytes' Anti-Malware
