Tuesday, August 10, 2010

Some steps to prevent PC virus and spyware.

Nothing is worst than spending a week or more getting rid of a virus. Install an anti-virus software, such as avast. See download.cnet.com for reviews of anti-virus software before downloading, since many are fake or are spyware. It is best to read the reviews of software by users, before downloading to a PC. If there is no review on the vendor site, then do a google search. Good sites for software reviews are download.cnet.com, brothersoft.com and nonags.com .

However, the best thing to do is to prevent virus and spyware.
1) Set cookies on your browser to 'always' prompt/ask. In the beginning, the notifications are a nuisance. However, if the browser remembers your 'safe' list, there won't be a notification when revisiting the site.
When you do this, then you'll be happy that you did. Because you'll see all the sites that have placed cookies on your PC, which take up computer disk space ... another issue. Sites that set cookies are not only the 'parent site', but also all the sites where the ads banners and the graphics are hosted. A big offender is doubleclick.net

2) Set the browser to not allow pop ups, therefore you can decide which sites to display. Again most browsers will have a white-list or exceptions list, so when revisiting the site, you won't be prompted in the future.

3) Use anti-spyware scanner, since it is different from a virus. A virus does actions, such as delete files. However anti-spy will log the user activity. Not all virus software will prevent spy ware. A recommended anti-spyware is MalwareBytes Anti-Spyware.

4) Run an analysis tool like Hijack This or Old Timer Listit, which list all types of inforamation such as programs running in the background such as services, tasks (run once) and start up programs, that may be hidden. Note caution DO NOT use the autofix, rather LOOK up the issue. Do your homework first before removing any entries(esp. registry) or files. Backup the registry (file->export) and create a restore point (start ->accessories->system, system restore , you will need administrative rights for this)


Note that preventing virus and spyware is not a one time deal. Just like dentist checkups are routine, the PC also needs checkups ....
1) Run the ms update monthly, to get the latest security updates. One way to do this, is by using the internet explorer->tools->windows update . Another way is to start->run then type without quotes "wupdmgr.exe –z –q"

2) Download the virus and spyware definitions weekly, if it is not automated. Only definitions are necessary, and not software updates. The definitions are always free and are updated within the software itself.

Tuesday, April 20, 2010

Recommended Weekly Cleanup Procedure

1- Update Virus Definitions. Note that this does not mean update software, but update the virus definitions. eg for some programs call these DAT files.

2- Update Anti Spyware definitions, again not the software but the spyware info.

3- Run system updates, to get security items, ignore other items for now(use custom always, since MS pushes updates for their office and live products). Note driver updates are not necessary unless issues are occurring , this should be last resort, especially if original disk to drivers is not to be found.
for Windows:
IE->tools->update
or Run->cmd, then type wuaucld.exe
or Run->cmd, services.msc , then for 'automatic updates' right click then select start

4- Clean Hard Drive
a) Clean Temp directories, in Windows use Disk cleanup, select 'my computer' then right click on 'C' drive in windows explorer, select 'properties' button, then on 'general' tab, under pie chart select 'disk cleanup'
b) For Internet files and cookies, do this by means of the web browser.

5- Clean Registry - must have admin rights
a) Backup First !!!!!!!
Run->cmd, then type 'regedit', then select File->Export, save this to c: drive and name it with date and time, so it's easy to find
b) use tool such as ccleaner or sbmav cleaner
c) if the changes are issues after reboot, just start in safe mode and start regedit(step a) and do file->import, and use the reg file from step b)

6- Run Full Virus scan, if takes long, then run in the evening when no one is using PC and won't be interrupted

7- Run Anti-spyware cleaner

Monthly
Review disk space usage, by using programs as:
tree size
tweak now-> disk usage analyzer
space sniffer
These will reveal directories that are taking up space or programs that are space hogs. However, use your discretion when deleting files in directories manually(delete button). If not sure....better to leave alone and get advice on a PC forum. Always use the uninstall programs with apps, since these will remove lingering registries settings.

Wednesday, January 06, 2010

How to filter ads from websites


How to filter ads from websites by creating a blacklist. Notes on how block by url/link, click on image to see full view to read notes. A major benefit with using host file vs plugins/addons etc is that it's global for the system. Where as a plugin for a browser is only valid for that browser specifically. Rather than update all browsers, host file applies to the entire PC and all software that access the internet .

Steps in, this example of chrome cache. However all cache displays show web addresses, this will be used for the host file.


Also, a hostfile manager program allows to update the host file using GUI, but also allows to enable and disable entries (good for testing)

Additionally, tcpview by sysinternals, displays the tcp addresses along with which app it's requesting from, which is good to see which ip addresses are using your PC.

For MAC, the host file editing , shown here http://decoding.wordpress.com/2009/04/06/how-to-edit-the-hosts-file-in-mac-os-x-leopard/

Use whois xyz.com at google search, to determine if the site is actually a pest. Note that many sites use other sites to store their data to decrease their traffic so that their servers are not brought down by overload.

TO TEST THAT THE HOST FILE WORKS, SEE THE FOLLOWING EXAMPLE


an example from browser where the ad is blocked





Another way to test is to using ping command (from Run->cmd), then type ping xyz.com where xyz.com is the address to be blocked, if 127..... appears, then it's blocked.


The issue with blocking site is when the site has multiple domains(ip addresses). To block a 'range' of ip address for example 64.233.169.x , where x is 0-255, use the route command:
route add -p 64.233.169.0 mask 255.255.255.0 127.0.0.1

To set it permanent, add this command to a dos bat file (bat), and copy to start menu-> startup