Apr 20, 2014 06:57 AM
(This post was last modified: Apr 24, 2014 09:41 AM by King Cin.)
![[Image: t0jMWNC.png]](https://i.imgur.com/t0jMWNC.png)
Index
• Introduction
• Types of infections
• Antivirus programs
• Tools
• Preventing infections
• Other useful threads
Introduction
You're probably wondering what this thread is about.
The title doesn't really say much about this thread, but the index did.
I will be talking about several things that will be useful to you.
I'm doing this because I have a 2 week break from school & work, so I can finally do something productive again.
I recently started with becoming more active in the Computing section and its sub-sections. You could see this as my introduction to this side of the forum.
Types of infections
There are numerous types of infections.
We classify them based on their features, purpose and way of infection.
Worms:
A worm is a type of malware that can create replica's of itself, it consumes a lot of space and bandwidth when it's copying itself.
Most worms don't alter files, but they can still cause damage, worms are unique because they duplicate themselves without any help of a human, they can travel through systems without input from a user.
Most of the people that are infected with a worm don't even know it, until they see that their computer is running slowly.
Worms were, and are still being spread by email, the host sends the target an email with something that interests them, the target opens the attachment and gets infected with the worm, the worm can then automatically spread itself using various methods, a couple of these methods are: LAN Spreading, USB Spreading, WinRAR Spreading, P2P Spreading and Spreading through messengers / Social Media.
Spyware:
Spyware is made to spy on your computer, but it isn't meant to damage your computer, spyware is often made by companies to spy on your habits, like which websites you often visit, the information the spyware gets from you is then sent back to the company.
Spyware is often installed with free software without you even knowing, spyware can monitor keystrokes, change your browser's homepage, and can even scan files on your hard drive.
The information the company/user gains is often sold to third-parties or is used for marketing/advertising purposes.
Trojan Horses:
Trojan Horses are well known malware, they are often made to literally destroy PC's, or just to have fun with people so they freak out.
A Trojan horse is often bound to a real application, the goal of a trojan is to do something that you won't expect the program to do, if it's bound to a real application, you probably won't notice this, if something is bound with a real program, we call this a backdoor.
Trojan Horses work the same way as the mythological Trojan Horse, they continue to infect other files and they cause potential havoc and destruction.
IRC Trojans are often combined with Remote Administration Tools to create botnets too.
Adware:
Adware is in my opinion, the most annoying thing that you can have on your PC. Adware often gets installed with free programs when you don't read the EULA / TOS.
It lets you see ads, without you wanting to, it installs toolbars that you don't need and that you don't want, it can also redirect you to pages you didn't want to see.
A good example of an adware-affiliated program is Babylon.
Adware isn't meant to be malicious, it's just highly annoying and it makes your browser relatively slower. The toolbars you get are also annoying and unneeded.
Rootkits:
A Rootkit provides access to your folders and files to a remote user who can do everything he wants with your files, and thus gets control of your computer. Rootkits can even infect your BIOS (Independent from your operating system, press F12, or F5 when booting and you'll see it) and they are very hard to remove. Rootkits mostly have the same authority-level as antivirus programs, so your system can't decide which program is stronger.
Another fact about Rootkits is that they can infect a wide variety of operating systems, the first Rootkit was made for Unix.
Rogue Security Software & Ransomware
I will start with Rogue Security Software, rogue security software is a program that looks a lot like an Antivirus scanner (often called Scareware), PC Speedup tool or sometimes Registry Cleaners. Rogue security software is also a type of ransomware. Rogue security software deceives you into thinking that it is one of the programs I listed above, it then claims that your computer is infected, you will then be prompted to pay a ransom to clean your computer, it doesn't clean your computer, but it actually infects your computer.
I will now talk about ransomware, most of the ransomware you'll see simply locks your screen and forces you to pay a ransom, these are easy to get rid of and you can easily do it manually, since most of them drop in folders such as Temp or AppData.
But there is also ransomware that encrypts specific data on your computer, making them hard to remove.
Ransomware's only purpose is to get the owner money, ransomware mostly works on people who don't have a lot of knowledge about computers, because they can easily think that the FBI really locked their computer. Some ransomware is deleted after you pay the ransom, but some stay.
Antivirus Programs
Antivirus programs are important. I see too many people who claim they're just using Malwarebytes' (which isn't even an antivirus) and never got infected. I then check up their PC and I find some adware, PUP's etc.
List of important Antivirus Programs:
Avast! Free Antivirus: One of the best free antivirus programs out there. It's stable and it is somewhat modifiable. I recommend this to people who want a free antivirus program.
Avira Free Antivirus: The same counts for Avira as for Avast! Avira is a good free antivirus and it will be useful to you if you're searching for a quality free antivirus program.
AdAware: This program was good back in the day. You shouldn't use it as of now because they have dropped their support and there are better programs out there.
Norton: This antivirus program comes with some new PC's/Laptops people purchase. If you have it installed, I recommend you to remove it and get a different antivirus program.
McAfee: This antivirus program comes with some new PC's/Laptops people purchase. If you have it installed, I recommend you to remove it and get a different antivirus program.
BitDefender: This is a decent antivirus program. It isn't the best though, there are better ones such as ESET and Kaspersky.
Kaspersky: Kaspersky is a high quality antivirus program and is extremely useful if your Computer can handle it. It uses up more resources than most of the antivirus programs, but it's worth it if your computer can handle it.
ESET ESET is a good antivirus company. The most recommended are ESET NOD32 and ESET Smart Security. ESET is probably the best paid antivirus out there if your PC can't handle Kaspersky.
Tools
Tools are important to white hat hackers too. Without them, removing infections would take ages. There are a couple of common tools, and all of the tools I'll list are useful and they will help you.
MalwareBytes' Anti-Malware. The best, and famous anti-malware program. I don't think it needs any further explanation.
MalwareBytes' Anti Rootkit. This tool was made to delete rootkits.
CCleaner. CCleaner is a tool made for optimizing your PC.
Junkware Removal Tool. Junkware Removal Tool is a tool that will remove common adware and potentially unwanted programs.
TDSSKiller. A tool used for removing rootkits.
Recuva. A program that will attempt to bring back deleted files, extremely useful.
ESET Online Scanner. An online scanner.
AdwCleaner. An extremely useful tool that will remove most of your Adware and PUP's.
Rkill.Terminates known malware processes so that the disinfection will be more efficient.
RogueKiller. Almost the same as Rkill, but is able to remove certain infections.
Preventing infections
To prevent infections, make sure you keep everything up to date.
Always install Microsoft updates, and make sure that you update Flash and Java as soon as a new update is released. People always search for exploits in the previous versions so you could get infected if you decide not to upgrade.
When analyzing malware, or when downloading suspicious files, use a Virtual Machine. Simply using Sandboxie isn't enough nowadays. Your Virtual Machine will ensure that your real computer won't get infected. Better be safe than sorry.
Check for weird files in your %temp% and %Appdata% maps, viruses often drop here.
Scan your Computer occasionally and make sure you enable scanning for PUP's. It will prevent some annoying programs.
Other useful threads
- Antivirus Recommendations by Chief
Guide for Dummies: Windows Security by Ego
Anti-Viruses vs Anti-Malwares : The Differences by Aura
How To Fully Speed Up Your Windows Operating System by MaiTriCks
Whitehat Tools by iMythik
