Robespierre in a Cape
- Jul 24, 2007
Preemptive Defense (and a few tips for enjoyment of your computer):
- Get Firefox 3.5. Firefox 3 is a lot more responsive than Firefox 2 was. It also fixes a number of bugs that were pretty gnarly (using up over a gigabyte of memory at a time? yeah, I'll pass). It is CPU-dependent, however, and slower, older computers (I'd say below 1GHz Pentium III and 1.4GHz Pentium IV) should stick to Firefox 2. You can download Firefox 3 for Windows here. If you already use Firefox it may automatically upgrade to Firefox 3, but by default it will not (their automatic updater won't update major version revisions, so 2.whatever won't automatically update to 3.0).
There have been a couple of changes to the user interface you were probably used to in Firefox 2. The new method of history searching is awesome. You don't have to type just web addresses because it searches your cache on the fly, both URLs and page titles--so to reach the SoSH Car Salesman thread, all I'd need to do is type in "SoSH Car Salesman," Firefox would pop up any pages I've visited with "SoSH Car Salesman" in the page title or in the URL. This is a brilliant feature that you will love. The downside to this is that the new dropdown bar layout they use looks like canned ass. I recommend the OldBar extension to fix the way it looks (but keep the Firefox 3 history search function, because, like I said, it's awesome). You can visit the OldBar Firefox Add-ons page.
- Get AdBlock Plus to save your sanity. SoxScout was spot-on with this. If I have to use somebody else's computer now I start getting an eye twitch from all the ads. I haven't seen them, except on sites I choose to unblock (because I like the site and want them to make their money off my hits), for years. Once you install Firefox 3, you can install AdBlock Plus just by going to the Firefox Add-ons page for it.
- Get a virus scanner. Some people will recommend AVG, by Grisoft. I will disagree most strongly with them because their business practices really, really, really suck and their software is slow and kind of iffy. Like SoxScout, I recommend Avast!, which is free for home use. Install it, let it schedule a boot-time scan, and it'll find anything that's currently in ur computer, killin' ur perf. Do not use McAfee or Norton; they are shit (Symantec is not bad...but I'd personally rather Avast!.) Trend Micro is crap too, but at least it's working crap. Among all the commercial antivirus applications, the only one I've ever seen significant benefits over Avast! is Kapersky. Kapersky is not cheap, but it's good.
Keep in mind that you are not invulnerable when you have a virus scanner, it won't catch everything, and you need to still use your head when browsing the web, running applications, etc. The consequences for not doing so can be pretty dire. I will enumerate some helpful suggestions below.
- Get a firewall. This is easy. Windows XP (Service Pack 2 or later--if you aren't running Service Pack 2 or Service Pack 3, you can download SP2 at that link, I don't have a SP3 link offhand), Windows 2003, Windows Vista, and Windows 2008 all come with Windows Firewall. It's as good as anything you can buy or download. Turn it on in the Control Panel's Security Center.
Do not use ZoneAlarm or other equivalent crap. Most of the problems I encounter that are firewall-related come from ZoneAlarm shitting the bed.
- Get a spyware scanner. In the Bad Old Days, you were responsible for your own spyware protection. Programs like Ad-Aware and Spybot were all the rage. Spybot is still useful, but its interface sucks, it's not good at telling the user what's dangerous (spyware) and what's not (tracking cookies), and it's just...kind of average. There are better tools. Avoid shit like Spyware Terminator or any of the other fly-by-night programs out there; they won't help much compared to the below programs.
Normally I don't recommend Microsoft software, but Windows Defender is good (no surprise, they bought it from someone else). It has real-time protection, which nobody else does well, and it's a pretty solid spyware tracker and eliminator to boot. If you have Windows Vista, Defender came with it. If you're on Windows XP or Windows 2003, you can get it here. If you're still using Windows 2000, you can get Defender too, but you'll need to jump through some hoops; if you don't understand how to follow the steps outlined in this Knowledge Base article, you really shouldn't still be using Windows 2000. If you're still on 98SE, ME, or 95, go fucking upgrade right now.
Generally, if you get spyware'd, Spybot and the like might kill it--and might not, too. That's why you will want to get and install this program ahead of time: HijackThis, the only good thing Trend Micro has ever published, mostly because they bought it from the guys who wrote it. HijackThis is a very, very high-powered, entirely user-unfriendly tool that will find and fix damn near any problem you encounter. Spyware, invasive IE toolbars (which you shouldn't have installed; see the notes below), all that crap will die in a fire when HijackThis comes to town. Keep in mind that this tool is very dangerous to use without guidance or a lot of knowledge about how Windows works. Unless you know what you're doing (as a rule, if I'm telling you anything new with this post, you don't know what you're doing), you should only ever use this tool with assistance. HijackThis can create log files which you can share with those who can tell you what items in it are safe and what items are not. Post 'em here if you want, I or someone else can look it over.
Also good, and thanks to a ton of people who mentioned it, is Malwarebytes. It's similar in approach to Spybot, but seems (totally apocryphally) faster, and generally seems to do a better job of rooting out the little fuckers.
If you come posting "I tried to use HijackThis without help and now my computer won't run," I will laugh at your stupid, stupid face.
- Make peace with your god or gods of choice. This is Step 1 because it is important to realize that, in the majority of cases, it is not a practical idea to try to eradicate the spyware or viruses infesting your computer. In almost all cases I have ever encountered, it was cheaper, faster, and much, much easier to just format the computer and reinstall Windows. There are very few good reasons to attempt a recovery.
- Run HijackThis and get somebody knowledgeable to go over it. Post it here if you want (as an attachment, don't just flood the thread)--I'm sure somebody will go over it. Try not to do anything with the computer once you've done this. Don't turn it off, just let it sit. The reason for this is that a lot of viruses tend to do things at boot time and shutdown time. Your HijackThis log can be invalidated if you reboot the computer, because some viruses will shift around. Once you get a response from your guru of choice, check the items he flags as "bad" in HijackThis and click "Fix Checked." Do not reboot the computer yet.
- Run your virus scanner in boot scan mode. This is a menu option in Avast!; since that's all I use, I can't help you with other AV solutions. Do this before you reboot after running HijackThis, because the one-two punch can sometimes knock out the viruses. (Don't get your hopes up. It will usually fail.)
- Consider bringing it to a professional. This is, realistically, about as much as you can do to fix it. (Please, please don't ask your relatives or friends who are good with computers to come fix your computer unless you're willing to pay. Computer professionals hate that shit.) Geek Squad sucks, but in some areas it might be all you can do. Ask around before taking your computer to anybody--everybody's got horror stories of snooped computers. A professional will be likely to just pave the thing and hand you a DVD of your data, quite possibly after having looked through your financial spreadsheets and copied all your porn to their private stash. If you have anything you don't want anybody else to see, do not take it to anyone else.
- If bringing it to a professional to fix is not an option, get ready to reformat and reinstall. First order of business--make sure you have your install CD. (It'll say "Installation CD," not "Recovery CD.") If you have a restore disc for your computer, treat this as a lesson: do not buy a computer without installation media. Go BitTorrent one or something if all you have is a recovery or system restore CD, because I can't help you and neither can most people. Second order of business--have your drivers. Most computers come with a CD full of drivers. If you've lost this, go punch yourself in the balls. If you didn't get a driver CD (or, after you've punched yourself in the balls, if you've lost the CD), go to the manufacturer's website. There's usually a Support section where you can punch in your computer's unique ID/serial number and download all the drivers.
- Get your data off the machine. Boot the computer (if it's unbootable, post here and I or somebody else can try to help you) and copy data to CDs or a flash drive. Then scan the CD/flash drive for viruses. Hopefully it's clean; if it's not, you can delete the bad data and reburn the CD or rescan the flash drive. Some viruses infect the boot sector or cause it to autorun and install viruses on any system they're plugged into. Make sure this isn't the case, or you will be going through this song and dance again.
- Reinstall. Put the install CD in the drive and reboot. (If it tries to boot from the hard drive, you'll need to select a boot device. Most computers will have a "press (some key) to select boot device" line on the splash screen when the computer first starts up--press it and select CDROM. Go through the steps of the install. Select the defaults unless you have a pressing reason not to.
- Go reapply all the steps under "preemptive defense". Self-explanatory.
I'll add to this as time goes on/questions pop up.
- Don't use Internet Explorer. This is an iron-fucking-clad directive. IE is fucking bad. Yes, IE7 is better. It's still bad. Unless you know how to be safe about your computer, delete the IE shortcut off your desktop and your start menu. If you have a website that requires IE (using ActiveX or something), I recommend that you use the IETab extension for Firefox; you can get it at its Firefox Add-ons page. It's still IE, so it's insecure (don't browse using IETab except for those sites that require it), but it minimizes your use of it and the available attack surface.
- This is IMPORTANT: avoid stuff like Andoscan or "Antispyware 2008" or whatever. Lots and lots of malware programs are masquerading as real stuff. I would honestly suggest just sticking to stuff in this thread, and stuff in this thread only; if there's something you have a question about, post here, somebody here can probably tell you if it's safe.
- Registry cleaners are (almost entirely) useless. This is the computer equivalent of snake oil. There are some cases where a registry cleaner can be helpful to remove a specific program that doesn't have an uninstaller (or, more likely, the installer puked on your shoes), the vast, vast, vast majority of the time they are useless. Sometimes (such as with XP Media Center), they can render your computer nonfunctional because they delete "unnecessary" keys that are actually...err...necessary. "Performance improvements" from registry cleaners are almost entirely in your head. You might save a tiny, tiny scrap of RAM here and there or maybe shave a second off your boot time, but the risk:reward ratio is waaaaaaaaay too high. I don't know anybody who recommends the use of this stuff.
In addition, I'd stay way the hell away from any of the cleaners advertised in banner ads, popups, etc.--you cannot verify their authenticity and they're a very common entry point for spyware. And if they want you to pay for it, give them the finger.
This is not a blanket indictment of all tools that happen to have registry cleaning functionality; some are fine programs that have "registry cleaner" as a feature tickmark to get the attention of people who think that's somehow a good thing. One program that comes to mind that I would generally advise against using is CCleaner, however, as I've heard reports (nothing substantiated) that it can hose your machine. I haven't seen any reliable tests that point to a significant performance benefit from CCleaner, so I have to advise against it.