Computer protection story

Tired of being threatened and bullied by makers of anti-virus software, your correspondent tried a little experiment several months ago. 
.
He decided to remove the various third-party firewall and anti-malware packages on a particular Windows machine in his office, and let it rely solely on the house-brand of security software (Microsoft Security Essentials) and what little added protection the broadband router afforded.

Barely a day had gone by without some report from Symantec, McAfee, BitDefender, Trend Micro, Kaspersky or some other security firm warning of the dangers that lurked out there in the online wild—and why the only solution was to buy a subscription (typically $20-60 a year) to the anti-virus suite being touted.

Even your correspondent’s existing programs got in on the act.

At least once a day, one or other of them would pop up with an alert boasting about the number of viruses, worms, Trojans, keyloggers, rootkits, spyware, hijackers or other nasties they had just saved you from.

If truth be told, the vast majority of items blocked were relatively harmless “cookies”—small text files used to make logging on to various websites easier.

But the inference was: “See what would have happened if you hadn’t renewed your subscription.”

Clearly, security-software makers are in the business of frightening users, and keeping them in a perpetual state of apprehension and doubt.

Talk about a protection racket!

Apart from the sheer cost of renewing the annual anti-virus subscriptions, all the extra bullet-proofing had taken its toll on performance.

It was time to see if, by reducing the security overhead, the ageing machine could regain some of its youthful vigor, while at the same time remain relatively free from infection.

Well, after three months of experimenting, the results are in.

Yes, though no before and after timings were taken, the computer in question—a home-made Windows XP machine built originally as a multimedia server with environmental credentials, —became a lot nimbler on its feet once the processing overhead caused by the additional security software was lifted.

But, no, the machine did not get through the trial unscathed.

A careful inspection earlier this week showed it had picked up a couple of parasites while running around half naked.

As to be expected, both infections turned out to be Trojan horses—viruses that spread themselves by masquerading as useful pieces of software that users are suckered into downloading, usually from a compromised website or by opening some unsolicited e-mail attachment.

Once inside a user’s computer, a Trojan opens a back door for criminals to take control of the machine unbeknown to its owner.

The attacker is then free to steal passwords, log keystrokes, launch “denial of service” attacks on websites, turn the computer into a zombie member of a “botnet” army for sending out millions of spam messages, or set up a phony retail or entertainment site to steal credit-card details from hapless visitors—all without the owner knowing what is happening.

Some of the latest Trojans have features known as “software-detection killers” which help them to neutralise firewalls and anti-virus software that has not been kept up to date.

The two that had slipped into your correspondent’s machine clearly embodied such elements.

Both had also foxed the router’s “universal plug and play” controls that were supposed to block all unsolicited requests for access, other than those specifically approved.

Neither degraded the computer’s performance in any way.

Your correspondent might have carried blissfully on, unaware that he was vulnerable to being robbed blind, or perhaps made an unwitting accomplice to some nefarious cybercrime.

Fortunately, with the experiment at an end, he ran a batch of scans using tools designed to detect malware.

Of the five anti-virus programs tried, Panda detected one Trojan (Tri/ClassLoader.AK) and Ad-Aware found the other (Trojan.Win32.Generic!BT).

The three remaining programs—AVG, Comodo and MSE—came up empty handed.

That said, it is one thing for a scanner to detect a virus, but quite another for the program actually to remove it.

Both Panda and Ad-Aware offered to squelch the viruses they found and, when given the chance later, did so thoroughly.

To see for himself, your correspondent first searched the registry keys (carefully) for the culprit by name, and then searched the rest of the hard-drive for any executable files or browser plug-ins that bore some resemblance to their program names.

Having found nothing, he concluded Panda and Ad-Aware had done their jobs properly.

In practice, few such programs are good at both blocking malware on the one hand, and removing it on the other.

And no security program can provide 100% protection.

That is why a layered approach has to be used, with a firewall as well as an anti-virus package, plus additional components to block spam and phishing attacks along with separate privacy and even parental controls.

Most of the major security-software firms produce suites that seek to do it all, and more, in a single package.

The aim, of course, is to lock the user into their product alone.

Your correspondent has found few suites to be good at everything.

He prefers a “best of breed” approach, with Zone Alarm as his first choice for firewall and Ad-Aware for his anti-virus protection.

For the rest, he believes it is better by far to use simple common-sense when going online.

The first thing is to be rightly suspicious of anything that looks too good to be true.

There are consequences for those who succumb to the temptation.

Beware, too, of the Facebook request from someone you have never heard of who wants to be your friend.

Also, if you have never heard of a website you are being directed to (especially if it is a shortened one like those provided by bit.ly and TinyURL), then check it out first on a reputable verification site like Webroot’s BrightCloud.

Above all, keep everything up to date.

That applies as much to applications like browsers, multimedia players and word-processors as to operating systems and virus signatures.

Turn on the automatic update feature on every program that provides the option.

A word of warning for the Apple faithful: Macs running the Safari browser are the most hackable computers on the planet (see “Browser wars are back”, March 27th, 2009).

At present, they do not suffer from break-ins and hijackings anywhere near as much as Windows machines, because there are simply not enough of them around to make it worthwhile for black-hat programmers to write the software for cybercrooks to carry out their scams.

But that will change—indeed, is already doing so—now that Macs are becoming more popular in the workplace.

Chastened, your correspondent has gone back to using third-party security software on his geriatric Windows machine and putting up with the performance hit.

But he sees no reason to pay for the privilege of the added security.

The conclusion of a comprehensive study done recently by PC Magazine was that Ad-Aware was one of the very few security packages that was good at both blocking malware and removing it.

Better still, the complementary version of the program (Ad-Aware Free) was virtually as good as, and in some ways better than, the paid version (Ad-Aware-Pro).

The only real difference was the lack of hands-on support.

In terms of blocking and removing malware, Ad-Aware Free tied with Spyware Doctor ($40 for a one-year subscription) for first place out of the 20 programs tested.

At least in security software, then, there really is such a thing as a free lunch.

Economist