Antivirus talk, also fan mod for overheating routers

[spystyle]

("antivirus talk" is below, for "fan mod talk" scroll down until you see an attached image)



Hello from Maine,

I have been building and using computers for many years, I've never really had a "virus problem" so I never looked deeply into it. I just run a weekly virus scan with "Avast" while I sleep. I run "SpyBot" daily.

My good buddy, on the other hand, has virus trouble! He is convinced that some people are targeting his business computer with viruses. He is a nice fella and I want to help him out.

So I will research the subject, but I was hoping there would be a few IT hi-tech guys here in the forum who could advise me.

My initial response would be "Avast antivirus" set to "aggressive" (as opposed to "default") a "hardware firewall", also a "software firewall" (Zone Alarm basic)

I always assumed a "hardware firewall" is the ultimate in computer defense. I will find out more as I research.

The kicker is my buddy has no money! His business was sabataged and he is at minus 700 clams right now, so I am hoping to help him out using older hardware and free software.

I can hear you now "Linux! It's virus proof!" - But he is not computer savvy and I don't know if he is willing to learn linux. He will be using Windows 2000 SP4.

Care to advise me?

Thank you,
Craig

[Zero_Hour]

As part of your research, you really need to analyze his computer usage habits. What kinds of sites does he go to, what bowser(s) does he use? How does he deal with spam and mail attachments? Does he download software from the net, and if so where from? All the antivirus and spyware protection in the world is useless if you have a user who runs malicious code out of laziness or ignorance. He doesn't have to become his own IT guy, but if he wants to use a computer for his business, he really should know the basic do's ad don'ts. Ultimately, you want to make sure he is not inflicting these problems on himself via bad practices.


And not to pass judgment on him, but if he is using Internet explorer, and you find cookies for adult sites on his system, I'll bet you money that's the source of his problems. Having worked in a University environment where there was no filtering, I have seen that problem a surprising number of times.

[spystyle]

I tell everyone I know to avoid IE and use FireFox. I installed FireFox on his rig. Though I'm not exactly sure what he uses.

[tetsu96]

Spyware and viruses can be pretty tricky sometimes.  Even with Firefox it's possible to be infected (use trusted extensions and be aware of potential flash vulnerabilities).

But here's the fastest things that can be done to minimize chances of being infected:

Keep current with patches and software versions.  This includes the operating system and software used on it.  If items like Winamp and Flash don't get updated then they can potentially be hacked.

Spybot - good choice in scanning tools but no scanner is 100% fullproof in catching everything.  Not that you should use multiple scanners regularly, but if you suspect an infection, it may not be a bad idea.  Also, this lets you in very quickly to check things like startup files and such which you can do outside of Spybot but it's pretty convenient.

Antivirus - doesn't matter too muich which you use, just make sure it has the latest virus definitions and that it's running (usually viruses and vicious malware disable the scanners once infecting a system).

Firewalling - it may be overkill to use a software and hardware firewall, but it's not the worst thing you can do.  The messages that pop up saying "xxxxx is trying to access the internet" may help him catch something which sounds like it shouldn't be starting up.

All that said, if he still manages to get infected, here's 2 good ways of handling it:

Safe Mode:  Only starts enough services and software to get you onto the system to work.  If you're running AV and Adware scans this is a good mode to insure a running process doesn't stop you from finding things.

Boot Discs: Barts PE and similar can allow you to make scanning and / or recovery discs.  Nothing from the local hard drive should be running when you boot off a boot disc, and again, scanning should be more effective this way.

Hope that helps.

[shorthair]

I thought it was sorta standard to have a software firewall. Also, I'm told my router has an internal one. For anti-virus ware, I find Ad-aware and AVG are more capable than Spybot. And I have norton av running.

[spystyle]

Shorthair,

Norton? You aren't IT are you? I've never heard anything good about Norton.

I just did a quick Google to see if there was somehting I didn't know and found this "Norton vs Avast"
http://www.techimo.com/forum/t162985.html

Apparently if you uninstall Norton and install Avast you'll gain some CPU cycles.

As for software firewalls being standard, they are in XP but not in any previous OS.

---

Routers, yes I've heard that they are similar to a hardware firewall, cool! To solve my friend's dilemma I ended up giving him a D-Link router (that I did not like, it overheats allot when under my desk), Avast antivirus, SpyWare blaster (it's good for FireFox), SpyBot, and Zone Alarm.

He *should* be all set.

I tested his computer on some warez sites, I downloaded a fake file that was full of trojans (allegedly a keygen for the most recent Nero) and Avast kicked right in - deleting the files and aborting the website connection. Then I ran SpyBot and it removed a single instance. Then I did a full scan with Avast and it found nothing because it was good enough to catch everything immediately. So I think he'll be all set as long as he does frequent scans and keeps updating his stuff. We'll see.

----

Thanks to all who chimed in - problem solved

You're all hired!

I personally have been online since the days of 28.8 and never had a real problem with viruses... It makes me wonder if his theory, that someone intentionally sent it specifically to him, is true.

Cheers,
Craig
 

---------------------------------------------------------------------

p.s. I mentioned an overheating router - well I did some research after I gave it to him on a "router fan mod" and here is what I came up with.

Add a regular 12volt PC fan and potentiometer to your router. The router will have 12v in it to solder to, but the fan will be noisey, so you can tune it with the potentiometer (like a volume knob)

Here is the method for calculating which potentiometer you need:

Most fans can use a 25 ohm 3W Potentiometer available from Radio Shack. This will give you variable fan speed for $4.

Be sure that your fan is under 3W at 12v; otherwise, you'll need to go with a higher capacity Pot.

Watts = Volts x Amps

3W = 12v x .25A
(You need a fan .25A or less @ 12V) 

Below are some links to modded routers. It's something to consider if you get frequent disconnects due to overheating.

They don't have potentiometers but dang they must be loud. It would annoy me as mine sits under my desk (near me)

http://gadgets.qj.net/Belkin-Router-Mod-Defines-Cool/pg/49/aid/56443
http://www.planetjay.com/dsl-modem-router-mod/
http://www.adrianbaugh.org.uk/technology/router.shtml

[BobA]

I have a D llink router/WiFi that tends to overheat.  All I did was raise if off the desk so the air vents could get some air with a small bit of wood and it has been OK ever since.   When sitting on the desk/bookcase before the air vents were almost totallly blocked.

[spystyle]

That's cool BobA, but some of us like an excuse to fire up the power tools and "fix" things.

:)

[AtomSmasher]

Norton? You aren't IT are you? I've never heard anything good about Norton.

I ran Norton for many years and it seemed to work fine, up until I got a nasty virus that wiped out one of my systems by deleting critical windows files.  For some reason Norton couldn't see the worm that was slowly eating the files, even with a full system scan.  I then picked up a copy of McAffe, which immediately found the infected files and haven't had a problem since.

[spystyle]

I don't think ITs use McAfee either

[AtomSmasher]

I don't ITs use McAfee either

I'm guessing that means "ITs don't use McAfee either", but in my experience its been better at stopping viruses and it uses less cpu cycles then norton (at least at the time I switched over), and since I get it free every black friday, I can't complain.

[spystyle]

oops, I left the word "think" out.. what was I thinking?

I fixed it

[Generic Eric]

Its been my limited experience that IT uses trendmicro office scan, but I have only had two corporate jobs.  *shrug*

Personally, I'm flying without a parachute, but I think its important to have safe surfing habits.   Stay off the kazaa and shareza and you'll be ahead of the game.


on another note regarding website saftey, McAfee has a plugin for IE and Firefox called Site Advisor.  It'll tell you if the site you are visiting offers spyware, spams your email address or if the sites it links do the same.

[knave]

We use a corporate version of Symantic Antivirus.

I don't think they call themselves "norton" anymore.

I remember the old school "norton" products being real hoggs.

The newer stuff is much better.

The Corp Version really acts like it's not even there...even when it's scanning.

anyways..., AVG, Avast and AntiVIR are pretty good free antivirus suites.
I used to use both Spybot and Adaware but I've mostly settled on adaware when needed.

I switched to symantic at home because I wanted to use ghost...I just get the pro version of systemworks.  I never notice any slowdown.  and Ghost is the best way to get rid of a virus.  Get a virus...no prob...re-image...POOF! gone. Usually though this is a non issue caus' nothing ever comes through the AV.