Technology News from James Moore & Co.

=20

Malware - What=20 is it and How Does it work?

A = New Face at=20 James Moore & Co., P.L.!

What Technology=20 articles would you like to read about? Please let us know. = Send=20 suggestions to John Sandy at JohnS@jmco.com


Moore=20 About Technology	September/October 2005

Quick Links... Moore About Us
Past Newsletter
Software Services
Network Services

Newsletter Sign-up

Email Address

Malware:=20 Short for malicious software, software designed specifically = to=20 damage or disrupt a system.=20

Most add-on toolbars for Internet Explorer are = malware=20 sources. This includes (but is not limited to) MySearchBar, = DashBar,=20 Xupiter, HotBar, and many others. The Google and Yahoo = toolbars are=20 safe. There is another class of application, which might be=20 considered "ad-supported", if there was any functionality = other than=20 the advertising. Things like Comet Cursor, Bonzi Buddy, the=20 Gator/GAIN "applications" (DashBar, PrecisionTime, and = DateManager),=20 and Internet Optimizer are like this. They masquerade as = useful=20 applications, but provide no substantial functionality and = are=20 merely a ruse to get their advertising software onto your = computer.=20

The latest and most dangerous trend is "anti- spyware" = software=20 that's actually just another source of malware. For example, = Google=20 searches for some of the common anti-malware software = packages will=20 turn up "sponsored links" (in other words, advertisements) = for=20 malicious software, linked to those keywords. So pay = attention to=20 what you're downloading and installing. If it's free, there = may be a=20 reason for that.=20

Another method (and harder to deal with) for = acquiring=20 malware is through "drive-by" software installs in Internet=20 Explorer. This can happen because IE supports a technology = called=20 "ActiveX", which allows website creators to embed small = programs in=20 their sites (called "ActiveX controls"), which can then call = larger=20 programs (such as software installers). When this technology = is used=20 correctly, it lets you install software like Macromedia = Flash or=20 Apple QuickTime from a website without having to download a = separate=20 installer. It's also the technology that drives Windows = Update.=20

When you give permission for a website to run an ActiveX = control,=20 it is exactly the same as if you had downloaded a program = and run=20 it. An ActiveX control can do literally anything to a PC; it = can=20 install software, it can change settings, it could even = delete all=20 the data on your PC. Many users do not realize that when = they see an=20 ActiveX control download prompt, they are essentially = handing=20 control of their PC over to a website (or in some cases, = over to a=20 banner ad).=20

The two most recommended malware removal tools are = SpyBot=20 and AdAware. These are general-purpose tools designed to = scan for=20 and remove a wide variety of malicious software (including = spyware,=20 adware, dialers, and other garbage). SpyBot is generally = more=20 powerful and more aggressive, but AdAware is easier to use. = Both are=20 good products, and can co-exist on a computer without = problems=20 (although AdAware may occasionally find items in SpyBot's=20 quarantine). Sometimes, when one tool fails to remove all = the=20 malware on a system, the other tool will finish the job.=20

SpyBot's homepage is http://www.spybot.info and the = latest=20 version as of this writing is v1.4. It is freeware. = AdAware's=20 homepage is http://www.lavasoftusa.com and the latest = version as of=20 this writing is SE v1.06. The "Personal" version is free for = use,=20 and has full scanning and cleaning functionality.=20

When running either tool, it is essential that they = be=20 updated to include the latest patches and scanning = databases. Like=20 anti-virus software, these tools can only scan for malware = that they=20 know how to identify. Updating AdAware is easy: click on the = "Check=20 for Updates" link when you first start it and then the = "Connect"=20 button. To update SpyBot, click on the Update button in the=20 left-hand column. Then click on "Search for Updates", check = the=20 updates you want (which should be all of them), select an=20 appropriate mirror from the list (which defaults to Europe), = and=20 click on "download updates". SpyBot may then restart, = depending on=20 what updates were retrieved.=20

Important note: You must upgrade SpyBot to v1.4 and = AdAware to SE=20 v1.06 or higher in order to receive updates. If you are = running=20 earlier versions, you must upgrade or you will not be able = to=20 download database updates. AdAware v5 and v6 are actually = older than=20 SE v1.06, so an upgrade is required.=20

To scan with SpyBot, click on the "Search and = Destroy"=20 button in the left-hand column, and then the "Check for = Problems"=20 button on the bottom. To scan with AdAware, click the = "Start" button=20 and follow the instructions. Once either application is = finished=20 scanning, it will present a checklist of items that it has = found.=20

If you think you may have Malware on your computer = or have=20 any other questions, feel free to call the ISC department at = James=20 Moore & Co., P.L..

Malware - What=20 Is It And How Does It Work?
(by Mark=20 Bates)

A New Face At James Moore & Co.,=20 P.L.

James=20 Moore & Co., P.L. would like to welcome John Sandy to = the=20 Information Systems Consulting Department. John is the = Information=20 Systems Consultant Manager. He is responsible for overseeing = the=20 sales and support effort to existing and potential clients. = This=20 includes the SAGE (MAS90, Business Works, MIP, etc.) family = of=20 software as well as the installation and support of = Microsoft and=20 Novell networks.=20

John has been married to his wife Marcia for 20 years, = they have=20 2 children, Jordan (16) and MaryJo (14). John graduated from = University of Florida in 1984. Since starting with NCR Corp. = marketing Mini- Computers, he has mainly been associated and = worked=20 with publishers of construction accounting and estimating = software=20 including CDCI and Timberline. John came to James Moore = & Co.=20 from Bradford Homes where he served as the General Manager. = In his=20 spare time, John enjoys playing golf and going fishing.=20