[prashant]

This section will show you how to defend your computer against the major menaces of operating a computer: spam, spyware, adware, and viruses. Viruses have been around for a very long time; spam just keeps getting worse and worse; and now there is a new computer menace that is infecting millions of computers, known as spyware and adware. Spyware is the name for applications that are secretly installed on your computer and record your personal activities or do other tasks with your computer of which you would probably not approve if you knew about them. Adware is very similar to Spyware, but can be a little worse. Instead of just spying on your activities, it uses its monitoring data to display relevant advertisements on your computer.

All of these computer menaces can be eliminate (or at least severely limited) by tweaking some of the settings of Windows XP and using various protection and defense apps. This section will show you how you can make Windows XP defend against some of the most popular types of viruses and spyware. It will also present some great utilities that you can use to battle spam and remove spyware and viruses from your computer.

Eliminating Spam

Spam is everywhere these days. Recently, I have been forced to change all of the e-mail addresses that I had used for years because I just started to get way too much spam. If you are tired of receiving messages from advertisers about debt consolidation, male sexual enhancements, and messages from the president of Congo asking you to help him launder $40,000,000 by giving him your bank account number, then this section is for you. When you are finished reading it, you will know how to stop spam from starting in the first place and how to filter the spam you already get.

Stopping spam in the first place

Users can do a lot of things when browsing the Internet to make sure that they do not end up receiving spam. But before anyone can prevent the actual receipt of spam, he or she needs to be aware of why spam is received in the first place. So, why is that annoying spam sent?

To start off, the most common reason why users receive spam is because they submit their email address to a Web site or company that starts sending them advertisements or sells their email address. Usually, most Web sites notify you when they intend to sell your e-mail address, if they plan on doing so. This notification is commonly hidden away in the terms of service agreement or privacy policy—so much so that 99 percent of Web visitors check the agreement box but never actually take a look at the information.

This is by far the number one reason why users receive spam. They sign up for some service that promises them some great free offer, such as free movie tickets, and then they end up receiving tons of spam because they didn’t realize that they gave the Web site permission to sell their e-mail address to thousands of other companies. If they would have taken the time to read the terms of service agreement and the privacy policy, they would have found out that by using the so-called free service, they give the Web site permission to do whatever they want with your personal information. Paying attention to the details is very important when you’re using the Web. With the absence of useful laws that actually make a difference on certain Internet subjects such as spam, some companies take advantage of users. If you are considering signing up for a site and cannot find their terms of service or privacy policy, do not use their service. That lack of information should be a huge warning sign.

Another common reason why users end up with inboxes packed with spam is because they inadvertently sign up for various newsletters. I shop online a lot and end up creating many different accounts at different stores so that I can purchase items. During the signup process, you are almost always asked if you would like to sign up for their deal-of-the-week newsletter or some other kind of promotional material. They want you to give them permission to send you more advertisements so that, it is hoped, you will buy from them again. You may think that this is nice, but when you have accounts at 25 different online stores, you could be getting a lot of messages that are just advertisements. When you are creating accounts at online shops or other Web sites, make sure that you uncheck all of the newsletter links, unless you really want to get one. These options are usually placed on the Web page in a location that you may overlook. The check boxes are checked on purpose so that those people that miss them automatically end up on the advertisement mailing list. Keep an eye out for these boxes and you will be able to cut down on spam.

If you follow the two tips just mentioned you will dramatically cut down on the amount of spam you receive. Another way to fight spam is to create separate e-mail accounts. There are several different Web sites on the Web from which you can get free e-mail. Create separate accounts on these free sites or request more mailboxes from your Internet Service Provider. Then, use each mailbox for a different purpose. I like to have one mailbox that is just for my personal mail from my family and friends. I never give away that address on any Web site and even tell my family and friends never to submit that address to any Web site on my behalf. I have been doing that for the last two years and still to this day have not received any spam to that account. I highly suggest that you create an e-mail that you will use for personal mail only and never give that address to any Web site.

I also have a separate account that I use for all of my online purchases. This way, if I ever start to get too many weekly newsletters and some unethical store sells my information, I can just close the e-mail account and start up a new one with a different name. Additionally, I have a separate e-mail address (my junk mail address) that I give to any Web site that requests an email to sign up for something. This way, I can still get the confirmation message that a lot of sites require you to do something with to verify your e-mail address and not have to worry about the site sending me tons of junk that will fill up my personal inbox. You should boldly create a separate junk e-mail address so that you can give that address out to Web sites instead of using your personal address.

Using filtering software

I have shown you how to lower your chances of receiving spam from sites on the Web. However, what if you already receive a lot of spam? If you fit into that category, you have two choices. You can either create a new e-mail address or start using the tips that I have given you previously, or you can try some filtering software. There are thousands of different anti-spam software apps on the Web. Everyone is trying to cash in on spam. Because of the mass amounts of spam apps, it is a little difficult to find the best programs. No spam filtering app is 100 percent accurate. If they are anything close to 90 percent, that is great.

I am not going to show you how to use all of the different spam filters; instead, I am going to give you a list of the best anti-spam apps (Table 13-1) so you can try out a few to find the program that works best for you.

Blocking external links in HTML mail

Every time you receive an e-mail, and your e-mail client supports graphical HTML-based email messages the possibility exists that the sender could be tracking you if you read the message. This can be done by using a hidden image link in the message that points to a Web server where a special tracking program resides. This may not sound like a big deal, but when you take into consideration that spammers use this type of technology, it is a whole new game.

Spammers can use this type of technology to prepare out e-mail addresses from their database that are no longer in use. When you open up spam, it can send a signal home to a spammer’s Web server, alerting them that your e-mail address is active and that you read your e-mail. If you could prevent that signal from being sent to the spammer’s servers, then you could make your e-mail address appear to be inactive and could be removed from their database.

Thankfully, Microsoft automatically blocks all external image links in HTML messages in Outlook 2003. Additionally, with the release of Windows XP Service Pack 2, Outlook Express also gains this feature. If you have not already upgraded to Service Pack 2, and use Outlook Express as your e-mail program, you should definitely upgrade. Your computer will not only be more secure, but you will also be protected against some spammers as well.

Table 13-1 Anti-Spam Apps

Application Name
McAfee SpamKiller : - SpamKiller is a good app that filters messages based on its database,
which is automatically updated once a day. Aside from the standard
filtering features that all anti-spam apps have, SpamKiller has a
quarantine area for your spam and also allows you to report spam
senders to McAfee to help them keep an up-to-date database. It
supports Web-based e-mail accounts such as MSN and Hotmail, as
well as POP3- and IMAPI-based e-mail accounts. SpamKiller costs
around $40. Visit McAfee - Antivirus Software and Intrusion Prevention Solutions for more information.

SAproxy Pro : - SAproxy Pro is another good program that uses the same database as
McAfee Spamkiller (the open source spam assassin database). It
includes all of the basic features of spam filters, as well as the
effective Bayesian learning engine that allows the program to get
smarter at catching spam based on what it observes you classifying as
spam. Currently, SAproxy Pro only supports POP3-based e-mail
accounts and sells for $30. Visit Stata Labs for more
information.

K9 : - K9 is another popular spam filtering app that allows you to filter your
incoming mail from a constantly updated database as well as
“statistical analysis”. It supports only POP3-based e-mail accounts,
but is available for free. Visit Robin Keir's home page - Software - K9 to
download a copy and for more info.

Cloudmark SpamNet : - SpamNet filters incoming mail based on its own database of spam
that is updated from its 800,000+ subscriber base. This app works
only with Microsoft Outlook and Outlook Express. It installs a special
toolbar in these applications that allows you to manage your spam.
Unlike other commercial spam programs, SpamNet works on a
subscription basis of $4 a month. SpamNet supports any e-mail
accounts that you can use with Outlook and Outlook Express,
including Hotmail and MSN e-mail accounts. Visit
Cloudmark Desktop: Spam Blocking, Filtering and Anti-Phishing Software for more
information.

Spam Inspector : - Spam Inspector filters all of the incoming mail using its own database
that is updated by its users daily. Also gives users the ability to make
messages bounce so it appears that your e-mail address no longer
exists. Recently introduced fraud protection that automatically flags
fraudulent scams that you may also receive. Spam Inspector currently
supports Outlook, Outlook Express, Eudora, and Incredimail and sells
for $20. Visit Windows Defender: Home Page to download a trial and
for more information.

If you are using Outlook Express, this blocking of external image links in HTML messages can be turned on by working with the Security tab of the Options window, located under the Tools menu bar item. If you are using a different e-mail program, I recommend that you read through the Help files or contact the developer of your program to find out how to disable HTML images and other external content.

Outlook and Outlook Express also provide a safe sender list that allows you to enable this feature for only certain senders, such as messages from your bank or newsletters that you have signed up for. Just right-click a message and add the sender to your safe list to enable images and other external content for a specific sender.

Defending Spyware and Adware

Spyware is becoming the largest menace of computers in the last year. Hidden away within free applications, these programs can spy on your computer activities and report home various information about your computer habits. Adware is another menace that is closely related to spyware. Just like Spyware, it can be secretly installed on your computer and will monitor what you do. Then, when the time is right, some Adware apps will display relevant advertisements. Did you ever visit eBay.com and then notice an advertisement for Ubid.com, one of eBay’s competitors, pop up on your screen? If so, then you are infected with a bad case of adware.
How does your computer get infected? There can be a number of reasons why, but the most common reason is that you visit a Web site and are prompted to click Yes on some pop-up box to allow an application to install that you think is a game or some cool browser utility such as a search toolbar. Often, these utilities are spyware themselves and are also bundled with other spyware and adware. Unfortunately, users never seem to read the terms of service agreements that are presented when they are installing these free apps on their computers and pass right over the notices that this software will display ads and will monitor your browsing habits.

These next few sections will show you how to detect and remove spyware and adware from your computer, as well as what to look out for to protect your computer from getting infected in the first place. Additionally, you will learn how to use some of the new features of Windows XP Service Pack 2 to protect your computer from getting infected if you accidentally try to install spyware or adware.

Detecting and removing spyware

There are a bunch of free apps on the Web that will help you scan your computer for adware and spyware. There are two programs I recommend that you use to scan your computer. Each of these programs has its own database of adware and spyware that is updated frequently. To make sure that no spyware and adware goes undetected, it is a good idea to scan your computer with both programs. The first app is called Ad-aware, which is published by Lavasoft. This is a great program that has a basic version available for free when used for personal use. The second app is called Spybot S&D, which is developed by Patrick M. Kolla and is also free.

Using these two apps to detect and remove spyware and adware from your computer will not only rid your computer of those annoying programs, but will also speed up your computer and free up disk space. Follow these steps to get started using Ad-aware:

1. Visit Ad-Aware @ Lavasoft - The Original Anti-Spyware Company - Lavasoft and download a copy of the basic version of Ad-aware that is free when used on personal computers.

2. Once you have Ad-aware installed on your computer, start it up by clicking the Ad-aware icon on your desktop.

3. When Ad-aware is loaded, the first thing you should do is update the data files. This can be done by clicking the globe icon, as shown in Figure 13-1.

4. Then, on the Webupdate screen, click the Connect button. It will tell you if a new update is available. If one is, just click OK and it will be downloaded and installed.

5. Now that Ad-aware is updated, you are ready to scan your computer. Just click the Start button in the lower-right corner of the window.

6. Select Perform Smart System-Scan on the Next screen and click Next. The scan will begin.

7. Once the scan has finished, you will hear a sound. Click the Next button again to view the results.



FIGURE 1-1: Checking for updated data files for Ad-aware.



FIGURE 1-2: Browsing the results of the Ad-aware scan.

8. The Scanning Results screen will be shown, which lists any instances of spyware and adware on your computer, as shown in Figure 13-2. Scroll through the list and uncheck any objects that you do not want to remove. Then, click the Next button again.

9. You will be asked to confirm that you want to delete the items on the list. Click OK to continue removing the files and registry entries associated with spyware and adware.

The files will be quarantined as a backup just in case you experience any problems with the operating system after you remove the files and registry entries. You are now finished with using Ad-aware and can close the application.

You are now ready to get Spybot Search & Destroy installed and set up on your computer so that you can ensure that you have removed all spyware and adware from your computer. To do that, just follow these steps:

1. Visit Spybot’s Web site at The home of Spybot-S&D! and download a copy of Spybot Search & Destroy.

2. Once Spybot S&D is installed on your computer, start it up by expanding the Spybot Search & Destroy folder and selecting Spybot S&D (easy mode). The first time it is run, you will have to select the language that you want to use and will be shown a few legal disclaimer screens.



FIGURE 1-3: Updating Spybot Search & Destroy.

3. When Spybot loads, you will want to update its data files as well. This can be done by clicking the Search For Updates screen located in the middle of the screen.

4. Check all of the updates that are shown on the screen and click the Download Updates button, as shown in Figure 13-3.

5. Once Spybot has finished downloading and installing the updates, it will restart itself. When that happens, you are ready to begin scanning your computer. To begin scanning, just click the Check for Problems button.

6. Once scanning has finished, you will be presented with the Results screen. Click the Fix Selected Problems button, as shown in Figure 13-4, to remove the entire selected search results.

7. When all of the entries in the search box have check marks, Spybot is finished cleaning your system. You may now close Spybot.

Your computer has now been scanned and cleaned with two great spyware cleaning software apps. As you can see, Spybot picked up on some things that Ad-aware missed. Using both of these programs together will allow you very good detection and removal of spyware on your computer.



FIGURE 1-4: Using Spybot Search & Destroy to remove spyware & adware found during a system scan.

Locking down Internet Explorer

Now that you have removed all of the spyware and adware on your computer, let’s turn off certain features of Internet Explorer so that you will be less likely to accidentally install more spyware. To get started, change the ActiveX install settings to prevent any new ActiveX apps to be installed. Follow these steps to change this setting:

1. Open up a copy of Internet Explorer.

2. Click the Tools menu bar item and select Internet Options.

3. Click the Custom Level button on the Security tab.

4. Locate Download Signed ActiveX Control at the top of the list and select Disable.

5. Click OK and click Yes on the confirmation screen.

6. Select OK once more to close Internet Options.

A change in this setting can prevent you from installing new ActiveX controls from all Web sites, good and bad. If you ever run into some problem with a Web site not loading correctly, just re-enable this setting and try the site again.



FIGURE 1-5: Immunizing your computer from common spyware apps.

Immunizing your computer

Spybot Search & Destroy does a lot more than just scanning your computer and removing spyware and adware. It also offers the ability to immunize your computer against some of the most common types of spyware. This feature provides a great added level of protection that can only help in your battles with spyware. To use this feature, follow these steps:

1. Start up Spybot by expanding the Spybot Search & Destroy folder and selecting Spybot S&D (easy mode).

2. Once Spybot S&D is loaded, click the Immunize button on the left of the window.

3. Then, just click the Immunize button, as shown in Figure 13-5, and you are now protected.

Defending against Viruses

Windows XP Service Pack 2 has many new features that make Windows XP the most secure Microsoft operating system to date. One of the new features, called execution protection, takes advantage of a new hardware protection found in the latest CPUs of modern computers.

One of the most common types of computer break-ins and virus exploits has to do with buffer overflows. These occur when data is being sent to a buffer faster than the CPU can process it. When the buffer becomes filled, the system can become unstable and sometimes can execute code that was placed in the buffer. This is how many types of viruses spread. They take advantage of an unchecked buffer and can get the CPU to execute their malicious code. One easy solution to solve this problem is to include a feature in the CPU that will disable executing of data in all buffers. By doing this, a virus might be able to get its code into the buffer, but because of limitations of the CPU, the code would never be executed, rendering the virus useless and unable to spread.

The new CPU level security can be found on the AMD Athlon 64 processor and new versions of the Intel Pentium 4 Prescott. If you have one of these chips with the execution protection feature, this feature is enabled by the operating system. However, having this feature enabled for all programs may cause some application errors because some need to be able to execute data in their buffers. To allow for this, Microsoft has created an exception list for such programs. You are advised to make sure every once in a while that no application has automatically added itself to the exception list. You really need to make sure that only the applications that truly need to be there are there. To do this, follow these steps:

1. Right-click the My Computer icon located on the desktop or Start Menu and select Properties.

2. When System Properties loads, click the Advanced tab.

3. Then, click the Settings button under the Performance section.

4. Next, click the Data Execution Prevention tab and make sure that Help Protect All Programs Except: is selected.

5. Then, review the list and remove any apps except for the ones that you are 100 percent positive should be there.

6. Click OK to save your changes.

7. Select OK once more to close System Properties.

Use an antivirus program

If you still are not running an antivirus program, then you really should reconsider your decision. Viruses, especially in e-mail attachments, are very prevalent these days. I highly recommend that you install an antivirus program on your computer if you do not have any protection currently installed. Additionally, if your current virus definitions subscription has expired and you no longer can download updates to the data files, your antivirus program is almost completely useless. You must always be running up-to-date antivirus data files so that your computer is always protected from the latest viruses.

If you do not want to spend $40 or more on getting some antivirus software, you can avail yourself of the many free antivirus applications. My favorite free antivirus app is called AVG by GriSoft. AVG is a very good antivirus program that is free for home use. Follow these steps to get AVG up and running on your computer:

1. Visit GriSoft’s Web site at AVG Anti-Virus and Internet Security - AVG Internet Security for Windows XP and Vista.

2. Scroll the bottom of the page and click the Download AVG Free Edition button. Be sure to enter a valid e-mail address on the form after the License Agreement page, because they will send you a serial number that you will need to use when installing AVG.

3. Once you have downloaded and installed AVG, make sure to update the virus definitions with the Update Wizard that is shown the first time you run AVG.

4. When you get your virus definitions updated, you are advised to do a full system scan by clicking the Run Complete Test button.