Cyber Attack on Poor Old Harry / General Chatting / Forums

Forums

4hv.org :: Forums :: General Chatting

« Previous topic | Next topic »

Cyber Attack on Poor Old Harry

previous 1 2 3 4 next

Move Thread

LAN_403

Renesis

Thu Aug 13 2009, 07:45AM

Registered Member #2028 Joined: Mon Mar 16 2009, 08:13PM
Location: Norway
Posts: 319

Nicko, you seem to know what you are talking about. I am using an updated version of Norton Internet Security, and people around me keeps telling me that it is completely useless. I am not qualified to either agree or disagree, but it seems to be very professional and it costs a lot, so it *should* be a fine AV. What is your opinion?

Nicko

Thu Aug 13 2009, 08:00AM

Registered Member #1334 Joined: Tue Feb 19 2008, 04:37PM
Location: Nr. London, UK
Posts: 615

Steve McConner wrote ...

... and I can't argue with anyone who likes Father Ted. That is arguably the main problem with Windows...

For some reason in my early morning, pre-caffeine, reverie , those two segments leapt out of me

I'm sure Father Jack would have a succinct comment about Windows.

The scene that came to mind instantly was Ted & Dougal sitting by the window with a model farm animal set - Ted is holding a small cow, and referring to it says "Now Dougal, SMALL," (then pointing out of the window), "FAR AWAY". No other explanation given. I fell off the sofa...

Hazmatt_(The Underdog)

Thu Aug 13 2009, 11:05AM

Registered Member #135 Joined: Sat Feb 11 2006, 12:06AM
Location: Anywhere is fine
Posts: 1735

Can we not just password protect the registry, system files, and critical system files to prevent changes to the system?

Steve Conner

Thu Aug 13 2009, 11:19AM

Registered Member #30 Joined: Fri Feb 03 2006, 10:52AM
Location: Glasgow, Scotland
Posts: 6706

Sure, but if you did that, it would break a lot of existing software. Because Windows traditionally had lax permissions, software developers got careless too. So you get programs that you can't install without admin rights, or worse still, ones that won't even run without admin rights. And yet others that make hundreds of registry accesses per second, each one of which might trigger the password dialog.

or, as Father Jack might say: DRINK!

Backyard Skunkworks

Sat Aug 15 2009, 07:28PM

Registered Member #1262 Joined: Fri Jan 25 2008, 05:22AM
Location: Maryland, USA
Posts: 451

Steve McConner wrote ...

Sure, but if you did that, it would break a lot of existing software. Because Windows traditionally had lax permissions, software developers got careless too. So you get programs that you can't install without admin rights, or worse still, ones that won't even run without admin rights. And yet others that make hundreds of registry accesses per second, each one of which might trigger the password dialog.

or, as Father Jack might say: DRINK!

What you can do though, is to run any questionable files either in a VM, or on LiveCD. I do that all the time with files that I can only get from a shady source, and then disassemble them and have a look at what they do. I won't run a file on my real windows install unless its either from a trusted source, or I've unpacked and disassembled it, and its come up clean on virustotal.com.

Watching filesystem and registry activity with Process monitor (from sysinternals) on a VM is also infinatly helpful. When you see a lot of unexplained registry activity that doesnt involve program settings, or a bunch of files being written in system32 or program files, you know something is up. Also, running a program such as Startup monitor or spybot Teatimer is very helpful in preventing malware from registering their executables to run at startup.

Nicko

Sat Aug 15 2009, 08:20PM

Registered Member #1334 Joined: Tue Feb 19 2008, 04:37PM
Location: Nr. London, UK
Posts: 615

Backyard Skunkworks wrote ...

Watching filesystem and registry activity with Process monitor (from sysinternals) on a VM is also infinatly helpful. When you see a lot of unexplained registry activity that doesnt involve program settings, or a bunch of files being written in system32 or program files, you know something is up. Also, running a program such as Startup monitor or spybot Teatimer is very helpful in preventing malware from registering their executables to run at startup.

sysinternal = hackery = not for ordinary folk.
vm = hackery = likewise

Process Monitor is a great tool, but even on an safe program it can generate reams & reams of output. 99.999% of people will never run anything first time in PM.

I've disabled TeaTimer on almost all our PCs (a few hundred) as it can absolutely kill performance - occasionally it loses the plot and runs 100%. Also, SBS&D Immunise kills internet performance by putting a gadzillion barred addresses in the hosts file. Killer way of doing it.

Nicko

Sun Aug 16 2009, 04:55PM

Registered Member #1334 Joined: Tue Feb 19 2008, 04:37PM
Location: Nr. London, UK
Posts: 615

Renesis wrote ...

Nicko, you seem to know what you are talking about. I am using an updated version of Norton Internet Security, and people around me keeps telling me that it is completely useless. I am not qualified to either agree or disagree, but it seems to be very professional and it costs a lot, so it *should* be a fine AV. What is your opinion?

I don't have a view personally, but some of my colleagues aren't enamoured of it especially since it was acquired by Symantec. It's not a product we use any longer.

Renesis

Sun Aug 16 2009, 10:05PM

Registered Member #2028 Joined: Mon Mar 16 2009, 08:13PM
Location: Norway
Posts: 319

Nicko wrote ...

I don't have a view personally, but some of my colleagues aren't enamoured of it especially since it was acquired by Symantec. It's not a product we use any longer.

I see. But i'll keep using it anyhow, i did after all pay for a full year. Thanks for your reply

Dr. Who

Fri Mar 18 2011, 09:26PM

Registered Member #326 Joined: Sat Mar 18 2006, 01:12PM
Location: Glasgow, Scotland
Posts: 66

The other cause of increasing windows slowness lies in the tendency of many applications to install components which run automatically on startup and continue to use RAM and CPU cycles while the PC is running. A lot of peripherals, such as printers, MP3 players, scanners, mobile phones, wireless adapters, etc. add such background software to your system. If you're no longer using a piece of hardware with your PC, it is very wise to uninstall the corresponding software.

MS Office, OpenOffice and Adobe Acrobat have components that run on startup, these can often be disabled via the menu that appears when you right-click the corresponding icon on the right-hand side of the taskbar. Google Desktop Search and Windows Sidebar have the same flaw, and should be disabled or uninstalled. HijackThis is also a handy tool for removing unwanted startup slow-ware, but must be used with care. Make a restore point before making changes with HijackThis.

Pinky's Brain

Sat Mar 19 2011, 11:00AM

Registered Member #2901 Joined: Thu Jun 03 2010, 01:25PM
Location:
Posts: 837

Edit : Oops, saw a little too late this was an ancient post ... thought you were hit by the same attack which hit the UK en masse last month.

Still slightly on topic.

previous 1 2 3 4 next

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob