Hot:

I saw this comment today on a malware site and I normally read them to see how folks troll malware sites looking for blame.
Folks, malware is your problem, not anyone elses.  I am constantly reminded how people fail to understand that its their actions and choices that cause the infections, and today social engineering is a big reason.
Even malware experts are not immune from falling victim to their tricks.  Its been like this for years and outside of the increase in targetted attacks,
its still the #1 reason.

What bugs me the most is how people feel like a innocent victim,
when they should really understand that they are the Generals leading the charge.
This letter below really sums up the problem with users in this regard.

NOTE: I am very sympathetic to anyone who gets infected
(just ask my email box…) and over 80% of people who have infections get
free assistance from me, even though I charge for my services.
But people simply do not know and do not bother to find out what they do
online is the cause of their problems.

Here is the entire comment, I will requote sections I will comment on.

---------------------------------------------
Charlie22 in Nova Scotia

I was infected with System Integrity Scan. Basically it was some sort
 of malware that would continuously popup urging me to download
"the fix". I did not download "the fix" as that would be directly
installing the malware on my computer. I knew I was infected so I
googled it and came across the malware removal site (which is a
lifesaver!) and after about a week my computer was certified clean.
I didn't lose any money, but I sure spent a lot of time troubleshooting
with the help of malwareremoval.

I would like the Canadian government to make maleware (spyware, adware
and any other sort of malicious software) illegal. Furthermore, any
server found to a) contain or b) support malware would be fined, the
actual server physically destroyed and those responsible imprisoned
and banned from computer access indefinitely. I'm not a computer whiz,
but for someone who is, it wouldn't be that hard to figure out which
servers are poisonous and which are not, who owns them and where they
are located.

I believe that malware is a form of harassment and an invasion of privacy;
two things that are both punishable under the Canadian judicial system.
As well, I think that malware violates the spirit of the internet.
What I mean by the spirit of the internet, is that it's a (for the most
part) uncensored medium, and users have a right to that freedom, however
it shouldn't be unsafe to use the internet. I'm not saying that illegal
/ illicit activities should be allowed on the internet, but I should be
able to roam freely without worrying about a cyber attack.

-Frustrated Malware Victim
---------------------------------------------

Well Charlie22, let me respond. First you installed a rogue-software or
fake-software tool that was in fact malware. Ok, this happens to everyone
and has become a big business for the malware authors. Now you did not
innocently get infected by a friends email or IM sent to you, you
did not visit a site that hosts malware, you did not run across some
illegal file sharing site and download some software (ok, maybe you did
but your post does not give me the inclination to believe this).

You found some program on the net, and decided to download and install it.
Simple. This is the #1 risky thing you can do on your system is give
trust to an unknown application By far the most risky thing today.
Sure its easier for me to say this than it is to live you life by it.
Everyday we get asked to just run/install something before we have
the facts. Many of us do not even give it 10 seconds thought which is
the real issue.

[page_break]

Many sites offer .EXE downloads only. FLAG #1. Even Malware experts
are guilty of creating their scripts into .EXE tools. It is quite common.
Thankfully delphi and other vendors offer engineers like myself tools to
reverse engineer these programs to determine what makes them tick.
Malware researchers do this all the time. However this is in most circles,
and license agreements a violation of usage, or other laws. See the
catch-22 here? A malware researcher needs to do this to make an accurate
assessment, yet its illegal activity. This simply turns the malware
experts into the very criminals they may seek to twart. Until this changes
its a very grey area that is wrought with legal challenges. But without
this going on, you would know nothing about how to fix your problem with malware.
But, users are not going to know how to do this or why.

So when you go to a site and download a .EXE file be suspicious, even if it
says its SPYWARE FREE. You have no idea, no clue so do not guess.
There are numerous sites to submit files to for testing purposes such as
VirusTotal.com or
jotti.org, even many of the AV vendors have their own
online submit forms (sunbelt, DrWeb, Kaspersky, etc.) to check your files.
However the act of downloading is not the method of infection, its
running the .EXE that typically causes your infection. Again in some
cases the license of the program may actualy forbid you to submit
samples for analysis

Now you downloaded a tool called System Integrity Scan,
which by its name to me, would imply that it is a file-integrity
checker. Why would you need such a tool in the first place?
Many times when I ask folks why they downloaded and installed an
infection in their system, they explain the tool looked
interesting|looked cool|I needed a tool like this, which is fine,
but then I ask, what do you know about the author? Usually this
draws a blank stare. This is a problem. WHO are these folks building
tools for us? What do we know about the real motive?
Especially in Windows and moreso in the Mac world, too many idiots
write software trying to make a buck and leave their resources open
to abuse. Worse is when folks head out to the grayhats and blackhats
areas on the web and start downloading software.

Getting back to the integrity checker, why did you need one? This
type of tool is designed for people who can manage massive file
lists, and verification methods and knows how to compare them.
Windows itself has a fair bit of integrity checking already built
in, from certificate signed programs and files, to DEP which protects
modifications to files that Windows watches. So why you felt the
need to download this software is the first issue.

Next what do you know about the authors? Is the tool licensable?
Are the developers known to the community? Do they have a decent
web site that offers you means to contact them? Do they provide
a real brick and mortar facility that you could actually visit?
What do other people/peers have to say about the product?
Does the tool/program come with source code? How is the product licensed?

All the above questions are very, very, very important to avoid
malware. If the developers are known to the community then its
a good chance they are not writing malware, still not enough to
confirm with just this. Many of these are pay software, but the
license is draconian (not allowed to share/sell/redistribute,
only allows install on one system. Sure lots of legit software
fall into this category, but licenses that do not provide the USER
with any rights can and will work against you. Stay away from
software that insists upon harse license conditions good or bad.

[page_break]

Having a web site that contains vital contact details, terms and
conditions, and a privacy policy. All these are vital REGARDLESS
of the web site you go to. Sure many personal web sites
may not have such things, but you would not consider getting
software to run on your PC from these sites either. 3rd party
downloading is not so much an issue since everyone does this to
preserve bandwidth. Having a valid email that the developers
respond to or a address or phone number go a long way into
reducing your risk.

Does the program provide its source code? Sure many Windows
programs do not and would refuse to provide you with it should
you ask (and building on Windows is no simple exercise…),
but why? Five times out of 10 they are just greedy and do not
want you interferring with their code (probably due to the fact
that its immature or possibly stolen…), but this is no excuse.
Anyone worth their salt could reverse engineer the software to
find out exactly whats what. Since software without source
distribution means you are at their mercy to believe their
claims. You cannot have a peer review to see if the code
is any good. And folks, much of it is rubbish.

Now Charlie22 did not actually download the real malware, she
got the downloader or loader component, which is designed to
force the user to download the actual infections. She was
wise not to do this, but with a sophisticated loader she
would be infected anyways. Hard to say without details of
the infection, and even then still difficult.

Now let me quote this phrase “…knew I was infected so
I googled it and came across the malware removal site (which
is a lifesaver!) and after about a week my computer was certified clean.”

This is what MANY who become infected do, and thats great!
They find a site to help them, they get a malware removal
expert who then certifies them as clean. Balony!
Let me qualify that balony with, you cannot check for kernel
rootkits on a running system. Period. Many userland rootkits
will go undetected also. Anyone who tells you otherwise is
lying to your face. Thankfully this is pretty well accepted
in the security community.

[page_break]

1. Most online malware experts are trained by others in
generic detection and removal. They do not understand
Malware forensics, hard disk recovery and forensics, debugging
code, reverse engineering files, many simply lack the proper
tools to do it (they are simply reviewing logs….) and then
cause more stability issues with the various pieces of custom
code to fix the system. Much of which is designed for stupid
users and not experts at Malware removal. However, I do not
want you to think I am being negative at all these folks, its
just that after watching this trend for five years I can say its
much adieu about nothing, since we do not address the problem.
Besides certification implies (and holds for liability
purposes) that they are truly clean. Since 99% of the
cleans I have reviewed seldom if ever find the true infection
vector, the fix is temporary at best. However some of the nastier
malware has such an impact on the system (which most people notice
as slow or crashes) that their removal has a vast improvement
on the system performance and stability. Thats great. In most
cases killing the active component of the malware pretty
much fixes the system. However malware authors are not blind to
the possibility of more infections using the dormant files left behind.

2. Many lack the ability to actually install software themselves
since they simply do not have access to the box. As such, they leave
it up to the user to do things in a calm controlled fashion. Again
folks like Charlie22 get too frustrated over this, and leave themselves
open for a mistake. Thats all it takes is one mistake to undo everything.

3. It takes many so-called malware expert fix it sites,
days even weeks to even acknowledge your post, then they have to
review your log, or get you to post one, some may have to check
first to see that your not running software they do not want to
work with. Then the time required for you to constantly login
to see if the expert has responded. Then you have to u
nderstand the response, and follow their instructions, then
follow up. This could go on easily for upwards of 10 or more
exchanges. Great, but this may mean months to get your PC fixed,
and what damage is being done in the mean time? Who else is
getting infected thanks to your PC? Who else is impacted because
you continue to use an infected machine? What do you lose out
on by not using the infected PC? So its great that you can get
online help, its not so great that it takes such a long time
to complete. Now it is not like there are not methods that are
available to allow remote users from fixing systems remotely,
again its very speculative whether it would be more effective
than simply taking it to a malware removal specialist in the
first place. Hands on with a machine means I can isolate
various hardware and test it in a controlled and trusted environment.
Since you got infected over the Internet in the first place
why would you consider using the Internet to fix the problem.
It can be done but logically it does not make any sense.

[page_break]

4. Considering that you could take the PC to a Malware
specialist, and in a few hours (at worst a day!) get your
PC back clean and fresh, it makes no sense that ANYONE would
waste this much time trying to deal with this online. On
average a PC cleanup will take 2-4 hours and at $70.00/hour
thats $140 – $280 to fix. For a $300-400 PC it seems a heck
of a lot to spend, but compared to 10-20 hours online (possibly
over 3 or 4 weeks!!!) it is a big impact. However COST is the
big factor and many folks are just TOO CHEAP to pay an expert
to fix their system in a few hours, or they are embarassed by
the infection or what they have on the PC. This is probably
the biggest deterrent to getting decent help. They are afraid
someone will find their porn collection, or illegal data collection,
{insert reason here} and so they will not take it in for fear of
reporting to the cops or accidently telling their spouse about the
porn collection.

For the record, and I speak only for my pc repair company…….
I do not care if your OS is legal or illegal. I do not care if you
have porn or pirated software on your PC. I do not care what you use
the PC for. I will simply work with you to fix it to the best of my
ability given what you have. Now I certainly will advise you if the
illegal stuff is causing a problem for you and how to avoid this
stuff if you like.

5. Many folks fail to consider hardware failures and problems
as the source of their troubles. Bad memory can behave like malware
in many ways, and is very simple to diagnose and fix, even a baby
could do it (provided they understand how to run memory testers ,
seriously tho, simply checking your hardware first could save
endless issues with wierd problems. But you cannot get this
checked professionally online on a malware fix-it site.
Sure, some have great volunteers, etc. etc. but they are volunteers.
If your PC is nothing important, fine then it makes sense to use this approach.
But I can say so far almost everyone I have ever done work for has
never come up to me and told me that the PC was not that important.
So if you have important stuff on a PC, you should spend you money
and time more wisely, let the experts fix your PC.

Regardless, of your choice of taking your PC in for cleaning or
you do it yourself the success comes down to understanding how to
do basic tasks on your PC. If you are not comfortable using a CLI,
then you probably should not be doing malware recovery or file-integrity
checking on your system. Oh, CLI stands for Command Line Interface,
but it can also be known as shell, DOS Prompt/Shell,
Command Line, Text Mode, terminal, and maybe
some others I am forgetting. Regardless it started by running cmd.exe
on the system and it opens a CLI for you. Many folks forget that
many of the power tools you download from various sites can
be done from the CLI with little to no effort. An example is KillBox.
This is a program that runs in Windows to allow you to delete files
that will not delete properly. Why not delete files properly?
Well that file-integrity checker thats a part of windows will
automatically restore any file it thinks is important, regardless
of whether the file is infected or not. So if you delete this file,
windows simply restores it. So the first thing to do is to find the
cache of the files, and delete it from there first, then delete the
running version. From the CLI you simply type delete /f filename.ext
and the file disappears forever. Sure killbox is handy but it requires
you to reboot in order to delete the file (during which time even
malware can reinfect) without intereference. What bugs me is that
some entities are attempting to sell you killbox like tools
for $40-100. Which you simply do NOT need, nor should you ever pay
money for. So even though its handy, it introduces steps we simply
may not need to perform (ie: reboot).

[page_break]

Charlie22 goes on to say “I didnt lose any money, but I sure spent
a lot of time troubleshooting with the help of malwareremoval.”,
which is one of my big points. Time is a precious commodity that
many people dont take enough control of. If your unemployed and
have lots of time to spend figuring this stuff out, great! Wonderful!
If your married with kids and trying to work, raise a family, and
spend time with your SO, or even friends, why would you take those
important hours to waste dealing with Online support solutions that
are volunteer based? Cheapness is the only reason I can see,
you are too cheap to spend a couple hundred dollars to save the time
and get the PC fixed, yet you will turn around and spend that online
or at best buy buying security software packages for example.
This is just a waste of money yet many folks think this is the way to go.
Why? They do not investigate they just read the advertising…

Anti-Virus products these days are simply NO GOOD at detecting much
of anything in a REAL TIME environment, yet most of the AV products
have free scanners but charge you for the real-time protection.
Throw it away. All realtime detection does is slow down the PC,
cause instability and flag the user to things they do not explain well
enough to be usefull. I have had numerous examples of various
ANTIVIRUS software detecting REALLY HONEST GOOD SOFTWARE. Had I
listened to this software I would have in some cases broke my PC to
not work. Folks the scanners are the only value in AV software today
and they are only going to be any decent AFTER YOUR INFECTED. So do
not think any of these security products are capable of stopping
anything in todays malware environment. Since 2004 most engines
appear to be 4 months to 3 years behind updating against in the
wild infections. Some companies now have gone to war against
other malware software companies and detect their packages as hostile,
or worse you install two packages and they have a war on your PC.
This is WAY worse than most malware symptoms you will ever experience
so I am not going to advise anyone to install this software. One
good scanner that can be isolated so it cannot be modified is important,
so I recommend using online scanners as much as possible. Almost all
of these are free and will work better than tools on the PC. On top
of this a lot of malware is capable of detecting AV products are either
disabling them, or circumventing these tools renders them simply
resource hogs. Not a solution, but again the marketting arms of
Symantec, Trend Micro, McAfee, etc. are going to tell you how
at risk you are without their solution. What they fail to tell you
is that your only improving your risk a couple of percent over
NOTHING AT ALL.

Because of that (and many of my avoid snake-oil salespersons selling
security products) I will never be recommened as a Microsoft MVP,
since I am not interested in making these folks money. I do NOT think
they have any RIGHT to make money, and I will go to great lengths to
encourage users not to spend their hard earned money for nothing.
Since software typically offers no assurances whatsoever about fitness
or ability, I beleive in the addage, “pay people not code”.

[page_break]

Now I am about to go on to less technical reasons for my interest in
this comment, and explain the next two paragraphs:

First, Charlie22 stated:

"I would like the Canadian government to make maleware (spyware, adware
and any other sort of malicious software) illegal. Furthermore, any server
found to a) contain or b) support malware would be fined, the actual
server physically destroyed and those responsible imprisoned and
banned from computer access indefinitely. I am not a computer whiz,
but for someone who is, it would not be that hard to figure out which
servers are poisonous and which are not, who owns them and where they are located."

Ignorance is bliss. And Charlie22 is really ignorant.

1. Malware is illegal, nearly everywhere. Most malware breaks license
agreements on most systems it infects. Most malware even breaks other
types of criminal law when it involes phishing or 419 type scams.
However much of malware is in the guise of advertising, which is
not illegal but probably highly immoral.

2. The courts are still working out definitions of these terms,
and as much as we may hate adware for instance it IS NOT
illegal, and frankly never will be. There are too many billions
of dollars surrounding advertising for anyone to do anything about
adware, yet it is the #1 cause in malware methodologies and infection
vectors. Because there is a lot of money it attracts a lot of criminals.
The solution is simple. Ban your system from displaying ANY FORM of
advertising. You are technically capable of challenging the
validity or honesty of advertising (even the big Fortune companies
lie or mislead>/i> in their advertisements, why should web
advertising be any different? But most folks in society are so geared
to advertisements that some folks think that banning all adverts
in a browser is stealing from a web site. Misguided fools they are.

3. Another addage; Anything on the net is free game.
This means PCs, servers, military C&C, ANYTHING even pictures of
the birth of your son is available for anyone who cares. Far too
many folks do not understand the simple tenant of the Internet,
its content for everyone. However many folks spend time restricting
access to this information to points of detail even I lose focus on.
In order for the net to remain free, you have to understand that you
alone are responsible for your machines or content you place on the Internet.

4. Many servers are ill protected, and harbor so many sites
(virtual hosting) that it is impossible to hold one site accountable,
unless it can be proved that they purposefully harbored malware,
even so what if the server is not in Canada? Then what? How does the
Canadian government police the Internet, it cannot and it should not.
However I have no problem if the person responsible decides to come to
Canada for some reason and gets arrested and charged upon arrival.
However that is not much of a deterrent.

[page_break]

5. Charlie22 last statment is just laughable. let me requote it:

"I'm not a computer whiz, but for someone who is, it wouldn't be that
 hard to figure out which servers are poisonous and which are not,
who owns them and where they are located."

Yes, you are not a computer whiz. Even for the computer whizzes,
the malware whizzes are just as smart, maybe even smarter, and have
less restrictions against them. Forensics is about finding evidence
in an approved manner that ensures the evidence was not tampered with
by the investigator. There are some great stories of guys who are smart,
who thought they could get the bad guy, and in term actually ruined the
investigation, rendered all evidence useless, and in turn got themselves
in legal hot water thinking they could perform the same tactics as the
malware designers did, to catch them.

It is NOT that easy, it is NOT that simple, and it is NOT that cut
and dried or black and white as Charlie22 would admit, but in fairness
she is not an expert and simply does not know. Using the same line of
thought I could say:

“I am a computer whiz, and in order to prevent malware we should not
allow any user to ever install software on their PC. They should go
buy a computer which does all they want with all the software preinstalled,
and forced by license to stick with it as is, and fine them should they
attempt to cirumvent the protections in place by installing other software.”

(some would accuse Apple of this form of licensing currently….but
not quite folks. Its pretty close tho.)

This would eliminate malware once and for all, but you would
have to buy prebuilt systems with preinstalled software that
hardened and locked down to prevent any form of modification.
No more malware issues. This is what should be done.

Oh? Am I being silly? Am I being totalitarian with my argument?
Fair comments. But is it any less than Charlie22 wanting to hold
all the server operators (who typically have little to do with their
sites hosting stuff)? Is it any less naive to think that the Canadian
Government should spend taxpayers money trying to police the .ca namespace?
I do not think so. I think my idea is superior (from a anti-malware
perspective) but it certainly would refocus what we use computers for
in our lives. But is not this where the problem is? Users downloading
stuff they should not? Users thinking they know how to fix or repair their
PC when they do not have a clue? Ok I am done with this and you can
forget I suggested it since I am not in support of my own example here,
but I wanted to offer the same argument from the opposite perspective and
you can see the argument is really quite pointless.

[page_break]

Charlie22s last paragraph is just all wrong for all the right reasons,
which is a shame because I like the idea its just not at all attached
to reality we call the world today:

"I believe that malware is a form of harassment and an invasion of privacy;
two things that are both punishable under the Canadian judicial system.
As well, I think that malware violates the spirit of the internet.
What I mean by the spirit of the internet, is that it's a (for the most
part) uncensored medium, and users have a right to that freedom, however
it shouldn't be unsafe to use the internet. I'm not saying that illegal
/ illicit activities should be allowed on the internet, but I should be
 able to roam freely without worrying about a cyber attack."

Malware is not a form of harassment, it is software plain and simple.
Some malware is even beneficial if used ethically (such are called
hackertools). Using the malware to harass is a WHOLE other
matter. But again she should be complaining about the advertising methods
used by legit advertisers that malware developers simply adopted.
As for Invasion of Privacy, this is just the stupidest argument I have
ever heard. Since WHEN have you ever had an expectation of privacy?
Can you define Invasion of Privacy in the Canadian Law? Probably
not since first the internet is about OPEN SHARING which means…good
OR BAD…you are sharing information with the entire Internet.
That is the opposite definition of privacy from my merriam-webster
dictionary definition, and also the Canadian Governments definition
of privacy. Have you read the license agreements and terms and
conditions on the internet or with the software you have? Probably
not, again that is probably a big waste of time for Charlie22 and
most people. But its a vital document explaining your rights and
where you have possibly waived them. A stripper has no
expectation of privacy against the viewing of her body to the
public, why do you think you have any privacy using Facebook or
Myspace for that matter? Anonyminity has long been the definition
of protecting online privacy, yet it is underpressure due to the
amount of bad guys? that use anonymousness to further their
goals. So which do you want, real privacy (in the form of
anonymous) or no privacy to help prevent bad guys from doing
their stuff? Keep in mind RIGHTS are something most bad guys do
not even consider, let alone worry about.

[page_break]

The only way you truly get privacy is if you remain anonymous.
However by being anonymous you reduce the chance of tracking
which is the #1 goal of advertising. Since anonymous folks do not
help advertisers, they are bad for big business, hence they must
be bad all around. This is a terribly ignorant perspective on being
anonymous, yet it is being pursued by many groups.

Charlie22 goes on to say something that simply is not mutually
exclusive, yet she tries hard to convince us it is:

"As well, I think that malware violates the spirit of the internet.
What I mean by the spirit of the internet, is that it's a
(for the most part) uncensored medium, and users have a right to that freedom,
however it shouldn't be unsafe to use the internet. I'm not saying that
illegal / illicit activities should be allowed on the internet, but I should
be able to roam freely without worrying about a cyber attack."

Well thats a great utopian dream, but its nothing more than a dream.
The internet was built under the guise of having a non-destructible
communication system. (Boy has that gone south!), it was designed
to offer the US military a superiour advantage in battle. Today that
has disappeared however the goals and issues are still the #1 concern
to many nations. Since the Internet is such a critical piece of the
communications structure to a nation, entities will see fit to disrupt
the communications of any warring party. Sorry, but war is a fact of
life as a day does not go by on this planet called Earth without some
battle being fought. Did you know the first computer virus was build
by Isreali spys and designed to disrupt palistinian computer systems,
and the interconnects of those systems to their allies? I bet you did
not realize that todays malware can trace its roots to the spy games.
So until we get rid of spys we will not solve this centuries old problem,
thats now on the net. In this sense who cares about Charlie22 PC? Nobody.

I guess Charlie22 also does not understand uncensored, that
typically also may include things that offend you or even the
community. Who decides what gets put up so Charlie22 does not have to
worry about walking down dark back alleys in drug/gang infested neighborhoods.
Sure she has a good point…you should not HAVE to, but if you do not
its a RISK you are taking. This is the real issue…risk assessment.
Sorry Charlie22, you fail without understanding risk and how to assess
it you are doomed to be a victim all the time. You are doomed to complain
that the government should do something about this when in fact you are the
policeman…you are the judge…you are the jury. Act like it and take steps
to stop being a victim. If this was a violence against women issue,
you would go see counsellors who would teach you to learn the signs, how
not to be a victim, and how to get out of the situation. The same rules
apply with your PC, the best part is its typically non-violent, unless
you start chucking computers around the house.

As for illegal/illicit activities on the Internet, Charlie22 has opened
another can of ignorance. As far as illegal/illicit activities where?
There are so many legal entities around the globe one could never hope
to know all the laws and rules, yet Charlie22 seems to think either that
it is very easy to grasp or that all the laws around the globe are the
same everywhere. They are not. They SHOULD not. I like the fact that
life is dangerous and deadly, yet we can live through it without having
to resort to glass bubbles. I know that there are hostile activities
going on right this second on the internet and I take the steps necessary
to protect myself from what concerns me. However this does not mean
that it is a cut and dried solution, frankly it is not.

[page_break]

One of the best solutions is simply eliminate closed source programs,
stop using them, stop buying them. Stick to open source software.
When one can read the source and compile it themselves you can rest
assured that it IS very unlikely to have malware. Stick with closed
source solutions, and you ll remain grasping at straws to fix problems with
your systems.

---

related post

• Looking for Work - Qualityshopper.org wants you, but does it secure your data?
• Unlocker 1.8.7 Infected with Trojan Adware
• Malware Discovered In Ubuntu -- Gnome Screensaver and Gnome Theme
• Focus Group Music Survey for $100 - I don't think so.
• Move Buttons Back To The Right - Ubuntu 10.04 Lucid Lynx

Comments are closed