1. Warren Toomey North Coast TAFE Port Macquarie campus
ICASAS206A Detect and protect from spam and destructive software Detect and Remove Destructive Software
Warren Toomey
North Coast TAFE
Port Macquarie campus

2. Malware Malware: software that does things you don’t want it to do
Slows your system, corrupts files, steals your data, steals your personal information
Sends s on your behalf
Takes you to malicious websites
Captures everything that you type
Watches you through your webcam

3. Malware Terms
Virus: not a full program. Modifies an existing program to change its behaviour
Worm: full program with malicious behaviour that copies itself to new computers
Rootkit: program with a backdoor that gives itself elevated privileges on your computer
Adware: software that displays ads
Spyware: software that spys on you
Key logger: software that captures your keystrokes

4. Malware Terms
Trojan horse: software that looks like it has a useful purpose, but hides malware inside
Backdoor: software with a hidden access mechanism that lets others into your computer
Screen scraper: software that captures what is displayed on your computer and sends to someone else

5. Malware Vectors
Malware gets into your computer from somewhere else. Where from?
s and attachments
Infected application documents (Word, PDF)
Downloaded from websites
Intentionally, click-through downloads
USB keys
Directly from the Internet (bugs in existing software)
Even real install disks (infected at manufacturers)

6. Protecting from Malware
So many ways for your computer to get infected
We need technology to help prevent infections
We also need intelligence and education to ensure we minimise the chance of being infected
Also, once your computer is infected, it can be an infection source for other computers
Botnet, to your contact list, infected files on your USB key etc.

7. Anti-malware software
Anti-virus software
Adware detectors
Network firewalls
Block outbound connections to bad sites
Regular software updates

8. Anti-virus Software Lots of 3rd party tools
Avast, AVG, Avira, Bitdefender, BullGuard, Emsisoft, ESET NOD32, Fortinet, F-Secure, Gdata, Kaspersky, Kingsoft, McAfee, Microsoft Security Essentials, Panda Cloud, Qihoo 360, Sophos, ThreatTrack Vipre, Trend Micro Titanium
Free and paid version of most of them
Read reviews, choose a well-recognised one
Keep them turned on, run scans regularly

9. Anti-virus Software: How They Work
Fingerprints: database of byte codes of recognised viruses
Files are scanned. If fingerprint detected, file is flagged as infected
Possible false positives and false negatives
Checksums on normal system files
If checksum fails, file has been tampered with
Heuristic approach
Patterns of code that indicate malicious behaviour

10. Adware and Spyware Detectors
Similar to anti-virus but detects adware and spyware
AdAware, Microsoft Windows Defender, Spybot- Preventor, SuperAntiSpyware, Malwarebytes, SpywareBlaster, SpywareGuard

11. Network Firewalls
Block incoming and outgoing network traffic based on their characteristics
e.g. stop outbound s except those to your ISPs official mail relay
stop unrequested inbound network connections
Best to block most things and only enable traffic if you need that service
However, will cause failures and side-effects that you many not be able to diagnose

12. Blocking Outbound Connections
Most firewalls block based on IP address
Web sites have names, so you also want the ability to block by site names
Google does this when you search
This link may go to a malicious web site
Also good for blocking ads on websites
e.g. AdBlock Plus add-on for Firefox
However, needs an updateable blacklist

13. Regular Software Updates
Bugs in software provide backdoors for malware
Keep your software patched and updated
Enable Windows updates
Set to check regularly for updates
Update Adobe software, Flash in particular
Update Java (if you have it installed)

14. Malware: Intelligence
Educate yourself about malware
StaySmartOnline: subscribe to their alert service
Use strong passwords, keep them safe
Use multiple passwords, don’t reuse
Anti-virus on, firewall on, software updated
Check your settings
Be careful with your USB drives
Download from trustworthy web sites
Don’t download tempting software

15. Activities Install anti-virus if none yet installed
Check settings, do a quick scan
Check your firewall settings
Check the status of Windows Updates
Browse the StaySmartOnline web site
Subscribe to their alerts!!!
Go back and read through some of the hyperlinks in this set of slides