What's the latest in anti-malware for the PC?

February 22, 2005 9:48 AM

I've been called upon to immunize a friend's PC against all sorts of malware (after re-installing the OS and apps to recover from the current infestation). Since I moved completely to Mac a while ago, I've lost touch with the current state of PC health. I intend to install NAV, AdAware, Spybot S&D, and SpywareBlaster, as well as the latest Win2k patches. I'll push Firefox, too. What else should I do to protect my friend's PC? What's the latest in anti-malware?
posted by jdroth to computers & internet (14 comments total)

Kills me to say it, but Microsoft's new anti-spyware app is effective.

If they're using broadband, a good router is the best first-line defense. Couple that with firefox (and thunderbird if they'll do it) and they should be safe for a while. I use Mozilla apps, a router and AVG, and I never even find anything when I do adaware, spybot and MS scans.
posted by Mayor Curley at 10:31 AM on February 22, 2005

I've found that the latest microsoft anti-spyware beta is very effective.
posted by viama at 10:34 AM on February 22, 2005

I thought How to Fix Mom's Computer was helpful. It offers more suggestions than it looks like you need but there are some relevant ones there also.
posted by MLIS at 10:39 AM on February 22, 2005

I heard somewhere recently (excuse me for not googling) that the MS Anti-Spyware app was actually already being targeted by those foul villains of malicious code, and thus I'm a little wary about installing it. But it sounds as if a couple of you have had good experiences with it. Am I worrying too much?
posted by jdroth at 10:41 AM on February 22, 2005

Microsoft's anti-spyware ought to be the best, I mean they did write the Operating System, after all.

I personally use AdAware, and also disable the Run Once and Legacy Run list, which are those registry keys that items can be placed in to start automatically at boot. Eliminate this startup route, and a lot of programs won't be able to reload themselves automatically. You can do this in Group Policy under Windows 2000 and XP Pro. In the same area, you can specify programs that you do want to automatically load, like trackpad drivers or printer helpers.
posted by odinsdream at 10:43 AM on February 22, 2005

Wow, MLIS, that site is a nice concise outline of what I end up doing (out of order) when people ask me to work on thier machines. Good find.

As a side question, anyone have suggestions how to convince people of the boon of Firefox/Thunderbird?
posted by steelbuddha at 10:48 AM on February 22, 2005

First thing: burn a cd-rom with the Win2K updates and a Kerio personal firewall.


Before you re-install the OS on your friend's computer, unplug the ethernet cable (or otherwise ensure it's off the net.) Install the OS patches and firewall before connecting to the net.

An unpatched PC on the net lasts an average of 16 minutes until compromise.
posted by Zed_Lopez at 11:09 AM on February 22, 2005

I've had no trouble with introducing people to Firefox after demonstrating tabbed browsing. Most people think The Internet means That Blue "E," so you'll actually have more trouble teaching them what a browser is in the first place.

Just set up firefox as their default browser.
posted by odinsdream at 11:33 AM on February 22, 2005

Just set up firefox as their default browser.

And get "That Blue 'E'" off the desktop or point it to Firefox. Old habits die hard.
posted by Mayor Curley at 11:40 AM on February 22, 2005

Zed_Lopez: I love this advice. However, I don't even know how to burn the Win2k updates onto a CD-ROM. I always just download them direclty from Microsoft immediately upon completing an OS installation. Is there a way to download them to disk without installing?

Odinsdream: I wish the Firefox were just as simple as "demonstrating tabbed browsing". I've problaby tried to push Firefox on a dozen people during the past few months. Only two have taken to it. Most don't get the concept of tabbed browsing, and won't unless they use it for a couple hours.

Others use web sites that don't display properly in Firefox (because they're built around IE's fussiness), or that won't even work. I do the maintenance for a small accounting firm. A couple of the employees are trying to use Firefox, but they can't get their internet radio stations to work, so they keep using IE.

And while it's nice to set Firefox up as the default browser, it never really works that well. Many pieces of malware specifically launch IE for popups, so if any sort of infection occurs, all of a sudden there's IE all over the place. Also, MS insists on launching IE for Windows Updates, which pisses me off to no end...
posted by jdroth at 11:40 AM on February 22, 2005

Most of the bases have already been covered, but I'll also recommend HijackThis, which lists, in one place, everything that is set to run on startup. The biggest downside to HijackThis is that it's not particularly judgmental--after getting a list of programs that run on startup, one must use Google or something similar to determine whether they're malicious.
posted by box at 12:07 PM on February 22, 2005

You might want to try to set the person as a user and not an administrator and show them how to use the "run as" command. Its a command line command and also is in the right-click context menu when you right-click executables. Then they would have to type in the admin password to install an app. This helps a lot with frivolous installs and "drive by activex" installs.

I second MS's antispyware.
posted by skallas at 12:35 PM on February 22, 2005

Windows 2000 Service Pack 4. And there've been a whole bunch of security updates since.

If the session id makes that link ephemeral, the basic idea is:
Go to the Microsoft Download Center
Search on keyword 'security', product 'Windows 2000'.
Sort your results by date.

I'm embarrassed to have said just 'PC' above regarding 16 minutes to compromise. I meant, of course, a PC running Windows.
posted by Zed_Lopez at 1:08 PM on February 22, 2005

typing msconfig in the run window will bring up a system configuration utility that has a startup tab which will allow you to configure which programs run on startup.
posted by jason9009 at 11:21 PM on February 22, 2005