Where Spyware Lurks on the Internet

Spyware has to be the most talked about PC security threat of 2005. It has now surpassed the computer virus as the No. 1 menace to computer user both at home and in the enterprise. Despite efforts from Microsoft and independent security software companies, the spyware menace is set to continue through 2006 and beyond. The research firm Radicati Group expect worldwide anti-spyware revenue to surpass $1 billion by 2010.

There are numerous types of spyware with some more dangerous than others. At one end of the spectrum spyware pushes annoying ads to your computer as is usually referred as “Adware.” It is still spyware as the ads are generally pushed to you based on your surfing habits. A bad infection can also dramatically impact your computer’s performance as your desktop slowly gets overwhelmed with pop up adverts.

At the other end of the spectrum spyware programs can record what you do on your computer including individual key strokes. This information is then shared with a third party. This data is then sold to marketing companies or used to profit from. For example, the program may have captured your bank log-in details or credit card information.

Profit from these activities drives spyware development and deployment. According to anti-spyware vendor Webroot Inc advertising revenue generated from spyware is much more lucrative than trying to generate profit through Spam Email.

Here are the common ways spyware gets onto your computer:

• Bundled with free software like screensavers or P2P file sharing programs which you download. For example Kazaa, a P2P file-sharing application, installs adware onto a user’s computer even though it claims to contain “no spyware.” Waterfalls 3 from Screensaver.com installs spyware and Trojan horses. Examples are courtesy of a report from StopBadware.org’s website.
• Opening Spam email attachments.
• Being enticed into clicking on links in pop up adverts which then downloads spyware. These pop ups usually display messages to do with winning money or entering a special prize drawer.
• “Drive-by downloading” – this is when spyware is automatically downloaded onto your computer from the website you are surfing.

Earlier this year a report published by the University of Washington revealed categories of websites which are mostly like to host spyware or infect users through “drive-by downloads.” Their research revealed the following categories:

• Gaming sites
• Music download sites (I interpret this to mean “illegal” music sharing sites like dailymp3.com or where you can find P2P applications)
• Adult sites
• Celebrity sites
• Wallpaper / screensaver sites

Here are some tips and strategies to reduce the chance of spyware infection:

• Switch on your browser’s pop blocker.
• Install an anti-spyware tool with active protection which helps prevent infection in the first place.
• Keep Windows and other Microsoft applications like office up to date with the latest patches.
• Use SiteAdvisor (http://www.siteadvisor.com). This is a free plug-in for your browser which tells you whether a site is safe or not based on their testing. This is new software which is highly recommended.
• If you are a frequent visitor of the high risk categories please consider changing your surfing habits or at least making sure your system is fully protected.

Read More

5 Security Considerations When Coding

1. Input Checking

Always check user input to be sure that it is what you expected. Make sure it doesn’t contain characters or other data which may be treated in a special way by your program or any programs called by your program.This often involves checking for characters such as quotes, and checking for unusual input characters such as non-alphanumeric characters where a text string is expected. Often, these are a sign of an attack of some kind being attempted.

2.Range Checking

Always check the ranges when copying data, allocating memory or performing any operation which could potentially overflow. Some programming languages provide range-checked container access (such as the std::vector::at() in C++, but many programmers insist on using the unchecked array index [] notation. In addition, the use of functions such as strcpy() should be avoided in preference to strncpy(), which allows you to specify the maximum number of characters to copy. Similar versions of functions such as snprintf() as opposed to sprintf() and fgets() instead of gets() provide equivalent length-of-buffer specification. The use of such functions throughout your code should prevent buffer overflows. Even if your character string originates within the program, and you think you can get away with strcpy() because you know the length of the string, that doesn’t mean to say that you, or someone else, won’t change things in the future and allow the string to be specified in a configuration file, on the command-line, or from direct user input. Getting into the habit of range-checking everything should prevent a large number of security vulnerabilities in your software.

3.Principle Of Least Privileges

This is especially important if your program runs as root for any part of its runtime. Where possible, a program should drop any privileges it doesn’t need, and use the higher privileges for only those operations which require them. An example of this is the Postfix mailserver, which has a modular design allowing parts which require root privileges to be run distinctly from parts which do not. This form of privilege separation reduces the number of attack paths which lead to root privileges, and increases the security of the entire system because those few paths that remain can be analysed critically for security problems.

4.Don’t Race

A race condition is a situation where a program performs an operation in several steps, and an attacker has the chance to catch it between steps and alter the system state. An example would be a program which checks file permissions, then opens the file. Between the permission check the stat() call and the file open the fopen() call an attacker could change the file being opened by renaming another file to the original files name. In order to prevent this, fopen() the file first, and then use fstat(), which takes a file descriptor instead of a filename. Since a file descriptor always points to the file that was opened with fopen(), even if the filename is subsequently changed, the fstat() call will be guaranteed to be checking the permissions of the same file. Many other race conditions exist, and there are often ways to prevent them by carefully choosing the order of execution of certain functions.

5.Register Error Handlers

Many languages support the concept of a function which can be called when an error is detected, or the more flexible concept of exceptions. Make use of these to catch unexpected conditions and return to a safe point in the code, instead of blindly progressing in the hope that the user input won’t crash the program, or worse!

Read More

Background of Password cracking

Passwords to access computer systems are usually stored, in some form, in a database in order for the system to perform password verification. To enhance the privacy of passwords, the stored password verification data is generally produced by applying a one-way function to the password, possibly in combination with other available data. For simplicity of this discussion, when the one-way function does not incorporate a secret key, other than the password, we refer to the one way function employed as a hash and its output as a hashed password. Even though functions that create hashed passwords may be cryptographically secure, possession of a hashed password provides a quick way to verify guesses for the password by applying the function to each guess, and comparing the result to the verification data. The most commonly used hash functions can be computed rapidly and the attacker can do this repeatedly with different guesses until a valid match is found, meaning the plaintext password has been recovered.

The term password cracking is typically limited to recovery of one or more plaintext passwords from hashed passwords. Password cracking requires that an attacker can gain access to a hashed password, either by reading the password verification database or intercepting a hashed password sent over an open network, or has some other way to rapidly and without limit test if a guessed password is correct. Without the hashed password, the attacker can still attempt access to the computer system in question with guessed passwords. However well designed systems limit the number of failed access attempts and can alert administrators to trace the source of the attack if that quota is exceeded. With the hashed password, the attacker can work undetected, and if the attacker has obtained several hashed passwords, the chances for cracking at least one is quite high. There are also many other ways of obtaining passwords illicitly, such as social engineering, wiretapping, keystroke logging, login spoofing, dumpster diving, timing attack, etc.. However, cracking usually designates a guessing attack.

Cracking may be combined with other techniques. For example, use of a hash-based challenge-response authentication method for password verification may provide a hashed password to an eavesdropper, who can then crack the password. A number of stronger cryptographic protocols exist that do not expose hashed-passwords during verification over a network, either by protecting them in transmission using a high-grade key, or by using a zero-knowledge password proof.

Read More

My Spyware Nightmare, Your Lesson

Have you asked yourself any of these questions lately?

1. Why is my brand new computer slowing down to a crawl?
2. Why is it taking so long to load a basic word processor?
3. Why do I have so many popups? Where are they coming from?
4. Why do I keep being sent to places I did not ask to go?
5. Where are these embarassing popups coming from? I never visit sites like that!

I did. I was ignorant. I was slow and it cost me a brand new computer. Here is my story.

A couple of years ago, we bought a new eMachine for my wife. She had just enrolled in school and needed something better for her school work. Prior to that, we had an older HP machine. I believe it was a pentium II. It worked pretty well, though a little slow. I wanted us to get another HP, but she wanted an eMachine. Her cousin had one and she thought it was good. I did not like eMachines a lot and did not think highly of them. She was bent on having one so we bought one.

With the arrival of the new computer, the HP was quickly abandoned. I was pretty much the only one that used it. Not because of my disdain for eMachine, but becasue the HP was more in a central location. Our three boys loved the new machine and spent quite some time on it. I was eventually won over to the eMachine and I must confess, it turned out to perform excellently well. It was good on speed and the resolution was great.

Several months down the road, I noticed how the new computer was slowing down. I knew in my mind it was the eMachine. They were no good. And then I thought it was the dial up connection. But I soon realized that it was also slow when I was offline. It was taking long to open up applications and even longer to load webpages. I also noticed there were strange windows openning up at the most awkward times. Some of the pages were to sites I would not ordinarily visit. May be the boys are going to places that we don't know about. As a concerned parent, I asked them and they promptly denied. I was still not sure they did'nt. They were teenagers.

As time passed, it became more difficult to do anything on the eMachine. We gradually migrated back to the HP and there was no immediate need to find out what was wrong with it.

Finally, it was time to act. I was ready to find out what the problem was. I started asking questions and doing querries on google. I was encouraged to get a good popup blockers. I did and it did not do much. That computer was far gone and corrupted. I had waited too long. I was not sure what was going on and did not know where to ask. The warrantee on the computer had also expired.

One afternoon, I turned the computer on to take another look and was greeted by a blank screen. The monitor had also quit I said to myself. Now I knew almost for sure it was the eMachine. They were really no good. My wife disagreed. But to be sure, I hooked the monitor up to the HP and it came alive. So it was'nt eMachine after all. I was a little embarrassed.

I reconnected the monitor and rebooted and was again faced by a blank screen. The following week, I took the cpu to a repair and they told me the computer was dameged beyond repair. I retrived it and took it to a sencond repairman and it never came back.

You know, lightening they say does not strike the same spot twice. But spyware is different. It can strike the same spot many times. Early 2005, I bought another computer, having out grown the HP. Months latter, I noticed the same exact symptons that ruined the eMachine. The slow down, the multiple popups, redirects to undesirable websites, they were all there. This time I did not wait. That afternoon I was frantic. I began searching for a quick answer. It was not until late that night that I found a product that worked for me. And once I found the right solution, spyware was no longer an issue to me.

Spyware can make your online experience a nightmare if you are not forward thinking about internet security. The good news is that there are plenty of products out there that can cure that effectively.

Read More

How to Protect Your Files From a Computer Virus

How safe is your computer? Could you be in danger of getting a virus on your system? Just how real is the danger? What steps should you take if any?

While visiting with a one of my students, I became aware that her anti-virus software was over seventeen months old and had never been updated. Upon informing her that she should update her anti-virus software regularly, she was totally surprised. Furthermore she had no concept how essential this was to ensure her system's safety. Therefore I thought it wise to write about some of the precautions you should take to avoid becoming infected with a computer virus.

While there are many 'virus' hoaxes, and please do not pass any of these hoaxes on as these may actually contain viruses, computer viruses do pose a very real danger. Therefore I've listed a few preventative measures that you should take to ensure computer safety.

1. Do install an anti-virus software program and update it often as there are new viruses discovered everyday. I update my anti-virus database daily. At least weekly should be a goal. If you are not updating perpetually, it is like having an insurance policy and never paying the premiums. In no time at all it would be worthless.

2. Be wary of email from strangers. Never open an email with an attachment from a source that is unknown or suspicious. Virus containing emails can be very persuasive in the subject line. Do not let your curiosity be aroused.

I prefer an anti-virus program that has the ability to check all email sent and received. If you update it often, this should keep you safe, although nothing is 100% secure. There are good programs that offer a free version for personal use. These programs generally allow continual updates. Some may require that you register again at the end of year, but the software and updates will still be free.

Two such programs are:

AVG anti-virus, Free edition
http://grisoft.com

Free avast! 4 Home Edition
http://www.avast.com/eng/avast_4_home.html

Free Firewall & Antivirus
www.personalfirewall.comodo.com
For more options and reviews on programs you can do a search on google for free anti-virus.

3. Do exercise caution when downloading files from the Internet. Be sure to download from well known and reputable sources. Ascertain that your anti-virus software is set to scan files while you are downloading. I have that feature enabled in my anti-virus program and it scans all files when I am in the process of downloading, and it has on occasion prevented me from downloading a file that was infected or posed a potential danger. These programs work so take advantage of the security your anti-virus will provide by using all of the safety features.

4. New viruses creep upon a daily basis. It is important to back up your important files regularly. CD’s and DVD’s hold a large amount of information. Take advantage of this and store your valuable information and computer programs on these removable disks. In the event that a virus should ever invade your system and your files become corrupted you will be able to replace them with your backup copies.

5. Lastly apply the little rule, 'When in doubt do without'. If you are uncertain, whether it is with an unknown source in your email or a web site that offers a download, then best not to take a chance. No email message or free software is worth the damage to your computer files and the time and expense of repairing your PC. Do not be fooled, computer viruses do affect everyone.

The Internet offers us an array of software, services, entertainment and education that is beneficial. There is no reason to fear the web, it can be safe and secure. Yet it would be unrealistic to assume that there is no danger of computer viruses. There are unscrupulous persons who desire to do you harm. By observing these few guidelines you can minimize any threat of a virus attacking your computer.

Read More

Check The Internet Forecast Before You Go Online

According to a recent survey conducted by the Cyber Security Industry Alliance (CSIA), more computer users are becoming increasingly insecure about using the Internet. Forty-eight percent of those surveyed avoid making purchases on the Internet because they are afraid their financial information might be stolen. Fewer than one in five of the 1,150 U.S. adults surveyed believed that existing laws can protect them from fraud, identity theft and other crimes on the Internet. More than two-thirds (70 percent) want Congress to pass stronger data- protection legislation.

Consumers have clearly taken notice of Internet threats and scams, but there have been few resources they can use to understand what the immediate risks are and what they can do to more safely participate in their favorite online activities. Consumers want to be informed of the risk levels associated with common online activities and the precautions they can take to protect themselves. One such tool is The Symantec Internet Threat Meter, which helps computer users become aware of the most recent Internet threats and educates them about the steps they can take to safeguard their computers and personal data while online.

While high-profile computer worms and other online attacks are not as visible as they have been in the past, Internet threats have changed shape and present even more risks to consumers. Today's threats spread in many ways-through Web sites, instant messaging and e-mail-but use more silent, targeted methods than before. Many attacks are launched with criminal intent to steal users' personal data or to take over computers in order to launch targeted attacks that result in financial gain for cybercriminals.

The Symantec Internet Threat Meter helps consumers better understand the Internet landscape by taking an activities-based approach. The index rates the four main online activities-e-mail, Web activities, instant messaging and file sharing--on a low-, medium- or high-risk level based on triggers related to malware, spyware, phishing/online fraud, vulnerabilities, online attacks and spam.

Consumers want to feel more confident about their security when they are online, whether they are communicating via e-mail, conducting financial transactions on the Internet, chatting over instant messaging or sharing files. Just as prepared travelers check the weather forecast for their destination city, consumers who are online now have a tool they can use to help them prepare for a safe and productive experience on the Internet.

Read More

‘Spoofing’, ‘Phishing’ and ‘Link Altering’ - Expensive Financial Traps

"Spoofing" or "phishing" frauds attempt to make internet users believe that they are receiving e-mail from a specific, trusted source, or that they are securely connected to a trusted web site, when that’s not the case at all, far from it. Spoofing is generally used as a means to convince individuals to divulge personal or financial information which enables the perpetrators to commit credit card/bank fraud or other forms of identity theft.

In "email spoofing" the header of an e-mail appears to originate from someone or somewhere other than the actual source. Spam distributors often use email spoofing in an attempt to get their recipients to open the message and possibly even respond to their solicitations.

"IP spoofing" is a technique used to gain unauthorized access to computers. In this instance the unscrupulous intruder sends a message to a computer with an IP address indicating that the message is coming from a trusted source.

"Link alteration" involves the altering of a return internet address of a web page that’s emailed to a consumer in order to redirect the recipient to a hacker's site rather than the legitimate site. This is accomplished by adding the hacker's ip address before the actual address in an e-mail which has a request going back to the original site. If an individual unsuspectingly receives a spoofed e-mail and proceeds to "click here to update" account information, for example, and is redirected to a site that looks exactly like a commercial site such as EBay or PayPal, there is a good chance that the individual will follow through in submitting personal and/or credit information. And that’s exactly what the hacker is counting on.

How to Protect Yourself
• If you need to update your information online, use the same procedure you've used before, or open a new browser window and type in the website address of the legitimate company's page.
• If a website’s address is unfamiliar, it's probably not authentic. Only use the address that you’ve used before, or better yet, start at the normal homepage.
• Most companies require you to log in to a secure site. Look for the lock at the bottom of your browser and "https" in front of the website address.
• If you encounter an unsolicited e-mail that requests, either directly or through a web site, for personal financial or identity information, such as Social Security number, passwords, or other identifiers, exercise extreme caution.
• Take note of the header address on the web site. Most legitimate sites will have a relatively short internet address that usually depicts the business name followed by ".com," or possibly ".org." Spoof sites are more likely to have an excessively long strong of characters in the header, with the legitimate business name somewhere in the string, or possibly not at all.
• If you have any doubts about an e-mail or website, contact the legitimate company directly. Make a copy of the questionable web site's URL address, send it to the legitimate business and ask if the request is authentic.
• Always report fraudulent or suspicious e-mail to your ISP.
• Lastly, if you've been victimized, you should file a complaint with the FBI's Internet Crime Complaint Center at http://www.ic3.gov.

Read More

14 Household Ways To Protect Your Computer From Viruses

Computer viruses are deadly. They often spread without any apparent contact and can be a nuisance, or even worse, fatal to your computer. Individuals who create these viruses, estimated at 10-15 new ones a day, are the electronic version of terrorists. Their goal is to inflict havoc and destruction on as many people as possible by disabling, stealing, damaging, or destroying computer and information resources. Often, they have no specific target in mind, so no one is safe. If you access the internet, share files or your computer with others, or load anything from diskettes, CDs, or DVDs onto your computer, you are vulnerable to viruses.

Fortunately, there are good guys working just as hard as the hackers to develop cures for viruses as quickly as they send them off into cyberspace. And there are many things you can do to keep your computer from catching viruses in the first place.

Defining Viruses:

A virus is a small computer program that can copy and spread itself from one computer to another, with or without the help of the user. However, viruses typically do more than just be fruitful and multiply, which is bad enough in itself because it hogs system resources. Anything else viruses are programmed to do, from displaying annoying messages to destroying files, is called their payload. Often, they cannot deliver their payload until an unsuspecting user does something to make the virus execute its programmed function. This could be as simple as clicking on an innocent looking file attachment with the .exe (executable) extension.

Catching a Virus:

Most viruses are spread through e-mail attachments because it's the easiest way to do it. Although Macintosh, Unix, and Linux systems can catch viruses, hackers are particularly keen on exploiting the security weaknesses in anything Microsoft, particularly Microsoft Outlook and Outlook Express. Because of the popularity of this software, hackers get maximum bang for their buck, and they probably get some satisfaction from continually reminding Microsoft that being big doesn't mean you're perfect.

Solution 1: Anti-virus Software

Your first line of defense is to install anti-virus software. To be extra safe, also install firewall software, which is now included in some anti-virus packages. This software can scan all of your drives for viruses and neutralize them. Here are some features to consider when evaluating anti-virus software.

- Compatibility with your operating system - Make sure the software works with your system, particularly if you are using an older operating system like Windows 98.

- Firewall software - If it's not included, find out if it's available. If you must, buy it from another vendor.

- Automatic background protection - This means your software will constantly scan behind the scenes for infections and neutralize them as they appear. This provides some peace of mind.

- Automatic, frequent updates - Because new viruses appear every day, you'll want regular updates. It's even better if they occur automatically when you connect to the internet. If automatic updating isn't included, you'll have to check the vendor's website and download updates yourself. This is vitally important, because you will not be protected from new viruses if your software is out of date.

- Disaster recovery - Software with a recovery utility to help you get your system back to normal after a virus attack is always good to have.

- ICSA certification - The International Computer Security Associatioin has standards for the detection rates of anti-virus software. Make sure your software has the ICSA certification.

- Technical support - It's a good idea to select a package that offers free technical support, either online or through a toll-free number. If you're ever felled by a virus, you may need it. Some anti-virus software vendors are Symantec Corporation (Norton AntiVirus), McAfee Corporation (McAfee VirusScan), Trend Micro Inc. (PC-cillin), and Zone Labs Inc. (Zone Alarm Suite).

Solution 2: The Virus Scan

If you receive a particularly juicy attachment that you're dying to open, save it on your Windows desktop and run your anti-virus software on it first. To do this, click once gently on the file on your desktop ... don't actually open it ... then right click and choose Scan with (Name of Anti-Virus Software) to activate a virus scan.

If it's infected, your anti-virus software may neutralize it, or at least tell you the attachment is too dangerous to open. On the other hand, don't feel guilty if the very thought of saving a potentially damaging file anywhere on your system is enough to quell your eagerness to open it and make you delete it immediately.

Solution 3: Delete first, ask questions later.

When in doubt about the origin of an e-mail, the best thing to do is delete it without previewing or opening it. However, some viruses, such as Klez, propagate by fishing in people's address books and sending themselves from any contact they find to another random contact. You can spread a virus just by having people in your address book, even if you don't actually e-mail them anything. They'll receive it from someone else in your address book, which really makes life confusing. Because of the proliferation of porn on the internet, e-mail viruses often tempt victims by using sexual filenames, such as nudes.exe. Don't fall for it.

Solution 4: Beware of virus hoaxes

E-mails warning you about viruses are almost always hoaxes. You may be tempted to believe them because you typically receive them from well-meaning friends, who received them from friends, etc. These e-mails themselves usually aren't viruses, but some have actually fallen into the hands of hackers who loaded them with viruses and forwarded them merrily on their way as a sick joke.

The proliferation of e-mails about virus hoaxes can become nearly as bad as a real virus. Think about it, if you obey an e-mail that tells you to forward it to everyone in your address book, and they THEY do it, and this goes on long enough, you could bring the internet to its knees. If you ever want to verify a virus warning, your anti-virus vendor may have a list of hoaxes on it website. It's in the business of providing the fixes, so it will know which viruses are real.

Solution 5: Beware of filename extensions

The extension of a filename is the three characters that come after the dot. Windows now defaults to hiding filename extensions, but it isn't a good idea. Just being able to see a suspicious extension and deleting the file before opening it can save you from a virus infection.

To see filename extensions in all your directory listings, on the Windows XP desktop, click Start button | Control Panels | Folder Options | View Tab. Clear the check box for Hide extensions of known file types. Click Apply | OK. System files will still be hidden, but you'll be able to see extensions for all the files you need to be concerned with. Viruses often live on files with these extensions - .vbs, .shs, .pif, .Ink - and they are almost never legitimately used for attachments.

Solution 6: Disable the .shs extension

One dangerous extension you can easily disable is .shs. Windows won't recognize it and will alert you before attempting to open an .shs file. The extension is usually just used for "scrap object" files created in Word and Excell when you highlight text and drag it to the desktop for pasting into other documents. If this isn't something you ever do, or you have Word and Excell 2000 or later, which allow you to have 12 items on the Clipboard, click the Start button | Control Panel | Folder Options | File Types tab. Under Registered file types, scroll down and highlight the SHS extension. Click Delete | Yes | Apply | OK.

Solution 7: Dealing with double extensions

When you turn on your extensions in Windows, you'll be able to detect viruses that piggy-back themselves onto innocent looking files with a double extension, such as happybirthday.doc.exe. NEVER trust a file with a double extension - it goes against Nature.

Solution 8: Beware of unknown .exe files

A virus is a program that must be executed to do its dirty work, so it may have an .exe extension. Unfortunately, this is the same extension used by legitimate program files. So, don't panic if you find files named Word.exe or Excel.exe on your system - they're your Microsoft software. Just don't EVER open any file with an .exe extension if you don't know what the file's purpose is.

Solution 9: Watch out for icons

Viruses in attachment files have been known to assume the shape of familiar looking icons of text or picture files, like the wolf in the hen house. If you recieve an unexpected attachment, don't open it without first running it through your anti-virus software.

Solution 10: Don't download from public newgroups

What better place for a hacker to lurk and stick his virus than in the middle of a crowd? Sooner or later, someone's bound to download it and get the virus going. Don't download files and programs from newsgroups or bulletin boards, or open attachments sent from strangers in chatrooms ("Let's exchange pictures!") without first scanning with your anti-virus software.

Solution 11: Avoid bootleg software

This may seem like a no brainer, but sometimes that tiny price tag on a popular but expensive package can be too good to resist. Resist it! Likewise, be careful about accepting application software from others. You don't know where it's been, and what may have started out as a perfectly clean package could have become infected during installation on someone else's infected computer.

Solution 12: Protect macros in MS Word, Excel, and Powerpoint

A common type of virus uses macros. Macros are sets of stored commands that users can save as shortcuts to perform long functions in just a few keystrokes. A macro virus may perform such mischief as changing file types from text files or spreadsheets into templates, locking up keyboards, and deleting files. Word, Excel, and PowerPoint come with macro virus protection. To make sure yours is activated, open each application, then click Tools menu | Macro | Security. On the Security Level tab, make sure Medium or High is selected. Clcik OK. If you are already infected with a macro virus, you may find that the steps of this procedure are unavailable becasue the virus has disabled them. In that event, run a virus scan on your system to see if your anti-virus software can kill the virus.

Solution 13: Use passwords

If you share your computer, it's a good idea to assign everyone a password. Passwords should be a combination of letters and numbers no less than eight characters long, and preferably nonsensical. Never write passwords and stick them anywhere near the computer. To assign passwords in Windows XP, click the Start button | Control Panel | User Accounts. Follow the prompts to assign/change passwords.

Solution 14: Update application software

Microsoft constantly issues patches for the security holes in its operating system and applications software. however, don't be lulled into complacency if you have Windows Update automatically checking things for you. Update checks for patches to repair bugs in the operating system, not for security problems.

To get the latest security hotfixes (as Microsoft calls them), visit www.microsoft.com and look for hotfixes for all your Microsoft software, particularly Outlook and Outlook Express.

Microsoft also has a free downloadable package called Microsoft Baseline Security Analyzer (MBSA) that scans your system for missing hotfixes. It works with Windows 2000 and XP Home and Professional only. It doesn't support Windows 95, 98, or ME.

To download the MBSA, go to the TechNet section of the Microsoft Website. Be warned that the information is written in techie language, so you may find it daunting.

Last Words:

Now that you know some ways for avoiding and dealing with viruses, let's wrap things up with some solution you've probably heard before but have ignored.

- Back up your files regularly - If a virus crashes your sytem, you'll feel much better if you've got backup copies of all your important files. Make the backup copies on a media that's separate from the computer, such as on diskettes, CDs, or zip disks. Scan them for viruses before you put them away to make sure they aren't infected. If they are, they'll do you no good if you ever have to use them because they will just transmit the virus right back onto your computer.

- Make a boot disk - Create an emergency boot diskette before you have a problem so you can start your computer after a serious security problem To make a boot diskette with Windows XP, put a blank floppy disk in the drive. Open My Computer, then right click the floppy drive. Click Format. Under Format options, click Create an MS-DOS startup disk. Click Start. Keep the disk in a safe place. With luck, you'll never need to use it.

- Turn off you computer - DSL and cable connections that are "always on" may be convenient, but you should always turn off your computer when its not in use. Hackers can't get to a machine that's powered off.



You are free to reprint this article in its entirety as long as the clickable URLs remain in the "Resource Box" section.

Read More

5 Mistakes You Might Be Making When Choosing A Password

Are you making yourself a target for fraud? More and more often I am hearing stories of people who have had their accounts hacked. They have had money stolen, lost sleep, spent hours setting up new accounts, or had their credit ruined. Don't let this happen to you.

Are you making these dangerous mistakes?

Mistake #1: Using the same password for all your accounts.

Please don't do this. Use different passwords for every email account, and definitely use unique passwords for shopping websites where you'd enter your credit card.

Mistake #2: Short passwords

The risk of someone guessing your password is increasingly difficult the more characters are in it. So, go for the gusto and make your passwords long.

Mistake #3: BradPitt, Charlie, Sarah, Princess, Barbie, Gandolf -- Did I guess it yet?

Do not use kids' names, pet's name, nicknames, names from characters in books or movies or celebrity names. Even if I didn't guess it in my list, someone who knows you could.

Mistake #4: Easy to remember English words

Easy to remember is also easy to guess. Passwords should not contain English words found in a dictionary. Non-English words or any words in any dictionary are a high risk as well. And, for goodness sakes, if your password is "password" or "test" then it's a wonder you haven't been hacked yet!

Mistake #5: Numbers are no-no's.

Seriously, stay away from birthdays, anniversaries, addresses, social security numbers or telephone numbers. They are all too easy to guess.

Choose random passwords for banking sites like PayPal. Combine letters (both uppercase and lowercase) and numbers.

If all of this sounds too hard to remember, then consider using a Password program. Most of the good password programs will not only store your passwords on your computer, but they'll generate completely random passwords when you need one.

Here are a few to try.

http://www.fgroupsoft.com/Traysafe/

http://passwordsafe.sourceforge.net/

http://www.treepad.com/treepadsafe/

It's never a good time to find out that someone has stolen money from you -- or locked you out of your own email account. It's a waste of your time and money. Please protect yourself.

Read More

Preventing Identity Theft

What is Identity Theft? It is the theft of your personal information, such as social security number, driver's license number, credit card and bank account numbers, mother's maiden name, and more, with the intent to obtain credit and credit cards from banks and retailers, steal money from the victim's existing accounts, apply for loans, establish accounts with utility companies, rent an apartment, file bankruptcy or obtain a job using the victim's name.

Did you know that in some states Identity Theft is not even against the law? The victim has to prove their innocence. This shocks most Identity Theft Victims, as it should. It shocks me. Law Enforcement and Credit Card Services should be there to help, but in many cases they don't.

Being prepared, just in case someone steals your identity is a must. It may be inconvenient, but unless you want to go out and try to use your credit card one day, just to find that someone else has been using your identity to make purchases and your card is no longer accepted, then you need to take steps to prevent your identity from being stolen. It can take years to clear this up if it happens to you, so a little prevention now is the answer.

Facts about Identity Theft;

 It is considered by law enforcement to be an absolute epidemic, the fastest growing crime in the United States at this time.
 For the criminal, identity theft is a relatively low-risk, high-reward endeavor. Credit card issuers often don't prosecute thieves who are apprehended. Why? The firms figure it's not cost efficient. They can afford to write off a certain amount of fraud as a cost of doing business.
 Recently criminals have been using the victim's identity to commit crimes ranging form traffic infractions to felonies. How would you like to find out you are wanted for a crime you know nothing about? It has happened.
 All that is needed is your social security number, your birth date and other identifying information such as your address and phone number and whatever else they can find out about you. With this information, and a false driver's license with their own picture, they can begin the crime.
 If you wait until it happens to you, it's a nightmare. You won't know until you are denied credit or a creditor contacts you about a charge you know nothing about.

How do I prevent Identity Theft?

At Home;

 If you have roommates, employ outside help, or are having work done in your home, make sure your personal information is not readily available to them.
 Deposit your outgoing mail in post office collection boxes or at your local post office, rather than in an unsecured mailbox. Promptly remove mail from your mailbox. If you're planning to be away from home and can't pick up your mail, call the U.S. Postal Service at 1-800-275-8777 to request a vacation hold. The Postal Service will hold your mail at your local post office until you can pick it up or are home to receive it.
 Tear or shred your charge receipts, copies of credit applications, insurance forms, physician statements, checks and bank statements, expired charge cards that you're discarding, and credit offers you get in the mail. To opt out of receiving offers of credit in the mail, call: 1-888-5-OPTOUT (1-888-567-8688).
 Give your Social Security number only when absolutely necessary, and ask to use other types of identifiers. If your state uses your Social Security number as your driver's license number, ask to substitute another number. Do the same if your health insurance company uses your Social Security number as your policy number.

At Work;

 Ask about information security procedures in your workplace or at businesses, doctor's offices or other institutions that collect your personally identifying information. Find out who has access to your personal information and verify that it is handled securely. Ask about the disposal procedures for those records as well. Find out if your information will be shared with anyone else. If so, ask how your information can be kept confidential. Keep your purse or wallet in a safe place at work; do the same with copies of administrative forms that have your sensitive personal information.

Online;

 If you do financial transactions over the Internet, read their privacy and or security statements. You want to know who they share your personal information with. You want to know they use a "secure server" for transactions. You want to know how they store your personal information. If you don't like what you hear, don't do your business at that website. There are always alternatives.
 Use PayPal. You can transfer a limited number of funds into your paypal account and use it to buy merchandise online instead of your credit card.
 Don't give out personal information on the phone, through the mail, or on the Internet unless you've initiated the contact or are sure you know who you're dealing with.
 Before you share any personal information, confirm that you are dealing with a legitimate organization. Check an organization's website by typing its URL in the address line, rather than cutting and pasting it. Be cautious when responding to promotions. Identity thieves may create phony promotional offers to get you to give them your personal information.

Going Out;

 Carry only the identification information and the credit and debit cards that you'll actually need when you go out. Don't carry your social security card with you unless you expect to need it.

Should I buy identity theft insurance?

Some companies offer insurance or similar products that claim to give you protection against the costs associated with resolving an identity theft case. Be aware that most creditors will only deal with you to resolve problems, so the insurance company in most cases will not be able to reduce that burden. As with any product or service, make sure you understand what you're getting before you buy. If you decide to buy an identity theft insurance product, check out the company with your local Better Business Bureau, consumer protection agency and state Attorney General to see if they have any complaints on file.

Conclusion: Be smart. If someone is asking for your personal information, anyone, including friends, acquaintances, companies, stores, websites, or anyone else, ask questions. Find out why they need this information, what they are going to do with it, how long do they keep it stored, who they share it with, and how can you be sure it is going to be kept secure.

Read More