Forgot your password?
typodupeerror
Security The Media News

New York Times Site Pop-Up Says Your Computer Is Infected 403

Posted by timothy
from the if-you're-reading-this-you-have-a-virus dept.
Zott writes "Apparently, 'some readers' of the New York Times site are getting a bit more with their news: an apparently syndicated adware popup with a faux virus scan of the user's computer indicating they are infected, and a link to go download a fix now. It's entertaining when a Mac user gets it, but clearly downloading an .exe file isn't a good way to keep your computer clean ..." Update: 09/14 03:20 GMT by T : Troy encountered this malware, "and did basic forensics. Summary: iframe ad then series of HTML/JS redirects, ending at a fake virus scanner page with a "Scan" link (made to look like a dialog box button) that downloaded malware." Nice explanation!
This discussion has been archived. No new comments can be posted.

New York Times Site Pop-Up Says Your Computer Is Infected

Comments Filter:
  • by Anonymous Coward on Sunday September 13, 2009 @08:02PM (#29408785)

    I think it's actually more entertaining when I don't get it at all on any platform, because I disabled javascript.

    • by PlusFiveTroll (754249) on Sunday September 13, 2009 @08:14PM (#29408867) Homepage

      FF + Adblock is my way to avoid it (and still get the sites I need .js to run on).

      This crap has been going on for a few years now with the 'AntiVirus XP' scam (http://www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/) that seems to strike major sites every few months. Just goes to show the ad distributers have no control ( or don't want it) over what goes in to their distribution network.
       
       

      Sad this is, people fall for it all the time :(

      • by Anonymous Coward on Sunday September 13, 2009 @08:20PM (#29408905)

        The newest version of the "Antivirus 2010" software is a pain in the ass to get rid of. It rootkits the system and makes manual removal pretty much impossible without a WinPE boot disk of some kind, and even then it's difficult to find all the instances. There's one tool I found to remove it and most of its kin, and that is combofix [bleepingcomputer.com]. It successfully cleans Antivirus 2010 and a host of other rootkit-based malware in a process I can only describe as "magic". I'm just posting this to help out others that have spent way too much time trying to get rid of this crap off of friend/family computers.

        • by Z34107 (925136) on Sunday September 13, 2009 @08:43PM (#29409081)

          I completely agree with "combofix rocks." My job at the college I attend is pretty much removing that virus 24/7 from student laptops, and I've learned a few things:

          1) McAfee sucks. We supply a copy of the Enterprise version to students, and a patched installation is required for internet access. Somehow, we're still inundated every semester with the latest flavor of AntiVirus ModelYear.

          2) ComboFix is amazing. It's simple, but it automates a lot of tools that are a bit of a pain to use on their own. Ten minutes, and most malware is somewhat neutered.

          3) MalwareBytes is amazing. ComboFix always misses stuff, but it lets us install MalwareBytes (also free) which finishes the job. I haven't seen any virus MB couldn't remove.

          It's usually faster to run ComboFix + MalwareBytes (half hour between the tools in most cases) than it is to nuke it from orbit and reinstall Windows. Unless you're paranoid, two programs will take care of your end of your extended family's implied social support contract.

          • by davidphogan74 (623610) on Sunday September 13, 2009 @09:12PM (#29409243) Homepage

            You make people use McAfee to get online? That would be enough to make me transfer.

            • Re: (Score:3, Informative)

              by Z34107 (925136)

              I personally loathe McAfee - it interferes with ComboFix. But, I'm not IT, and you can technically remove it after your machine passes registration.

              • Re: (Score:3, Interesting)

                by davidphogan74 (623610)

                It seems you can never fully remove a McAfee program without formatting and restarting. I'd probably just get a new hard drive, install Windows XP and McAfee on it, pass the system through, then swap in my normal drive. But, I am an IT nerd.

          • Re: (Score:3, Insightful)

            by Orion Blastar (457579)

            Sorry after installing Combofix, my AV program Spysweeper reported three viruses just got installed, and Unhackme reported one rootkit got installed on my system from software from that link. Also it seems to have destroyed the control panel and I cannot Add/Remove programs anymore.

            I think that anti-malware software needs to be peer reviewed by reliable sources before we decide to use it or not. This seems to be just as bad as a fake "infected" ad infecting your system.

            Lucky for me that I was able to remove

            • Re: (Score:3, Informative)

              by Z34107 (925136)

              Sorry after installing Combofix, my AV program Spysweeper reported three viruses just got installed

              Combofix is pretty much a glorified batch file that automates the operation of programs like GMER. Some of these programs are considered "hacking tools" by AV vendors. Another reason I hate McAfee: it will automagically "clean" my flash drive of most of my antivirus tools.

              If you downloaded ComboFix from bleepingcomputer.com, it's a false positive.

              • by Orion Blastar (457579) <orionblastar@gm[ ].com ['ail' in gap]> on Sunday September 13, 2009 @11:02PM (#29409837) Homepage Journal

                Yes I downloaded Combofix from bleepingcomputer.

                I am not sure why it would be flagged as a false positive. I am suspicious of any program that says I have to shut down my AV software in order for it to run.

                Luckily both Unhackme and Spysweeper removed it, and was able to restore my control panel as well. I noticed that ComboFix was not in the Add/Remove programs and I tried the "Combofix /u" to uninstall it only to be greeted with a file not found error.

                I looked in the program files directory and it was not there, but on the root directory of my system under c:\combofix\ hidden as a system file with copies of iexplore.exe and other files. Easy enough to delete, but the uninstall didn't seem to work. Maybe the combofix.exe file was deleted as a virus?

                Spysweeper reported it as Mal/Pack-A, Virus/Test, and one other I forgot, and Unhackme said it was the FU Rootkit. Kapersky said it was Trojan.Win32.Inject.ph. I would think Combofix would have been whitelisted by now as a false positive and removed from the detections, but apparently it has not.

                Users need to be warned about false positives if that is indeed the case. I did a web search and it turned up web sites suggesting using Combofix, so I suspect it may be indeed a false positive. I can recall the BartPE and Retrago WinPE boot tools had some of their automated programs got detected as hack tools and removed via AV software as well. Maybe those Hack tools are effective at removing stuff the non-Hack tools don't?

          • by Deathlizard (115856) on Sunday September 13, 2009 @10:36PM (#29409687) Homepage Journal

            We Use F-secure here. I wish we didn't, especially when they tell us not to go to known malware sites to test if their protection is working (even though a studest is going to do just that). Makes you feel really secure doesn't it? I really wish we were running either Avira Antivir or Microsoft Forefront, since they seem to have the highest detection rates against roges so far, but we decided to give F-secure a second chance. I don't know why.

            Anyway, Since we have a laptop program at the college, our answer is simple. You're getting a new hard drive and we will move your favorites, My Documents and anything on your desktop. I know students don't like this option, but they REALLY won't like their credit card being stolen, or worse; their identity. Usually when I explain to them that this method is the safest option and that ID theft has happened to students (Guess what! if you pay for Antivirus 360 at 79.95, it still doesn't work AND they got your $79.95 AND they got your CC number and all the info they need to start swiping away your credit score!!) they agree with it, but some just don't care as long as they can download movies ("My Friends Hot Mom". "Milf Hunter", ETC) or music (from Gnutella, where the music is usually trojans or piggybacking some sort of virus) all day. Most will be back infected within the month as well.

            The worst one so far is TDSS.F. It runs a rogue DCHP server across your network and tries to infect anyone that connects through it. It also adds autorun entries to infect across hard and flash drives and likes to install file fixer pro, which encrypts all your files. Luckily, Bradford Campus Manager detects the DHCP rogue and denies them access (That's why many campuses do this registration [slashdot.org] now.) but our virus scanner always misses it.

          • by Culture20 (968837) on Sunday September 13, 2009 @10:39PM (#29409695)

            It's usually faster to run ComboFix + MalwareBytes (half hour between the tools in most cases) than it is to nuke it from orbit and reinstall Windows. Unless you're paranoid, two programs will take care of your end of your extended family's implied social support contract.

            It used to be A rocked, and then A and B rocked. Then B started to suck, so we used A & C, then malware defeated A, so we used D & C (C had to be used second), with a splash of E. A came back with a new version, and we'll call it F. F'n rocked! Then it sucked. etc.

            I could never be bothered figuring out which version of what software _really_ cleans up this week's malware. I always would nuke from orbit (after judiciously backing up data using the drive as a neutered USB disk).

          • by symbolset (646467) on Sunday September 13, 2009 @11:36PM (#29410039) Journal

            If you can confirm that there was malware on the system there is no cure except to start with a clean image - preferably one you stored with an imaging tool like the free Clonezilla [clonezilla.org] prior to accessing any network at all or any untrusted media. Putting a clean image on can take 5-30 minutes, and is certain to remove all traces of infestation. It's actually quicker than scanning. Once you've got a confirmed hit your only business using a compromised machine is an inspection of the features that got the user into trouble so you can turn those off after you image, and capture for them a more suitable image.

            There's a tired old nag about no software being secure but really one thing is for certain: once an app has been running that's known to be infested it got there because the maker knew something the user didn't. Among the other things the user doesn't know are how many other applications the malware infested, how many running services were leveraged with local privilege escalation, how many rootkits of various sorts were installed. Most modern malware immediately upon installation scans the local system and sniffs the network. They look up components and download a cocktail of toxic code that's both tailored to the specific machine and randomly generated so as to be unique. There's a management system that auto-permutes millions of vile code variants every day, and uses a genetic algorithm to determine which of the little beasties is the most efficient. This is not your dad's malware ecosystem.

            Pretending to remove malware is nothing short of malpractice. All you're doing is helping the bad guys by pointing out which modules survive a cursory attempt at cleaning.

          • Re: (Score:3, Insightful)

            by Mr. Freeman (933986)
            "1) McAfee sucks. We supply a copy of the Enterprise version to students, and a patched installation is required for internet access."

            It sucks and yet you require it on every student machine. Sounds to me like this isn't a student problem.
            • Well, from an IT administrator that manages McAfee Enterprise, it does indeed suck royal balls at doing its primary job (catching virii).

              However it does excel at pointy hair boss reporting, which is often key to getting funding for said product. It is also easy to manage and update via ePolicy Orchestrator (ePO).

              The other "corporate" option is Norton/Symantec product which sucks balls and then licks colons.

              And this weeks "AV" "best" choice which then "sucks" next week isn't really an option for TRUE enterpr

        • by capnkr (1153623)
          Combofix does do a good job at catching and removing these things, but: rootkit.

          Best to bite the bullet, and talk the client into a drive formatting and OS reinstall. Given that opportunity, you can also go ahead and do some system optimization, and with a vanilla-install source, get rid of manufacturer-installed bloatcrap. For about the same amount of time (and thus, price) that it would take to do whatever you can to ensure a clean system, they get a much better job. The system will probably be running
          • by Z34107 (925136) on Sunday September 13, 2009 @09:13PM (#29409251)

            In a perfect world, we would do that, but we get too many machines in and out to make that feasible. Then, there's all the normal luser problems: I don't know where my files are, I have no install media, I have no keys, I deleted my recover partition to save space, etc.

            The foolproof way to remove the AntiVirus ModelYear rootkit is: Make a file-based image of the hard disk. By design, it hides from the file system, meaning it will not be included in a image made by a tool like ImageX from Microsoft's free WAIK. Gather an image and apply it to the same hard disk, and the rootkit's gone.

            If you're adventurous, ImageX lets you mount the image file on a clean PC to do offline scans of its files and registry hives. You can clean a computer without ever booting it.

            But, that's generally overkill. AntiVirus ModelYear rootkit isn't the nasty kind of hardware-hypervisor rootkit - it runs at kernel privileges. So does MalwareBytes. To be dangerous, it has to run at a higher privilege level than the removal tools.

            For family members that promise me food, I go the extra mile and do the clean install for them. Staff machines we just re-image.

            • Re: (Score:3, Insightful)

              by rantingkitten (938138)
              The foolproof way to remove the AntiVirus ModelYear rootkit is: Make a file-based image of the hard disk. By design, it hides from the file system, meaning it will not be included in a image made by a tool like ImageX from Microsoft's free WAIK. Gather an image and apply it to the same hard disk, and the rootkit's gone.

              I don't want to sound like "that guy", but really, that sounds like an awful lot of trouble to go through to protect an operating system that is, by design, vulnerable to such BS. The act
          • Re: (Score:3, Insightful)

            by erroneus (253617)

            That is generally my approach. Once a machine is compromised, I insist that they are reinstalled from absolute scratch. Following that, I take an image file of that machine in perfect working order. And during checkups, if the machine is still in good order, I take another snapshot.

            All applications should be reinstallable and all data should be stored on servers that are backed up routinely.

            If those basic rules are followed, an infected machine is something of an embarrassment to the user and an inconven

        • Re: (Score:3, Insightful)

          by davidshewitt (1552163)

          It successfully cleans Antivirus 2010 and a host of other rootkit-based malware in a process I can only describe as "magic".

          How do you know that it successfully cleans it out? Most viruses are closed-source, so you have no idea what's in them. Some are very, very clever, and hide in ways that software cannot detect, especially the rootkits. My policy is that the only way to be SURE that the virus is gone is to format the drive and reinstall the OS. Especially so if you don't know what the cleanup software is doing (a.k.a. "magic").

      • I have FF 3.5.3 and AdBlock, the latest Flash and Java, AND the latest MVPS Hosts file, and it came up anyway. Three hours after I added the two sites involved to my Hosts file, the redirect happened again... but this time, it stalled.

        Bottom line: Signature- and site-based detection can always be defeated.
      • by mysidia (191772) on Sunday September 13, 2009 @11:39PM (#29410063)

        They need to take responsibility for what they publish on their own sites.

        I'd like to see a class action suit against the NY Times or the ad network they use by users who were infected.

        Based on NYT negligently allowing advertisers to inject code into their web site.

        I can understand users getting hit with fake dialogs after clicking on an ad.

        But I believe web sites have a duty to take standard precautions and avoid loading remote script code

        I differentiate ad content from code. It's not rocket science -- when the advertiser uploads their ad unit, sanitize the input, so the upload cannot contain any javascript, SCRIPT, IFARME, FRAME, or other unexpected tags or tag attributes, for that matter, or any remote loading. Only approved 'safe' HTML tags such as IMG. And any images referred must be uploaded and served from the ad network (again, no remote loading).

        Again, it's not rocket science to sanitize input. There's really no excuse for not doing it, other than negligently ignoring security issues, and possible harm malicious ads can do...

  • News? Where? (Score:5, Interesting)

    by SilverHatHacker (1381259) on Sunday September 13, 2009 @08:09PM (#29408837)
    What exactly makes this different from any of the other hundreds of sites with the same popup? Is it just because this is a large, well-known website like the New York Times?
    • I was thinking the same thing. The answer is probably yes.
    • Re:News? Where? (Score:5, Insightful)

      by petermgreen (876956) <plugwashNO@SPAMp10link.net> on Sunday September 13, 2009 @08:35PM (#29409019) Homepage

      Not exactly news but nonetheless a sad indictment of the state of online advertising that even big sites with a reputation to uphold are using adverts from seedy advert networks who tolerate this shit.

    • Re:News? Where? (Score:5, Informative)

      by Jahava (946858) on Sunday September 13, 2009 @08:43PM (#29409083)

      What exactly makes this different from any of the other hundreds of sites with the same popup? Is it just because this is a large, well-known website like the New York Times?

      That's my impression. I think the interesting thing here is that the presumption that reputable websites have reputable advertisements has been violated. NYT's advertising policies [whsites.net] include the following paragraph [whsites.net]:

      The Times may decline to accept advertising that is misleading, inaccurate or fraudulent; that makes unfair competitive claims; or that fails to comply with its standards of decency and dignity.

      Granted, they don't outright state that the content is prohibited, but they do imply a stance against this type of advertising. This is a clear violation of that intention, and they took the appropriate response. I'd be most interested in knowing if this particular advertisement was intentionally approved, "slipped through" accidentally, or was injected illicitly (e.g., their advertising server was hacked, etc.).

    • by sjames (1099)

      Yes, a large website with high traffic and a reputation to maintain. Be assured, somewhere someone ate dinner standing up tonight.

    • Re: (Score:2, Insightful)

      by rm999 (775449)

      I think this case is semi-interesting because it conveniently parallels the slow death of the media as we know it. The idea is that people used to look to newspapers like the New York Times for trustworthy news; now, these sources mislead (lie?) to their users and mess up their expensive computers in the process.

      Of course, I agree with you that it is misleading to accuse just the NYT - 1000s of sites run these misleading ads, and many probably don't mean to (including the NYT, I'm sure). I would call this a

  • I saw it (Score:5, Funny)

    by HangingChad (677530) on Sunday September 13, 2009 @08:13PM (#29408855) Homepage

    But when it starts telling me the C:\ drive on my Linux box is infected it's hard to stop laughing.

    Still was a job to get rid of the circle jerk pop ups.

    • by sjames (1099)

      Still was a job to get rid of the circle jerk pop ups.

      If not for that, I'd bookmark the ad!

    • Re:I saw it (Score:5, Funny)

      by DoofusOfDeath (636671) on Sunday September 13, 2009 @10:07PM (#29409545)

      But when it starts telling me the C:\ drive on my Linux box is infected it's hard to stop laughing.

      You moron, it was complaining about your .wine directory!

  • by PC and Sony Fanboy (1248258) on Sunday September 13, 2009 @08:15PM (#29408875) Journal
    And they wonder - Why is print media dying?

    Because they can't adapt properly. Seriously guys, filter your ads!
    • by popo (107611)

      Wait...what?

    • by Aurisor (932566) on Sunday September 13, 2009 @08:24PM (#29408931) Homepage

      The New York Times is one of the most respected publications in the world. It's not going anywhere.

    • by wampus (1932) on Sunday September 13, 2009 @08:30PM (#29408989)

      Yeah, I was sitting over breakfast reading the Sunday Times and this popped up. Doomed.

  • I was hit by this issue earlier today, more info with some malware URLs available on metafilter here [metafilter.com].

  • by QuantumG (50515) * <qg@biodome.org> on Sunday September 13, 2009 @08:21PM (#29408909) Homepage Journal

    What really annoys me is that these things are most effective because they use javascript alerts to freeze the browser. If you could just browse away from the crap, I could teach my parents just to ignore it.

    "Javascript alerts are not tab modal" has been a known bug in Firefox going on 9 years now. It's not just an annoyance, it's a security bug, fix it!

     

    • by Anonymous Coward on Sunday September 13, 2009 @08:42PM (#29409065)

      Would that be this one [mozilla.org]? That's pretty darned old. Reminds me a bit of the title text display bug that used to hit XKCD et al.

    • by Ilgaz (86384) on Sunday September 13, 2009 @09:22PM (#29409297) Homepage

      If you used the evil closed source Opera browser, you would have "stop executing scripts from this page" option right below that javascript popup.

      It is interesting since nobody really cares who takes what from other browsers, no "patent" or anything, especially from Opera side. It must be very easy to implement, why don't they do it? It is not some high tech JIT compiler either, a basic checkbox.

  • Damn right (Score:5, Funny)

    by Anonymous Coward on Sunday September 13, 2009 @08:23PM (#29408921)

    but clearly downloading an .exe file isn't a good way to keep your computer clean ..."

    Absolutely, .com, .bat and .scr are the only way to go!

  • Funny (Score:2, Funny)

    I get these occasionally as well me being a mac user it's humorous to see my "c:" drive being scanned ...
  • by PPH (736903) on Sunday September 13, 2009 @08:26PM (#29408955)

    ... if we wanted to catch a virus from the New York Times, we had to read a copy that some hobo had used for a blanket.

    Now you kids stay off my lawn!

  • by fermion (181285) on Sunday September 13, 2009 @08:29PM (#29408983) Homepage Journal
    It really is a good social attack, reminiscent of the days when advertisers put 'click ok to continue' buttons to trick users to a promotional web site.

    In this case, it runs a mock scan, states the computer is infected, and then pretends to offer help. The exe file sometimes gets downloaded. From the way I have seen IE work lately, I would not think the file would download without user intervention, but, the page does a good job of scaring users, so I suspect some might download the files.

    The malware site is protection-check07com

    malwareurl.com [malwareurl.com] has the owner listed as Elton John, perhaps on can think that this is pseudonym. Kind of lends credence to rules that require valid information on domain name registrations.

    In any case, this is where the address is listed [google.com]. Looks residential, so maybe that is fake as well. I hope the protection-check people are not setting up some poor sod. Ha, protection check.

    Of course this does bring up two issues. Everyone is afraid of viruses, so it easy to translate that fear into irrational action. It might make us think about some activities that went on this past weekend. Second, such attacks work on mimicking the theme of certain systems, so perhaps one countermeasure is to allow users to vary they theme. This might be very good for corporate machines, as firms might like custom themes. On Macs and *nix, of course, the attack did not work because the web page did not integrate into the background, an elephant is going to look quite conspicuous in a field of leopards.

  • I Applaud (Score:3, Funny)

    by Anonymous Coward on Sunday September 13, 2009 @08:29PM (#29408987)

    I really have to thank the N.Y. times for going far above and beyond the call of duty and notifying their readers of virus infected computers.
    Best 40 bucks I ever spent, I can now browse the web with confidence with my shiny new AntiVirus 2010 Enterprise.

  • by bsandersen (835481) on Sunday September 13, 2009 @08:38PM (#29409039) Homepage

    The concern I have over the long term is that sites like the NYT may not know what advertisements will appear because they are placed by bulk-buying proxies that dispense them at page-load time, probably based on evil-cookie trails or other demographic markers. So, the question becomes: how should a presumably high-integrity site such as a major news outlet ensure quality when they've outsourced advertisement delivery?

    Review of each possible advertisement would be onerous, but failure to have some standards in place will eventually lead to malware (or worse) injected into unsuspecting reader's machines. I just chuckled when it popped up. I run Macs at home. But, when things like this happen to family members running PCs (and we get the phone call) it stops being funny pretty quickly.

    Is there a business case for reviewing advertisements (and the associated mobile code whether it be FLASH, etc.) for a 21st century "Good Housekeeping Seal of Approval"? After all, the NYT and others are just one virus (or porn advertisement) away from a PR nightmare.

    • Re: (Score:3, Insightful)

      by PCM2 (4486)

      Review of each possible advertisement would be onerous

      Seriously? So we're OK with major newspapers having absolutely no standards at all these days? What do you suppose people did back in the days before you could get ads via RSS feed?

      • by bsandersen (835481) on Sunday September 13, 2009 @08:55PM (#29409149) Homepage

        So we're OK with major newspapers having absolutely no standards at all these days?

        I believe I said the opposite; I said a failure to have standards will cause problems.

        What do you suppose people did back in the days before you could get ads via RSS feed?

        They reviewed the advertisements with their clients directly. There were a few hundred per day and it was a manageable problem. Now, advertisements may be served by proxies and selected from among tens of thousands of potential ads, designed to be targeted to readers in specific geographic regions, income levels, purchasing habits, interests, age categories, gender, education level, or other factors.

        The point of my post was that the combinatorial explosion of possible advertisement choices to be served-up on my specific page load may not be easily reviewable by NYT staff a priori.

        • Re: (Score:3, Interesting)

          by PCM2 (4486)

          They reviewed the advertisements with their clients directly. There were a few hundred per day and it was a manageable problem. Now, advertisements may be served by proxies and selected from among tens of thousands of potential ads, designed to be targeted to readers in specific geographic regions, income levels, purchasing habits, interests, age categories, gender, education level, or other factors.

          Surely a good ad proxy works something like an online dating service? If they're just throwing anything and everything at you, why use a middleman in the first place? So what criteria made them think these particular ads were acceptable for a major newspaper? Personally, I don't consider them acceptable for any site (and yes, I've seen the ads in question on the Times -- my reaction when I saw them was to immediately run a spyware scan, which turned up negative).

          And God help us if the New York Times is so d

  • by Morris Thorpe (762715) on Sunday September 13, 2009 @08:44PM (#29409087)

    I had the popup (despite FF w/adblock enabled) while reading a story this morning.
    I never even considered that the Times would be running something like this so I launched into cleansing mode. I wasted an hour hunting for malware or a virus that was not there. Thanks a lot!

  • I could understand this if it were a News Corp paper like the WSJ, but a lie intended to induce fear and take money from people on the NY Times, seems out of place.
  • CNN... (Score:5, Informative)

    by CryptoJones (565561) <akclark@cryptospac[ ]om ['e.c' in gap]> on Sunday September 13, 2009 @09:52PM (#29409453) Homepage
    has also been doing this for the past two days.
  • by davidshewitt (1552163) on Sunday September 13, 2009 @09:54PM (#29409473)
    ...seem to do the trick for me. I put this huge list of malicious sites into my HOSTS file, so most ads never even show up. http://www.grc.com/sn/hosts_mvps_org.txt [grc.com]
    • oooooh, I forgot about this. I heard about it on Security Now but never implemented it. Thanks for the reminder. I would mod you up if I had points.
    • by Rick17JJ (744063) on Monday September 14, 2009 @02:25AM (#29410743)
      I have been using the latest version of the MVPS modified hosts file on both my Linux computer and on my Windows XP computer. However,instead of using the 06-14-06 version which davidshewitt linked to, I have been using the much newer Sept-02-2009 version instead. One link is for, what at the moment, is the latest version of the modified hosts file and the other link is to the installation instructions and general information.

      http://www.mvps.org/winhelp2002/hosts.htm
      http://www.mvps.org/winhelp2002/hosts.txt

      I recently also started using the NoScript add-on and also the Adblock Plus add-on for Firefox on both my Linux computer and on my Windows XP computer. But, perhaps using both the ad blocking host file, plus Adbock Plus, is redundant and unnecessary. With the NoScript ad-on, I occasionally click on the icon, which has now been added to the lower right corner of Firefox. After clicking on that, I can choose whether to temporarily or permanently allow a particular web site scripts.

      I do nearly all of my Internet browsing from my Linux box. But, when I occasionally actually dare to use my Windows XP computer to browse the Internet, I use Sandboxie to sandbox my default browser, which in my case happens to be Firefox. I am not an expert on any of this, and am not a regular Security Now listener, but here are a couple of episodes that are about Sandboxie.

      http://www.grc.com/sn/sn-172.htm
      http://www.grc.com/sn/sn-174.htm
  • by rantingkitten (938138) <kitten AT mirrorshades DOT org> on Monday September 14, 2009 @01:26AM (#29410547) Homepage
    but clearly downloading an .exe file isn't a good way to keep your computer clean ...

    Then how else are Windows users supposed to get new software? Downloading and installing random executables from god-knows-where is the expected method in Windows. Then people wonder why Windows users get infected with all kinds of crap.

    The lack of any managed repository of vetted and verified software is, to me, the number one reason Windows sucks so hard, A plain vanilla Windows install does absolutely nothing on its own -- you're expected to go find all the software you need, and this trains users to believe that downloading and installing random crap is just fine.

    Combine that with Windows' propensity for getting up in your face about every little detail -- THIS SOFTWARE NEEDS UPDATING! YOUR FIREWALL SETTINGS AREN'T CORRECT SOME OTHER SOFTWARE NEEDS UPDATING! CLICK HERE TO GET NEW VIRUS DEFINITIONS! CLICK ME! CLICK ME! CLICK ME! -- and it's easy to understand how this happens.

    The entire Windows model is built around mindless, unnecessary alerts and "download and install now" crap. How are you supposed to teach users which are legitimate and which are not, and what's okay to download and what isn't, when the culture of the OS itself encourages you to do all the wrong things?
    • Re: (Score:3, Interesting)

      by dkf (304284)

      The lack of any managed repository of vetted and verified software is, to me, the number one reason Windows sucks so hard.

      So you're advocating the iPhone-style app store, with obscure fascist rules determining who is blessed and who is not? I'm assuming you're not suggesting that Microsoft should be the only source of all possible software for running on Windows; that most definitely won't work due to the diversity of things that people do with computers. Well, thinking about it you might actually be advocating that, in the misguided belief that the Linux Distributor model works well; it only does if you want OSS - not always

      • False dichotomy (Score:3, Interesting)

        by sean.peters (568334)

        So you're advocating the iPhone-style app store, with obscure fascist rules determining who is blessed and who is not?

        Of course, "absolute free-for-all" and "Apple-style App Store" are not the only two choices. You sort of get it this later in the post, but of course the main concept left out here is the Linux repository concept. You can be reasonably sure that apps in the repository have been vetted for viruses, etc (at least you can with Debian)... and yet, if you really want to get software somewhere el

    • by Rick17JJ (744063) on Monday September 14, 2009 @06:59AM (#29411727)
      Users of Debian Linux, or a Debian derived distro such as Ubuntu Linux, have always had a safe official place to download free software from. We can use the apt-get command to quickly and easily download whatever free software we want from the more than 25,000 free software packages available in the official Debian repositories.

      Synaptic is an easy to use point-and-click GUI front end for apt-get. Synaptic can easily download and install, upgrade, or uninstall various programs from the official repositories, while reliably taking care of all dependencies automatically.

      Windows users do not have a similar place to go to, or built-in tools to use, to easily download and upgrade reputable, safe, non-Microsoft software. However, for installing an occasional commercial paid for software program on a Linux computer, that would still be downloaded from a companies website. As far as I know, it is just the free open source software programs that are available in the main official Debian repositories.

      That is my rough understanding, of how the Debian repositories work. As a desktop Linux user, I am glad that I do not have to download software from god knows where, in response to some pop-up. If I did suddenly decide that I needed new software or an upgrade, I would generally stick to using Synaptic or apt-get to download the software for me from the official repositories, instead of using an advertising script on a script enabled web page to download whatever it is from who knows where.

      There are also a few reputable, reasonably well known, commercial software companies, with Linux software, that I have bought software from, for my home computer.

      The lack of something like Synaptic and apt-get, and the Debian repositories, is a severe shortcoming of Windows.

      http://en.wikipedia.org/wiki/Debian
  • by dk90406 (797452) on Monday September 14, 2009 @05:36AM (#29411371)
    The story [nytimes.com] is somewhat weak. It suggests running Avast and MS Malicious Software Removal Tool.

Kill Ugly Processor Architectures - Karl Lehenbauer

Working...