Semi-Manually protecting myself for YEARS, are my understandings accurate?

Learn about Computer Security General Security Questions and Comments
#1

Hi all,

I’ve been thinking about my personal methods/thoughts on the whole secuirty issues… i’ve stuck w/ it for years and it’s never failed me… but i wana ask you guys, if I’m really on track here, or am i just as clueless as a dumb blond in a nuclear submarine?

To summarize, I’ve used comodo and a bunch of other internet suites etc for as long as i can remember… a few years back, gaining much knowledge on how these threats work, I decided to rely less on software protection and more on manual methods… and most specially because of resource/performance impact of these Security suites etc…

Here are my understandings on the matter at hand:

  1. the only file types that are a potential threat to your system are EXECUTABLES (exe, vb, etc)… JPG, video files, Music, or other NON EXECUTABLES are NO THREATS - ofcourse except for non-exec documents that has a way to take advantage of vulnerabilities of its executing/host application: i.e., Word document that uses macros vulnerabilities of Microsoft word etc etc… but these are really RARE occassions and i can easily spot these things, so i dont consider non exect types potentially threatening in general.

  2. The only way you can get a threat into your system is if you voluntarily (knowing or unknowingly) copy the threat from a source to your computer (download, file copy, etc)… or if a shared resource (like a shared/writable folder on your PC) is on a network and there’s a worm spreading copies of itself to any writeable network location…

  3. … the only way for this threat to be activated and/or actually infect your system and do damage to it is if you voluntarily EXECUTE them (knowingly like by double clicking on them, or unknowingly like double clickin on a usb drive w/ autorun.inf instructions to execute the threat)… heck i even play around w/ trojan’s and viruses on my pc, keep them there so i can study them , and i know they’re just files / inactive untill they’re executed…

ofcourse there is a rare exception on threats that has the ability to execute itself via OS vulnerabilities and script routines etc. but again, RARE stuff…

  1. … and when a threat is active / able to do stuff on your PC, that threat will be there in your list of running programs, processes and services…

  2. and that… removing an ACTIVE threat means manually ending the threat’s processes, deleting the file, and removing it from your startup entries (in the registry)…

With the above knowledge, and for each of the above I:

  1. take extra precaution handling, running, installing executable file types… and dont really care to scan or be paranoid about any other non-executable files, specially images and music files … like c’mon, i laugh sometimes at people running scans on mp3 and jpg files… sheesh…

I also have gotten into the habit of setting my system to SHOW ALL FILES , regular or system files, and showing the EXTENSIONS of known file types, so that i can tell if an executable is using a JPG icon to fool me…

  1. I have the habit of ignoring email attachments and other things I do not need, or do not expect… and when i do need to copy files I scrutinize each executable file … again… i dont care about copying images/videos/music files … they can never hurt my system (99%)

  2. for those executable files that I need to copy, install, or run, while some I would know to be CLEAN such as those being downloaded from official websites of known developers, most executables i run has the potential to be a bad boy, coz i really do download a lot, try lots of cool software for PC… some useful, some just for fun… and i do admit to running keygens and cracks to software that i wana try for a long time… Please follow forum policy :slight_smile:

anyway back to the point, I do run a lot of potentially dangerous applications/installers on my system and i never get infected because i simply:
a) run a quick scan using whatever free AV i have installed like AVG, AVAst, etc… and for very suspicious files I run them through virustotal.com

b) if checks prove an executable is clean i install it… then i immediately run PROCESSEXPlorer and Autoruns and sometimes TCPViewer (all by Sysinternals) to check for PROCESSES that are running that i do not recognize, startup entries that shouldnt be there, as well as check for unexpected network traffic from any of these processes…

c) for the 99%/most part, all those 3 areas are usually clean and from here I CONCLUDE that whatever i just ran/installed is OK… and i go on w/ my life.

d) sometimes i go so much as to running the application in a virtual enviornment first and comparing snapshots of the system before and after running the app… to see if thre’s anything suspicious

  1. Should i spot a process that is unknown to me, or unexpected, or as per research is confirmed to be a threat, I would simply end it, delete the file and startup entries, and study it’s effects… if it doesnt do much to my system then I go on w/ life… if it does (Like what happened to me just recently where it mesed up my registries and task manager etc), i simply restore my system’s image and have a fresh system running again… that’s so much better than running AV removal that removes the threats but can never really put a system back to it’s normal state (coz there’s no way AV’s can reveres all the things /changes a virus has done, really)…

  2. well , number 4) answered this already…

So… for many years, I was able to protect myself w/ the above philosopy on these threats… and I can honestly say that at least in the last 5 years, I’ve probably been infected 4 times only, but never really experienced major intrusions, identity theft… etc… i was simply in belief also that whatever antivirus in paranoid mode can do, i am simply doing more manually and more effectively (i dont need to rely on virus definitions) … and the most wonderful thing about this is not just the effectiveness of my process as proven in many years, the fact that there’s almost zero ANNOYANCE from FALSE POSITIVES! ← this gets terrible annoying w/ paranoid security suites…

Now, I may be contented w/ all this already, but I think it’s about time I ask other experts what they think of this too. Specially since all this i learned by myself, by experience, and by lots of trial and error… and reading around… i never really had formal computer science education etc… (i did Business / Marketing major w/c is far from what i do now in the IT industry hhaaha)

So the question of it all is, AM I IN THE RIGHT TRACK HERE?

It’s not that I dont trust these AVs, infact i have very high respect for comodo, and it’s cloud style, etc… but I always felt these AVs are for the regular users who

  1. dont know what to look for in a system , dont know how to check, dont know the processes well etc
  2. dont have time or cant be bothered to worry about these steps… people who like the convinience of just running something and not worry about all this stuff…

Not that there’s anything wrong w/ the above, but at least for me, i felt more comfortable in being in control and most importantly not have to worry / be scared of false positives…

Right now i got Comodo suite installed, it’s great, but darn it’s raising all these false positives (or so i think it is)… even flagged applications in my programs archives (cracks and keygens included) w/c ive already been using for many years w/o issues…

I know this has been a long read, thanks so much for going thru this for me, and I would really appreciate your thoughts on this…

Regards

TJ

#2

  1. Malware can indeed be hidden in non-executable files.

  2. Yes, malware must get into your system before it can do any damage.

  3. Certain exploits do not need to be executed by the user. This is how driveby infections propagate.

  4. Rootkits can can hide from the running processes list.

  5. Rootkits can’t be stopped by manually ending processes, deleting files, and removing startup entries.

#3

Dammmmm that’s a long post

also remember this,

  1. some malware can recognize if there in a sandbox or a virtual system. If detects either of them, the malware will not run. Then when you put it on a normal OS, the malware will run and it’s too late

  2. If feasible, disable “autorun” for USB drives on the computer

Your good to go :-TU

#4

I too semi-manually protect the problem came when I had to delete Comodo to install new version. Spybot found win32loadfraud.edt. Prior to that Comodo nor Spybot found anything so assume it was laying in wait or hitched a ride with software updates.

Manually, this could not have been prevented it seemed completely able to execute on its own.

#5

@ALL

thanks for your feedbacks and advises…

as for the RARE occurances of driveby and rootkits (on my system atleast) i guess i can leave it in the drawers… just the fact that 99.9% of all threats will have a corresponding process / thread/service viewable in task manager or other more sophisticated process managers like the new comodo KiLLSwitch, i think it’s safe to say that , even w/o an AV on one’s system,so long as you are a bit of an expert and know and can recognize running processes in your system, you can have decent manual protection

but in a different note i also didnt say i dont use an AV, i have also always used an AV but i just dont turn on the REAL TIME PROTECTIOn… i just like the convinience of havin to only rightclick > scan on a NEWLY INTRODUCED application or installer…

PS
do you know of a list of threats that doesnt have process or hides themselves in differnt processed? we all know there are those kinds of threats but can you point me to specific ones? i’d like to read up on them , and perhaps even try running them in my VM so i can study it myself… i personalyl have NOT EXPERIENCED such a threat…all threats i’ve encountered always had a process or atleast a service running…

#6
Hi all,
Hello :)
I've been thinking about my personal methods/thoughts on the whole secuirty issues.. i've stuck w/ it for years and it's never failed me.. but i wana ask you guys, if I'm really on track here, or am i just as clueless as a dumb blond in a nuclear submarine?
Thinking for some of us can be quite dangerous :D
1) the only file types that are a potential threat to your system are EXECUTABLES (exe, vb, etc).. JPG, video files, Music, or other NON EXECUTABLES are NO THREATS - ofcourse except for non-exec documents that has a way to take advantage of vulnerabilities of its executing/host application: i.e., Word document that uses macros vulnerabilities of Microsoft word etc etc.. but these are really RARE occassions and i can easily spot these things, so i dont consider non exect types potentially threatening in general.
Executables; Anything you can load into the memory is a potential threat; but Most common are exe/vb/bat/cmd/msi/etc etc
2) The only way you can get a threat into your system is if you voluntarily (knowing or unknowingly) copy the threat from a source to your computer (download, file copy, etc).. or if a shared resource (like a shared/writable folder on your PC) is on a network and there's a worm spreading copies of itself to any writeable network location.....
True; You can get a threat from any external connection from your machine (usb/cd/dvd/intra-internet/etc)
3) .. the only way for this threat to be activated and/or actually infect your system and do damage to it is if you voluntarily EXECUTE them (knowingly like by double clicking on them, or unknowingly like double clickin on a usb drive w/ autorun.inf instructions to execute the threat).. heck i even play around w/ trojan's and viruses on my pc, keep them there so i can study them , and i know they're just files / inactive untill they're executed..
Right; Also, buffer-overflow, injections, driveby but then i'm sure these would tie into double clickin on a usb drive w/ autorun.inf instructions to exectue the threat; just different type of process as in you go to
4) .. and when a threat is active / able to do stuff on your PC, that threat will be there in your list of running programs, processes and services..
Wrong! Some ocasions its very easy for malware to hide; Polymorph virus's are inparticuraly good to do so
5) and that.. removing an ACTIVE threat means manually ending the threat's processes, deleting the file, and removing it from your startup entries (in the registry)...
Just nuke the darn thing :) but true
1) take extra precaution handling, running, installing executable file types.. and dont really care to scan or be paranoid about any other non-executable files, specially images and music files .. like c'mon, i laugh sometimes at people running scans on mp3 and jpg files.. sheesh..
Tell me about it! My uncle scans his computer every 3 hours :P but Its a sense of security, a lot of people don't know the computing enviroment so they are extra caution, and whats wrong with that?
I also have gotten into the habit of setting my system to SHOW ALL FILES , regular or system files, and showing the EXTENSIONS of known file types, so that i can tell if an executable is using a JPG icon to fool me..
Add that with showing details instead of thumbnails and other settings but i do the same :D One day you'll run into a virus that actually copies a real image from your computer so if you are viewing in thumbnails you wont tell the difference :D
2) I have the habit of ignoring email attachments and other things I do not need, or do not expect.. and when i do need to copy files I scrutinize each executable file .. again.. i dont care about copying images/videos/music files .. they can never hurt my system (99%)
Ah; I love those 99% :P
3) for those executable files that I need to copy, install, or run, while some I would know to be CLEAN such as those being downloaded from official websites of known developers, most executables i run has the potential to be a bad boy, coz i really do download a lot, try lots of cool software for PC.. some useful, some just for fun.. and i do admit to running keygens and cracks to software that i wana try for a long time.. [u]Sorry I had to remove this Reason of Forum Policy[/u]
anyway back to the point, I do run a lot of potentially dangerous applications/installers on my system and i never get infected because i simply:
I wouldn't say never :D
a) run a quick scan using whatever free AV i have installed like AVG, AVAst, etc.. and for very suspicious files I run them through virustotal.com
Thats good;
b) if checks prove an executable is clean i install it.. then i immediately run PROCESSEXPlorer and Autoruns and sometimes TCPViewer (all by Sysinternals) to check for PROCESSES that are running that i do not recognize, startup entries that shouldnt be there, as well as check for unexpected network traffic from any of these processes...
Thats good too
c) for the 99%/most part, all those 3 areas are usually clean and from here I CONCLUDE that whatever i just ran/installed is OK.. and i go on w/ my life.
99% again :D
d) sometimes i go so much as to running the application in a virtual enviornment first and comparing snapshots of the system before and after running the app.. to see if thre's anything suspicious
And do you use the command Tree /f and compare? :D
4) ....coz there's no way AV's can reveres all the things /changes a virus has done, really)..
And why not?
So.. for many years, I was able to protect myself w/ the above philosopy on these threats.. and I can honestly say that at least in the last 5 years, I've probably been infected 4 times only, but never really experienced major intrusions, identity theft.. etc.. i was simply in belief also that whatever antivirus in paranoid mode can do, i am simply doing more manually and more effectively (i dont need to rely on virus definitions) .. and the most wonderful thing about this is not just the effectiveness of my process as proven in many years, the fact that there's almost zero ANNOYANCE from FALSE POSITIVES! <- this gets terrible annoying w/ paranoid security suites..
CIS is a very powerful suite; but its the user that makes it much more powerful :D or much more less useless but their Working on it :D
Now, I may be contented w/ all this already, but I think it's about time I ask other experts what they think of this too. Specially since all this i learned by myself, by experience, and by lots of trial and error.. and reading around.. i never really had formal computer science education etc.. (i did Business / Marketing major w/c is far from what i do now in the IT industry hhaaha)
Aye; Me too but i do have few certs up my sleeve
So the question of it all is, AM I IN THE RIGHT TRACK HERE?
As a great friend of mine would say; Aye You are alright man
It's not that I dont trust these AVs, infact i have very high respect for comodo, and it's cloud style, etc.. but I always felt these AVs are for the regular users who
  1. dont know what to look for in a system , dont know how to check, dont know the processes well etc
  2. dont have time or cant be bothered to worry about these steps… people who like the convinience of just running something and not worry about all this stuff…

Not that there’s anything wrong w/ the above, but at least for me, i felt more comfortable in being in control and most importantly not have to worry / be scared of false positives…


Oh; You are not as they would say "computer illirate ?

Right now i got Comodo suite installed, it's great, but darn it's raising all these false positives (or so i think it is).. even flagged applications in my programs archives (cracks and keygens included) w/c ive already been using for many years w/o issues...
Maybe turn of the heuristics?

Hope this helps

Jake

#7

+1 to Jacob. Well done Jake that is one of the most interesting replies that I have seen and I would be proud to call you my Grandson. Kind regards from Grandpasticks.

#8

Don’t forget that there are also ways to protect yourself online as well. For that you can read this article.

Some methods are obtrusive while others will silently protect you from the background. Just pick and choose which you like. :wink:

Also, I understand protecting your computer without a real-time scanner (I do), however this must be complemented by a HIPS to offer adequate protection.

You’re on the right track though. :-TU Just let us know if you have any more questions.