Trojan free software

[AlexSem]

Hi guys,

I've been looking around this forum and I have one question - how am I to know I'm safe, downloading something like "flop-a-set-meter"? With my limited knowledge, it's very easy to put some form of trojan in these freeware programs and then you have a huge problem on your hands.

How do I make sure I, and others here, are safe when looking at these wonderful freebies?

[Chillee]

Id you don't download it you are 100% safe

[Dadswell]

scan it with uptodate virus software first. Also you should be running some sort of firewall that blocks all outgoing/incoming. I have mine set up so that a program will not have access to the network unless I manually add it and give it access. It's a little bit of a pain because nothing works at first, but I think it's a lot more secure.

[CudjoeBill]

This site uses 31 separate anti-virus scanners to check a file:

http://www.virustotal.com/en/indexf.html

These sites use 18 anti-virus engines:

http://virusscan.jotti.org

http://scanner.virus.org

[Phil153]

They're all pretty much worthless though. If someone is going to make a poker trojan it's not hard to have it evade virus scanners.

The only real protection is running an OS firewall like ZoneAlarm or processguard, and not downloading stuff you aren't sure of. The community here is no protection either. rbcalc.exe was a nasty trojan that was promoted on 2+2 and hosted on a popular site, and it went undetected for months I think. As another example, my own poker program uses a (legit) third party installer that has very suspicious behavior. If you dont' have .NET 2.0 installed, it will ask if you want to download it from Microsoft. However, before even loading this part, it installs itself in the registry to run at startup, so it's available after the reboot from installing .NET. It's really badly designed, and this behavior will pop up alerts from firewalls and antispyware programs, but noone has said a word about it. It could just as easily be something nasty. Another point is that some trojans are quite sophisticated and will shut down if they detect programs like Zonealarm or Processguard which would sniff them out. Which means the poor unsuspecting guy using Norton or McAfee or Windows Live won't benefit from the more security conscious around here catching nasty stuff.

And finally, open source is no protection either, unless you compile it yourself. You can put a rootkit dropper in the install script, while keeping your program and its source clean. Or have the occassional upgrade contain a keylogger. No one is going to compile the source and check that everything matches for each build.

I don't want to be alarmist but if you have a lot of money going through your computer, you need to be aware that most antivirus programs are only poor protection. People scan something and it comes back clean and they think "ok, it should be fine" when in reality the scan doesn't tell you much.

[CudjoeBill]

Agreed, Phil. You bring up a lot of very valid observations.

So what do you personally do to ensure programs you install are virus/trojan/malware/spyware free?

[SamIAm]

Keep in mind that everything AHK is inherently safe. It's not just open-source, it's human-readable.

[jukofyork]

Yep, what Phil said is very true: don't just assume that running a virus killer will keep you safe from new/novel Trojans, etc. Somebody could quite easily make a brand new Trojan that the virus killer has never seen and most likely it wouldn't detect it as a threat.

Juk [img]/images/graemlins/smile.gif[/img]