10 Quick Fixes for the Worst Security Nightmares

Fix 4:  Sidestep Social Engineering

The most dangerous crooks use clever marketing to get you to do their dirty work for them and infect your own PC. Lots of social engineering attacks are laughably crude, with misspelled words and clumsy grammar, but that doesn't mean you should dismiss the danger. Every now and then, a well-crafted attack can slip past your defenses and lure you into opening a poisonous e-mail attachment or downloaded file. A targeted attack might even use your correct name and business title.

To fight back, turn to a simple but powerful tool: VirusTotal.com. You can easily upload any file (up to 10MB) to the site and have it scanned by a whopping 35 different antivirus engines, including ones from Kaspersky, McAfee, and Symantec. A report tells you what each engine thought about your file. While some (such as Prevx) are prone to false alerts, if you get multiple specific warnings that include the name of the particular threat, then you almost certainly want to delete the file.

A lack of warnings doesn't guarantee a file is safe, but it does give you pretty good odds. Use VirusTotal to check every e-mail attachment and download you're not 100 percent sure about, and you'll avoid insidious social engineering.

With the free uploader for VirusTotal, you can easily send suspicious files for an online security check.
If using VirusTotal starts to become a habit (not a bad idea) and you want to make sending files for scanning to VirusTotal really easy, download the free VirusTotal Uploader. Once you've installed the utility, just right-click a file, and you'll see an option (under Send To) to upload it to the VirusTotal site.

Fix 5:  Get the Jump on Fast-Moving Malware

Traditional, signature-based antivirus software is getting snowed under by a blizzard of malware. Attackers try to evade detection by churning out more variants than security labs can analyze. So besides signatures, any antivirus program worth its salt today uses proactive detection that doesn't require a full signature to spot sneaky malware.

One promising approach uses behavioral analysis to identify malicious software based solely on how it acts on your PC. But your antivirus software by itself may not be enough. ThreatFire, a popular free download from PC Tools, adds such a layer of behavior-based protection. In recent tests, it correctly identified 90 percent of malware based on its behavior alone.

PC World's ThreatFire review provides a thorough analysis of the program and a quick download link (as well as a warning about installing too many security programs on one PC). And for more on behavioral analysis and proactive virus detection, see "When a Signature Isn't Enough."

Note: If you use the AVG Free antivirus program, hold off on trying ThreatFire until PC Tools releases a new version. The current 3.5 version conflicts with AVG, but PC Tools says it's working on a fix. 

Fix 6: Rescue Your Inbox From Spam

Spam filters are getting better, but some junk still makes it through even the best of them. Instead of resigning yourself to hitting delete for all those hot-stock and Viagra come-ons, try disposable e-mail addresses.

Such an address is something you create every time you encounter an online shopping site, forum, or other service that requires you to enter an e-mail address. If that address gets flooded with spam, you can terminate it. That's a better system than the alternative, creating a free Web mail account that you use only for purchases and Web signups. With a single separate account, you have to throw the baby out with the bathwater and cancel the whole account if it gets too much spam.

Yahoo Web mail users can opt for the $20-a-year Plus service, which includes the AddressGuard disposable e-mail service (among other benefits). With it, you can click a bookmark to create a new, disposable address for any given site in about 10 seconds.

Gmail users can simply append "+ whatever" to their regular e-mail address before handing it out, but if that address starts to receive spam you can't simply turn it off. You'll have to create a filter in Gmail to block all mail to that address.

For everyone else, we suggest a good, free service from Spamgourmet.com that's quick and easy to set up and use; it allows you to create disposable addresses on-the-fly that will forward e-mail messages to your regular address.

Subscribe to the Security Watch Newsletter

Comments