A friend of mine called me for help after she started getting pop-ups every time she opened her web browser. She asked me how her computer got into this mess. While I could not pinpoint an exact cause (no log files), I suspect she downloaded crapware with a software installation she trusted.
She also wanted to know why anyone would want to inflict this malware on her computer. The answer is simple: Money.
So what can you do to avoid this problem? The consensus advice is to only download programs from a trusted source. Ok! That’s great advice! But what is a “trusted source”?
HowToGeek.com explains in “Yes, Every Freeware Download Site Is Serving Crapware” that all the major free download sites–Tucows, CNET Downloads / Download.com, FileHippo, SnapFiles, MajorGeeks, and yes, even SourceForge–include adware and even malware with their installers. While some sites are better than others about telling you what they’re including and about allowing you to uncheck those additions, they all do it.
What to do instead? Go to the developer’s website and download from there. And support those software authors that do not include crapware by donating to support their development work.
Other steps to take:
- Back up regularly (at least once a week or oftener), then disconnect the media. Test your backups by periodically restoring a file. I also recommend alternating backup media to offsite storage, such as a safe-deposit box. Backup media–just like any other technology–can break, become corrupted, get lost or stolen.
- If you back up to a cloud provider, your back ups can become unavailable if their storage media becomes unavailable for any reason, so use physical backup media as well.
- On Windows systems, set System Restore Points.
- Change your IMPORTANT passwords as soon as you can from a computer that is not infected. Use a unique, strong password for each site.
- Can’t remember all those passwords? Use a password manager. Note: Do NOT lose this password! I use the Professional versions of KeePass and Portable KeePass, and KeePass2Android (available from Google Play), but cloud-based LastPass is also very popular. (LastPass is more convenient, but I am leery of cloud-based services for availability reasons.)
If you have recent back-ups and your files get locked by a version of CryptoLocker / CryptoWall, you may not have to pay to get your files back (depending on how recent your backups are).
For an interesting read, check out Kaspersky’s 2014 Trends in the Internet Security Industry.
Intentional Privacy 