Windows Security Checklist - Windows Security Checklist, Part 3: Safe at Any Speed Online

by Larry Stevenson, aka Prince_Serendip, CastleCops Staff Writer
December 12, 2004

No one application nor technique can protect you at 100%, but you can still get pretty close to that. When these guidelines are followed by Windows users, it can bring their chances of being infected by malwares almost to zero. Now we begin our next installment of the Windows Security Checklist, Part 3: Safe at Any Speed Online.

It is not as complicated as it may first appear, although there is a lot of information to absorb. The Security Experts, 1st Responders, Special Response Team members and Host Consultants at CastleCops can help you if you have questions about any of these techniques and applications. The applications featured here are compatible with all Windows platforms, unless otherwise noted.

Browsing the Shelves

Configure your browser for maximum privacy. Force it to prompt you for permission for everything possible. For more details on how to do this refer to this article Safe Surfing Settings for Internet Explorer. For all other browsers please refer to their Help sections.

With Internet Explorer, clear your browser cache, called "Temporary Internet Files" or TIF, and browser history often. Always clear these after visiting any site where you performed personal business such as online banking or buying products. Please refer to this How-To post at CastleCops for instructions, especially #4 and #6. For those who would prefer an application to do it for them, this little freeware can speed up the job: Crap Cleaner at Crapcleaner.com It is also available from CastleCops Downloads: Disk and Track Cleaners. Other browsers, such as Opera, can be set to clear cache and history just by closing the program.

For Internet Explorer users: Get a web content/browser filter to prevent remote site contact through ad banners and embedded web bugs. Proxomitron is an example of a web content filter. For more info, please visit the CastleCops Proxomitron Forums. Also, get a cookie filter. They are built into most browsers these days, but third-party programs usually offer better filtering options. For IE there is CookieWall which you can find at CastleCops Downloads under Anti-Spyware. Another excellent application for browser filtering and to prevent hijacks is WinPatrol, which you can find at the bottom of this page at Castlecops Downloads: Anti-Spyware. For more information or help please visit the WinPatrol Forums.

Internet Explorer can be a safe and able browser if you configure and protect it properly. Some of the reasons as to why IE has had security problems are not due to Microsoft, but largely to inept and uninformed users. These articles help alleviate that by informing and educating all users.

Take Care of Your Information

Be careful about what information you share on websites. Use common sense when filling out forms or providing any personal data, unless you are completely sure it will not be misused. Read their Privacy Policy or Statement. Just because they have one does not mean they will not still use your information. Read it carefully. If it is vague, not clear, or absent, do not share anything with them.

Stay away from everything to do with mailing lists and requests to use your personal information. Avoid sites that offer some sort of prize or free gift in exchange for your contact details. These are sure to be some form of identity theft scam or for spam.

Do not use "click here to unsubscribe" with spam e-mails. What this really does is verify that the spam was delivered to a valid e-mail address and confirms that you saw it. The sender has no intention of honoring your request. By responding you are certain to get even more spam from the same sender, as well as those who were sold your confirmed address. Delete the spam without responding to anything. To fight spam get MailWasher Pro at CastleCops Downloads Filters (Mail - Web), at the bottom of the page. For more information visit the MailWasher Forum.

Do not give your personal (ISP, Internet Service Provider) e-mail address to a commercial website, whether for buying something online or answering a survey. Use a disposable, free webmail account instead. These are easily obtained from Hotmail, Yahoo, Google etc.

Do not use your personal e-mail address when posting to message boards, or newsgroups. Always use a webmail address. Spiders and crawlers are constantly checking these places for valid addresses to use for spam. Many websites provide a choice in your profile whether to hide or reveal your e-mail address.

Also avoid giving your personal e-mail address to your friends. They may not be as well protected and informed as you. Use webmail.

Anonymizers or proxies can help where both privacy and security are at risk when browsing to new websites and posting to certain newsgroups. Check CastleCops Downloads under Web Proxies for more info.

Be informed. Visit CastleCops and other security websites frequently. Read the news and apply what you learn.

Test the Waters First

Try one or more of the free services listed below to test the security of your computer connection to the Internet. Be sure to include a check for identity vulnerabilities and port scanning.

CastleCops UDP Port Scanner

S.O.S: Sygate Online Services

ShieldsUP! by Steve Gibson, Gibson Research Corporation.

Symantec Security Check

Online Security Tests by LockDown Corporation. These are provided for HTTP Log Tests, FTP E-mail Address, NetBIOS Tests, Ping, Traceroute, Internet Explorer Vulnerability Test, and more.

Look at the results. Make adjustments to your firewall or network settings and apply software patches as required for the best defense.

Check your firewall and router logs often for suspicious incoming or outgoing traffic. If you suspect that you are a victim of a hacker attack, that someone did in fact compromise your system, go to the Internet Crime Complaint Center for instructions on gathering proof and filing a report. Look for changes on your hard drive, unknown or changed files and folders with decreased hard drive space. Do not delete. Quarantine anything suspicious as you will need this information for evidence. An easy way to quarantine files is to encrypt them so they cannot be opened except by you. See CastleCops Downloads: Encryption for more info and applications.

Always Have a Backup!

Keep current backups of all personal and system files. Backups restore lost data in the event that your system security is compromised or your critical files become corrupted. Keep copies of everything you need whether for a simple or a major restore. In the event of something catastrophic, like a hard disk failure or major file damage, you need to be prepared to re-install your Operating System. This means keeping your installation CD for Windows, the CDs for all of the other programs you have installed, copies of programs downloaded put on CD, and any personal files in a safe place seperate from your computer. These will be destroyed when you re-format a hard drive partition.

Always create a backup of your registry before installing any new program or making any changes to your system settings. Instructions to do this are in your Windows Help Files.

For Windows 98/se users, keep backup copies of WindowsSystem.dat and WindowsUser.dat. If you are using User Profiles, you will also find a copy of User.dat under each WindowsProfilesprofilename. Simply copy these files to another location for safe keeping. If you need to restore these files, just boot to a command prompt and copy the files back to their original locations.

Since system files in Windows XP cannot be simply copied while they are in use, XP users should use System Restore to create restore points. A shortcut is placed by default under System Tools in the Start Menu.

If you are selling your computer, deeply clean your hard drive. Deleting files and reformatting is not enough. Reformatting does not overwrite every sector, and private information can remain retrievable. Use a secure delete or disk wiping utility to overwrite every sector on all hard drives. You can find excellent utilities to do this at CastleCops Downloads: Disk and Track Cleaners section.

Article Resources

Best regards and always take care of your security!