Infection/security guide.

This is an archive of the mabination.com forums which were active from 2010 to 2018. You can not register, post or otherwise interact with the site other than browsing the content for historical purposes. The content is provided as-is, from the moment of the last backup taken of the database in 2019. Image and video embeds are disabled on purpose and represented textually since most of those links are dead.

To view other archive projects go to https://archives.mabination.com

Rydian wrote on 2012-01-03 01:57

So given the recent huge scare of game account security along with the persistent threat of account hacking, I'm wondering if a guide on virus/infection/hacking prevention for the tech forum would be welcome. I have a guide like that written up, and if it'll be accepted/stickied I wouldn't mind porting it here and modifying it to apply to the game (as in, have a focus on keeping online accounts secure). I see far too often people are misinformed about computer/account security, and so take risks they shouldn't, or don't bother to protect what's actually important/vulnerable, so the guide would also focus on proper information along with the basic preventative steps.

So you can see what it is now, here's the guides I maintain on another forum, I'm linking both since a lot of the info would be coming from both of them since they're meant to work in tandem normally.
http://www.gaiaonline.com/forum/test-forum/infection-removal-guide/t.71939023/
http://www.gaiaonline.com/forum/test-forum/infection-prevention-guide/t.72292663/
inb4 "omg gaia???" - Do note that we're currently on a forum for a game where dressing up as a loli in flashy clothing is considered a normal pastime. :P

Anyways I'm not going to do it without confirmation because it seems every forum system likes to have subtle differences in it's bbcode that makes managing things with nested lists and such a hassle. :P Also for this one it'd need to be restructured to be more informative and focus on the game anyways, meaning more work.

[SIZE="1"]I intend for this to be just prevention, the guide for removing infections partially depends on feedback/interaction... it has a lot of instructions for self-cleaning, but focuses on analyzing logs and such if the automated steps fail, and while there's some technical people on this forum I feel that in such a situation it's better if the user is directed to another forum that specializes in this sort of thing so they can be sure help is available quickly... so I'm hesitant to bring that part over here and want to focus on prevention and myth-busting.[/SIZE]
Conor wrote on 2012-01-03 03:22

I'm all for it! But I'm not the confirmation you were looking for, hehe.
Yoorah wrote on 2012-01-03 03:25

Just do it! I was actually planning on making one myself, so you'd save me the trouble. :p
They'll sticky it if they find it to be useful.
Skye wrote on 2012-01-03 03:28

tl;dr but I get the gist of it.
If you'd like to post a guide, please do. If it's good, it'll most definitely be stickied!
Yoorah wrote on 2012-01-03 04:31

Hmm, I've read your prevention guide, and one point in it is pretty flawed:

Q - Why not just format when you get infected?
A - At least once a month, windows receives automatic security updates. These fix security holes that viruses and other types of infections can use to get into your computer and mess it up. When you format and reinstall windows, you are taking it back to a time before all the updates, meaning you are just opening the door for even more infections to get in! Most of the time it's better to remove the current infection and then take steps (listed in the "future prevention" post) to prevent reinfection. Formatting is a last resort, some people may have 50 gigabytes of personal files on their computer, and some people have their computers set up a very specific way that would take hours or days to restore to working order after a format. Just because formatting is your choice does not mean it should be the first suggestion to somebody else.

Dude... no. Just no. D: That's just incorrect, unless they proceed to use their computer for random crap right after it was re-installed, before securing it. Your removal guide was good, but the prevention one.. D8
oasis789 wrote on 2012-01-03 10:26

Its good to keep data and OS on sep partitions so reinstalling is easy. Only takes a couple hours to get all program and settings back.
Rydian wrote on 2012-01-03 14:28

Quote from Yoorah;719500:
Hmm, I've read your prevention guide, and one point in it is pretty flawed:

Dude... no. Just no. D: That's just incorrect, unless they proceed to use their computer for random crap right after it was re-installed, before securing it. Your removal guide was good, but the prevention one.. D8
How is this incorrect? You kinda' never stated that... but anyways. :P

Blaster/sasser, 0-day, network stack exploits, even plain old browser plugin hijacking... there's plenty of documented times and situations where having a machine with outdated protection can get infected within days, or even hours of getting online. This is partially because, to most people, the only "formatting" option they have handy is the recovery discs/partition of their computer... which will set the computer back to a specific point, with old versions of software (browser, browser plugins, the system itself) that are vulnerable. If you set to fixing these issues right away then yeah you're fine, but most people WILL just use their computer for random crap right after reinstalling. The average person doesn't know crap about computers.

Anyways, the main focus of that was that for many people the time spent to get their machine back to fully operation condition (for their use) is often longer and more troublesome than the time spent removing whatever got in. I see far too often people that just use their computer for facebook and youtube suggesting a format to somebody that uses gigs of production software and system tweaks and stuff, that's part of what I want to prevent.

The "Why do I need to fix it when I can just reformat each time?" mentality is bad, which is why I worded it the way I did, to prevent people from coming in and saying that to users with issues (some of them will still do it anyways of course).

Quote from oasis789;719904:
Its good to keep data and OS on sep partitions so reinstalling is easy. Only takes a couple hours to get all program and settings back.
Like the average person even knows what a partition is? Hell, even when computers come partitioned the people I've seen ask me what the other drive is for, they just keep stuff in their desktop/documents like usual (which are on the main partition). If people actually did that on a daily basis it'd save a lot of hassle, but people often find out about that too late (hindsight is 20/20 they say).

EDIT:

Okay, posted it. Given that the bulk of the info (by size) is technical I put it in the tech forum, not sure if it'd be better in the mabinogi discussion section.
http://mabination.com/threads/45456-Infection-Hacking-Prevention-Guide
Yoorah wrote on 2012-01-04 05:16

It's incorrect because unless the user actually uses their machine after a fresh OS installation, without the updates installed, they are not in danger of getting infected as a result of the fresh OS install. And it's only ancient releases of Windows XP that are famous for getting infected without you doing anything. Besides, NAT these days helps, too.
In the professional world, malware removal is for the most part considered to be a pretty amateurish thing. At work, if we have any reason to suspect that a machine may be infected, we don't bother with troubleshooting--we just nuke it. Why? Because even with the top-class cybersecurity experts we have (who make me look like a total noob ;_;), it is time consuming and difficult to guarantee that the infection had been removed.

And more importantly: The purpose of a guide, is to, well, guide people to the proper practices. They may be "idiots," but your job is to make them a bit less so. So you might as well give them the information they need.

Don't get me wrong, I like what you're doing to help people (and you offer great points overall), but I just prefer correctness in as many areas as possible. xP
Rydian wrote on 2012-01-04 11:32

Quote from Yoorah;721374:
It's incorrect because unless the user actually uses their machine after a fresh OS installation, without the updates installed, they are not in danger of getting infected as a result of the fresh OS install.
People DO that. People do that all the time. I'm not talking professional environments, I'm talking the average person. I fix computers for a living and I'm in college for computer stuff and did a work study with the college's tech department for a few semesters, I've been working with the average person for years and the average person doesn't know this crap. I run into people on almost a weekly basis that turn windows update off because they consider it a hindrance, and still use some old version of firefox (like 4 or something) because they don't like the look of the new versions.

Quote from Yoorah;721374:
And it's only ancient releases of Windows XP that are famous for getting infected without you doing anything. Besides, NAT these days helps, too.
A majority of the issue (again, for normal people) nowadays is plugin/browser security.

http://www.mozilla.org/security/known-vulnerabilities/firefox.html
Firefox 9 fixed four "critical" vulnerabilities. The definition of "critical"?

Vulnerability can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.

And Flash/Java have the same sort of stuff, they get hijacked to install fake AV software all the time.

Quote from Yoorah;721374:
In the professional world, malware removal is for the most part considered to be a pretty amateurish thing. At work, if we have any reason to suspect that a machine may be infected, we don't bother with troubleshooting--we just nuke it. Why? Because even with the top-class cybersecurity experts we have (who make me look like a total noob ;_;), it is time consuming and difficult to guarantee that the infection had been removed.
Professional environments and home environments are pretty different, home users tend to NOT have all their data backed up somewhere else, and often the issue is easily fixable (half or more of the instructions in the removal guide aren't needed for any given situation, it's just got a lot of things to cover all the bases).

Quote from Yoorah;721374:
And more importantly: The purpose of a guide, is to, well, guide people to the proper practices. They may be "idiots," but your job is to make them a bit less so. So you might as well give them the information they need.
If the guide was aimed at professional environments, it certainly would have a different tone... but it's not.

Quote from Yoorah;721374:
Don't get me wrong, I like what you're doing to help people (and you offer great points overall), but I just prefer correctness in as many areas as possible. xP
I agree that being correct is important, but I disagree that there's a single measure of correctness for all situations.
Yoorah wrote on 2012-01-04 20:21

Quote from Rydian;721723:
People DO that. People do that all the time. I'm not talking professional environments, I'm talking the average person.

â†“

Quote from Yoorah:
And more importantly: The purpose of a guide, is to, well, guide people to the proper practices. They may be "idiots," but your job is to make them a bit less so. So you might as well give them the information they need.

Quote from Rydian;721723:
A majority of the issue (again, for normal people) nowadays is plugin/browser security.

http://www.mozilla.org/security/known-vulnerabilities/firefox.html
Firefox 9 fixed four "critical" vulnerabilities. The definition of "critical"?

And Flash/Java have the same sort of stuff, they get hijacked to install fake AV software all the time.

I'm well aware. But that requires user action. :) I was referring to old versions of XP that can get hijacked by simply being connected to the net. Those are the only ones where you risk getting infected as a result of a fresh OS install. I don't think even XP SP2 is affected by that anymore. I'm not against you telling people they need their software updated, haha.
Rydian wrote on 2012-01-05 03:10

Keeping software updates is covered in the prevention guide though.

I did have it all in one guide, but people were honestly tl;dr-ing it so I split it into two so it'd be less wall of text.