are downloads scanned?

I am wondering if downloads are scanned for viruses, spyware etc etc. My AV
software seems to intercept most e mail threats and my firewall seems to
protect me against direct intrusion but when I run my spyware program I
nearly always have something lurking, a tracking cookie or some other such
thing, how do these things get passed all of the security?

Whenever I get an attachment in an e mail, my e mail prog firstly warns me
that the attachment might contain something nasty, I then save the
attachment to my desktop and run a virus scan on it before I open it, am I
doing the right thing?

Mike
Sat Jan 10 06:49:17 CST 2004

zipadedodazipadeday,
>"nearly always have something lurking, a tracking cookie"
http://www.mvps.org/winhelp2002/cookies.htm

>"run a virus scan on it before I open it, am I doing the right thing"
*Only* if you are opening attachments from someone you are
expecting to send you an attachment ..... otherwise ....no.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 01-08-04]
Please post replies to this Newsgroup, email address is invalid
--

"zipadedodazipadeday" <noanswer@hotmail.com> wrote in message
news:OS2rCW21DHA.2928@TK2MSFTNGP09.phx.gbl...
> I am wondering if downloads are scanned for viruses, spyware etc etc. My
AV
> software seems to intercept most e mail threats and my firewall seems to
> protect me against direct intrusion but when I run my spyware program I
> nearly always have something lurking, a tracking cookie or some other such
> thing, how do these things get passed all of the security?
>
> Whenever I get an attachment in an e mail, my e mail prog firstly warns me
> that the attachment might contain something nasty, I then save the
> attachment to my desktop and run a virus scan on it before I open it, am I
> doing the right thing?
>
>

taff
Sat Jan 10 08:27:46 CST 2004

On Sat, 10 Jan 2004 10:35:37 -0000, "zipadedodazipadeday"
<noanswer@hotmail.com> wrote:

>I am wondering if downloads are scanned for viruses, spyware etc etc. My AV
>software seems to intercept most e mail threats and my firewall seems to
>protect me against direct intrusion but when I run my spyware program I
>nearly always have something lurking, a tracking cookie or some other such
>thing, how do these things get passed all of the security?
>
>Whenever I get an attachment in an e mail, my e mail prog firstly warns me
>that the attachment might contain something nasty, I then save the
>attachment to my desktop and run a virus scan on it before I open it, am I
>doing the right thing?
>
If you are downloading a file from a web site, it is always worth
right clicking and requesting a virus scan before opening, this will
not always catch everything but it will catch obvious threats.

Taff............



www.sounds-pa.com | www.thecomputerworkshop.com

John
Sat Jan 10 09:16:17 CST 2004

Replies inline...

"zipadedodazipadeday" <noanswer@hotmail.com> wrote in message
news:OS2rCW21DHA.2928@TK2MSFTNGP09.phx.gbl...
> I am wondering if downloads are scanned for viruses, spyware etc etc. My
AV

It is possible that your e-mail is being pre-scanned for viruses and other
malware. Some ISPs have started either voluntary or mandatory scans of
everything coming through their mail servers. If you download something from
a website or ftp server it is unlikely that anyting at all is being done
with it before it gets to your computer.

> software seems to intercept most e mail threats and my firewall seems to
> protect me against direct intrusion but when I run my spyware program I
> nearly always have something lurking, a tracking cookie or some other such
> thing, how do these things get passed all of the security?

Cookies are not, per se, an intrusion or dangerous. They may be used in an
intrusive manner but so far as I can tell their good uses outweigh the bad
ones. This is why AdAware and the like only identify and offer to remove
ones that have been shown to have been used badly. It would be MUCH easier
to simply erase every cookie if that were not the case. You can erase them
yourself and prevent new ones from being saved but if you do you will find
that many websites become difficult or impossible to use.

> Whenever I get an attachment in an e mail, my e mail prog firstly warns me
> that the attachment might contain something nasty, I then save the
> attachment to my desktop and run a virus scan on it before I open it, am I
> doing the right thing?

Blindly executing attachments is, of course, an incredibly stupid thing to
do. But blindly relying on an AV scan to assure yourself that an attachment
is safe might be just as bad. Every AV scanning program relies on either 1)
matching bits of data against other bits of data which have been identified
as existing in a known virus and/or 2) trying to identify bits of code
within a file which seeem to suggest some nefarious purpose. Great ideas but
if you receive and execute an attachment which is 1) new enough that it has
not been identified and had its signature placed in the virus definitions
and/or 2) has been written in such a way as to appear innocuous there is
really nothing to stop it from doing anything it wants with your computer.
In fact, it could even be the case that a malicious attachment might not be
a virus or worm or anything else that would be of any interest to the AV
program writers. If someone writes a program which will reformat your hard
disk when run and has no way of spreading (maybe someone who just hates your
guts) you are still in major trouble if you run it but it will never
register on the virus trackers charts.

Yes, scan to your heart's content but be sure that your AV definitions are
up to date. But don't depend on it to be 100% effective. Use your head. Ask
yourself "why did I receive this attachment?" "who sent it to me ?" "do I
trust them implicitly?" "did I ask for it?" If you are downloading ask
yourself "do I know the parties involved?" "do I have reason to trust
them?" "is this site/server really what it seems to be?". Example: if you
download a piece of shareware from CNET you can be relatively sure that the
executable is safe but if you download a 'crack' from some hacker/cracker
site you might expect that some percentage of them aren't exactly what they
claim to be.

It all comes down to practicing safe hex.

--
John McGaw
[Knoxville, TN, USA]

Return address will not work. Please
reply in group or through my website:
http://johnmcgaw.com

zipadedodazipadeday
Sat Jan 10 09:38:02 CST 2004

I am not sure if I have posted in the right area but thank you all for
taking the time to explain to me, especially the in depth response from
John, very informative. I like the Practice safe Hex idea, do we need
script in order for it to execute or do we just get our digits out and make
code?
"John McGaw" <nowhere@inparticu.lar> wrote in message
news:uHwXzy41DHA.2180@TK2MSFTNGP12.phx.gbl...
> Replies inline...
>
> "zipadedodazipadeday" <noanswer@hotmail.com> wrote in message
> news:OS2rCW21DHA.2928@TK2MSFTNGP09.phx.gbl...
> > I am wondering if downloads are scanned for viruses, spyware etc etc. My
> AV
>
> It is possible that your e-mail is being pre-scanned for viruses and other
> malware. Some ISPs have started either voluntary or mandatory scans of
> everything coming through their mail servers. If you download something
from
> a website or ftp server it is unlikely that anyting at all is being done
> with it before it gets to your computer.
>
> > software seems to intercept most e mail threats and my firewall seems to
> > protect me against direct intrusion but when I run my spyware program I
> > nearly always have something lurking, a tracking cookie or some other
such
> > thing, how do these things get passed all of the security?
>
> Cookies are not, per se, an intrusion or dangerous. They may be used in an
> intrusive manner but so far as I can tell their good uses outweigh the bad
> ones. This is why AdAware and the like only identify and offer to remove
> ones that have been shown to have been used badly. It would be MUCH easier
> to simply erase every cookie if that were not the case. You can erase them
> yourself and prevent new ones from being saved but if you do you will find
> that many websites become difficult or impossible to use.
>
> > Whenever I get an attachment in an e mail, my e mail prog firstly warns
me
> > that the attachment might contain something nasty, I then save the
> > attachment to my desktop and run a virus scan on it before I open it, am
I
> > doing the right thing?
>
> Blindly executing attachments is, of course, an incredibly stupid thing to
> do. But blindly relying on an AV scan to assure yourself that an
attachment
> is safe might be just as bad. Every AV scanning program relies on either
1)
> matching bits of data against other bits of data which have been
identified
> as existing in a known virus and/or 2) trying to identify bits of code
> within a file which seeem to suggest some nefarious purpose. Great ideas
but
> if you receive and execute an attachment which is 1) new enough that it
has
> not been identified and had its signature placed in the virus definitions
> and/or 2) has been written in such a way as to appear innocuous there is
> really nothing to stop it from doing anything it wants with your computer.
> In fact, it could even be the case that a malicious attachment might not
be
> a virus or worm or anything else that would be of any interest to the AV
> program writers. If someone writes a program which will reformat your hard
> disk when run and has no way of spreading (maybe someone who just hates
your
> guts) you are still in major trouble if you run it but it will never
> register on the virus trackers charts.
>
> Yes, scan to your heart's content but be sure that your AV definitions are
> up to date. But don't depend on it to be 100% effective. Use your head.
Ask
> yourself "why did I receive this attachment?" "who sent it to me ?" "do I
> trust them implicitly?" "did I ask for it?" If you are downloading ask
> yourself "do I know the parties involved?" "do I have reason to trust
> them?" "is this site/server really what it seems to be?". Example: if you
> download a piece of shareware from CNET you can be relatively sure that
the
> executable is safe but if you download a 'crack' from some hacker/cracker
> site you might expect that some percentage of them aren't exactly what
they
> claim to be.
>
> It all comes down to practicing safe hex.
>
> --
> John McGaw
> [Knoxville, TN, USA]
>
> Return address will not work. Please
> reply in group or through my website:
> http://johnmcgaw.com
>
>

Bill
Sat Jan 10 19:23:05 CST 2004

http://www.claymania.com/safe-hex.html

"zipadedodazipadeday" <noanswer@hotmail.com> wrote in message
news:OM6FD$41DHA.2948@TK2MSFTNGP09.phx.gbl...
>I am not sure if I have posted in the right area but thank you all for
> taking the time to explain to me, especially the in depth response from
> John, very informative. I like the Practice safe Hex idea, do we need
> script in order for it to execute or do we just get our digits out and
> make
> code?
> "John McGaw" <nowhere@inparticu.lar> wrote in message
> news:uHwXzy41DHA.2180@TK2MSFTNGP12.phx.gbl...
>> Replies inline...
>>
>> "zipadedodazipadeday" <noanswer@hotmail.com> wrote in message
>> news:OS2rCW21DHA.2928@TK2MSFTNGP09.phx.gbl...
>> > I am wondering if downloads are scanned for viruses, spyware etc etc.
>> > My
>> AV
>>
>> It is possible that your e-mail is being pre-scanned for viruses and
>> other
>> malware. Some ISPs have started either voluntary or mandatory scans of
>> everything coming through their mail servers. If you download something
> from
>> a website or ftp server it is unlikely that anyting at all is being done
>> with it before it gets to your computer.
>>
>> > software seems to intercept most e mail threats and my firewall seems
>> > to
>> > protect me against direct intrusion but when I run my spyware program I
>> > nearly always have something lurking, a tracking cookie or some other
> such
>> > thing, how do these things get passed all of the security?
>>
>> Cookies are not, per se, an intrusion or dangerous. They may be used in
>> an
>> intrusive manner but so far as I can tell their good uses outweigh the
>> bad
>> ones. This is why AdAware and the like only identify and offer to remove
>> ones that have been shown to have been used badly. It would be MUCH
>> easier
>> to simply erase every cookie if that were not the case. You can erase
>> them
>> yourself and prevent new ones from being saved but if you do you will
>> find
>> that many websites become difficult or impossible to use.
>>
>> > Whenever I get an attachment in an e mail, my e mail prog firstly warns
> me
>> > that the attachment might contain something nasty, I then save the
>> > attachment to my desktop and run a virus scan on it before I open it,
>> > am
> I
>> > doing the right thing?
>>
>> Blindly executing attachments is, of course, an incredibly stupid thing
>> to
>> do. But blindly relying on an AV scan to assure yourself that an
> attachment
>> is safe might be just as bad. Every AV scanning program relies on either
> 1)
>> matching bits of data against other bits of data which have been
> identified
>> as existing in a known virus and/or 2) trying to identify bits of code
>> within a file which seeem to suggest some nefarious purpose. Great ideas
> but
>> if you receive and execute an attachment which is 1) new enough that it
> has
>> not been identified and had its signature placed in the virus definitions
>> and/or 2) has been written in such a way as to appear innocuous there is
>> really nothing to stop it from doing anything it wants with your
>> computer.
>> In fact, it could even be the case that a malicious attachment might not
> be
>> a virus or worm or anything else that would be of any interest to the AV
>> program writers. If someone writes a program which will reformat your
>> hard
>> disk when run and has no way of spreading (maybe someone who just hates
> your
>> guts) you are still in major trouble if you run it but it will never
>> register on the virus trackers charts.
>>
>> Yes, scan to your heart's content but be sure that your AV definitions
>> are
>> up to date. But don't depend on it to be 100% effective. Use your head.
> Ask
>> yourself "why did I receive this attachment?" "who sent it to me ?" "do
>> I
>> trust them implicitly?" "did I ask for it?" If you are downloading ask
>> yourself "do I know the parties involved?" "do I have reason to trust
>> them?" "is this site/server really what it seems to be?". Example: if you
>> download a piece of shareware from CNET you can be relatively sure that
> the
>> executable is safe but if you download a 'crack' from some hacker/cracker
>> site you might expect that some percentage of them aren't exactly what
> they
>> claim to be.
>>
>> It all comes down to practicing safe hex.
>>
>> --
>> John McGaw
>> [Knoxville, TN, USA]
>>
>> Return address will not work. Please
>> reply in group or through my website:
>> http://johnmcgaw.com
>>
>>
>
>

Sarah
Mon Jan 12 19:09:05 CST 2004

From Jon's post (trimmed)

>>Every AV scanning program relies on either 1)matching
bits of data against other bits of data which have been
identified as existing in a known virus and/or 2) trying
to identify bits of code within a file which seeem to
suggest some nefarious purpose. Great ideas but
if you receive and execute an attachment which is 1) new
enough that it has not been identified and had its
signature placed in the virus definitions
and/or 2) has been written in such a way as to appear
innocuous there is really nothing to stop it from doing
anything it wants with your computer<<

Interesting article on this (if you happen to be
interested) by Arun Lakhotia and Prabhat K. Singh of the
University of Louisiana at Lafayette
www.virusbtn.com/magazine/archives/200309/formal.xml

From which comes the following quote:
>> Signature-based heuristics, whether dynamic or
static, for detecting malicious code are no match for a
program that modifies, encrypts and decrypts its code as
it propagates.
Researchers in academia and industry are beginning
to develop anti-virus technologies founded on formal
methods of analysing programs (Christodorescu and Jha
2003, 12th Usenix Security Symposium, 2003; Perriot, 13th
Virus Bulletin International Conference 2003; Singh,
Moinuddin et al., 2nd European Conference on Information
Warfare and Security, 2003). These methods, with rigorous
mathematical foundation, have mostly been developed for
optimizing compilers and, more recently, for hardware and
software verification. <<
If you are interested in this stuff, the article is
fascinating.