Slashdot Mirror
Best Resource For Identifying Legit Applications?
bjb writes "While helping a somewhat computer illiterate person figure out a problem recently, they mentioned that PDF files had recently stopped working. Upon investigation I found something installed called 'PDF Suite.' Never having heard of it, I Googled it with 'malware' and other key words, but nothing turned up, though my suspicion remained (and was somewhat confirmed by WOT.) So my question is, where can you go to find out if something is legitimate? Because the person I'm helping is on a dial-up connection, downloading malware detection applications (and updates) is too heavy consider. And I don't maintain a USB stick with such apps, since I don't do this kind of thing very often. Where can you quickly find information?"
and many other software download sites [claim to] thoroughly test submitted applications with antiviruses. in recent times i haven't downloaded any app from them that turned out to contain any sort of malware.
weinersmith
That will help in figuring out where to go.
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
downloading malware detection applications (and updates) is too heavy consider.
Any yet they find the time to download all of that malware...
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
If you've never heard of an application, assume that it's untrusted malware.
Linux has been pioneering a way around this through trusted software repositories, but the concept hasn't panned out for Windows yet.
ummm, first hit on google for PDF Suite.
http://www.pdf-suite.com/
Looks legit to me...
"Legit" apps sells your info just as well as the others. That's another plug of open source software.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
Google.
Does the vendor make md5 or sha1 hashes available?
Linux repositories are signed with pgp keys, this is usually pretty good(pun intended) for security. Even when breaches happen things are found out pretty quickly.
Searching the internet for downloads and running downloaded apps to install is a very 1990's way of installing software. Its hard to believe Windows users don't have App repositories yet.
find /usr/ports/* >> notmalware.txt
Unfortunately there's no one good list of "Trusted" software. Mostly because "trusted" cannot be empirically measured. Trusted by whom? Bloatware/Spyware/Crapware are sort of like art, you know it when you see it.
If it is malware, it's probably more secure against attack than Adobe Reader is.
No better time than now to start collecting installer .exe files.
The reason you collect the installers (or the portable installations for programs that don't require installers) is because in the Windows world, you never know when a publisher will go rogue. UsefulUtility 0.8.5 might be great, UsefulUtility 0.8.6 might come with an optional toolbar/crapware that can be deselected at install-time using the "custom" button, and UsefulUtility 0.8.7 might not have the option to delesect the toolbar/crapware.
In that case, UsefulUtility 0.8.5 or UsefulUtility 0.8.6 are the last safe versions (depending on how you define "safe"), and you stop upgrading. But even if the publisher vanishes from the face of the earth (or puts in gobs of crapware in 0.8.8), you've still got that USB stick with known-trustworthy installers.
The best place to find this sort of information, unfortunately, is by random googling on an app-by-app basis. UsefulUtility might have user forums, and when they go from 0.8.6 to 0.8.7, its users will be screaming bloody murder. Or you might come across a thread on one of the larger tech sites that talks about utilities, and when people start looking for replacements for UsefulUtility, you might find a BetterUtility that does the same thing, only with less bloat.
Did you try Googling it *without* the word malware?
http://www.google.com/#hl=en&source=hp&q=%22PDF+Suite%22&aq=f&aqi=g10&aql=&oq=&fp=1
that it might not be malware, but simply ancient software incompatible with newer documents?
"believe in my innocence and I might consider yours." -- charles bukowski "Scientific progress goes 'boink'?" -- Calvin
If it's legit it's in your repos.
Ho ho ho, allow me a moment, my monocle has fallen into my snifter of brandy. Ho ho!
I, being a LINUX USER, you see, do not have such mundane Mico$$$$$$$$$oft problems, ho ho!
Did I mention I use LINUX! Ho ho. I bet you are impressed with my LINUX USING ABILITY. We USERS OF LINUX have SOFTWARE REPOSITORIES, ho ho ho. By USING LINUX you too can have a SOFTWARE REPOSITORY.
What is that I hear? You use Mico$$$$$oft products?! Ho ho! My dear friend, you must cease at once and switch to LINUX. LINUX has SOFTWARE REPOSITORIES, did I mention this? Ho ho ho...
oh dear, it appears my monocle has come off again! Ho ho!
I believe that you answered your own question.
Before installing an unknown application, do a little research first; such as google for the app + malware.
If someone is passing you on the right, you are an asshole for driving in the wrong lane.
Helping someone try and fix their computer is an exercise in futility, even if you are getting paid for it. Are you getting paid? And if not, why not? And if so, why are you trying to do this over the phone?
Tell the person that they need to pay you to fix their computer (even if they need to ship it to you). Anything else is a waste of your time.
Its hard to believe Windows users don't have App repositories yet.
It's not *that* hard to believe...LOL
I don't think there's a good way to tell, short of a truly rigorous approach that takes a long time to verify all the software on a system. It's a combination of (1) too many things happening at once on a modern system, (2) lack of good DRM-type authentication (which would allow you to approve or disapprove vendors, or approve each software package independently if from a noncommercial vendor), (3) too much of the stuff that's happening being distributed to different locations. In linux, you can usually tell pretty easily what's going on by running ps and tracing down the processes--okay, you can hide stuff in libraries and modify the code, but you've got a good first step there.. In windows, some is in processes and some is in services, and it's a pain to even put together a list of everything that's running, much less find out where it comes from or whether it's the software it claims to be. It should be easy, but I don't know of a good way to do it.
There are anti-malware programs that take a common swipe at your system. Sometimes they work. But it's like practicing bad medicine as opposed to figuring out what's really wrong--it may work sometimes, but it doesn't solve the larger problem. The reality is it's a completely broken system. We can hunt down bugs, and if we lock down a system from install-time and don't do anything too adventurous or unusual we can be sure to keep it clean, but our security model is basically wrong because we're blacklisting instead of whitelisting, and it's hard to even get a list in the first place. Why aren't there system utilities that automatically generate a list of all running processes and services and anything else that uses CPU time, lists their pipes to each other and to the file system and the network, and then verifies all of that against digitally signed configurations from the vendor?
If the software isn't doing what it's supposed to be doing, it should shut down after giving you a chance to override the shutdown. So leave the end-user with control, but leave the default conditions so for the 99.99% of end users who don't want the nondefault behavior, their machines are safe.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Signed hashes only assure you of the source of the files. They don't in themselves provide any assurance of trust.
In the majority of these cases, the only thing it would achieve would be that you can state with some confidence that it's definitely the fault of a particular asshat.
LINUX has SOFTWARE REPOSITORIES, did I mention this?
The software repositories associated with major desktop Linux distributions, such as Fedora and Ubuntu, have a drawback: not all applications, even useful and legitimate ones, satisfy the licensing requirements of the repositories. For example, almost no major label video games are completely free software and free assets.
If you're a small shop and can't afford the "arm, leg, and firstborn" prices of volume licensing, set up a system where a manager or an experienced IT admin pre-approves software installation, and makes a (hopefully organized) record* of what software got installed on what computer/server.
If you're not starting up, have all the users go through their PCs and write up a list of software on their computers. It's disruptive, it's time-consuming, but only when you do it the first time, and it ferrets out the odd user who installed Google Desktop and a crapton of add-ons, distracting him more than making him more productive.
* If there's discomfort over management approval of software installs, you could be fairly liberal about it and say "well, you can install anything within company policy (i.e. no porn), just let us know so we don't freak out when WeIRDsofTWAREName shows up."
"We are Microsoft. You shall be assimilated. Competition is futile."
Searching the internet for downloads and running downloaded apps to install is a very 1990's way of installing software. Its hard to believe Windows users don't have App repositories yet.
App repositories are only good if they are always up to date. One can go to Ubuntu forums, as an example, to find numerous stories of people having to go outside of the repositories to find the latest versions of apps or to find apps that aren't in the repository. Sure, repositories can help to ease in installing and finding software but they aren't this perfect magic bullet as people like you like to claim. If they were why is there any need of a mechanism to add 3rd party repositories in apt?
I'm trying to picture a penguin with a monocle and a snifter of brandy... it's like Mr. Peanut, but with booze.
Liberal? Conservative? Compare perspectives at Left-Right
Amusing, however app repositories arent confined to open source, Apple do it (At least for the IPhone), Nintendo do it, google do it, Sony do it. No reason Microsoft couldnt do it.
The best resource is still Google. You will need to be a little more patient and a little more competent with your search terms, however. Or you could just write in to Ask Slashdot.
And they aren't always up to date, certain software you might want could have been removed from them (XMMS for example with later versions of Ubuntu), or they just never included certain software in the first place.
Searching the internet for downloads and running downloaded apps to install is a very 1990's way of installing software. Its hard to believe Windows users don't have App repositories yet.
I haven't spent any time looking, but is there possibly a nice cross platform (Win/Lin/Mac) solution for an application developer to stick on his web server and give everyone a link to add that to their package manager of choice? That or some kind of uniform repository "tag" of sorts. This would be something that would contain the developer's repository information and all repository clients could understand how to read it and/or know if they support it.
It definitely would be cool (and avoid silly one click installs) if an indie developer distributing their application could just give their users a link and post their latest version(s) to that application so anyone can keep up to date with the latest version. I have a feeling such a system doesn't exist and people would get all strung up arguing how to do it.
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
If this person is important to you (ie, a relative, family friend), then set up a CD-R with A/V and malware detection on it such that it autoruns, and mail them a new, fresh copy once per month that includes the latest A/V definitions. Hell, include a defrag as part of the autorun process. What does this person do for updates to Windows? I'm betting nothing. Include those too.
90% of maintaining my computer semi-literate parents' and relatives' computers is basically this: (1) update antivirus, (2) run A/V, (3) update Windows, (4) defrag.
Put my fist through my alarm clock with its ding-dong death inside my ear. - The Blackjacks.
If it's not in the Ubuntu Software Center, don't even consider installing it. Works great for me.
http://fileadvisor.bit9.com You can search by file name or md5 hash, but you'll want to use the md5 hash to ensure you are checking the real file (and that it is not just spoofing a good file)
Searching the internet for downloads and running downloaded apps to install is a very 1990's way of installing software. Its hard to believe Windows users don't have App repositories yet.
How is that any less worse than having to dig up third-party repositories or searching the internet for packages to install software that isn't in your OS's repository?
If it is not in the default repositories do not install it.
For novice users the Ubuntu Software Center is nice too.
Just delete the apps that aren't needed and replace them with OSS alternatives. Other than some well known software (Office, Photoshop, iTunes, etc) most everything else can be replaced with a better working, faster and generally better OSS alternative. Why keep that PDF suite? The most you would need would simply be Foxit, Sumatra PDF or Adobe Reader.
Taxation is legalized theft, no more, no less.
Downloading only from CNET is probably the lowest common denominator that provides some level of protection
It's not, novice users should not be installing non-repository apps at all.
Of course since I am responding to a troll I am sure you will insist on making more silly claims.
Ho ho ho, allow me a moment, my monocle has fallen into my snifter of brandy. Ho ho!
I, being a LINUX USER, you see, do not have such mundane Mico$$$$$$$$$oft problems, ho ho!
Did I mention I use LINUX! Ho ho. I bet you are impressed with my LINUX USING ABILITY. We USERS OF LINUX have SOFTWARE REPOSITORIES, ho ho ho. By USING LINUX you too can have a SOFTWARE REPOSITORY.
What is that I hear? You use Mico$$$$$oft products?! Ho ho! My dear friend, you must cease at once and switch to LINUX. LINUX has SOFTWARE REPOSITORIES, did I mention this? Ho ho ho...
oh dear, it appears my monocle has come off again! Ho ho!
sudo apt-get install monocle
HTH.
Third party repositories are still better than random app off random webpage. As you first trust the repository before you would think of adding it. Nothing is a magic bullet, but you knew that already.
No go back under your bridge.
BitTornado, an application I administer, was once available via ZDNet, a site which distributed freeware and shareware apps much like Download.com. At some point someone began offering download mirrors for BitTornado and other apps, with installers that were modified and apparently contaminated with malware. I complained twice; the second time, they nastily asked whether I wanted them to remove BitTornado from their site. I told them yes.
Just because software is available via some popular gateway, you can't be 100% certain what you download will be perfect and free from malware.
What's with the incredibly nooby questions today?
News for (wannabe) nerds?
Download.com has it all. Programs of every description.
Open Source. Closed Source. Free Ware. Trialware. Inkscape is there.
It's a painless way to survey pretty much everything worthwhile that is out there - and infinitely more accessible than SourceForge.
File Hippo has much narrower, utilitarian focus, but the essential apps are there. File Hippo's update checker is quick and reliable.
hashes don't assure you of the source at all, they just provide a unique (within the limits of the hash type) fingerprint for the file. If you know what a file's hash should be, the source is irrelevent.
I do this all the time. I live in a rural area where some people still have dial-up. They get infected. I'm known as the computer geek, so they call me. I either go to their house, confirm that it's malware, etc, and then take the computer home with me, where I have broadband, my big box of tools, spare parts, etc, and work on it there, or just have them drop it off. I'll then either download what I need to clean the system, or I'll just completely re-install it for them. It's nice doing it from the comfort of my home. I can let it install or run scans while I work on other things. When it's done, I call them up, or go deliver it. And I get paid. Imagine that. I find that trying to work over dial-up is impossible, or a huge waste of my time, when it's much quicker to drive to my house than to wait for something to download. Also, trying to talk users through things over the phone, especially when they are on dial-up or hampered by a slow, infected computer, is an even bigger waste of time! So, even if you love this person, and want to just do it as a favor, then do yourself a favor, and take the computer somewhere where you have the proper tools, a good connection, and can do it at your leisure.
Release the source code, or source with paid registration
I know of several developers who refuse to release source code because they've had their software plagiarized[1] by some unscrupulous yet judgment-proof[2] party.
Get listed by one of the major download sites as this poster said
I looked into this, and it turns out that the way to get your software listed on Download.com is (fittingly) called Upload.com. And its policies don't look as bad as I expected.
[1] Copied without attribution. In most cases, plagiarism is a form of infringement.
[2] Lacking financial resources or located in another state or country.
may help. they collect a lot of md5's and have a plugin to run an md5 within explorer.
It scans the file with several virus scanners and returns the result. Not 100%, but quite useful.
It's not, novice users should not be installing non-repository apps at all.
Why? What if they want something that is more up to date than what is in the repository or what if the application they want has been removed?
Of course since I am responding to a troll I am sure you will insist on making more silly claims.
How am I a troll? Because I bring up legitimate issues that have appeared on various linux forums such as Ubuntu Forums?
Really, today, on dialup, the best you can do is run an up to date live cd that has a range of apps on it, suitable for most purposes, and drop the few bucks every few months to get an updated version snail mailed to you from one of the disk burner companies. Knoppix, ubuntu, whatever, one of those live versions.
Get a few different ones to start, see which works the best, then stick with that one if you can. I was on dialup until last year and actually had two different isps give me grief over being online excessively, and dang if it wasn't just trying to keep up to date with patches overnight in a lot of cases. Trying to patch plus surf at the same time made both near unusable, dialup really can't handle that well, so I did the "do it over night" deal, which lead to excessive hours online. Note, the cheaper "bargain" dialup providers gave me the grief, then I went with the large nationwide one sorta sounds like planet chains, which is full price, and never no grief from them. FWIW. Still took a long time though, and was a PITA for patches and updates. And forget full distro upgrades, that was just nuts to try and do that.
Modern web pages are designed for broadband for the most part. No way around it anymore, so for those stuck on dialup with no broadband on the horizon for another few decades, like still huge areas of the US, it's live CDs if they want to go online. Keep an old rat box with windows on it that isn't connected to the net *ever* never, ever, ever to play games if you must. Modern OSes and apps need frequent patching, and it takes a long time to do this on dialup, so just run the best live CD you can and be done with it. Not worry so much about malwarez then, just reboot for a clean new install every time, and make sure to keep images turned off for the most part, and run noscript and adblocker to also help with the security and to give you a fighting chance of viewing a web page under two minutes load time. That's the best I could come up with as a workable compromise being stuck on dialup from 95 until 09.
Third party repositories are still better than random app off random webpage.
Why? Any person can set up a random repository.
Nothing is a magic bullet, but you knew that already.
Which runs contrary to what the GP was attempting to project.
No go back under your bridge.
*yawn* Get some better material, kiddo.
Actually, as he is using Monocle then I'd like to suggest he might be a SUSE User.
Then sudo apt-get install monocle is absolutely useless.
I'd rather be riding my '63 Triumph T120.
because someone has to [xkcd.com]
Signed hashes only assure you of the source of the files. They don't in themselves provide any assurance of trust.
In the majority of these cases, the only thing it would achieve would be that you can state with some confidence that it's definitely the fault of a particular asshat.
How don't they provide provide assurance of trust?
If you trust Vendor A, and you install Vendor A's repo, then the number of things to worry about has just been sharply reduced, because you can reasonably trust that packages signed by Vendor A's repo do, in fact, come from Vendor A.
I think what you meant to say is that hashes only assure that the files came from a specific vendor, and that's self-evident. It's like saying that water is wet.
You don't see how this is a dramtic net improvement?
I have no problem with your religion until you decide it's reason to deprive others of the truth.
hopefully your friend has kept all the original packing that their computer came in. Repack everything and return it to the original vendor. Tell them that your friend (and quite possibly your friend's friend) is not really smart enough to own a computer.
Posts, MyBio or Sig, may contain satire, sarcasm, bolded nouns be sardonic or even witty & be Church of SD
It's best to leave repositories for those who already have it (Linux, BSD) or for those who more rigidly control their platforms (Apple/OSX, Sony/PS3, Nintendo/Wii). Personally, I'd rather Microsoft not even try, lest they turn everyone off of the idea of repositories (which is a damn good one) when they F it UBAR (and they will, though not necessarily because they're incompetent).
The quickie test is: if it's in the repository (Linux) or ports (*BSD), then the app probably at least means well; it's very unlikely going to be deliberate malware (though it might be buggy). If it's not in the repository and not written in-house, then it's at least suspicious. Who vouched for it? How does it get installed in the first place? It's actually pretty rare for this situation to even come up; when it does, there ought to be an explanation. Is this a developer checking out app sources from github or something?
If it's suspicious, then you need to audit the source yourself (Hi, Theo!), do without it, or install it with acceptance that it may compromise the machine (you're doing this in a VM, right?). If you're a casual user, then the real answer 99.999% of the time, is to do without. You don't want to end up like those poor Windows users.
How is removing XMMS a sign of not being up to date? XMMS hasn't been supported by the developer for years. Audacious is what you are looking for and I'm sure it's in the Ubuntu repos.
We hope your rules and wisdom choke you / Now we are one in everlasting peace
... almost no major label video games are completely free software and free assets.
Well, don't you have something better to do with your life than play games?
That is all.
Just download http:///www.amilegit.com.ru/legit_app_detector__win32_trojanfree!!!!.exe and it will scan the app and tell you if it is legitimate.
Ho ho ho...Ho ho...ho ho!...Ho ho...ho ho ho...Ho ho!...Ho ho ho...Ho ho!
Who are you? Santa?!?
I call it 'The Aristocrats'
You may have just found an old Windows app. PDF995 had a number of pdf applications, and I think all together they became pdfsuite. They were entirely legitimate, sold for about $20 as I remember, and let you export print files as pdfs, make changes to pdfs, etc. Try searching for PDF995 Suite.
When I >need something like a PDF reader, even for Windows, I often go to freshmeat.net first. There are many more solutions there that are functional in Windows than you might think.
In this case, I typed "PDF suite" into a Wikipedia search box, and ended up on the Foxit Reader page (http://en.wikipedia.org/wiki/Foxit_Reader) which contains this sentence:
"Foxit Phantom PDF Suite is a complete suite of PDF editing and creation software." complete with a link to their web site.
In general, though, it is not trivial to determine who can be trusted, and to determine where an obscure application came from.
hashes don't assure you of the source at all, they just provide a unique (within the limits of the hash type) fingerprint for the file. If you know what a file's hash should be, the source is irrelevent.
Sure, but cryptographically signed hashes tell you that somebody who possesses the private key used to sign the sha1sums file (or equivalent for other hashes) claims that the signed hash values are correct, so if you get a file with that hash you can be confident it has not been modified relative to what the key possessor calculated the hash on.
Thus, in this sense it assures you of the original source of the file, and that the file has not been tampered with, regardless of the end source the user gets the file from.
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
Do and Dose are not fully interchangeable.
Why is it so hard to only have politicians for a few years, then have them go away?
This is /. Here trolls do not belong hiding under a bridge. This troll was right out in the open right where it is supposed to be.
Why is it so hard to only have politicians for a few years, then have them go away?
> So my question is, where can you go to find out if something is legitimate?
"apt-cache search " works for me, though you may prefer aptitude or synaptic.
You can, of course, trust the Ubuntu archive as well. Debian-multimedia is ok too, though it is unofficial.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
He could also be using Debian and needs a note taking application
Mod Parent Up! I don't care if it's posted as anon, this is EXACTLY what would happen. About the only other scenario is if a neutral third party (har har) decided what repos were allowed to be added. The issue is that anyone with centralized control will eventually corrupt it. We don't trust Microsoft because they're already corrupt, but who is trustworthy and will remain so without wreaking privacy havoc?
I 100% agree with AC here. Repos in Windows are a good thing, but like most good ideas, the courtroom prohibits action from being taken.
Considering how Ubuntu comes with Mono now (save your jokes 'til the end, please), along with F-Spot, Banshee, Tomboy, and other Mono-based apps, I'd say sudo apt-get install monocle is just right. That said, if you're on a SUSE box, yes, "yum install monocle" would be more suitable syntax.
Before even bothering to discuss where to check to see if software is legit or not, my main question is why is this person still using dial-up? It is ridiculous to be using dial-up this day in age to browse the internet or be downloading software. I understand dial-up to be used for verification purposes or other low-data transfer usage, but where Hi-Speed connections can be had for as little as $10 a month, dial-up seems more problematic than its worth.
If sorting out the crap from the good is such a burden for them, then they are probably better off staying away from the latest version anyways.
This is Joe n00b we're talking about here, not Dave power user.
A Pirate and a Puritan look the same on a balance sheet.
And by "yum install monocle", I of course meant "yast2 -install monocle"... bloody hell...
If only there were a moderated, if a little bit restrictive, "store" where one could purchase "apps". A single, central location for free and for-pay applications... hmm. That way you wouldn't have to double-check and perform research on whether or not an application will asplode your computer. If only there was a platform just-locked-down-enough to prevent this kind of snafu. Maybe if it had a nice, touch interface, you could give it to a computer-illiterate person. Making it shiny might not hurt. Oh, and a 3G/Edge connection sure would be nice, to drop the chains of dialup and all.
Too bad nothing like the iPad exists.
Oh wait.
If a (particular version of) an application hasn't hit the repositories - and especially if it has been redacted, there's a reason for it. If it's political, then just add another repository and be done with it. But if it's technical; then people who don't know how to compile from source, or install from a standalone packages (including building dependancies) should NOT be using packages which are not in the repository, because they certainly won't know how to fix it when it goes pear-shaped. Remember, package management administration requires root/superuser access, which implies that they are the administrator of the machine, and therefore the ones that are going to have to "wear it" when the system fails. Cripes, Ubuntu is already running on the "unstable" repository* - are these users on ubuntuforums.com so desperate for the latest version that they're willing to make their system MORE unstable than "unstable" to get it?
* Yes, I'm aware that these classifications are Debian's, and that Debian has notoriously conservative ideas on what comprises "stable" and "unstable". But dammit, Debian isn't lying when it says "stable", and if you've ever cleared up truly borked upgrades you'd know how much it's worth to stick with "stable" - doubly so if you don't even have the ability to clean it up.
Now, this ain't bulletproof but it's a start.
1) Download autoruns, run it, take a look at what it finds.
2) Think something is suspicious? Upload to Virus Total.
3) Act accordingly
It's anything but foolproof and there are a LOT of things that will slip past, but it's a good way to start without having to know anything about software.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I agree, virustotal answers the original question of an online-resource to check a file. A similar scanning service is http://virusscan.jotti.org/. Remember, take the answers with a grain of salt. These are both multi-scanner services, in which the file is examined by multiple virus-scanning software packages.
Computers obey me.
If it isn't used frequently for a specific purpose, its not a specific tool for their computer use. Remove it and install foxit, and also install an anti-malware program and run it anyways.
Malwarebytes and Foxit are both fairly small, I don't think dialup should be an issue here.
Look at your own username. You might as well make it "Troll".
Just tell them to buy their software from NewEgg.com, that company would never let any malware pass to the consumer.
> see if it's on download.com...this can only prove that it isn't malware
Proof? Dude, what do you think the download.com guys do?
They get given a binary, they run some black box testing on the output of it, then shrug their shoulders and say "looks okay".
The closest you can get to "proof" is if the source code is online as free software, there are developers that don't work for the same company, and there are plenty of users. In those situations, malware tends to be found and removed.
Failing that, the simplest criteria is just that it be free software. That doesn't guarantee anything, but there are almost no cases of free software containing malware. ...or maybe you meant that being on download.com is just a proof that the software isn't *too* bad.
Please help publicise swpat.org - the software patents wiki
For me if the app is open source, then the chances of spyware are slim. I know literally handfull of opensource applications that contained malicious stuff, and each time it happens, it is widely publicized (PDF Creator as an example). Other source - check if wikipedia mentions anything about the software.
I dont think any antivirus or antispyware program would be good to scan software, when the software itself is unique spyware.
One other example of software I don't like is stuff made by google. Google.com is great website but I trust it only when i open it with firefox. stuff like picassa or google toolbar which sends ton of info back to google servers is not something i can tolerate on my pc.
One other option would be switching to system like ubuntu - then spyware would not be a concern anymore (I'm seriously considering switching after using windows 7 for a bit. going back to xp is not an option as my pc has more than 4gb of ram and i want it used)
Latest version not in the repositories? No problem! Just svn/git from the developers server the tagged version, preferably on command line, read both README and INSTALL, run ./configure --prefix=/it/goes/here --whatnot=yes --even-more-arguments=yes. ./configure && make && make install.
After this you realize that you need to get the dependency packages either from the repositories or by the perfectly sane method of svn/git and
Now at this point you can return to the original source code and ./configure && make && make install.
If anything fails just go trough a pile of mailing-list archives and you might find how it should be done.
You now have the application that was outdated on your repositories at a newer version and as an added bonus you just polluted by accident both /usr and possibly /lib by not knowing what you are doing.
But hey, you can always reinstall ubuntu from scratch. With any luck you actually saved your home folder and a snapshot of installed packages in a text file so you can get it up to almost the same as before you trashed it.
Easy as cake.
Well, don't you have something better to do with your life than play games?
Yeah, he's gotta make 37 more tetris clones, and then post on slashdot 329 more times complaining that 4-player party games aren't popular on PCs.
If they don't have time to keep AV updated and they run Windows, they need to pay for every app they use. There are no 100% trustworthy free apps, just ask Microsoft. In fact, they should only use paid Microsoft apps.
The good news is since they aren't really using the Internet, they don't need to patch anything either.
BTW, my sister, who is also on dialup asked a similar question over Xmas. I told her there was no answer that she'd like. Sorry. The best answer I could give her was to only use Linux when online. She rejected my solution. OTOH, I refuse to provide computer support to MS-Windows users in my family, except Mom. I figure I owe her. I'm gonna switch her to Linux on my next visit, tho.
If they (or you) can't tell then running Antivirus and Malware detection isn't "too heavy consider" it's mandatory, even if it means a few hours on dialup. If they can download the crapware they can download the AV.
(And you're being overly dramatic. Daily updates should take a few minutes to download at most, even on dialup.)
If the King can't afford a food taster then he gets poisoned or he starves to death.
I couldn't find that package, so I decided to sudo aptitude install everything in subsection cli-mono instead.
Would that work?
One of these days, I am going to flip out. When I flip out, I'll be back in five minutes.
Is it just me that felt like he was getting stabbed in the chest each he read "___ do it". I normally don't make a big dal about grammar but...
Atleast the last one was right.
Outside of scanning and known definitions - the only difference between software and malware is intent. Creating a complete, current and accurate list of potential and existing "malware" is like trying to find a list of door and window manufacturers burglars use.
...I pretty much stick with Malwarebytes, CCleaner, SpywareBlaster, and MSE.
Actually, I got this tip off another /. post...researched each (non-MS) application, determined for myself that they were legit, and have not looked back. In fact, I just spent a few minutes last night eradicating the trojan "Microsoft" Antivirus 2010 on a friend's computer using the Malwarebytes app on a USB. Worked like a charm.
But don't take my word for it...do your own evaluation. I think you'll like what you find.
If you can't find it at packages.debian.org, it ain't worth the trouble.
No, really.
Get the ISO from http://trinityhome.org/Home/index.php?wpid=1&front_id=12 for the Trinity Rescue Kit. Run it. Update it and save the updated ISO image. Burn that to a CD and give it to your friend. He can run it and disinfect his computer without an Internet connection. Give him an updated CD every month.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
I'm happy you use Linux, but you don't have to be so sarcastic.
It would be a good idea for vendors of Windows-centric software to create a common source for downloads like Apple's app store for i-phone . It would help keep out mal-ware. Altruistic support for small time projects would put a happy face on things.
The current flock of vendors would probably use the repositories to block serious competition.
This is definitely not a Microsoft created problem. It is a problem that affects Windows users, but Microsoft didn't create the problem.
Microsoft should be able to solve it, but probably wouldn't be allowed to set up a solution. Other software vendors would fear giving this power to MS and would complain to the DOJ. Too bad, MS would probably be the best one to certify software as safe and run the thing.
well you just look for it in your distribution's package reposito...oh you're running windows..Microsoft really should have something like that.
I guess they'll get around to it when they're done with all those important 3D desktop effects.
...and that is all I have to say about that.
http://jessta.id.au
It's funny and true, too.
How is that malware secretly updating itself going to happen to a live linux CD? If the machine is turned off it is turned off, it is not going to be dialing out, plus, you can't burn anything to a CDR once it is fixed. Plus it is linux. It may be security by obscurity, but whatever works....works.
Even then, linux is not a panacea for a game free existence. There are plenty of highly addictive games in FOSS operating systems, including Ubuntu. Even FreeBSD has the power to serve... you up games. The more addictive the game is, the higher the likelihood of there being a port for it. To find the most addictive ones, just sort by rating using the PC-BSD game repository - http://www.pbidir.com/bt/category/games/rating/. Wesnoth, Tremulous, Assault Cube. And if you give it a chance, the roguelikes (Angband, Nethack) will happily eat as much time as you can throw at them.
If I have seen further it is by stealing the Intellectual Property of giants.
one more reason to use only free software...
closed apps, abandoned software, obsolete apps, etc are set to disappear with time, its the survival of the strongest and being free software is huge strength.
being a closed and bad app is half way to die, even if popular (see the flash, attacked by all sides, is set to be replaced and irrelevant sooner of later)
but hey, nothing forbids closed apps builds of building a repository
Higuita
Install some good AV and FW. Period. Other than that, preventing to get the computer infected with malware in the first place and for whatever stupid reasons avoid having to bother with scanners and updates, "teach" him this: Only download from the original author's homepage and don't use Google to find it as it might turn up websites looking like it might be the homepage but aren't. Use wikipedia instead and follow the "official website" link there. If it doesn't have a wikipedia entry... well, if you are someone computer illiterate, then really just don't bother. There is a more popular and easier to use app for your task out there. How do you find it? Wikipedia, of course. I don't know what this PDF suite is but searching for pdf +list will turn up a list for many PDF creators and readers that are popular enough to have an entry. Just take your pick there. Same goes for anything else. Protip for you: If you care about your friend, just clean his computer, install the protections from your USB stick, show him how to use them and make sure to bring updates the next time you are around. Also let him just call and ask you if something is safe to download, request his download-link by email and check it with your broadband. If you don't care about him, then... just don't care! Say NO! and kthxbye.
There are several good online virus scanners. They will ask you to download a small plugin, but I've used them with great success, without having to install applications.
http://housecall.trendmicro.com/
http://security.symantec.com/sscv6/home.asp
Also, two arguments against what is often suggested:
1) Virus scanners aren't for everyone. Some are extremely intrusive, often with their own "innovative" interfaces that make them bulky and impossible to manage for novices. Some will hijack your email applications, not tell you exactly when they block or delete something, and can also hinder web surfing speeds. If you don't know how things work already, having a scanner will make things even more confusing. Add subscription fees, and I say the whole thing isn't worth it.
2) No, I don't think "knowing your software" is a good way to tell if something is legit. Seriously, Windows alone will update itself and install weird things, as do most large software suites these days. They give ambiguous names to critical components, and to think we would know them unless they were dangerous is a bit much.
If you know what you're doing, I'd say you can avoid most issues by just being careful and knowing the signs (of danger and of contamination).
If you don't (or helping someone who doesn't), then I say dumb down the apps so things are simpler and safer. Like migrate to gmail, make FireFox or Chrome the default browser, and just setup all the bundled security features to their appropriate settings (windows firewall etc).
If you ponder this question for long enough, the answer will come to you.
This post expresses my opinion, not that of my employer. And yes, IAAL.
Amusing, however app repositories arent confined to open source, Apple do it (At least for the IPhone), Nintendo do it, google do it, Sony do it. No reason Microsoft couldnt do it.
Holy bungling of plural/singular verbs Batman!
"Google *does* it".
Worldwide Military budgets: $2100 billion. Worldwide Space Exploration budgets: $38 billion. Really, world? Really?
Microsoft already does it. Microsoft has a repository, which vendors can optionally submit drivers to, complete with digital signatures validated by the OS and all that jazz. The model seems to work pretty well, and I don't see why it couldn't work for non-driver software.
Socialism: a lie told by totalitarians and believed by fools.
Compare that to a clueless windows user who hasn't updated anything since he got the computer...
Usually people who want the latest version of something is because they need certain functionality it brings. The clueless person will conform with just having the application.
Default repositories could satisfy the clueless users perfectly.
You can get one at Big lots for $10 for a 4Gb, or if you check with surpluscomputers occasionally you can get bundles of 1Gb to 2Gb sticks for dirt cheap. So get a really cheap stick and then get the Computer Repair Utility Toolkit V2 which is like the Swiss Army Knife of PC Tools. So much more than simple malware repair it has fixes for networking, file recovery,info, scripts and tweaks, and it is simple to add you own. Just add Malwarebytes Antimalware and portable Firefox along with updating the included ClamAV and you have a one stop PC shop in your pocket.
but trying to guess what is a nasty and what ain't, especially when dealing with dialup, is simply a fool's game. There are literally thousands of new pieces of nasty released every day, and even if you guess right on this one there is no telling what else could be on that machine. Take the Toolkit I linked to above, add installers for Comodo AV and MalwareBytes, along with the latest Firefox, and simply stick the flash on your keyring and be done with it. Just plug the stick into any PC USB port once a week to update it and you have a full toolset in your pocket. So what if you don't do it everyday? The few times you DO run into something like this you will be able to handle it easily and look like a genius at the same time, all for a few dollar flash stick and less than 5 minutes a week.
ACs don't waste your time replying, your posts are never seen by me.
I call bullshit on the premise. If the user has bandwidth enough to download malware, he has bandwidth enough to download malware detection software and updates.
Currently hooked on AMP
I trust programs in Debian stable.
I trust the Debian folks. So far, so good!
Your mileage may vary.
Uh, Linux geek since 1999.
neither are do and does.
Too bad, MS would probably be the best one to certify software as safe and run the thing.
Yeah, just like they were so good at certifying that something was "Vista-ready," or "Designed for XP."
I'm not saying that they'll start pushing malware, but I wouldn't be at all surprised to hear about kickbacks, and vendor lockout and other things that would make the DOJ's case that much easier.
McAfee SiteAdvisor plugin for Firefox
Support the FairTax
The driver model only works because drivers are naturally uncompetitive. If you have a new computer, and it has a nVidia 9400GT, you don't think "who should I get to supply my driver?" (at least, not if you're on Windows). But if you want to go to slashdot, you certainly DO say "which browser should I use?" (especially if you're in Europe). In fact, this European "browser choice" issue is a perfect model for what I'm talking about - Microsoft only implemented this because they were forced to; and even now people complain that $OBSCURE_BROWSER doesn't get equal coverage. As I said earlier - if they implemented it of their own accord, you better believe that they'd either get sued for it (for leaving out $OBSCURE_BROWSER, or unfairly favouring IE/$POPULAR_BROWSERS, or charging too much for small ISVs to afford, or whatever), or it would just be the exact same free-for-all model we have now, only with an annoying extra step.
You're right in that the technical aspect is relatively easy; it's the social and political (and legal) aspect which kill this idea.
PS. If you want to see repositories done right, check out [most linux distributions]. Standalone installers like windows mean that the application has to include all of its libraries, so the installers are generally huge - but on linux, because package management can assure the developer that the user will have (or be able to get) the requires dependencies, the developer only ships his code and a list of dependencies (in the particular repository systems' format) and so the installs are almost always tiny. Plus, they don't need to include installers, uninstallers and updaters, because that's handled by the package manager. Plus, there's the security aspect; a malicious or buggy application has to make it past the package maintainer (some buggy ones do, but very few malicious packages do).
As soon as I saw the filename it looked very suspicious but alas it's a known bug in a sound driver. That being said, I wonder how many viruses are hiding using the filenames of known buggy drivers.
I fuckin hate those repositories and wish to always manage my own software. I hate the fact that standard app installers are not used for linux. One of the major reasons (besides being crappy ass super slow) I don't use linux is because of the software installation issues.
Futhermore linux sucks and will probably always fail at being a desktop operating system. Compiling everything into the kernal just plain blows. No one using KDE successfully when it is the obvious fucking choice as the main desktop for any PC running Linux is another obvious blunder.
It needs scrapped and rebuilt as objects but then it wouldn't be a unix clone then would it?
In my experience if your application fails a DRM check it's probably legit.
see the flash, attacked by all sides
Don't worry, he can outrun them.
USB stick?
What's that?
Still on dialup? Don't go out on the Internet; you can be infected with malware just by connecting. No downloads, no browser use, no IM programs running, no email...just being connected will let somebody connect to your PC and exploit security holes. Ditch dialup and connect with something fast enough to get daily antivirus and antimalware updates...you've been warned. I've seen a Windows 2000 Advanced Server running nothing but SAMBA (shared folders) and Exchange get filled with malware like a swiss cheese with nobody running on the desktop (except for occasional reboots and user-account maintenance)...no web browsing, no actual Internet use, just being connected let the malware (MIRC bots, phantom user accounts being added, Mytob worm infections, and LOTS more) into the server. No decent antivirus = not safe at all.
I feel sorry for non-geek computer users. It really is tough to tell what is safe software and what isn't.
Personally, I would check sourceforge.net first for an open source equivalent. I'm not an open source zealot, but OSS tends to be malware free, and the bonus is that I can freely give a copy to other people. When that fails nonags.com is where I go. They test for naggy shareware, and I think malware and viruses.
Outside of that? Who knows. I trust my gut based on the website, or I run it in a virtual machine! But other people just don't have that option. Even using Google for the software product + "review" will get you fake affiliate reviews.
I doubt there is a way of knowing what you ask. That requires clarevoyance. If its present threat most anti viral software or resident shields will know about it. Just use them and let them run a full system check. I use TeaTimer that comes with Spybot S&D and never had any permanent problems. Its bit cumbersome on resources but how much is your safety worth vs the advantage of getting an extra 2-5FPS on your favourite game??? Dont feed people fish. Teach them how to protect their fish and not reel in infected fish just because the Sirens offered them. :) :)
He's probably English.
In America, organizations (such as "Microsoft") are generally considered singular nouns. We write "Microsoft does that" or "Microsoft is this".
In England, they're more commonly thought of as plural. "Microsoft do that", "Microsoft are this". It's not necessarily better or worse, but it can be jarring.
It is much easier to deal with the rare piece of software that is not in the repo, than lots and lots of software that is not in the non-existent repos.
Gamers are rarely completely naive users, and are rarely Linux users anyway.
There is usually a recognised non-free repo which should be enabled on installation for free-as-in-beer proprietary software. The problem only needs to be solved once.
Proprietary paid for software is usually safe-ish anyway (no worse than on Windows) and only a small proportion of all the software you install (serious gamers aside, again)
download the open disc and burn a copy for them
I realize that this is not the angle the OP was after, but as far as I can see, the most reliable way to ensure that your programs are legitimate is to use open source software. It is not bulletproof, since there are potential problems related to patents, but I think if the owners of the alleged patents were serious, they would have come out of the woodwork by now. And we shouldn't forget that most SW patents seem to be of a very dubious nature.
Solution #1. Tell everyone to ask an expert. At this point there are two possibilities: 1) They are click-happy idiots with their brains turned off since they were born. They don't know how to locate experts, also couldn't care less and will loudly whine when 'messenger' doesn't work. Hopeless - stay away. 2) They are ignorant but intelligent. Tell them to always buy software at a brick and mortar store and to ask an expert before. If they don't ask, put them on the queue, punish them with waiting time until you are tired of waiting.
Solution #2. If the person is important to you (parents, fiance, no one else), set up an old computer and a DSL/Cable service at their home. Install Linux there. At your home host a virtual machine with familiar software (windows/thunderbird) accessing a IMAP server also virtual at your home. Firewall that virtual pair off your own network or put them on their own virtual network so they are isolated. The local account at your parents' is locked down completely, and of course no admin privileges. Teach them how to use remote desktop. Let them click on trojans/whatever at their convenience. When they call, tell them 'One minute, dad', and just power off their VM and revert it to a good snapshot (the one I didn't tell you to do! You did it, right?). They are good before they can hang up the phone. Email is not gone because I said it's IMAP. Nothing is gone. No virus can get out, revert equals instant disinfection of the most sophisticated malware. Your parents are happy, you are happy. Make them pay for *your* DSL.
Of course there are downsides to this: I hear you yadda yadda. Parents/fiancé don't want fancy. Shut up.
Open My Computer > Tools > Folder Options > File Types > Scroll down to PDF > Change "Opens with" to Adobe Reader. Not malware. Just idiocy.
The best resource for discovering legitimate applications is in your own skull. The second-best is an internet search engine.
"Upon investigation I found something installed called 'PDF Suite.' Never having heard of it, I Googled it with 'malware' and other key words, but nothing turned up..."
Dig deeper. I googled "PDF Suite" and found pdf-suite.com, which claims to be "a leader in the "Online Software Selling" business reaching 5.4 million unique visitors per month (Google Analytics, January 2008)." I then checked whois.org to see who owned pdf-suite.com, and found it was owned by Interactive Brands of Montreal, Quebec. interactivebrands.com claims to be "a privately held corporation, it was formed by a team of experienced industry professionals who had a vision of creating the “ultimate” digital-market-dedicated affiliate programs."
Googling "interactivebrands.com" brought up this note:
"McAfee TrustedSource web reputation analysis found potential security risks with this site. Use with extreme caution."
OK, I understand now. Ya, that was what I was doing, overnight updates, but frequently it resulted in just tieing up the line and being connected for excessive hours that annoyed the ISP. Plus, running diskless with just a live CD is just way more secure. Fast, too, blazing fast even on modest hardware if you have enough RAM. I am seriously considering that for my next upgrade for my desktop, looking for a used server board that can hold a ton of RAM and going completely diskless. I am not a big media packrat or anything, stuff I really need to keep I can burn to a cheap CD disk. Mostly I just want a fast internet appliance. I don't even have a big hard drive, it is only 8 gigs and frequently is mostly empty now as it is.
Guess I learned to get by with less being on dialup all those years.
Don't try to identify the myriads of malware. Persuade such folks to surf from a live CD.
.
Regards,
Bill Drissel
...dumped in the bad end of a red light district. That's about how easy it is for users to learn how to judge such things for themselves. You may think they are just idiots, but try to ponder how many factors really go into determining the suspiciousness of data/apps/sites on the web; it's more factors than the simple gut feeling would suggest.
Emotions! In your brain!