Best Resource For Identifying Legit Applications?

bjb writes "While helping a somewhat computer illiterate person figure out a problem recently, they mentioned that PDF files had recently stopped working. Upon investigation I found something installed called 'PDF Suite.' Never having heard of it, I Googled it with 'malware' and other key words, but nothing turned up, though my suspicion remained (and was somewhat confirmed by WOT.) So my question is, where can you go to find out if something is legitimate? Because the person I'm helping is on a dial-up connection, downloading malware detection applications (and updates) is too heavy consider. And I don't maintain a USB stick with such apps, since I don't do this kind of thing very often. Where can you quickly find information?"

Comments

download.com

[martas]

and many other software download sites [claim to] thoroughly test submitted applications with antiviruses. in recent times i haven't downloaded any app from them that turned out to contain any sort of malware.

Re:download.com

[kalirion]

That might work if the application is infected by (known) malware. What if the application is itself the trojan, perhaps one that activates in the future so no one would have reported it yet? Unless someone has access to the source code and the time and inclination to look through it, how do you know it's safe?

Re:download.com

[Cylix]

Uninstall them all and let God sort em out.

When I was ever called to sort some disaster of a mind fucked mess I wouldn't take prisoners. Usually, my first question was could I just re-image and generally this was a resounding no.

When you can't re-image you can only do the next best thing with next best thing results. Remove, scan and move on.

It's more like war time triage then anything else.

Sure, I feel somewhat bad they made it in the mess they did, but I can only personally do so much.

Re:download.com

[Keeper Of Keys]

He he heh! Now that my PDF reader is reasonably popular, I can switch on its backdoor functionality.

"to big to download"

[Sir_Lewk]

downloading malware detection applications (and updates) is too heavy consider.

Any yet they find the time to download all of that malware...

Re:"to big to download"

[Monkeedude1212]

Exactly. If you have the time to download an application you have time to download malware detection.

And really, what do you suppose you were going to do if Google did confirm it as Malware? You can't download anything and you don't have a USB stick with that stuff on it - in most cases you're pooched already.

It honestly sounds like either you or the person you're helping simply don't want to put in the effort in -actually- testing the machine for malware.

Assume malware

[c 0xFF]

If you've never heard of an application, assume that it's untrusted malware.

Linux has been pioneering a way around this through trusted software repositories, but the concept hasn't panned out for Windows yet.

Re:Assume malware

[tepples]

If you've never heard of an application, assume that it's untrusted malware.

Then how should a micro-ISV or a free software developer earn users' trust?

Re:Assume malware

[fuzzyfuzzyfungus]

There are certainly costs to the strategy; but it is still a decent heuristic for somebody in the demographic we are talking about(ie. clueless, no broadband, probably no backups, or even system restore media).

New entrants will naturally attract the attention of the sort of savvy tech enthusiasts who follow news outlets and whatnot, and are arguably in a far superior position to evaluate for utility and nonmalice. Once they've rendered their verdict, the noobs can follow the received wisdom, or have it done for them.

"If you've never heard of an application, assume that it's untrusted malware." would make a shitty universal rule; but it is mostly a good idea in this context. Some people are better cut out to deal with technical risk than others. People with disposable VM appliances can do whatever they want. Noobs with dialup who will end up losing months of work, a week's use of their computer, and several hundred in Geek Squad fees if they do the wrong thing should probably stick to the beaten path.

Re:Assume malware

[ekhben]

If only I'd learned that rule before I first heard of MS Office...

Does the vendor make md5 or sha1 hashes available?

[number6x]

Does the vendor make md5 or sha1 hashes available?

Linux repositories are signed with pgp keys, this is usually pretty good(pun intended) for security. Even when breaches happen things are found out pretty quickly.

Searching the internet for downloads and running downloaded apps to install is a very 1990's way of installing software. Its hard to believe Windows users don't have App repositories yet.

Re:What is your OS?

[Kitkoan]

Seen as "somewhat computer illiterate," read as "Windows."

I know a lot of OSX users that fit that description.

Look at it this way

[Anonymous Coward]

If it is malware, it's probably more secure against attack than Adobe Reader is.

Er

[Quiet_Desperation]

Did you try Googling it *without* the word malware?

http://www.google.com/#hl=en&source=hp&q=%22PDF+Suite%22&aq=f&aqi=g10&aql=&oq=&fp=1

Re:how about google?

[Mr Z]

Well, if it was benign software, then maybe the free trial ended? Or, if it really did have some malware in it, maybe it was a "cracked" version, with extra Russian Hacker Goodness?

Re:Does the vendor make md5 or sha1 hashes availab

[Anonymous Coward]

Ho ho ho, allow me a moment, my monocle has fallen into my snifter of brandy. Ho ho!

I, being a LINUX USER, you see, do not have such mundane Mico$$$$$$$$$oft problems, ho ho!

Did I mention I use LINUX! Ho ho. I bet you are impressed with my LINUX USING ABILITY. We USERS OF LINUX have SOFTWARE REPOSITORIES, ho ho ho. By USING LINUX you too can have a SOFTWARE REPOSITORY.

What is that I hear? You use Mico$$$$$oft products?! Ho ho! My dear friend, you must cease at once and switch to LINUX. LINUX has SOFTWARE REPOSITORIES, did I mention this? Ho ho ho...

oh dear, it appears my monocle has come off again! Ho ho!

Re:Does the vendor make md5 or sha1 hashes availab

[Dr_Barnowl]

Signed hashes only assure you of the source of the files. They don't in themselves provide any assurance of trust.

In the majority of these cases, the only thing it would achieve would be that you can state with some confidence that it's definitely the fault of a particular asshat.

How important is this person to you?

[pz]

If this person is important to you (ie, a relative, family friend), then set up a CD-R with A/V and malware detection on it such that it autoruns, and mail them a new, fresh copy once per month that includes the latest A/V definitions. Hell, include a defrag as part of the autorun process. What does this person do for updates to Windows? I'm betting nothing. Include those too.

90% of maintaining my computer semi-literate parents' and relatives' computers is basically this: (1) update antivirus, (2) run A/V, (3) update Windows, (4) defrag.

Re:What is your OS?

[e2d2]

Macs are dumbed down. So you gotta be smart to use them. Or something like that.

beware!

[TheSHAD0W]

BitTornado, an application I administer, was once available via ZDNet, a site which distributed freeware and shareware apps much like Download.com. At some point someone began offering download mirrors for BitTornado and other apps, with installers that were modified and apparently contaminated with malware. I complained twice; the second time, they nastily asked whether I wanted them to remove BitTornado from their site. I told them yes.

Just because software is available via some popular gateway, you can't be 100% certain what you download will be perfect and free from malware.

Re:how about google?

[Mr Z]

There is a legit package named PDF Suite. It's unclear whether that installation was legit or not. If "PDFs stopped working," it's entirely likely that the trial period for the legit software expired. No idea. I wasn't weighing in on either side of that.

The problem as stated in this article's question is almost something of a fools errand: "I have a connection to the Internet that at best can give me benign but worthless stuff, and can give me unbounded amounts of virulent crap. I can't use this connection to download anything useful or helpful, nor can I bring anything with me that's useful and helpful. How do I avoid the crap?"

Perhaps I overstate it a bit, but not by too much, I don't think.

Great tool for identifying legit applications

[MobyDisk]

Just download http:///www.amilegit.com.ru/legit_app_detector__win32_trojanfree!!!!.exe and it will scan the app and tell you if it is legitimate.

Re:What is your OS?

[OhHellWithIt]

"Doubleclick it until it opens up a Finder window, and then drag the icon into the Application folder on the left hand side of the Finder window".

Um, yeah. In December, my parents asked me to set up file sharing between Dad's Mac and Mom's PC, and the documentation on the Mac talked about a Finder window and some other stuff. I had to do a web search to learn how to decipher the MacSpeak. Intuitive, it's not. I sure was glad to go home to my Linux laptop.

Re:What is your OS?

[Kitkoan]

I know a lot of OSX users that fit that description.

And a quick check of Ubuntu Forums should convince anyone that Linux has long since joined the party. If posts on /. don't.

How is this a troll? He's right. Not everyone who uses Linux is a computer expert. Hell, when I started using Linux I was a beginner with Linux and just took a blind plunge. Wasn't hard with Ubuntu and thats why the forums are there, to help beginners and solve problems. It's the online FOSS version of Apple's Genius Bar in there stores and Microsoft store's Guru Bar. OSX and Linux are gaining speed with all users, not just the hardcore users.