As many of your know, I am a computer science major in college. I also work in the IT department at the corporate headquarters of ServiceMaster. As you can imagine I receive many questions from people about how they can take care of their computer. This is especially true when it comes to the issue of viruses, spyware and pop-ups. Because I find myself answering these questions so often, I thought that it would be helpful for me to put together a document on general computer practices. This document does not address specific problems you might be facing, but rather seeks to give you the upper hand in the fight against those who seek to cripple computers. I have sought to do this by providing some instructions on practices you can use to better understand and maintain your computer. I hope that you find this helpful. If you have any questions, comments or suggestions concerning the practices I have outlined, feel free to contact me.
I am going to try and do more of these computer tutorials in the future. Please feel free to contact me with suggestions on what you would like me to write about.
(Click the link below to view the tutorial)
to effectively maintain your computer
The purpose of this guide is to give the average user some tools they can use to effectively manage their computer. It is written for Windows XP. A lot of the concepts are applicable to other operating systems, but the specifics of how to do them are not.
Table of Contents:
- Programs installed on your machine
- Programs set to run at startup
- Programs running on your machine
- Using Ad-Aware
- A brief word about using email and internet
- Viewing open connections
- Other practices
- Resources
The key to keeping your computer clean is knowing what is on your system. If you are familiar with what you have and what you use it will be much easier to identify potentially malicious software on your system.
Programs installed on your machine
There are a couple of places that you can identify programs installed on your computer. The most straight forward is in the START menu. The START menu contains a listing of programs on your computer. Included in most program folders is an uninstall tool to remove the applications you do not want.
Another place is to go to “Add and Remove Programs” in the “Control Panel”.
This is the definitive place for programs that exist on your computer. Here you can see what programs are on your machine and also choose to remove them. Look over the list for programs that you know you will never use and uninstall them. You may have to do a little research for programs that you don’t immediately recognize. A lot of times things like hardware drivers and system programs show up in this list. Be sure that you know what you are removing before doing so. This will help to keep your hard drive clean, saving you room for all of the things that you want to store. Periodically check this list of programs to make sure that only the applications you want on your machine are there. By doing so, you can easily recognize when an anomalous program shows up.
Some programs may be running in the background and therefore will not let you uninstall them. In that case you will need to kill the process first by going through the steps outlined under the Programs that are running section.
Programs set to run at startup
Windows keeps a list of programs that are set to run each time your computer starts up. A lot of the time you can find programs here that you don’t need running each time you start your computer. To view the list:
- Go to the START menu
- Click on RUN
- Type MSCONFIG and press enter
- Choose the STARTUP tab at the top
This is the list of programs that run automatically when your computer starts.
Look over the list of programs. You can see where the main program resides by looking at the “command” column. Many times looking at the path will tell you a lot about the program. For example, in mine there is a task called QTTASK set to run at startup. If you look at the path of this program you can see that it is in the QuickTime folder. This tells me a lot. Simply by knowing that this process is associated with QuickTime, I know that it is not malicious and that it is not required to run at startup. So, I can safely turn it off. I also have a program called VPTRAY set to run at startup. The path to this one tells me that it is associated with Symantec Anti-Virus. This is my anti-virus program. I do not want to turn this off, becaue I want my anti-virus to run at when the computer starts.
You will probably come across programs that you do not recognize. These are most likely programs that came pre-installed on your computer and may be necessary for your computer to work properly or they may be malicious files. You can find out more information about certain programs by going to WindowsStartup.com. Search for the file that you do not recognize and see if this site can tell you more about it. If after reading the site you realize that you do not need to have this file running each time your computer starts go ahead and turn it off. To turn off a program just uncheck the box next to it. If you are unsure about a program it is probably best to leave it on, but do some more research to see if you can find out anything about it. Simply searching Google for the file name may also yield some helpful information. It’s a good idea to document what you change so that if you end up turning something off that you should have left you can you go back and change it.
When you’re done the program will ask you if you want to restart. After you restart the machine a warning will show up telling you that you have modified your startup settings. Make sure to click the box to tell the dialogue not to display again and then dismiss the dialog.
If you would like an application for a more detailed view, check out: AutoRuns
Programs that are running
To get a list of all programs that are currently running on your machine, as well as, the number of resources they are using:
Press Control+Shift+ESC.
This will open up the Windows Task Manager. Here you can see each of the programs that you have started, as well as, those which are running in the background. The main column that you want to look at is the CPU column. This will tell you which programs are using up most of your processor. You can sort by CPU usage by clicking on the column heading. If you see a file there that you do not recognize and is taking up a lot of CPU (more than 30%) it may be cause for concern. This is especially true if you are not doing anything else on the computer. You can find out information about a given process by searching your hard drive for where the program resides or by searching Google.
Again, this may seem like a lot of work, but the more you do this, the more familiar you become with your computer. You will start to notice patterns of what programs are supposed to be running and what they are doing. If something suspicious shows up it will be immediately obvious to the informed user and they will be able to take appropriate steps to resolve the issue.
For Advanced Users: There is a program called Process Explorer that will tell you everything you ever wanted to know about processes running on your system. This includes other files associated with this process, threads, dlls, etc. It is a very handy tool for digging deep into the programs running on your system.
Using Ad-Aware
Ad-Aware is a great program you can use to scan your computer for potential spyware infections. Download the software at Download.com.
After you have downloaded and installed the software. Run the program.
The first thing you will want to do is to get the latest updates. Click on “Get new updates”. This will make sure that you have the latest definitions.
After you download the latest definitions; run a scan of your entire hard drive. This may take a while if you have a large hard drive. It is also a good idea to run the scan when you are not online. When the scan is complete the program will tell you what it found. Look over the list and take note of what it identified. The program is very reliable and so you should be able to delete everything that it finds without any problem. It is good to periodically run this program to ensure that your system is clean.
A brief word about using email and the internet
Email and the internet are great tools of today. But given the increasing number of malicious items out there, one needs to be cautious in order to protect their machine from harm. The biggest thing you can do is just to be observant of where you are on the internet and what you are doing. Do not just go blindly clicking around. The same with emails; do not just open every email that is sent to you. Take an extra second or two to look at it and see who its from, if it has attachments, etc. Here are some other tips for using email and the internet.
Do not install anything from a website unless you know what it is. Sometimes a website may require you to download and install a certain addon to your browser in order to be able to view some part of their site. For example, if you go to Macromedia.com it will prompt you to install Flash player. This is legitimate because you purposely went to Macromedia.com and have identified what it is going to install. If ever you come to an unfamiliar website and you are asked to install something, carefully look over the what is being installed. If you have any questions about it, do not install it. You can always go back to the site and install it later if you really need it. But if it is malicious it could take you longer to clean your system than it would to do a little research and find out what you are installing.
It probably goes without saying that you should never click on a link if you do not recognize the source or destination. Meaning, if you don’t know where the link came from or you don’t know where it’s going to take you. If you receive a suspicious email with a link in it but the link has been replaced by text and not does not show the address; right click on the link and try to copy the address and paste that somewhere to see where the link is going to take you.
If you get a pop-up window and do not recognize the content, you can press F11 to display the window full screen. The reason you should do this is because it will display the source address of the pop-up allowing you to see where it came from.
Do not open unknown email attachments. Check with the sender first.
Do not unsubscribe from spam ads. When you unsubscribe from a piece of spam; you are basically telling the sender that you have a live account and to send more spam. If you are on a legitimate newsletter or receive subscriptions from trust websites it is ok to unsubscribe.
Do not visit gaming or gambling websites or sites that contain a large number of advertisements. Almost always these sites will install malicious software on your system.
For an overall better internet experience, I recommend using FireFox. It is a free web browser that will help protect you from attacks targeted at Internet Explorer. It also has great features like a pop-up blocker and tabbed-browsing, as well as many other helpful additions.
Viewing open connections: For Advanced Users
This section is really only for super-nerds that want to know about the network activity of certain processes, but feel free to try it out and learn something new. If you have an always on connection to the internet (e.g. cable, dsl, T1, etc), it is a good idea to keep track of which processes are trying to contact the internet and where they are trying to connect to. In order to view this:
- Go to START
- Choose RUN and type CMD
- In the command window type NETSTAT -a -o
This will show you a list of all of the running processes that are either listening on certain ports or actually have open connections. You can identify the processes by matching the
PID with the column in your task manager. (To display the
PID column in the task manager: choose
VIEW ->
SELECT COLUMNS and check the
PID box) For an alternative way to do this download
TCPView. This will give you a display of all processes and ports including an option to set the update interval. For you
iTunes nerds like me, I use this program to see who is listening to my music. It is good idea to make sure that only the programs that you want are trying to connect to the internet and that your security is not being compromised by an outside source.
Other Practices
There are two other things that you should do when working on any system. First, make sure that you have anti-virus software (e.g. Norton or McAfee) installed on the machine. It is a good idea to go through the settings of your anti-virus program to get a better understanding of what it is and what it is doing. Simply having the program installed is usually sufficient, but it is a good idea to be familiar with the program. The program might give you pop-up messages telling you what its doing or what it found, the informed user will notice this and understand what is going on. If you are not familiar with the application, the messages, which are supposed to be helpful, may appear confusing. Read the help menu in your program for specifics. Also, keep the virus definitions up to date. This will protect you from the latest threats. Second, another good practice is to regularly apply all of the “critical updates” on Windows Update. This ensures that you are protected from the latest security vulnerabilities.
By following the practices outlined above you should be able to understand a lot about what is running on your system. Simply having this knowledge puts you far above the average computer user and a difficult target to those who would try to harm your computer. As long as you remain aware of what is on your machine you will be able to optimize your system’s performance for various tasks and keep it clean of unwanted software.
Resources
Disclaimer: I don’t really want to add this to the end, but in our day and age I feel I must. I do not take any responsibility for anything that may go wrong with your computer if you follow these instructions. I am happy to answer any questions you have concerning these or other computer issues, so feel free to contact me.
Steve Erickson 2004[/cut]
