[...]
> I hardly ever get phishing email saying it is from ebay or paypal
> any more, I used to get several per day. Nowdays they all say they
> are from my ISP.
All you need is one that downloads a keylogger. That can come from
anywhere.
One thing is to use Gishpuppy for disposable emails. It works great
in Firefox, and you can have an unlimited number of email addresses.
>> One thing I strongly recommend is to split your operating system
>> into separate installations. One for normal browsing, and a
>> second installation that is strictly for financial transactions.
>> I use Ubuntu 10.04 LTS as the host, and VirtualBox as the VM. I
>> have separate installations of WinXP that provide the services
>> needed for browsing, banking, software development, etc. I do pcb
>> layout and routing in Ubuntu so a windows crash will not
>> interrupt an autoroute in progress.
> I like this one, I have been wanting to move my financials to a
> VM. BTW what PCB software are you using?
I was using PCAD but it has outlived its usefulness. However, it had
macros, which means you can do wonderful things with your own code.
For example, I could overlay a previous layout on the current pcb
and show exactly where the design had changed. I also made my own
parts selection menu that held my complete inventory, plus automatic
links to datasheets and any other useful information.
I'm looking at Eagle since I understand it also has macros. I'm
hoping to re-use most of the code and simply convert the commands to
the new syntax.
>> The XP installations are stripped to the bare minimum that is
>> needed for the required services. That means all unnecessary
>> functions and services are stripped or disabled. I turn off Auto
>> Update, Restore, Firewall (not needed), and I don't bother with
>> antivirus programs. Everything else is turned off and any
>> unnecessary files are deleted.
> I turn off auto update on everything that I can, and a VM is way
> easy to restore. Have you been able to tell VBox where to put its
> virtual machines (like to a specific volume)?
Do you mean to run the vm on a flash drive? No, I'm not good enough
to figure out how to do that, but my experience with Ubuntu says it
should be possible to do pretty much anything you want. All you have
to do is find someone who has done it and posted the procedure.
One thing I forgot to mention is to turn off the Windows cache. This
simply wastes disk space and has no benefit.
Another thing I should mention is when you are generating the vm,
don't use the latest release of VirtualBox. It will put the vdi file
in its own folder and separated from the other vms, which makes it
difficult to back up.
Instead, use version 3.2.12 to install the vm. This will put all
your vdi files in a single directory where it is easy to pick which
ones you need to back up and do them all at the same time.
However, version 3.2.12 takes forever to boot the vm, so you want to
go to a later version which fixes the slow bootup.
However, don't use the latest release to run the vm. This has
another annoying bug.
VBox added support for Windows Aero starting in version 4.1. Here's
the release note:
"July 19, 2011. Oracle today released VirtualBox 4.1, a new major
release. Introducing VM clones, increased capability for very large
hosts, and Windows Aero support."
This causes the probe in LTspice to align the tail to the wire
instead of the pointer. The problem is described in the LTspice
forum
http://tech.groups.yahoo.com/group/LTspice/message/53351
I found that all the version 4.1.XX releases do the same thing. But
if you go back to version 4.0.12, it fixes the problem. This is the
last version that does not have Aero support, and was released 4
days before. Here's the release note:
"July 15, 2011. Oracle today released VirtualBox 4.0.12, a
maintenance release of VirtualBox 4.0. It improves stability and
fixes regressions."
https://www.virtualbox.org/wiki/News
Also remember to update the Guest Additions when you run 4.0.12.
[...]
>> I use the System File Checker from Win98 to check for missing or
>> corrupted files, and to see if any new ones have suddenly
>> appeared. This only works with the Win98 version - the XP version
>> does not allow you to specify the file extensions and folders you
>> want to monitor. It also eliminates Win7 since that has folders
>> that will not allow Win98 to enter.
>> I use the various rootkit detectors to look for keyloggers and
>> other malware. But the combination of Win98 SFC and Rootkit
>> Revealer pretty much covers any trojan or virus that can attack
>> the system, so there is no need to waste time on Symantec or
>> other resource hogs.
> The use of W98 SFC on XP is a new twist for me.
It is available online. If you can't find it, I will dig up the url.
It is a marvellous little program that can detect a single bit
change in any file. So you can see if a virus has changed any of the
Windows system files or downloaded other files that you don't know
about.
The malware can change the operating system to make the changes
transparent. But if it does this, Rootkit Revealer will show the
infection.
So you get them coming and going. If they don't mask themself, Win98
SFC will catch them. If they do mask themself, Rootkit Revealer will
find them.
>> The banking installation is the only place where the passwords
>> and logon information to Paypal and the banks is kept. This
>> information is stored in Stickey Password manager and is heavily
>> encrypted. So it is not available to viruses or trojans that may
>> scan the hard disk looking for text strings. But there is little
>> chance they could be on the banking computer since it never goes
>> anywhere else except to the financial sites.
> Cool. Not quite there yet. Still learning to get VMs to do just
> what I want.
If you figure out any useful tricks, please post!!!
[...]
>> There are many other attacks that can get through all these
>> protections, so you always have to be vigilant and keep
>> monitoring your accounts for unwanted transactions.
>> But these methods will give a vastly improved security over what
>> you now have.
> Except as noted, I do much of this already.
>>Mike
I think these methods will block most malware attacks. It used to
worry me a great deal that I would lose everything in my bank
account and credit cards, since there is almost no way to avoid
doing financial transactions online.
But now that I have blocked the bank accounts and split the vms, I
can do all my banking and Paypal transactions and I am now free of
the worries that some rootkit or trojan can get to the account.
I also use many other methods, such as Proxomitron to filter
IFRAMES, Drop My Rights to prevent Firefox from installing files in
critical system folders, QuickJava for quick enable and disable of
Java, Javascript, Flash, Silverlight, Images, Stylesheets and Proxy
from the Statusbar, and so on.
I used to use Certificate Patrol to check for changes in the SSL
certificate which would indicate a malware had changed the dns to
point to a copy of the banking site. But it turns out that banks may
change their certificate often enough that it just became a pain to
try to keep track.
Finally, the Win98 SFC method won't work on Win7, so I am committed
to XP for the forseeable future. But I have no interest in Win7. The
basic install requires 6GB since they have included every possible
variation of every DLL they have ever released, and put it all in
the WINSXS folder. So there is no way to get rid of the unwanted
junk that you will probably never use, and the vdi now takes a very
long time to back up. Typical Microsoft crap.
I'm happy with XP. It works fine, and I don't need the fancy
resource hogging features in Win7 and later releases.
Thanks,
Mike