a-squared Help

a-squared Homepage
a-squared Homepage Trojan

a-squared

a-squared protects you computer against many dangers which are always present while surfing the web.

These dangers are:

  • Trojans
    Trojan Horses or Backdoors open your PC from the inside to attackers. Once a trojan is installed, someone can take full control of your computer. Most trojans are delivered via email and just previewing the email can activate the trojan. The term Trojan usually also includes Keyloggers.
  • Worms

    Worm-Viruses are the most wide spread hazard on the internet. Worms arrive as emails with harmful attachments. If you open an attachment the worm will then copy and send itself to as many other computers as possible, damaging yours and your friend's systems. a² detects worms on your PC and removes them before they can do any damage.
  • Dialers
    Dialers are small programs which reconfigure your dial-up number to a premium rate number. If you use a dial-up modem to connect to your isp you are at risk. Premium rate numbers can cost you hundreds in just a few days! a² detects and blocks dialers immediately when they try to dial.
  • Spyware

    Your personal data and your habits are a goldmine for some advertising companies who seek to infiltrate your computer. Often you are not aware that a spyware program has been downloaded. This software can collect personal information about you and your internet habits, change your home page and even stop you going to some websites! a² removes Spyware programs from your computer.

© 2003-2005 Emsi Software GmbH


a-squared Editions

 | a-squared Free | a-squared Personal
Scanner:
Scan drives and folders |  |
Signature scan for Trojans/Backdoors/Keylogger |  |
Signature scan for Worms |  |
Signature scan for Dialers |  |
Signature scan for Spyware/Adware/Hijacker |  |
Signature scan for Tracking Cookies |  |
Signature scan for Riskware |  |
Registry scan for Spyware Traces |  |
Memory scan of all active processes |  |
Heuristic scan for unknown Malware |  |
Remove detected Malware |  |
Save formatted report |  |
Right click scan (Explorer context menu) |  |
Background Guard:
Scan of applications while program start |  |
Live detection of Backdoor behavior |  |
Live detection of Worm behavior |  |
Live detection of Dialer behavior |  |
Live detection of HiJacker behavior |  |
Live detection of Spyware behavior |  |
Live detection of Keylogger behavior |  |
Live detection of Trojan downloaders |  |
Live detection of code manipulators |  |
Live detection of new drivers and services |  |
Live detection of new autorun entries |  |
Live detection of suspect behavior |  |
Define your own ruleset |  |
Exclude applications from protection |  |
Self protection against shutdown by viruses |  |
Protection of self defined applications |  |
Extras:
Online update of software and signatures |  |
Automatic online update |  |
a-squared HiJackFree analysis tool integrated |  |
Personal support if you have troubles |  |


a-squared installation/uninstallation

Installation

1. Choose the edition of a-squared that fits your needs:

a-squared is currently available in two editions.

  • a-squared Free

    This version is recommended if you'd like to scan your computer for a possible infection and clean it. With the integrated scanner you can scan all hard drives in your computer in a few minutes. If malware is found, it can be cleanly removed after the scan; however, a-squared Free does not protect against a new infection. Use the online update function to manually equip a-squared with the newest malware definitions before you scan.

    -> Further details about a-squared Free (Online)
  • a-squared Personal

    This 'big' version of a-squared is recommended if you'd like to continually protect your PC against malware infection. The integrated Background Guard is always active and blocks malware even before your PC starts; that way, it doesn't even have a chance to become active. With the automatic update you also don't need to worry about how current your software is. As soon as a new update of the software or malware definitions becomes available, it's automatically downloaded from the a-squared update server and installed.

    -> Further details about a-squared Personal (Online)

2. a-squared download and installation

On the download site you'll find the correct version of a-squared and you can download the installation file.

-> a-squared download site

Run the installation file and follow the directions of the installation assistant. During the installation you can choose where you'd like to install the program and whether or not to place icons on the desktop and/or in the quick start tray.

3. Online Update - Finishing the Installation

After the installation is completed, you'll be instructed to run an online update. This is necessary as a new installation has absolutely no malware signature files at all. The signatures, as well as any available, new porgram components, are automatically downloaded and installed during the online update.

Login:

In order to have access to the updates you need an a-squared account. This account identifies you to the update server and ensures that you receive the correct update files.

If you should happen to not have an account, you can open one for free at any time at the a-squared website.

-> Open an a-squared account

After you've opened an account, you'll receive an e-mail with the login username and access code (password). Enter these details during the online update and click "Login".

At this point, all available updates will be downloaded and installed. After the software is brought up to date, it's set to protect your computer against dangerous malware.

Uninstallation

To uninstall a-squared proceed as follows:

1. Close all program components of a-squared
2. Open the Windows Control Panel
3. Open "Add/Remove Software"
4. Select a-squared from the list
5. Click "Remove"

If "a-squared" or "a2" are not shown in the list, you can also manually delete the installation directory and start menu group. Should the scan via Explorer context menu be active, you'll have to unload the a2contmenu.dll file at the command line interface with the following command: regsvr32 a2contmenu.dll -u


a-squared Order Information

Thank you very much for your interest in a-squared Personal.

Order a-squared Personal now!
a-squared :: the future of malware protection

a-squared Personal
For Windows 98, ME, NT4, 2000, XP and Windows 2003 Server

Provides a high level of security for your computing environment.

1 Jahr Abo Order Now!

2 Jahre Abo Order Now!

Important order information:

To try a-squared Personal before you buy, download and install the free 30 day trial version. The trial is fully functional and has no detection or removal limitations.

Why buy a-squared Personal?

  • The full version of a-squared personal including background guard with IDS and automatic updates.
  • 1 year of signature updates to detect new malware.
  • 1 year of program updates and upgrades. No separate order needed when a new software version will be released!
  • Access to Control Center - our customer service and support center.
  • 50% discount on the following year's licence when it becomes due.

Activation

You will receive your account information (user and code) via email after purchasing. The user and code is used to activate the full version of a-squared Personal. The full version will be installed automatically when the user and code are verified online.


a-squared start center

a-squared Startcenter

The a-squared start center acts as the central control point for you to be able to ensure the security of your computer.

Here are the four main menu options:

  • Scan your computer for Malware infections

    Start the scanner to remove any malware present on your PC. The scanner searches all hard drives and checks all active programs for malware. Anything found can be removed after the scan is completed.

    -> Details of Scanner
  • Configure Background-Guard

    The a-squared Background Guard is the proactive part of a-squared. It's always on and ensures that your computer does not become infected with malware. The malware IDS contantly monitors the activity of all active programs and immediately sounds an alarm when a program performs a suspicious operation normally associated with malware.

    -> Details of a-squared Background Guard with IDS
  • Check your system with a-squared HiJackFree

    Only for advanced users, a-squared HiJackFree aides you in manual tracking and removal of malware. It allows you to edit all auto-start entries in your system and provides much useful information about your system's current state.

    -> Details of a-squared HiJackFree
  • Update a-squared online

    The scanner is only ever as good as its definitions. For this reason, it's important that you always download the newest definition updates before you run a scan. In a-squared Personal the automatic online update takes care of that.

Above and to the left you'll see the language selection. The program comes with over 20 languages to choose from and you can switch languages at any time.

The yellow status box provides the status of the program:

  • Version Mode

    Free or Personal. With a-squared Free as well as a-squared HiJackFree the Background Guard is deactivated.
  • Version

    The current version number of the software. Tip: when a new version is released it's not necessary to purchase a new license. The license for the time period purchased always includes all software updates.
  • Last Update

    The date at which the update last searched for updates. This date should never be longer ago than on day.
  • License Expires

    The date at which the license of the current installation expires. The license for a-squared Free never expires. With a-squared Personal you'll receive an e-mail before the expiration of the license with details as to how you can extend the license for a competitive price.


a-squared scanner - Configuration

a-squared Scanner

1. Configuration

Scan List

On the left side you'll see the list of directories that are to be scanned for malware. All locally installed hard drives are pre-selected at scanner start-up. You can add or remove directories to or from this list at any time.

Settings

After you've selected all the directories you'd like to scan, you can further refine the settings on the right side.

  • Scan memory

    When this option is selected, all programs currently loaded in main memory are scanned. If malware is active on the computer, it is immediately recognized.
  • Scan for riskware

    In addition to the clearly damaging malware categories like trojans, worms and dialers, a-squared also recognizes programs that often serve as aides for attacks on your computer. These are, among others, chat programs, server programs, monitoring tools and downloaders. If you'd prefer that these programs aren't shown in the scan results, deactivate this option.
  • Scan for unknown Malware

    Along with the definition scan, a-squared also has a heuristic scan module. With this, malware can be found for which no defintion is yet available.
  • Scan for Spyware Traces

    Spyware and, for that matter, adware leave tracks known as traces in the system. These are entries in the system registry, known directory paths and files as well as tracking cookies. These traces by themselves pose no danger, however they help spyware become active. Turn this option off if you'd prefer the scanner not show spyware traces.

Click "Scan selected folders" to begin scanning for malware.

-> Continue to the next step: Malware Scan


a-squared scanner - Malware Scan

a-squared Scanner

2. Malware Scan

During the scan you'll see the last checked directory at the left. On the right side you'll see how many objects (files, programs, traces) are currently being scanned and how many malware objects have been found.

-> Continue to the next step: System Cleaning


a-squared scanner - System Disinfection

a-squared Scanner

3. System Disinfection

After the scan has ended, you'll see the results list. This shows you which objects have been identified as malware. You can save the results as a report by clicking "Save HTML-Report".

Choose the objects you would like to remove. By default, all objects found are pre-selected. Tip: you can also invert the selection by right clicking in the list and selecting "Invert selection".

Click "Remove Selected Malware" to disinfect the computer. Warning! During disinfection the objects are fully and irreversibly removed. Always check beforehand whether the files found were mistakenly marked by the scanner or whether they are riskware you may need.

After the computer is disinfected, click "Finish" to return to the start center.


a-squared Background Gard

a-squared Background Guard

The Background Guard may seem small and inconspicuous in its service as a symbol in the taskbar; it is, however, the part most important for your security. You may be able to disinfect your computer with the scanner, but that offers no protection against new infections.

Start the Background Guard from the a-squared program group in the start menu.

You'll know that the Background Guard is active when you see the a-squared symbol in the taskbar (next to the clock). Double click the symbol to open the a-squared Startcenter. By right clicking the symbol you'll open a context menu with quick access to the most important parts of the a-squared program, like the start center, scanner, online update and Guard settings.

The a-squared Background Guard is actually composed of two large components:

  • OnExecution Scan

    The Background Guard checks every program you run with the definition scanner before it even starts. If malware attempts to execute, you'll immediately receive a warning notification and can halt the further execution of the program.

    -> Continue to the Guard's general settings
  • Malware IDS

    The Malware IDS constantly monitors the activities of all acitve programs. As soon as a program performs suspicious operations, you'll receive a warning notification; at which point you can decide whether that program should be allowed to continue or if it should be stopped. Read more about the functions of the malware IDS.

    -> Continue to the malware IDS configuraion


a-squared Background Guard - Configuration

a-squared Background Guard configuration

General Settings

In the Guard context menu, click "Guard Settings" or choose the "Configure Background-Guard" menu option in the Startcenter to open the Guard configuration.

General Settings

Choose the option "Enable background guard on system start" if you want the Background Guard to automatically load at system start. This option is strongly recommended.

Choose the option "Download and install updates automatically" if you want the Background Guard to check hourly for new updates for a-squared. If there are any, they will be automatically downloaded and installed.

Scan Settings

The Background Guard checks every program you run with the definition scanner before it even starts. If malware attempts to execute, you'll immediately receive a warning notification and can halt the further execution of the program.

Choose the option "Scan for riskware" if the Background Guard should also check for riskware programs. In addition to the clearly dangerous malware categories like trojans, worms and dialers, a-squared also recognizes programs that often serve as aides to attacks. These include, among others, chat programs, server programs, monitoring tools and downloaders. These programs are classified as riskware.

Choose the option "Scan for unknown malware" if the Background Guard should also show programs found with the heuristic.

-> Continue to the malware IDS settings


a-squared Background Guard - Malware-IDS

a-squared Malware-IDS
Malware Intrusion Detection System

1. What is the IDS? How does it work?

Malware protection without signatures?

The a-squared Personal Background Guard scans all running programs with a signature scanner the same as all other antivirus guards. The scan can only detect the malware if it has the correct signature. Although the a-squared Team wish to create signatures for new malware and provide them as fast as possible via the online update, the process of creating a new signature can take a while. During this time you are not protected against new malware.

This is where our a-squared Intrusion Detection System (IDS) comes in. This is a special system which is able to detect and block malware without the need for signatures.

Behavior Analysis

The usual way of detecting malware is through heuristics. Heuristic scanning looks at the code in the file and analyses it, then decides whether the file is harmful or not.

The a-squared IDS works differently, it watches any program that is active and stops the program if it shows any suspicious activity. When this happens a-squared IDS pops up a message to let you know it found a program trying to change something. If this happens while you are knowingly installing a program on your computer, you can tell IDS that you are authorising this change. If a-squared IDS pops up a warning when you are not doing anything your computer, then you can be pretty sure the program is working without your authorisation.

And this is the way it works..

Each malware type, no matter if it is a virus, a trojan, a worm, a dialer or spyware, always want to achieve a particular result. Each type has it's own unique properties, properties that make each type identifiable. A virus always infects, a worm always spreads, a trojan always sends files and a dialer always dials, etc. The methods that each type of malware employs to do something may differ, but the result is always the same.

It is at this point that a-squared IDS interrupts the program. It analyses the behavior of all active programs and alerts if any program tries to do something harmful. The program is stopped and cannot continue until you decide whether or not to authorise the behaviour.

Now, if you think that sounds too good to be true, you're right. This technology has one disadvantage: a-squared IDS recognizes the behavior of malware. The behavior is always the same within the same malware type. So a-squared IDS is not able to alert you to malware by name. a-squared IDS can't tell you if it is the NetSky or Bagle worm, it can't say if it is the Optix or SubSeven trojan. But it can say it IS a worm or a trojan. You can then run the appropriate removal program.

2. What does it detect?

Currently a-squared IDS can detect the following malware types:

  • Email worms
  • Backdoors
  • Backdoors with Reverse Connection Logic (LAN Bypass)
  • Spyware/Adware
  • HiJackers
  • Dialers
  • Rootkits

In addition, a-squared IDS can monitor and stop any of the following actions:

  • Installation of new drivers and services
  • Any kind of process manupulation like DLL-injection, code-injection, patching, termination, etc.
  • Installation of new BHOs (Browser Helper Objects)
  • Changes to your Internet Explorer configuration

3. What should I do if it alerts?

The IDS is a system which was designed to detect suspect behavior. The behavior of programs and malware is sometimes nearly the same, so the system may alert in error from time to time. It is important to consider what you are doing with your computer at the time of the alert and whether you recognise the program the alert is about before clicking allow or terminate. If you are unsure you should close the program and send it to us for further analysis.

Worm alert example

The alert window tells you what the IDS detected and which type of malware it may be. Additionally it contains a suggestion what to do next.

How can I tell if it is a false alarm?

First identify the program that the alert is about - is the program is one that should be on your computer? If the program shown in the alert is your browser, the mailscanner of your antivirus software or another known started server software like FTP or webserver, you can click on "Allow program once" or "Always allow program".

How can I tell if it is a real malware alarm?

If the alert box appears while you are surfing the web, reading your emails or opening an email attachment, then this is likely to be a real alert. Close the program with clicking at the "Terminate program" or "Delete file".

A general tip for using the IDS:

After installing a-squared, please ensure that the background guard is running. Then start your most used programs one by one so that you can tell IDS that these programs are allowed. This procedure only takes a few minutes to correctly configure IDS on your PC.

-> Read how to configure the Malware-IDS

4. Who can I ask if I have a problem?

If you are not sure if a specific program is really dangerous, please ask our specialists at the discussion forum. Your questions will be quickly answered.


a-squared Background Guard - Malware IDS Configuration

a-squared Background Guard configuration

Malware IDS Settings

The Malware IDS constantly monitors the activities of all acitve programs. As soon as a program performs suspicious operations, you'll receive a warning notification; at which point you can decide whether that program should be allowed to continue or if it should be stopped.

The IDS alerts at:

  • Signs of backdoor activity
  • Signs of spyware activity
  • Signs of hijacker activity
  • Signs of worm activity
  • Signs dialer activity
  • Signs of keylogger activity
  • Signs of trojan downloader activity
  • Code injection into other processes
  • Additions of auto-starts
  • Installation of services and drivers

The IDS Ruleset

Since the registered, and possibly dangerous, signs of activity are in some cases also present in normal programs, there can be false alarms. For this reason, a-squared offers a rule set for configuration similar to a desktop firewall. This way, you can permit certain actions from normal program without receiving a warning notification from the Background Guard every time.

With the rule set, you can prevent individual actions or even entire programs from being monitored by the Background Guard. This necessary for some programs in order to prevent negatively affecting system stability.

Checksums

If, for instance, you prevent a program you need from being monitored, a piece of malware could, under certain circumstances, attach itself to the program or even replace it. It would therefore be theoretically possible to circumvent the IDS protection. To prevent this, a-squared notes the so-called 'checksum' of every program which is not monitored. The checksum provides a unique number that's generated by the executable file of the program.

Whenever the executable file changes (through outside attack or also an update to a newer version), the checksum changes also. If the new checksum does not totally agree with the saved one, a-squared alerts; even it's prevented from monitoring that program.

You can, at any time, recalculate all saved checksums by clicking "Recalculate all checksums".

-> Read more about the functionality of the Malware IDS


a-squared HiJackFree

Features

a-squared HiJackFree is a detailed system analysis tool which helps advanced users to detect and remove all types of HiJackers, Spyware, Adware, Trojans and Worms.

  • Manage all types of Autoruns on your system
  • Control all Explorer and Browser plugins (BHOs, Toolbars, etc.)
  • Manage all running Processes and their associated modules
  • Control all Services, even those Windows doesn't display
  • View open ports and the associated listening processes
  • View all DNS entries in the hosts file
  • Manage installed Layered Service Providers (LSPs)
  • Analyze the system configuration with using our live online analysis

Online Analysis

The a-squared HiJackFree Online Analysis is a very powerful helper feature to see quickly which autoruns, processes, addons or open ports are harmful. Once you click the Analyze button in the program, a XML logfile is created and sent to the analysis server. Then a brower window comes up with a detail analysis of your system configuration. The report is stored so you can also tell the web address of the report to specialists if needed.


a-squared HiJackFree - Autoruns

a-squared HiJackFree

Autoruns

View and edit all autorun entries. More than 50 different autorun locations are displayed. Beside the default registry autoruns of the current user (HKCU) and all users (HKLM), a-squared HiJackFree also shows autoruns in files like win.ini, system.ini, autoexec.bat and config.sys. Additionally it lists all programs which are automatically run by the autorun start menu folder.

Autoruns can be deactivated temporarily or removed permanently.

The tricky autoruns cover all locations of the registry which are not mainly used to autorun files, but can also be used to start processes like the default screensaver path and others.

The LSP section shows all installed Layered Service Providers which are some kind of network drivers. Some spywares use LSPs to place ads on transferred website files you view with your browser.


a-squared HiJackFree - Explorer- and Browser-Addons

a-squared HiJackFree

Explorer- and Browser-Addons

The Addons section of a-squared HiJackFree allows you to view and edit plugins and addons of the Windows Explorer and Internet Explorer. Addons are mainly Browser Helper Objects (BHOs) which extend the functionality of the browser or additional Toolbars.


a-squared HiJackFree - Services

a-squared HiJackFree

Services

With the included Service Manager you can easily see which services are installed and started. Additionally to the Windows Service Manager it shows the full path to the executable service file in the list to help identifying potential harmful services quickly.


a-squared HiJackFree - Open Ports

a-squared HiJackFree

Open Ports

The Ports section of a-squared HiJackFree shows all local open ports. An open port means that there is a process running which listens on the port number for input from outside.

The Ports Manager shows also the processes which listens on the ports so you can quickly see which processes must be shut down to close a specific port.


a-squared HiJackFree - Hosts File

a-squared HiJackFree

Hosts File

The Hosts file contains the mappings of IP addresses to host names. This file is loaded into memory at startup, then Windows checks the Hosts file before it queries any DNS servers, which enables it to override addresses in the DNS.

You can use the Hosts file to redirect ad network server names to localhost to avoid ads on websites. Another 'feature' of the Hosts file is used by worms. Many of them use that file to redirect all requests to websites of Antivirus companies to localhost to avoid removal of the worm.


a-squared HiJackFree - Running Processes

a-squared HiJackFree

Running Processes

Like the Windows Task Manager, the a-squared HiJackFree Processes section lists all running processes. But additionally it shows the full path to the executed files and their loaded files and modules. Processes can be killed too.


a-squared Help - FAQ

FAQ

Frequently asked questions and answers:

  • I need HELP!!
  • Why does the updater or product activation not work for me?
  • I didn't receive the activation code email after subscribing for a new account
  • My virus scanner found something in the restore- or temp-folder, a² didnt. Why?
  • Does a² replace my antivirus software?
  • How can I determine if the a² background guard is running and working correctly?
  • I need help removing found Malware
  • I lost my a² account login details. What should I do now?
  • Is a² fully compatible with antivirus or firewall tools?
  • How can I disable the automatic download of language file updates?
  • My email address changed. What should I do now?
  • How can I switch from a-squared Personal to a-squared Free?

Question: I need HELP!!

Answer:
Please post your question at the a² Forum for a quick answer or write a support ticket to the a² team in the a² Control Center.

Include always the following details:
  • What did you already try to solve the problem?
  • Where was Malware found and by which scanner? (Copy the full message from the report including paths and filenames!)
  • Which operating system to you use? (Win98, 98se, 2000, XP Home/Pro, ...
  • Which other security software do you use too?
  • Is it possible that the detected file could be so called "False Positive" (false alarm)?

            •

    Question: Why does the updater or product activation not work for me?

    Answer:
    If you have troubles activating the a² updater, please check the following points:

  • Did you enter the correct a² account information?

    "User" is always your email address.
    "Code" is your account access code (password).
    Please pay attention to upper/lowercase, unintentional blank spaces, difference between an uppercase "o" and "0" (zero), etc.
    Check if your information is correct by trying to log in at the a² Control Center:
    http://cc.emsisoft.com

  • Do you use a desktop firewall?

    (ZoneAlarm, Kerio, Norton Internet Security, Sygate, etc.)
    If yes, then you have to allow the a² updater "a2upd.exe" to connect to the internet.

    Remark: If updating worked in the past, but since a few days it doesn't anymore:
    Remove the rule for the a² updater and create a new one.

  • Is a proxy used?

    If yes, then configure the proxy server in Internet Explorer (doesn't depend on if you usually use another browser for surfing the web):
    Tools/ Internet Options/ Connections/ LAN-Settings.
    Note: Configuration scripts and proxy servers with authentication are currently not supported by a². Will be supported in a² 2.0.

    If no, please check if the proxy settings are activated in Internet Explorer and deactivate them:
    Tools/ Internet Options/ Connections/ LAN-Settings.

    Remark for WebWasher: Please disable it! It prevents the a² Updater to download the files properly ("An error occured during the download process!").

  • Are you able to ping "www.emsisoft.com" and "update.emsisoft.com"?

    Start/ Run/ enter "command", click OK (black window is displayed).
    Enter "ping www.emsisoft.com" or "ping update.emsisoft.com" and press the Enter key. Something like "Reply from .." should appear then. If not, there is a problem with your internet connection (e.g. no DNS server configured, etc.).

  • Still not working?

    Please post the content of the "debug.txt" file in the a² technical support forum. The file is located in the a² installation folder, e.g. "c:\program files\a2". Please remove your activation code before!
    Alternatively you can also contact our support via the a² Control Center. Write a new support ticket with a description of the problem and what you have already tried to solve the problem.
            •

    Question: I didn't receive the activation code email after subscribing for a new account

    Answer:
    The registration email is sent automatically by our servers immediately after you create the account. Usually it only takes a few minutes until you have the email in your inbox. If you didn't receive the email, please check these points:

  • Too restrictive spam filter

    Check your spam filter or contact your internet service provider if the email was wrongly filtered. Some big freemailers like Hotmail, Yahoo, Verizon or GMX use very restrictive spam filters which remove most of the automatically sent emails. If you use a spamfilter that requires a manual confirmation by the sender, it doesn't work. All automatically sent emails will be sent from donotreply@www.emsisoft.com. This is a send only email account and will not be read if you write a reply. You must enable this email address manually in your spamfilter.

  • Wrong email address

    Did you really enter a working and correct email address? In some cases typos are the reason for an impossible delivery of the email. Does your email address really work? Try to send a test email to yourself to ensure the address is working correctly.

  • Email routing problems

    Sometimes, mailservers have technical problems which may result in a long delay or non delivery. Mails may hang in queues for hours or days because of the high traffic. Mailservers may be overloaded because of spam and worm emails.

    If our system is not able to deliver the email within 2 days to the responsible mailserver, the user account will be removed. You can create a new a² account then.

    If you get a message that there is already an a² account for your email address, you can request the right code for the address at the a² Control Center:
    http://cc.emsisoft.com
            •

    Question: My virus scanner found something in the restore- or temp-folder, a² didnt. Why?

    Answer:
    Sometimes, virus scanners detects Malware in on of the following hidden or system folders, but a² doesn't:

    • C:\_RESTORE
    • C:\System Volume Information
    • C:\Windows\Temp
    • C:\Windows\Temporary Internet Files
    • ..\Content.IE5

    As long as Malware is only found in of of these folders, there is no danger.

    _RESTORE:
    In the "_RESTORE" or "System Volume Information" folders, Windows stores the files for the system recovery feature. If you deactivate the system recovery, a² can remove the infected files.

    Windows ME: My Computer (right-click)/ Properties/ Performance/ deactivate System Recovery (after scanning with a², you can re-activate it)

    Windows XP: My Computer (right-click)/ Properties/ System Recovery/ deactivate System Recovery (after scanning with a², you can re-activate it)

    Temp*:
    All other "Temp" folders: You can delete the content or clear the browser history.

    Internet Explorer: Tools/ Internet Options/ General/ Temporary internet files/ Delete Files (NOTE, that this may take very long!). You can also set the memory limit to about 10 MB at the Settings.

    Mozilla: Edit/ Options/ Extended/ Cache/ Clear Cache

    Then, please scan all your harddisks once again with a² to ensure there is no Malware left.

    Question: Does a² replace my antivirus software?

    Answer:
    No, a² is a complementary program to antivirus tools. It is specialized in finding and removing Trojans, Worms, Dialers and Spyware. Read more at the product page).

    Question: How can I determine if the a² background guard is running and working correctly?

    Answer:
    Download the harmless EICAR test file http://www.eicar.org/anti_virus_test_file.htm and try to start it ("eicar.com"). The a² guard blocks the execution of the fil with an alert "Eicar test file". Then you can remove the file.

    If you don't get the alert message, it may have one of the following reasons:

    • You have installed a² free instead of a² personal. The background guard is only contained in a² personal.
    • The guard is not activated. Run the a² Guard via the Start menu - Programs - a² - a² Guard. Open the options in a² and ensure the box "Run at system startup" is activated.

    Question: I need help removing found Malware

    Answer:
    If the Malware was detected by a², right click on the result list and choose "Select All". Then, click the "Removed selected Malware" button. All found malware files will be removed.

    But in some cases, the system restore feature of Windows restores infected files after removal. If this occurs, you need to deactivate the system restore feature. More information how to do this can be found in the FAQ:
    My virus scanner detected malware in the restore or temp folder, but a² didn't

    Recommended approach on an infection:

    • Boot up your computer in failsafe mode (press F8 early while booting and select "failsafe")
    • Scan your PC with a² and remove found Malware
    • Install missing patches ("Windows Updates") immediately!
    • Change your passwords (Windows logon, dial-in, etc.)
    • If that doesn't help, please read on at "I need HELP!!"

    Question: I lost my a² account login details. What should I do now?

    Answer:
    No problem, if you know the email address which you have used for your account.

    Please enter your email address at the Control Center login form only. Click at "Code Lost" to receive an email with your login details.

    a² Control Center: http://cc.emsisoft.com

    Please note, that the a² account can not be used to log in at the Forum! A separate account is necessary for the forum. But you can view all topics at the forum without a login.

    Question: Is a² fully compatible with antivirus or firewall tools?

    Answer:
    Yes.

    a² is a complementary product to antivirus- and firewall software. a² was designed to be fully compatible basically with all programs.

    If you encounter a problem in combination with another program, please tell us. We will solve the problem as quickly as possible.

    Please note, that you should turn off other background guards while running a scan with a². Other guards would check each file twice and the scan would take very long.

    Question: How can I disable the automatic download of language file updates?

    Answer:
    Please log in at the a² Control Center and go to "Manage Licenses":
    http://cc.emsisoft.com/en/licenses

    There you can disable the checkbox "Language Updates". If you delete the language files in the languages folder of a², they will not be restored with the next online update.

    Attention!
    Never delete the language file of the language you are currently using. a² would not work any longer and a re-install of the full a² package would be necessary.

    Question: My email address changed. What should I do now?

    Answer:
    If you changed your internet service provider or only your email address to a new one, please to the following:

    1. Please log in at the a² Control Center using your a² account details: http://cc.emsisoft.com

    2. Switch to "Account data" on the menu and enter your new email address. Save your input. From now on your new email address is your a² account user name. The access code (password) is still the same.

    3. Run a² on your computer and start the online update "Update a² online". Check the box "Manage update and account settings" to enter the account details. Click "Next".

    4. Enter now your new user name and click "Log in" and "Next". Now the update server will recognize you successfully with your new details.

    Question: How can I switch from a-squared Personal to a-squared Free?

    Answer:
    1. Shutdown the background guard and all other program parts of a-squared.

    2. Open the installation folder of a-squared (by default C:\Program Files\a2) and delete the following files:

    a2guard.exe
    a2handler.dll
    a2sys.exe
    a2cfg.exe

    3. Start a-squared and run an online update.

    If you start the a-squared Startcenter then, you will see that the version mode switched to Free and the license end has changed.


a-squared Knowledgebase - Securityguide - The Basics

Security-Guide - The Basics

This Guide is dedicated to all those who want to know more about easy handling of threats in the Internet. Furthermore it shows how to obtain useful software and which safety precautions are relevant or even a must.

The following topics are listed by priority. For an optimum security level all of them should be worked through step by step.

  1. Service Packs, Patches and Windows Update

    You can install as many security tools (such as anti virus, anti malware or firewall software), as you like, it won't be a secure solution if the operating system itself has security flaws. Windows 95, 98 and ME for example are not designed for today's security requirements. Windows NT, 2000 and XP are based on another, better system core. That's why it's recommendable to use Windows XP (always the latest operating system with the most progressed technology).

    However no software is error free. If it is a Microsoft creation or comes from the open-source fraction does not matter, some software errors are based on problems in the software architecture. Most of the critical security holes result from inaccurate programming or too short tests during the developing phase. As soon a critical error is found, a patch, which is a tiny update eliminating the security hole, has to be made available by the software manufacturer.

    Microsoft offers patches and patch collections (service packs) for free. All you have to do is go to the Microsoft Windows Update Page and follow the installation instructions:

    Windows Update: http://www.windowsupdate.com

    Thus the most important rule to make your system safe is: Always keep your System up to date with updates and patches!

  2. Anti-Malware Software

    Malware describes Trojans, Dialers, Worms (worm-viruses) and Spyware (adware). These few are the most important threats in the internet.

    Trojans
    Trojan Horses (Trojans) are programs that make you think they are something else than what they really are. In most cases they come via email or downloads to the computer. They mask themselves as programs, games or other media of interest. Trojans hold a wide choice of harmful features such as spying out credit card numbers and passwords up to destroying all data on your system. A special subgroup of Trojans are the backdoors, they open the computer from the inside and hold a port open for an outside attacker who can take over the pc.

    Dialers
    Dialers are little programs that reconfigure your dial-in default number to an extra cost number if you have a computer dialup modem. This can result in many hundred dollars costs for each dial-in procedure. When a site popup asks you if it may install some software, even if it seems necessary to obtain more information on certain topics, be alarmed and if you don't wish to install it, don't let them coax you into saying "accept".

    Worms
    Worm-Viruses are currently the biggest dangers in the Internet. These are emails with harmful attachments, which send themselves to as many other computers as possible and damage your system if they are opened. If you don't open the attachments or, at best, delete them at once, you won't be in danger.

    Spyware, Adware and Browser Hijackers
    Your personal data and your habits are gold for some advertising companies. So they try to infiltrate your computer with their software that can collect your information and spy on your privacy. The information it collects is then sold for advertising purposes or for companies to gather marketing data. Browser Hijackers can change your Internet Options settings to get you to visit certain websites or use certain search engines. They usually affect your Internet Explorer search settings and homepage, but can also change context menu items or add entries to your Registry and Hosts file to redirect you to the site of their choice (not yours). Advertising modules and Adware can also change your default home page settings in your browser.

    a² removes also Spyware and other related Malware such as Hijackers and Adware from your computer. The background guard shouts an alarm if Malware is detected on your pc.

  3. Antivirus Software

    Although the classic 'virus' has been moved into the background lately, a good antivirus software is indispensable. When you chose the software, make sure that the program has a background guard that detects and blocks the spreading of viruses. Viruses affect programs or write into the boot sector of hard disks, some of them are not found in files on the disk but exist in the virtual memory space of the PC (the latter can be eliminated with a reboot). Good Antivirus Software can also find these viruses in the memory and remove them.

  4. Firewall Software

    Here you must distinguish between two different types of firewalls:

    Desktop-Firewalls
    They interpose into the operating system and catch unwanted data packages before they can reach the target program. They also catch data, which is sent from specific programs to the web. You can define rules which program is allowed to send or receive data via the network.

    But desktop firewalls have a fundamental weak point. They can be bypassed for example. Because nearly everyone has a rule for the web browser (Internet Explorer) defined, which allows the browser to access the web. This fact is capitalized by some Trojans that hijack the browser to make a connection to outside the computer with the rights of the browser. Another weak point of desktop firewalls is, that they can only catch data that is processed by the communication modules of the operating system (WinSock). If a harmful program uses it's own communication module (it's own protocol stack) the firewall can't do anything against it in most cases.

    Hardware-Firewalls
    Firewalls that are not installed on the local computer are better in every way. They are located between your computer and the Internet. So they can hardly be bypassed. Hardware firewalls are special appliances or computers with special firewall software installed. For private use, they are too expensive in most cases. But several routers (DSL, Cable) can also be used as hardware firewalls.

    The best solution in any case is, if you don't run software that tries to send or receive unwanted data. If a port is not opened, a firewall that tries to block the port is not necessary. Read more about ports in the articles "What is a port?" and "How can I close a port?".

  5. Backups - Data Protection

    Actually this point should be the first point in the priority list. Because if you loose data despite all security arrangements you will need a copy of your data to restore them. There are a lot of backup solutions available. Also Windows is shipped with a tiny backup software that can be used to make daily backups of your important data.


a-squared Knowledgebase - Securing Windows

Securing Windows

Servicepacks, Patches and Windowsupdate

Software is not clever, it is not aware of its own shortcomings and bugs. People are clever though. Sometimes, clever guys find mistakes in programs like Internet Explorer or operating system software. If virus or trojan writers find a problem they will exploit it and you end up with damaged files. If a software manufacturer finds out about, or is told about the problem, the manufacturer should provide an update for the software to remove the exploitable code with secure code. This results in the manufacturer releasing a patch for your software. Microsoft also calls them security or critical updates. You are always advised to install all available patches for your software to make your PC as secure as possible.

Service Packs are several patches rolled into one. Service Packs are normally available on CD either from the manufacturer or on CDs supplied with PC magazines or you can download them from the manufacturer's website. This saves having to download a myriad of different patches and making sure you have them all in the right order - just downloading the latest patch without the previous patches or service pack may still leave your PC vulnerable to attack. Microsoft usually roll up the patches into a service pack in 6 to 12 month intervals. Servicepack 4 for Windows 2000, for example contains more than 600 (!) corrections which were not included in the previous service packs.

Microsoft provides the Windowsupdate website to search for available service packs, security and critical updates easily. It will scan your software and find what updates you require and then install and then install them for you.

Windowsupdate: http://www.windowsupdate.com

Go to windows update website periodically to update your windows operating system.

Ensure that the following service packs are installed on your the PC:
- Windows 95/98/ME: No service packs available
- Windows NT4: Service-Pack 6a
- Windows 2000: Service-Pack 4
- Windows XP: Service-Pack 2
- Windows 2003 Server: Currently no service pack available

Windows XP and 2003 Server come with an integrated windows update and are able to search automatically for available updates and patches. For Windows 2000, the windows update software is available at the microsoft website.

"You can thwart 95% of all possible risks from the internet by just keeping your operating system up to date."

The updates prevent a lot of well known internet worms like "Nimda" or "Klez" as well as emailed worm attacks from "Sobig" and "Blaster".

Important note about Microsoft and other manufacturer's patches: Unfortunately patches are not always perfect. Sometimes the patch needs patching!. Occasionally patches don't remove all the problem or create problems with other software. It is strongly advised that you always backup your PC to ensure that if a problem does occur, you can restore your PC to its previous state.


a-squared Knowledgebase - The Dialer-Problem in Detail

The Dialer-Problem in Detail

Basic Knowledge

What are Dialers?

Dialers are small programs that either change your existing internet access telephone number or create a new internet connection on a computer system. After the program is downloaded and installed, the dialer connects to the internet via modem or ISDN-card. The existing internet connection is usually disconnected. The dialer sets itself as the default connection, then uses a very expensive phone number to dial in. Usually, dialers only work with Microsoft Windows operating systems.

The Way To The Internet

There are two ways a PC can connect to the internet by using an analog dial-up connection (modem or ISDN) or a broadband connection. The difference between them is how the data is submitted. A dial-up internet access converts the data into sound and sends it through the phone line like a phone call. ISDN submits data digitally using the phone line. Broadband connections (DSL or cable) also send data via the phone line but with much higher frequency. While some DSL connections use the windows dialup connection, the dialer is designed for an analog modems and cannot operate with a DSL or Cable modems. BUT, if you have an analogue modem connected to your computer for faxing or other connection requirements, then despite your broadband connection, the dialer can make the analogue modem dial a premium rate number.

The System of Premium Rate Numbers

Premium Rate Numbers (PRNs) are phone numbers which charge extra fees for services they offer. In the European Union, these numbers, also called service phone numbers, are administered by government institutions. Several services on the internet, radio, TV or in the telecommunication field charge their customers by using these PRNs. The legal situation concerning these numbers differs from country to country. Dialers use local PRNs as well as foreign PRNs. The use of foreign PRNs is not allowed in Germany.

Areas of Application

For the user, dialers are an easy way to for a customer to make a payment. Fee-based services are rising, a number of companies offer goods or services for the price of the phone call to them. The payment for subscription internet sites via dialers (PRNs) is becoming common for internet users.

  • Software Downloads (Games, Applications, SMS-logos etc.)
  • Download of Newspaper Articles
  • Instant News Services
  • Sexual Content (Web Cams,Live-chat, Video streaming, Images...)
  • Information offers such as Jobs, Homework, Essays, Cooking, Travel, Horoscopes, IQ-Tests and much more.)

Reliable Companies

The system of dialers and PRNs is OK, as long the user knows what he/she is getting into. In many cases, this does not happen. The massive abuse of dialers in Germany in 2003 led to a new law which requires dialers to be registered with the German 'Regulierungsbehörde für Telekommunikation und Post' (a government institution regulating telecommunication and postal services). The registration is only granted if all obligations are fulfilled and unlawful use is impossible. Unfortunately, this is only checked in a very few cases or when complaints are received. Unregistered dialers or those which do not fulfill the regulations are illegal. There are similar regulations of varying strengths in other countries as well. Check with your telecoms provider for the applicable regulatory body.

Dubious Companies

Along side law-abiding companies which use dialers appropriately to charge for their services there are many firms or individuals that do not care about regulations. Illegal dialers have become an international problem. For example dialers are implanted in web pages and are installed on the PC upon visit of the site without your knowledge. These are called auto-dialers. Most dialers can only be removed by a professional, because they are protected from simply being deleted. Many dialers can manipulate the system settings and make themselves appear as a standard connection to the internet. If your phone allows international access, then you could be dialling a foreign premium rate line. (Did you know, for instance, that a phone number beginning with 0049190 is a German PRN?)

How You Protect Yourself From Unwanted Dialers

The tricks of dubious companies become more cunning every day. Thus, it becomes more and more important for internet users to effectively protect themselves from unwanted dialers. This is how it works.

The Right PC Settings

By correctly configuring a PC, protection from dialers can be significantly improved:

Updates And Patches

Update the operating system – and the internet browser - regularly. Dubious firms often use security gaps to install dialers or viruses on your PC. Producers of operating systems, like Microsoft, fix those security gaps with patches and critical updates. If you use Microsoft Windows, install the latest service pack for your system. XP Pro and Home should have Service Pack 2 installed. When installed, warnings are shown in case of pop-ups and unknown ActiveX-activities.

Browser

Microsoft's Internet Explorer has many security holes. If you wish to use Internet Explorer you should change some system settings to minimize risk. The first and most important step is to deactivate ActiveX in your browser. ActiveX-components are used by many web sites to install and start dialers automatically. To avoid this, proceed as follows:

Extras-> Internet options-> Security-> Internet -> Adjust Level:

Now, change the settings by clicking the check boxes.

Execute ActiveX control elements that are secure for scripting: deactivate

Initialize and execute ActiveX control elements that are not secure: deactivate

Execute ActiveX control elements and plugins>: deactivate

Download of signed ActiveX control elements: deactivate

Download of unsigned ActiveX control elements: deactivate

Additionally, you should set the following:

Active Scripting: deactivate

Installation of desktop elements: prompt

For all browsers: if you wish to be really secure, deactivate JavaScript. Often, the download of dialers is offered in a pop-up. Pop-ups are only possible if JavaScript is activated. Please note: If active contents like ActiveX and JavaScript are deactivated, some web pages may not be displayed correctly or may not appear at all. With this deactivated some functions may not be allowed. Active Scripting has been used to avoid the ActiveX-blocking and can install dialers on the PC anyway.

Please note: if you are running Windows 95/98/ME then windows updates will not operate for you with JavaScript and ActiveX turned off. You will need to re-enable them to update. If you are using Windows 2000 SP4 or Windows XP SP2, then use the automatic update facility in control panel.

Dial-up Connection

The dial-up password should not be stored on the computer. It is better if you have to enter in this information for each new session. This is important, because some dialers register themselves as the default connection. For the same reason, browsers and email applications should be kept separate from the internet connection.

Modem

Modem users should make sure that the modem sound is played upon dial-in. This isn't the best form of protection, because some dialers deactivate modem sound before they dial in. It will also draw your attention to the dialer dialing without permission, some dialers activate the connection without your knowledge. Alternatively, when you have finished your internet session, unplug the phone line from the wall that is connected to the modem.

Broadband Users

If you use a broadband connection, you are protected from dialers since they can not dial in via the network. There is a risk if you use an analogue modem for fax. In that case, there is only one way to protect the computer and that is to unplug it. If you need the secondary connection, tell your phone company to block PRNs.

Administration Rights On Windows NT/2000/XP

If you are using Windows NT/2000/XP, it is better not to log-in as administrator, but as a user. In this mode, installation of programs (including dialers) is not possible.

Turn Off Windows Messenger Service

Windows Messenger Service (not to be confused with MSN Messenger) is a good thing for sending short messages within a network. This technology can also be abused - you are bombarded by unwanted advertisements via the internet. If you wish to be safe, it is best to completely turn off the Windows Messenger service:

Windows XP: Start -> Control Panel ->Performance and Maintenance -> Administrative Tools Icon -> Double click Services -> Double Click Messenger -> In the Properties -> Click Stop : From the startup type drop down, select disabled -> Apply.

Block Expensive PRNs

The most effective protection from high fees is to tell your phone company to block PRNs. Please ask your phone company about blocking. If you do have PRNs blocked, make sure that foreign PRNs are also blocked. Many dubious firms use foreign PRNs to connect to the internet.

Protection Software

Protection software can deliver protection from unwanted, expensive dialers. Usually, these programs check the dial-up connections for new connections or unknown numbers. They block the dialer or at the very least show a warning message. Contrary to popular belief a firewall, in most cases, does not protect you from unwanted dialers. A firewall supervises the ports of a PC, but not the dial-up connection. A firewall might offer some control only if a dialer tries to download additional components, but the price of the phone call is still the same!

Hardware-Solutions

Telephone Equipment

Telephone equipment can be effective protection from unwanted dialers. If you have questions on how to configure your telephone equipment, consult the manufacturer. Be careful with telephone equipment that is connected directly to the computer. CAPI-ports are often used and dialers can use them to connect to the internet. Also, telephone equipment only offers useful protection if you are using a whitelist. Blacklists of phone numbers are useless because they can be avoided by adding provider numbers at the beginning of the PRN. Many telephone systems which include an integrated DSL-modem and USB-port have an ISDN-modem. If you have one of those, you are not safe; dialers can use the ISDN-modem to connect to the internet.

Router

If the settings are appropriate, a router can be used to block expensive PRNs. It can be dangerous if the router supports the "Fallback-function" (if dialing via DSL fails, ISDN is used) or offers fax services. You can find further information on this by contacting the router's manufacturer.

Satellite Connections

Satellite connections only offer limited protection from unwanted dialers. The reason is that a back-channel is necessary in most cases which can be used by dialers to connect to the internet. Thus, if you are using a SAT-connection, you need the same security to protect you as you would need with ISDN or analog connections.

Careful Surfing

Mistrust

For many people, dialers are only used to earn money. The number of offers on the internet that can be reached by using a dialer is rising. This can be noticed when using a search engine like Google. The first ten pages are mostly pages that have been optimized to show up when specific words are searched, but can be only be reached via an expensive dialer. Thus, it is important for you as an internet user to have some healthy mistrust. Use caution if access to an offer is dependent on acceptance of a security certificate or if you are asked to type in something.

Symbols

Pay attention to unknown symbols in the task bar or on the desktop while surfing. These could be an indicator of a dialer. If you right-click on a symbol, you can find out the application it belongs to.

Check The Dial-Up Connections

Check your dial-up connection list regularly for new or unknown entries. If you find an uncommon number or a new entry, you should be careful.

Check Folder "downloaded program files"

Many dialers use this folder (usually C:\Windows\downloaded program files), to save their ActiveX-controls. These can cause an automated download or a dial-in of a dialer if you visit a specific web page. Check all entries in this folder regularly for their properties and owner listing. (Right-click on them). You can delete dubious controls by choosing "delete" from the context menu (right-click).

Is It A Reliable Firm?

If you are planning on using a dialer, check the firm offering it. Do they inform you about their charges and accounting period? Is there a contact page on the web site telling you who owns it and how you can contact them? Does the dialer mention the firm behind it? Are the general terms of service provided and is it possible to download and save them? Before using German dialer-offers, check with the "Behörde für Telekommunikation und Post" whether it is a registered dialer.

What To Do As A Victim Of a Malicious Dialer

  1. In order to be able to prove that you have been deceived or even cheated you have to have evidence for the authorities to investigate. Also, evidence strengthens your position if you are billed for no reason. Do not make the mistake of deleting or changing information. It often happens that victims delete data out of shame because they visited pornography sites but in doing so delete the evidence to show that they had been cheated.
  2. Write down the web site from where you downloaded the dialer (URL). If possible, make a screenshot of the site (press PrntScr on your keyboard, open a Word document and press Paste). Better still, download the whole site (File ->Save As...) onto your computer. If you got the dialer via email, save the whole email, including the header.
  3. Locate the dialer on your computer and save it do disk or CD-R. Save the web site, the screenshots or the mail that way, too.
  4. Find out who owns the PRN used and the web page.
  5. Create an image of your hard drive and save it to a disk or CD-R. The registry of your computer should be saved as well. (Start->Run->regedit-> Registry->Export Registry to file)
  6. Ask your phone company for an unedited list of connections from your telephone.
  7. If you are to report this to the police, do not change your computer's configuration. That way, the police can trace the dialer's manipulation. Give them all available, relevant data (owner of the Domain, name of the dialer etc.) and documents. If necessary bring your whole computer to the police station.
  8. If you are charged on your next phone bill, only pay the 'normal' phone charges and not the premium rate amounts. Send your complaint to your phone company in writing.
  9. Report to the relevant government institution that you were victim of an illegal dialer. In Germany this is the "Regulierungsbehörde für Telekommunikation und Post". There are similar institutions in other countries as well. Submit your evidence and ask them to take legal proceedings against the dubious firm.

This article was created with friendly support of Dialerschutz.de, your knowledgebase about dialers.


a-squared Knowledgebase - What is a Port?

What is a port?

Short answer: A communication channel for computers in networks.

A little more detail:
In order for computers connected to the internet to be able to communicate with each other, the transmission standard "TCP/IP "was designed. TCP/IP is a software protocol for formatting and transferring data within a network - such as the internet. One of the main advantages of TCP/IP is that it is not dependant on the computer's operating system. Transmissions between different operating systems are therefore possible.

Each computer on the internet has an IP-address (IP = Internet Protocol), which is similar in principle to a telephone number. However, unlike telephone numbers, IP addresses are restricted in their numerical range. An IP address has the format "###.###.###.###". Four number blocks, each of which are segmented with dots, and each block can only contain a value from 0 to 255. The IP address of the a² webserver, for example is "66.98.132.62". Enter this into your web browser to see this in action.

By knowing the IP address in use, a program is therefore able to send data to another computer. But an essential factor has been left out. How the receiving computer can know which program to use for the data it receives. For this reason there is a system of port numbers, also known as ports. With each transmission of data, the data package must contain the receiver's IP, and also the port number of the program which is responsible.

Imagine ports as a direct dialling number in a phone system. You can reach, for example, a company under a specific telephone number (0123-45678). If you want to call a specific person in that company, you call the main number plus the direct-call number (0123-45678-90). If the direct-call number is not existent, you simply won't get a connection. The same thing occurs if you try to connect with a computer on a port where no service is present.

When you open the website of the Anti-Trojan Network with your browser, it is always transmitted via port 80 (213.153.38.220:80). A complete data transfer always contains the IP address plus the port number required. This applies to both outgoing data (requests to the webserver) and also the incoming data - data transmitted from the website itself).

Port numbers can be any number from 0 to 65535. This range is split into three main categories:

  • 0 to 1023 are "well known ports", meaning they are reserved for special services like FTP (21), SMTP (25), HTTP (80), POP3 (110), etc.
  • 1024 to 49151 are "registered ports", meaning they are registered for services.
  • 49152 to 65536 are "dynamic and/or private ports", meaning that everyone can use these as required.

Port numbers are managed by the IANA (Internet Assigned Numbers Authority). The problem in fact is that there are no control mechanisms available which can prevent a trojan from using port 80. If a trojan does use this port, a novice user could imagine the program is a webserver, and may even simply ignore the port.

Trojans are nothing more than programs using a port to transmit data to an attacker. They hold a port open, e.g. Port 31337. The attacker connects to the trojan and sends requests to do a certain task, for example to make a screenshot. The trojan makes the screenshot and sends the image via the port to the attacker. On newer trojans, the port number is quite freely configurable, which makes identifying the trojan by the port number difficult.

But how can a port be closed? Quick answer - close the program holding the port open. But there are also more advanced methods for preventing communication over specific ports. Read more about this in the next article:

How can I close a port?


a-squared Knowledgebase - How can I close a Port?

How can I close a port?

Important: An open port is not necessarily dangerous!
You are only at risk if the program using the port contains harmful code. So there is no reason to close all ports in your system. In fact without your ports being open, the internet simply wouldn't work!

An open port is not an autonomous object, and should not be considered as something which can be destroyed by closing it. If a port is open on your computer, it means that there is an active program using this port number to communicate with other computers on the web. A port isn't opened by the operating system, it's opened by a specific program wanting to use it.

To close a port, it's usually only necessary to shut down the program holding the port open. On some ports it's enough to tell the program or service that the port should not be opened. A good example is the Microsoft Internet Information Services in Windows 2000 and Windows XP. If installed, they open three ports automatically: 21, 25 and 80. Port 21 is the FTP server, port 25 the SMTP server (email server) and port 80 the webserver for http.

The FTP server enables other internet users to download shared files from your system. They can also upload files to you, if you choose to permit this. The SMTP server is used to send emails directly to the recipient's mailbox without the use of an external mailserver. The webserver allows you to run a website on your PC. But this is only reachable on your IP address. If you wish to make this accessible to the public, you need a domain name that redirects to a static IP address.

If however you don't need all these servers, simply shut them down and the ports will be closed automatically. Open the service manager at the control panel - administrative tasks. Services are programs which are automatically run at the system startup without any visible window. They work in the background.

Search the list for "WWW publishing service" and click on Stop Service icon at the top. The port 80 is no longer in use, meaning that it is closed. You can do the same with the "FTP publishing service" and the "Simple mail transport protocol (SMTP)".

However it is not always as easy to find out why a port is open. One example is port 5000 which is opened by Windows ME and XP by default. For this, there is no service which you can turn off. To close this port, it is necessary to actually uninstall a certain system component. Port 5000 is used for plug and play with network devices. If you close this port the network plug and play is no longer available.

Firewalls

Even if a port can't be closed by shutting down a program or service, there are still other options for blocking communication to the port. Firewalls can prevent connections on specific ports. They work on the principle that data packages which use a specific port on a network are filtered. However, firewalls only provide passive security. Meaning you may have a trojan installed on your computer, but it can't connect to the attacker beause the firewall is blocking the connection.

There are different firewall concepts. On the one side there are Desktop-Firewalls like Zonealarm or Tiny Personal Firewall, which are installed locally on the PC they protect. These firewalls are located upon the network driver layer of the operating system, and prevent connections to or from specific blocked ports. But there's also an obstacle here. Programs or trojans which don't use the network driver of the operating system can't be prevented from making a connection to outside the computer. If an attacker can install a trojan with it's own network driver on your PC, a desktop firewall would not help.

A more secure technique is to install a firewall on a second computer. Usually a whole network of computers can only send data to the internet over a firewall server. The computers in the network don't have a direct connection to the internet. All data is transmitted by the firewall, and can therefore be blocked as and when required. Most of such firewalls are also able to analyze the data packages. So for example if a harmless email is transferred, the firewall can check that there are no viruses attached to the email, and filter the attachment before sending the mail to the target PC. In general however, good firewalls tend to be fairly expensive and usually require special hardware.


a-squared Knowledgebase - Backups

Backups

Higly recommended but rarely done

Emergency! Your PC doesn't react to the keyboard or mouse as expected or worse only displays a blue screen with confusing codes. What do you to do now? Throw it away? Ask your a friend who knows about these things? Pay a professional? Not nice alternatives considering that you could solve the problem on your own if you had just learned to backup!

What should you backup?

It depends! If you want to be able to restore your data - that is emails, documents, photos, music, or anything created by you using a program installed on the PC - but not the programs themselves, you should just copy the files to a CD, DVD, or even a usb drive. Then when any data gets lost through an infection or perhaps hard drive failure you are able to restore the files by simply copying them back to your repaired system. Backing up this way means that you would have to have all the cds for your Operating System, PC drivers and programs. It sounds like alot of work and if you have spent hours getting things just the way you like it, it may be. If you don't have lots of programs restoring will only take an hour or two

If you want to backup your entire hard drive including the operating system and programs it will take longer to create the backup, but as a rule is much quicker to restore. You need special backup software which is able to store all necessary files and settings correctly to a backup drive. If your system gets damaged, you can restore your PC to the state it was in at the last backup. How often you do this type of backup depends on how much data you are prepared to lose. Companies usually make "incremental" back up daily and do a full backup once a week. Incremental backups are mini backups - it just backs up files that have changed since the last full backup.

Backups can be stored on disks such as ZIP or usb drives, CD-R or CD-RW, DVDs, tape drives or to a drive on another machine in a network if you have one. The danger with network backs is if one pc gets infected, often it spreads to all the PCs on the network.

Hard disk imaging software is a popular method of backing up. Most imaging software will write the image directly to your cd/dvd writer, a network drive or another hard drive or partition. Restoring from images usually takes less than an hour - a basic system can be completely restored in 15 minutes.

Many companies and some private individuals use data mirror techniques within RAID. Two or more hard drives are operated in such a way that the operating system sees them as one. Each byte of data is stored with a special technique on all available disks so that if one hard disk crashes, the others are not affected and the system continues to run. The faulty drive is then replaced and RAID rebuilds the data on the new disk from the other drives. This backup concept has one big disadvantage: if a PC using mirrored RAID array gets infected, all the drives are infected because the virus is immediately written to all the drives .


a-squared Support Contact

Contact Us

Need an answer to a problem?

  1. FAQ - Frequently Asked Questions and Answers

    The most common problems are answered here. Please check through the Frequently Asked Questions and Answers (FAQ) before requesting help from the a² team. Using the FAQ first will ensure you get a detailed answer from the a² team.
  2. Forum

    If the FAQ didn't help then post your question in the discussion forum. Qualified technicans are available and will help you solve your problem. Please note: Separate registration is required for the forum. Your a² user and code should not be used for registering at the forum. Forum registration is free and available to everyone.

  3. Control Center

    Customers of a² Personal can contact the a² Team via the Control Center directly. Each support request will be answered as soon as possible. The a² team prides itself on it's response speed. Support request are only available for customers with valid licenses.
  4. Contact us

    Email support requests will only be answered if:

    • Your question is not answered in the Frequently Asked Questions and Answers (FAQ) section.

    • You didn't get an answer at the discussion forum or at the Control Center Support within the last 48 hours.

    • You have a problem accessing the discussion forum or Control Center.

    • You have a question regarding the purchase or licensing of a² Personal.

    • You have a problem with Malware (Trojans, Worms, Dialer, etc.) which a² has not been able to solve.

    • You have a non-technical question regarding a².

    Account Login or Control Center troubles: cc@emsisoft.com
    Forum troubles: forum@emsisoft.com
    Sales/Licensing: sales@emsisoft.com
    Corporate Sales: corporatesales@emsisoft.com
    Submit new Malware: submit@emsisoft.com
    Press: press@emsisoft.com
    Other Enquiries: info@emsisoft.com

    Please note that we can't answer your technical questions on these email addresses. Use the discussion forum or Control Center instead. Your questions will not be answered faster if you send to all addresses at the same time. Please choose only one address for your request.

    What's with all these restrictions?

    a² Free is free and a² Personal is priced very competitively. We want to be able to provide the best possible product at the lowest possible price. If the support team spends all its time answering the same questions over and over then the response time to customers who have questions not covered in the FAQ goes down and the cost of support goes up. We want to provide the customer with an accurate and detailed answer every time. Please help us to do help you.


a-squared Knowledgebase - Achtung Email! Sicherer Umgang mit Emails

Achtung Email!

Sicherer Umgang mit Emails

Wenn Sie die folgenden Tipps im Umgang mit Emails beachten, werden Sie in Zukunft kaum Probleme mit Email-Viren bzw. Email-Würmern haben.

Die Mehrzahl der Internet-Nutzer verwendet zum Senden und Empfangen von Emails MS Outlook oder MS Outlook Express. Durch die große Verbreitung dieser Email-Programme (Email-Clients) werden sie zum Hauptangriffsziel für Email-Viren. Wurm-Viren arbeiten meist nach dem gleichen Schema. Sie als Benutzer erhalten eine Email (eventuell sogar von einem Ihnen bekannten und vertrauten Absender) in der steht, man müsse unbedingt die angehängte Datei öffnen. Die Texte variieren dabei und sind oftmals auch in Fremdsprachen gehalten. Viele Emails enthalten dabei auch noch einen gefälschten Hinweis, daß der Inhalt bereits auf Viren überprüft wurde und keine Viren enthalten seien.

Die angehängte Datei ist aber nicht der angepriesene wichtige Patch oder das neueste Spiel, sondern ein Wurm-Virus. Der Wurm ist anfangs nicht gefährlich. Erst wenn Sie den Email-Anhang öffnen, wird der Wurm aktiviert und beginnt Schaden anzurichten. Es sind jedoch in der Vergangenheit auch schon Würmer aufgetreten, die ganz gezielt Sicherheitslücken im Email-Client ausnutzen, um bereits durch bloßes lesen des Textes aktiv zu werden.

Der Wurm verschickt sich zuerst selbst an alle möglichen Email-Adressen, die er auf Ihrem Computer findet (vom Adressbuch oder besuchten Internet-Seiten) und beginnt anschließend mit seiner meist zerstörerischen Arbeit. Es können Dateien geändert oder gelöscht werden oder auch eine Hintertür für Angreifer aus dem Internet geöffnet werden, mit der Ihr Computer ferngesteuert und missbraucht werden kann. Schlimmstenfalls als Speicherort und Verteiler für illegale Daten wobei Sie als Benutzer auch noch dafür strafbar gemacht werden können.

Tipp 1:
Verwenden Sie keine veraltete und ungepatchte Software. Neue Versionen von MS Outlook und MS Outlook Express bieten bereits in der Grundeinstellung einen höheren Schutz vor solchen Wurm-Viren, indem sie das Öffnen von potenziell gefährlichen Email-Anhängen unterbinden. Aktuelle Versionen sind MS Outlook 2002 (XP), Outlook 2003 und Outlook Express 6.0. Beachten Sie jedoch, dass Outlook immer wieder durch Sicherheitslücken auffällt, auch bedingt durch seine Verknüpfung mit dem Internet Explorer und dessen Sicherheitslücken. Erwägen Sie daher im Notfall auch den Einsatz alternativer Email-Clients.

Tipp 2:
Öffnen Sie NIE Email-Anhänge, von denen Sie nicht 100%ig sichergestellt haben, dass sie keine Gefahr darstellen können. Gefährlich sind alle ausführbaren Datei-Endungen wie EXE, COM, SCR, PIF, BAT, VBS und einige andere.

Viele neuere Email-Würmer verpacken sich selbst in ZIP Dateien, welche von den meisten Schutzmechanismen unbeachtet auf den PC gelangen können. Öffnen Sie daher nie Dateien, die in ZIP-Archiven enthalten sind, deren Ursprung nicht eindeutig harmlos ist.

Achtung! Viele Email-Würmer kommen mit doppelten Dateiendungen. Wenn Sie Ihr Betriebssystem so eingestellt haben, dass die Endungen ausgeblendet werden, könnten Sie auf den Trick hereinfallen. Eine Datei heißt zum Beispiel patch.txt.exe. Sie sehen nur patch.txt und könnten denken, es sei ungefährlich, diese Datei zu öffnen.


a-squared Knowledgebase - Sicherheitsleitfaden - Die Grundregeln

Trojanische Pferde im Detail

Viel zu oft werden Computerbesitzer ahnungslos zu Opfern von Angreifern, die aus Spaß oder mit gezielter Absicht mit Hilfe von Trojanischen Pferden in Rechner eindringen. Dieser Artikel zeigt, was mit Trojanern möglich ist, und wie man sich am besten vor ihnen schützt.

Warum der Name “Trojanisches Pferd”?
Trojaner, Backdoors & Viren?
Ablauf einer Trojaner-Infektion
Wie sind Trojaner aufgebaut?
Arbeitsweise eines Trojaners
Trojaner-Funktionen (Beispiel)
Erweiterte Funktionen
Abhilfe
Anti-Trojaner Tools
Firewalls
Manueller Schutz vor Trojanern

Der Anwender ist beim Surfen im Internet sehr großen Risiken ausgesetzt. Kaum jemand ist sich diesen jedoch auch wirklich bewusst. In den Medien ist oftmals die Rede von Sicherheitslücken technischer Art in verschiedenen Programmen oder Diensten. Das größte Sicherheitsproblem ist jedoch meist der Anwender der den PC bedient.

Computersysteme sind in ihrer Komplexität für den Laien heutzutage kaum noch überschaubar. Gerade daher wird es immer wichtiger, zwischen kleinen Problemchen und echten Gefahren unterscheiden zu können. Eine dieser echten Gefahren sind Trojanische Pferde, oftmals auch nur kurz „Trojaner“ genannt. Kurz gesagt, ein Trojaner ist ein Programm, das sich als etwas anderes ausgibt, als es tatsächlich ist.

Warum der Name „Trojanisches Pferd“?

Ein wenig zur Vorgeschichte: Eventuell erinnern Sie sich an die Stadt Troja aus dem Geschichtsunterricht. In der historischen Geschichte geht es um einen jahrelangen Krieg zwischen Griechen und der Festung Troja. Die Stadtmauern waren für die Griechen über mehr als 10 Jahre lang unbezwingbar. Dann täuschten Sie einen Rückzug vor und hinterließen ein riesiges hölzernes Pferd. Die Bürger von Troja sahen dies als Geschenk an und brachten es in ihre Stadt. In der Nacht jedoch entpuppte sich das Pferd als Transporter für griechische Soldaten, die dann für die nachfolgenden Truppen die Stadttore öffneten. Die Griechen konnten dadurch den Krieg gewinnen und die Stadt einnehmen.

Nach dem gleichen Prinzip funktionieren moderne Trojanische Pferde. Jemand macht Ihnen ein Geschenk, welches jedoch einen gefährlichen Inhalt mit sich bringt, von dem Sie nichts ahnen.

Trojaner, Backdoors & Viren?

Sie werden im Internet häufig die Bezeichnung Backdoor für Trojaner finden. Sicherheitsexperten definieren den Begriff „Trojaner“ mit Programmen, die etwas anderes tun, als sie vorgeben zu tun. Das können zum Beispiel Programmdateien sein, die als Spiel deklariert sind, in Wirklichkeit jedoch eine Schadensfunktion am PC ausführen. Als „Backdoor“ werden im Allgemeinen Trojaner bezeichnet, die eine Hintertür im Betriebssystem öffnen, über die Angreifer eindringen können. Eine weitere Bezeichnung ist auch „RAT“ (Remote Administration Tool). Backdoors sind heute die am weitesten verbreiteten Trojaner.

Trojaner sind entgegen weitläufigen Meinungen definitiv keine Viren oder Würmer. Viren und Würmer haben die Eigenschaft, dass sie sich selbständig weiterverbreiten können indem sie entweder fremde Dateien durch Manipulation "infizieren" oder aber sich selbstständig von einem auf den anderen Rechner kopieren. Trojaner besitzen solche Verbreitungsmechanismen nicht. Jedoch gibt es bereits Wurm-Viren-Trojaner Kreuzungen (soganannte Hybride) die zusätzlich zu ihrer Schadensfunktion Trojaner im System installieren können.

Ablauf einer Trojaner-Infektion

Es gibt verschiedene Möglichkeiten für Trojaner, einen Computer zu befallen. Bei fast allen Trojanern ist das Zutun eines Anwenders für eine Aktivierung erforderlich. Das heißt, die Programmdatei muss mindestens einmal manuell gestartet werden, um gefährlich zu werden. Es gibt jedoch auch schon Trojaner, die von Wurm-Viren automatisch installiert werden, ohne dass der Anwender etwas davon erfährt.

Üblicherweise läuft eine Infektion nach folgendem Schema ab:

1. Angreifer schickt den Trojaner

Da ein Trojaner immer eine ausführbare Programmdatei (z.B. .EXE) ist, kann dieser leicht auf verschiedensten Transportwegen zum Opfer gelangen. Dies kann zum Beispiel als Anhang in einem Email geschehen. Der Email-Text ist meist irreführend und fordert den Anwender zum Starten der angehängten Programmdatei auf. Ebenfalls zur Verbreitung genutzt werden oftmals auch Instant-Messenger Programme wie MS-Messenger, ICQ, AIM oder andere. Eine relativ neue Möglichkeit stellen Filesharing-Dienste dar. Trojaner werden damit als Musikdateien getarnt in Umlauf gebracht.

Abbildung 1: Email-Anhang

Ein Hinweis an dieser Stelle: Durch das Empfangen einer Trojanerdatei allein entsteht noch keine Gefahr. So lange ein Trojaner inaktiv auf der Festplatte des Computers liegt, geht absolut keine Gefahr davon aus.

2. Empfänger startet die erhaltene Datei

Damit ein Trojaner gefährlich werden kann, muss er einmal gestartet werden. Meist genügt dafür ein Doppelklick auf die entsprechende Datei. Sobald dies geschieht, installiert sich der Trojaner im System und setzt Autostarteinträge, damit er bei jedem Systemstart automatisch geladen wird. Macher von Trojanern haben mittlerweile sehr effektive Möglichkeiten entwickelt, damit die Datei automatisch ausgeführt wird. Der Ort des Autostarteintrages ist oftmals schwierig ausfindig zu machen. Die meistverwendeten Orte für Autostarteinträge sind die Run-Sektionen der Systemregistrierung oder früher oft Dateien wie autoexec.bat, win.ini, system.ini, etc. Moderne Trojaner gehen einen Schritt weiter und schreiben sich als Plugins unterschiedlicher Programme oder als Active-X Komponenten in die Registry. Viele Trojaner löschen außerdem die ursprünglich gestartete Datei beim Starten, um beim Anwender Verwirrung auszulösen.

Wie sind Trojaner aufgebaut?

Ein Backdoor-Trojaner besteht immer aus mindestens zwei Teilen. Dem gefährlichen Trojaner-Server, manchmal auch Host genannt, und dem Trojaner-Client, über den sich ein Angreifer mit dem Server verbindet. Sobald ein Server installiert wird, öffnet dieser einen Port (Kanal) zur Kommunikation übers Internet. Über den offenen Port kann sich dann ein Angreifer mit dem Opfer-PC verbinden und seine schädlichen Aktionen beginnen.

Die einzige Information, die der Angreifer benötigt, ist die IP-Adresse seines Opfers. Ein Weg, diese ausfindig zu machen, ist, sich vom Opfer zum Beispiel eine Email schicken zu lassen. Die IP-Adresse kann im Email-Header ausgelesen werden. Auch mittels Netstat kann die IP abgefragt werden, wenn eine Instant-Message über eine Direktverbindung empfangen wird.

Angreifer, die nur aus Spaß ohne ein bestimmtes Angriffsziel Trojaner verwenden, nutzen auch Portscanner, mit denen ganze Netzwerkbereiche nach offenen Trojaner-Ports durchsucht werden können. Trojaner verwenden unterschiedliche Ports damit sie nicht sofort erkannt werden. Bei vielen Servern kann der Angreifer den verwendeten Port auch manuell ändern, bei manchen sogar im laufenden Betrieb.

Abbildung 2: Portscanner

Arbeitsweise eines Trojaners

Der Trojaner-Server für den Client ist eine Schnittstelle zur Betriebssystem-API (Application Programming Interface) des Opfer-Computers. Der Server empfängt vom Client Anweisungen, in denen definiert ist was er tun und zurückgeben soll. Je nach Komplexität des Servers kann dieser mehr oder weniger Funktionen ausführen. Meistgenutzte Funktionen sind das Ausspähen von Passwörtern und geheimen Dokumenten.

Abbildung 3: Schnittstelle zur API

Trojaner-Funktionen (Beispiel)

Die folgenden Screenshots sind vom Trojaner „NET DEVIL“, Version 1.5.

Ordner und Dateien durchsuchen
Eine Standardfunktion bei Trojanern. Damit kann der Angreifer den PC seines Opfers nach bestimmten Dateien durchsuchen und diese anschließend auf den eigenen PC übertragen. Ebenso kann der Angreifer Dateien auf den Opfer-PC laden. Der Angreifer hat meistens im Client-Programm die gesamte Ordnerstruktur abgebildet und kann dort verschiedene Funktionen ausführen (Ordner und Dateien erzeugen, verändern und löschen, etc.).

Abbildung 4: Dateimanager

Passwörter ausspähen
Viele Trojaner haben eingebaute Routinen, um im System gespeicherte Passwörter abzufragen. Bei Windows 9x gestaltet sich dies als besonders einfach, da viele Passwörter in einem System-Cache gespeichert werden. Darunter fallen z.B. Passwörter von Wählverbindungen oder Email-Passwörter.

Abbildung 5: Passwörter

Prozesse anzeigen
Diese Funktion gleicht dem Task-Manager von Windows NT/2000/XP. Es können alle gestarteten Programmtasks angezeigt und auch auf Wunsch terminiert werden.

Abbildung 6: Prozesse

Fenster abfragen
Damit kann sich ein Angreifer einen Überblick verschaffen, welche Fenster auf dem Opfer-PC geöffnet sind. Sichtbare aber auch unsichtbare Fenster können damit geschlossen werden (z.B. Programme im System-Tray). Dem Angreifer stehen unterschiedliche Funktionen zur Verfügung. Er kann Fenster einfrieren, den Schließen-Button deaktivieren, den Fenstertitel verändern, den Focus auf andere Fenster legen und eine Textsequenz an das Fenster schicken.

Abbildung 7: Fenster

Chat mit dem Opfer
Damit kann der Angreifer einen Chat mit dem Opfer starten. Diese auffällige Funktion versetzt jeden unerfahrenen PC-Besitzer in Angst, da dieser nicht weiß, wer sich hier mit ihm unterhalten will.

Abbildung 8: Chat

Webcam fernsteuern
Viele private User verfügen bereits über eine Webcam. Auch wenn diese nicht gerade vom Besitzer verwendet wird, kann sie der Angreifer nutzen, um sein Opfer zu beobachten. Das Opfer merkt davon nichts. Eine Webcam bietet die maximale Überwachung des Opfers.

Abbildung 9: Webcam

Screenshots erstellen
Damit der Angreifer genau sehen kann, was sein Opfer gerade auf dem PC macht, kann er ein Bildschirmfoto erstellen. Die Screenshots können dann gesondert abgespeichert werden.

Abbildung 10: Screenshot

Keylogger
Als Keylogger bezeichnet man eine Funktion, die alle Tastenanschläge aufzeichnen kann. Damit lassen sich zum Beispiel Passwörter, die der Benutzer eintippt, abfangen.

Abbildung 11: Keylogger

Systemregistrierung editieren
Dem Angreifer sind in seinen Möglichkeiten kaum Grenzen gesetzt. Er kann auch die Registry editieren. Es lassen sich auch neue Sektionen und Werte anlegen. Praktisch um z.B. Autostarteinträge für den Trojaner-Server zu verändern oder andere Programm beim Systemstart automatisch starten zu lassen.

Abbildung 12: Registry-Editor

Plugins

Einige weit verbreitete Trojaner-Server haben eine Plugin-Schnittstelle. Damit können sich Angreifer den Server so zusammenstellen, wie sie ihn benötigen und selbst Plugins für den Trojaner entwickeln. Der Kreativität im Entwurf neuer Schadensroutinen sind hier keine Grenzen gesetzt.

Erweiterte Features

Versteckspiel

Moderne Trojaner wie zum Beispiel Optix können sich auf dem befallenen PC sehr gut verstecken. Sie manipulieren dazu die Windows-API Aufrufe, die für die Anzeige der Dateien im Explorer oder in der Registry zuständig sind. Der Benutzer hat dann keine Möglichkeit mehr, den Trojaner manuell zu finden, da er unsichtbar ist. Nur der Angreifer weiß wo sich der Server versteckt und wie man ihn wieder abstellt.

Antivirus und Firewall deaktivieren

Ebenso eine häufig eingesetzte Methode unentdeckt zu bleiben ist es, alle aktiven Antiviren-Programme oder Firewalls abzuschalten oder zu deaktivieren. Der Trojaner-Server bleibt somit unerkannt auf dem PC.

Personal Firewalls umgehen

Eine bemerkenswerte Leistung erbringt der Trojaner "Assasin 2". Dieser kann Desktop Firewalls umgehen. Das Funktionsprinzip ist relativ einfach erklärt. Der Trojaner injiziert sein Kommunikationsmodul in ein Programm, das sicher durch die Firewall darf. Der MS Internet Explorer eignet sich daher als Opfer sehr gut. Assasin hijacked quasi den Browser um durch ihn nach draußen verbinden zu können. Der PC-Benutzer merkt nichts davon und fühlt sich sicher.

Abhilfe

Es gibt mehrere Wege, seinen PC frei von Trojanern zu halten. Im Folgenden werden drei Ansätze zur Sicherheit erläutert. Eines vorweg: Einen 100-prozentigen Schutz gegen Trojaner gibt es nicht. Mal abgesehen vom generellen Verzicht auf das Internet bzw. Netzwerke allgemein.

Anti-Trojaner Tools

Der einfachste Weg für Anwender den PC „sauber“ zu halten, ist ein Anti-Trojaner Programm zu installieren. Diese Programme durchsuchen alle Laufwerke nach Trojaner-Dateien und bieten meist auch noch Hintergrundwächter an, die aufpassen, dass sich Trojaner erst gar nicht einnisten können. Je nach Tool wird auch die Registry nach Autostarteinträgen durchsucht und der Speicher geprüft um einen maximalen Schutz zu gewährleisten. Auch Anti-Viren Tools finden Trojaner, können diese jedoch meist nicht in der Qualität eines speziellen Anti-Trojaner Tools entfernen. Manche Anti-Viren Programme scheitern beim Versuch, eine Trojanerdatei zu bereinigen, da nach einer virenartigen Signatur in Programmdateien gesucht wird, welche es aber in Trojanern nicht gibt, da Trojaner wie jedes andere Programm aufgebaut sind. Gute Anti-Trojaner Tools bieten ständig Updates der Trojanersignaturen-Datenbank an um immer die aktuellsten Trojaner erkennen und beseitigen zu können. Einen Nachteil haben solche Tools jedoch. Es können nur Trojaner erkannt werden, die den Entwicklern bereits bekannt sind und sich in der Signaturen-Datenbank befinden.

Firewalls

Hier muss man unterscheiden zwischen Firewalls, die durch Filterung der übertragenen Daten einen Transfer von Trojanern verhindern, und solchen, die die Kommunikation nach Außen für Trojaner unterbinden.

Erstere können zwar verhindern, dass sich ein Trojaner über das Internet in ein lokales Netzwerk einschleicht indem z.B. bestimmte Dateitypen geblockt werden, jedoch schützen diese nicht vor bereits aktiven Trojanern, die womöglich über andere Wege als das Internet in das lokale Netzwerk gelangt sind.

Portblocker-Firewalls basieren auf dem Prinzip, dass erstmal alle Kommunikationsports gesperrt, und dann stückweise die benötigten Ports geöffnet werden. Die wichtigsten Ports die man nicht sperren sollte sind: 21 (FTP), 25 (SMTP), 80 (HTTP), 110 (POP3), etc. Je nachdem welche Dienste man im Internet verwenden möchte, muss man jedoch Ports öffnen. Spätestens hier ist die Sache mit der Sicherheit jedoch schon wieder relativ. Die Portnummern bei Trojaner sind meist variabel, d.h. ein Angreifer kann den Trojaner z.B. so modifizieren, dass Port 80 verwendet wird. Somit können Trojaner-Server auch durch Firewalls hindurch mit dem Angreifer kommunizieren.

Portblocker-Firewalls können nur einen passiven Schutz gegen Trojaner bieten. Wenn in einem lokalen Netzwerk auf einem PC ein Trojaner aktiv ist, kann er trotzdem immer noch intern im LAN verwendet werden. In großen Firmennetzwerken werden Trojaner immer häufiger von den eigenen Mitarbeitern eingesetzt, um geschützte Daten auszuspionieren.

Proxy-Server oder NAT-Netzwerke schützen nicht vor Angreifern, die sich mit einem installierten Trojaner hinter dem Proxy- bzw. NAT-Server verbinden wollen. Auch Trojaner sind mittlerweile Proxy- und NAT-fähig und verbinden sich selbständig nach außen zum Angreifer.

Manueller Schutz vor Trojanern

Natürlich können Sie jetzt auch sagen „Ich brauche keine Schutz-Tools, ich habe mein System auch so im Griff“. Dies ist natürlich Ihr gutes Recht und es kann Ihnen auch keiner dagegen reden. Jedoch sollten Sie dann die wichtigsten Regeln, die Sicherheit im Umgang mit dem Internet betreffen, beherrschen.

1. Vorsicht mit Dateien

Öffnen Sie keine ausführbaren Dateien aus dem Internet, denn sie könnten Trojaner enthalten. Dies gilt nicht nur für .EXE-Dateien. Es gibt eine ganze Palette von Dateitypen die ebenso wie .EXE ausführbaren Code enthalten können. Beispiele: .COM (DOS), .SCR (Bildschirmschoner), .DOC, .XLS, .MDB (VBA-Makros), .VBS, .JS, .HTA, .WSF (Scripts), uvm. Vergewissern Sie sich, dass die Quellen der Dateien vertrauenswürdig sind. Da gilt vor allem für Downloads.

Vorsicht bei Email-Anhängen! Auch wenn ein Email von einem vertrauten Absender stammt, kann es einen Trojaner enthalten. Viele Email-Würmer verschicken Trojaner automatisch an alle im Adressbuch befindlichen Email-Adressen, ohne dass der Anwender etwas davon bemerkt.

2. Updates

Achten Sie darauf, dass Sie immer die aktuellsten Updates und Patches Ihrer Programme installiert haben. Ansonsten kann es schnell vorkommen, dass Ihr PC von Trojanern infiziert wird, ohne dass Sie etwas davon bemerken. Einige Trojaner erreichten einen sehr großen Verbreitungsgrad durch das Ausnützen von Sicherheitslücken im MS Internet Explorer und den MS Internet Information Services.

3. Programme und Ports im Griff

Wenn Sie sich nicht auf Schutzsoftware verlassen möchten, sollten Sie alle aktiven Programmtasks auf Ihrem PC kennen. Ihnen sollte sofort auffallen, wenn ein Ihnen neues Programm läuft, welches einen Port offen hält. Mit dem Kommandozeilen Tool „netstat“ können Sie alle aktiven Verbindungen abfragen und anschließend diese manuell den aktiven Programmen zuordnen.

4. Autostarteinträge im Griff

Trojaner benötigen Autostarteinträge um beim Systemstart automatisch geladen zu werden. Sie sollten alle Programme kennen, die an den folgenden Orten automatisch geladen werden:

Startmenü – Autostart
Wird von Trojanern kaum genützt, da sehr leicht zu finden.

autoexec.bat
Kaum von Windows-Trojanern genützt, hauptsächlich für DOS-Programme verwendet.

config.sys
Ebenfalls hauptsächlich für DOS-Programme.

system.ini
Beim Eintrag „shell=“ können Programme geladen werden.

win.ini
Über die Sektionen „run=“ und „load=“ werden manchmal Trojaner geladen.

Systemregistrierung (Registry)
So gut wie alle neuen Trojaner nutzen die Registry um automatisch geladen zu werden. Die wichtigsten Positionen sind:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

sowie

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Weitere Möglichkeiten sind durch Plugin- und Modul-Keys gegeben. Ein Trojaner kann sich z.B. als Active-X Control in die Registry schreiben um beim Start verschiedener Programme geladen zu werden. Eine andere trickreiche Möglichkeit sind die Dateitypen-Registrierungen. Bei jedem Dateityp kann festgelegt werden, mit welchem Programm eine solche Datei aufgerufen werden soll. Manche Trojaner nutzen das um beim Aufruf jeglicher Dateien gestartet zu werden.

Um einen Trojaner sicher zu entfernen, beenden Sie zuerst den Programmtask, löschen Sie dann die Programmdatei und entfernen Sie anschließend die Autostarteinträge.