Home > Ask the Security Experts > Platform Security Questions & Answers > How to ensure the validity of Microsoft Windows updates
Ask The Security Expert: Questions & Answers
EMAIL THIS

How to ensure the validity of Microsoft Windows updates

Michael Cobb EXPERT RESPONSE FROM: Michael Cobb

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 20 August 2008
I paid for and downloaded Antivirus XP 2008 and AlphaWipe Tracks Cleaner 2008 from a link in my Windows Update icon, but now I'm concerned with whether they are Microsoft products. Are they legitimate? I am concerned with identity theft. How can I ensure that the products I receive via Windows Update are secure and valid?

>
EXPERT RESPONSE
Updates and applications installed using Windows Update will always be digitally signed by Microsoft. The signature allows you to verify where the code came from and if it has been tampered with since its publication.

Unfortunately, both the programs you have installed are a complete scam and have nothing to do with Microsoft. Both programs use scare tactics to try and intimidate you into buying them. AlphaWipe is a suspect history cleaner, creating fake alerts about problems with your PC's registry that don't actually exist. XP Antivirus 2008 uses similar tactics by generating its own fake system error messages, which pop up and try to coerce PC users into buying the program in order to remove them.

You say that you downloaded these programs from your Windows Update icon. If this is the case, then it sounds very much like other malware is resident on your PC, which has changed where the Update icon takes you. I've also read instances where people have been duped into installing these programs while trying to purchase genuine antivirus and antispyware. So, sadly, you are not alone. Malware often comes bundled with free software downloads. It can also install itself when you use file-sharing functions found in instant message programs or visit a malicious website.

You need to first safely remove both of these programs and any other malware on your PC. There are many trusted antivirus and antispyware programs you can use from vendors such as Symantec Corp., McAfee Inc., and Kaspersky Lab Inc. If you don't want to spend any money, AVG Technologies provides a very good free antivirus program. SpyBot - Search and Destroy, a spyware tool, can also be downloaded for free..

Download, install and run both of these programs to remove what will probably be a large number of malicious applications that have infected your PC. Once you have done this, I would go to SpywareRemove, an online spyware removal guide, and check that the files they list as being part of XP Antivirus have been deleted. The next step is to restart your PC and run both the antivirus and antispyware programs again to ensure that no unwanted programs have reappeared.

Once you have cleaned your PC, it is very important that you practice safer online habits to prevent being infected again. If you get an unexpected window popup on your PC, close it by clicking the cross in the top right corner. Often malicious popups will have what appears to be Yes and No buttons. No matter which button you click on, a download starts, installing a malicious program on your system.

Do you use a peer-to-peer (P2P) program or other applications with a shared network? When you use these applications, you put your system at risk by possibly and unknowingly downloading an infected file. I would also ensure your Web browser's security settings are not set too low. If you're using Internet Explorer, go to Tools then Internet Options. On the Security tab, you should have the Internet setting at least at Medium-high. Depending on the types of site you visit, I would even consider setting this to High.

SearchSecurity.com has lots of advice on safe surfing, including a spyware removal checklist, an FAQ on spyware and malware, and a free Intrusion Defense School. I would suggest that you read these articles about protecting yourself -- and your organization -- from spyware and other malicious programs.


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


RELATED CONTENT
Platform Security
Can DNS be used to support encryption?
Are there software tools that can automate the server hardening process?
How can 'DRAM remanence' compromise encryption keys?
Should users have a removable boot drive for online banking?
The unexpected costs of server virtualization?
Is attack code valuable for vulnerabilities or just a publicity stunt?
Will the features of Windows Vista SP1 encourage wider adoption of the OS?
Is a Master Boot Record (MBR) rootkit completely invisible to the OS?
What are the pros and cons of zero-knowledge penetration tests?
Are open recursive DNS servers inherently insecure?

Patch Management
Microsoft Windows XML flaw exploits test desktop antimalware
Microsoft warns of SQL Server zero-day
Adobe issues warning for Linux users
Microsoft issues emergency patch to fix IE flaw
Microsoft to release emergency patch for IE XML flaw
Microsoft fixes critical flaws in Office, IE
Inside MSRC: Microsoft issues guidance on critical flaws
Dangerous Java flaws could expose sensitive data
Microsoft to patch critical Windows, Excel flaws
Microsoft flaw reveals inefficient security model

Viruses, Worms and Other Malware
Study of banking malware analyzes underground economy
Microsoft Windows XML flaw exploits test desktop antimalware
Use BotHunter for botnet detection
Cisco: Cybercriminals more savvy than ever in 2008
Flash, PDF are growing malware targets
Holiday shopping threats
Spam declines, Web-based attacks rise, says MessageLabs
Microsoft flaw reveals inefficient security model
Microsoft learns of successful RPC worm infections
Security researchers leading way in biometrics, insider threats, encryption and virtualization

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
attack vector  (SearchSecurity.com)
back door  (SearchSecurity.com)
ethical worm  (SearchSecurity.com)
Patch Tuesday  (SearchSecurity.com)
zero-day exploit  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
Browse our Expert Advice



Find Security Solutions for Your Business
Targeted Security Channel Tips for Resellers, Integrators and Consultants
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts