Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How is it possible that my up to date install of Windows 7 with UAC enabled and Microsoft Security Essentials running became compromised, seemingly in a website drive-by?

I've run ostensibly the same security setup for many years now and never been compromised, what has changed? Has the nature of attacks become more advanced? What could I do to prevent another attack being successful?

Edited to add: Browsers used are mainly Chrome & Firefox, IE only on certain sites that require it and/or we know are safe.

Edit: Thanks for the answers. I've gone through everything and nothing was permanently damaged (no MBR virus etc.) but at the same time I didn't find anything that would point to the vector. Chalk one up for experience I guess.

share|improve this question
1  
Out of curiosity, how do you know you are/were infected? What if anything were you able to find out about whatever it was that infected your Win 7 install? Was your Win 7 32-bit or 64-bit? –  irrational John Jul 29 '10 at 11:58
    
32bit. MSE started throwing alerts and although these were removed/quarantined automatically depending on the threat level, obviously one or more got through as I started seeing rogue processes, hosts file redirects and an install of (presumably infected) Avira Antivir appeared. It's now in safe mode while I figure out if a rootkit or MBR virus has been installed aswell. There are still some things wrong, namely that common anti-malware programs are disabled, crippled or BSOD on open, but I think I'll try to fix it first before I give in and format/reinstall becuase I like a challenge :) –  Lunatik Jul 29 '10 at 12:47

6 Answers 6

I've run ostensibly the same security setup for many years now and never been compromised, what has changed? Has the nature of attacks become more advanced?

Yep! New virii, new tactics, new ways of exploiting peoples computers (eg: Tab nabbing) it never ceases to amaze the things 'bad guys' are doing to unsuspecting users. The problem only gets worse.

What could I do to prevent another attack being successful?

Follow all basic rules:

  • Don't visit suspect websites
  • Don't open suspect emails
  • Keep system up to date
  • Run Anti-Virus/Anti-Malware and a Firewall
  • Use good pass-phrases (not password!)
  • Dare I say ditch Windows? (Trying not being elitist, just suggesting an OS with a different security model. I use both Linux and Windows OS's)
  • Listen to a Security Webcast and learn about new attacks and how to defend yourself (Education)
  • There are too many to list but the biggest protection is common sense...

In regards to drive by downloading you can reduce your risk by doing browsing without JavaScript enabled, use something like NoScript with Firefox for example. Also disable JavaScript in Adobe Reader, if you didn't know it was in Reader then you don't need it.

Linux can be just as vulnerable as Windows if used incorrectly. Educating oneself will pay dividends.

EDIT: Just adding a link to a NoScript type workaround for Chrome, if people want to lock it down a little more: http://superuser.com/questions/8365/noscript-plugin-for-google-chrome

share|improve this answer
    
Thanks for the reply. Linux is a no-go (home PCs need to be used by wife, kids, friends, babysitters etc.), most of the rest I am up on (MCSE in previous life, developer and general tech head nowadays), it's just that I was under the (obviously mistaken) impression that hardening a modern, 'protected', updated Win7 PC to that level would at least detect and isolate any threats before they were able to damage the install. What is the point of UAC if not to prevent this kind of thing? –  Lunatik Jul 29 '10 at 7:40
2  
There isn't much point in having the sudo elevation command Linux if the user will type in or run any script/program crafted by 'bad guys'. Its the same thing with UAC, you can put up all the software security in the world but if the user is going to run suspect programs then it is all moot. Security is only as strong as the weakest link and 9/10 of the time this 'weak link' is going to be between the keyboard and the chair. Might I suggest the use of a Linux live CD to use on your home computer to do stuff like online banking, then you can have both worlds. –  Qwerty Jul 30 '10 at 0:55
    
Doesn't no script break 75% of all websites? It seems that all webpages that have things like expandable menu's or picture previews would be severely broken –  TheLQ Jul 30 '10 at 5:01
1  
If you have the patience for it, NoScript can be used. You just spend a noticeable amount of time letting NoScript know that "Yes, this IS yet another a site I want to run JavaScript on <sigh>". Having said that, it does give you URL level granularity in picking which scripts to authorize. And it's simply "click to authorize" so as fast as I think it can be. I've found I can live with it, partly because I find it interesting to see just which & how many scripts are being run on a site. ;-) But not for everyone ... or even most I suppose. –  irrational John Jul 30 '10 at 15:16
2  
The computer being used by others (kids, babysitter, etc.) is not a reason to use Windows, but instead a reason to use Linux. I don't let others use a Windows machine. It is too easy to infect or break. If they use a Linux machine as a limited privilege user, they can browse and play flash games all day without being able to hurt it. –  Grant Johnson Aug 2 '10 at 15:15

I agree 100% with Qwerty, I'd like to add my 0.02 EUR: if you're using Internet Explorer, try using a different browser instead. IE8 may be the safest Microsoft browser yet, but one thing's for sure: it isn't updated as often as other popular browsers like Firefox or Chrome. (Firefox has been updated 3 times this month, if I'm not mistaken). The longer it takes for a security hole to be fixed, the higher the chance that it gets exploited.

That doesn't mean you'll be perfectly safe using an alternative browser. But I think you'll be safer.

share|improve this answer
    
I use Chrome exclusively, my wife uses Firefox (so that we can both be logged into mail etc. at the same time) and we use IE only when absolutely necessary –  Lunatik Jul 29 '10 at 9:03
    
+1 for alternative browsers to IE. It's my opinion that those reports that say IE is more secure is complete rubbish. There are so many more angles to analyse the data but news outlets don't seem to be interested in reporting them. Firefox with NoScript is a good baseline, and Chrome is smoothly updated behind the scenes which is good for lay users. JavaScript is a big attack vector. Stay safe! –  Qwerty Jul 30 '10 at 1:01

What is the point of UAC if not to prevent this kind of thing?

Despite the risk of the Dreaded Down Vote, I decided to use the "Answer" format to post what is basically just some questions better suited for a comment.

As has already been observed in a comment by Qwerty, the UAC isn't much use if it is either (1) disabled or (2) the warning is ignored and a rogue program is given the authority to do whatever. My understanding was that if you had UAC enabled (... did you check it's current setting?) then you could not have been infected unless someone authorized the rogue program.

You mentioned that "home PCs need to be used by wife, kids, friends, babysitters etc.". Could one of them have let whatever this is through the UAC? (Frankly, the thought of "kids" or "babysitters" using a system other than via a limited user level account without any administrative/install authority makes me shudder. BWTHDIK?)

I think another possible way it could happen is if somehow a program was given Windows XP compatibility and that program then turned around and bit you either directly or because it was somehow subverted. Windows XP compatibility seems to give some form of elevated authority to a program. Could that be possible in your case?

Another part of the reason to post this is because if I'm wrong about UAC needing to be consciously by-passed in order for something to infect a Windows 7 system, I'd like to know more about that threat. At the moment I can't see how it would be possible though.

share|improve this answer

Without knowing the specifics, it's hard to say. You could try using a third party anti-virus/anti-spyware program.

Try AVG or my personal favorite, Avira.

share|improve this answer

Antivirus and Firewall can only do this much ... from my experience - visiting the "wrong" sites will get you infected (just like with everything else).

Personally, I haven't had a virus in ages just by not clicking on "you just won a MILLION $$$" banners and not downloading god-knows-what from torrents :D Of course I'm oversimplifying things ... speaking of babysitters and wives ... they are probably the ones to blame ... just saying ...

share|improve this answer
    
Until a few days ago I was pretty much the same. I've had maybe two infestations in 15 years of Windows (95, 98, 2k Pro, XP Pro, Vista HP, W7 Pro) and the last of those was probably about 7 years ago. –  Lunatik Jul 29 '10 at 9:05

One thing to remember is that anti-virus software is largely reactive. There is some heuristic-based checking going on, but mostly whenever a new bit of malware appears in the wild there is always a (hopefully short) span of time between it's initial appearance and when it is detected, analyzed, countered, and new definitions delivered and updated on your system.

share|improve this answer
    
I think that may just be it judging by the way things almost healed themselves when I managed to get AV updated and running again. Ho hum. –  Lunatik Sep 2 '10 at 5:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.