Giveaway of the Day Forums

1. 

   Whiterabbit-uk
   Games Guru

   Hi folks,

   HELP needed..........

   I don't usually download games from the free game sites any more, partly because I have a massive library of games (approaching 5K on my Steam account as well as thousands more from other game sites like Desura, Gamersgate etc. I have so many unplayed games, downloading games from the free game sites like MyPlayCity, Gametop, FreeGamePick etc seems pointless unless I need to write up a review for a game giveaway that's sometimes available from one of these sites. I usually get access to the giveaways before they go live, so that option is usually not needed, however sometimes a new site is recommended by the community. Before I allow the address to be seen by the community I will download and install a game to see how safe it is. If I come across any suspicious activity during the installation process I usually stop immediately and then won't recommend the site.

   A community member recommended a new free games site on Sunday; one I'd not seen before. Because Jenkat games had been removed due to changing practices I decided to go ahead and download a game from this site to test it to make sure there were no hidden extra's included; unfortunately there was and I became infected with malware.

   Stupidly I no longer have a sand box program installed despite knowing the sense in using one under these conditions, so...... I went ahead and tested the game without a VM. I unchecked the check-boxes to avoid the usual tool bars, home page hijacks etc but still ended up with some nasty adware etc; (despite promises from the site that they never install anything without the users permission); ..... yeah I know...... but the site did seem a decent one, with none of the usual adverts found on sites that tend to be risky; so, I made a regretted decision to just go ahead and try it because I was already hours behind moderating comments from Sundays game and wanted to get on as I'd promised my daughter I'd play some Elder Scrolls Online with her.

   I spent all evening searching through my hard drives (I have several HDD's and SSD's installed to my main computer) for hidden folders and combed the registry for specific key words (Dregol being one of them) deleting many of these and other associated entries, but couldn't shift the infections as some were hiddent in folders named with nonsense names like bhrefjkwrgbhldslwevlqelev; (I only discovered these after running the demo of Spyware Hunter).

   I must admit to having become rather complacent of late, my browsing habits are usually confined to sites I know, but the drugs I take do make me rather sleepy and forgetful and consequently I sometimes do things without thinking of the consequences. Installing a game from the site that was recommended was one of these oversights.

   I've had lots of sand box programs over the last several years, (most of which I can't remember the names of) but all have been acquired via the giveaway site. I usually format my main hard drive at least once or twice a year, so lose most of the giveaways. We've not had a sandbox program in quite a while and the one I purchased several years ago is backed up on disk, but I can't find it (I've got several hundred disks with backed up programs, games etc). So need to buy a new one, but don't know which to buy.

   I also can't decide which Anti Malware program to purchase. For the past several years I've used free versions, but I'm no longer satisfied with them due to the infection I've just acquired. After searching the net using the key word Dregol, Spyware Hunder 4 was the only name that cropped up with respect to removal of this particular infection so I downloaded a demo which picked up so many other infections I wondered whether I should buy it or one of the more popular anti malware suites. McAfee is the one that seems to be the most popular, but I've not been able to find a demo of the program to compare it to Spyware Hunter.

   Can anyone recommend either of these or other anti malware programs that they have been using for the past several months or longer, as well as a commercial sandbox program. I'm not looking for free versions, but paid for commercial versions.

   Thanks in advance for any advise given. :)

   regards

   Stephen

   Posted 9 years ago #
2. 

   starfire
   Member

   Hi Stephen I use comodo which has a sandbox feature built in. I do use the free version but have been asked by them if I wish to purchase a full version. I hope this is of some use to you...........Mike.

   Posted 9 years ago #
3. 

   ChrisS
   Administrator

   Sorry to hear about the problem. First, if you haven't already, you might want to run AdwCleaner to make sure that you've rid yourself of all the nasties. BleepingComputer also has a good forum on malware/adware removal.

   I don't use sandboxes anymore. It's really a matter of how easy it is to recover from an "oops" or system failure and, for me, it's far easier to use VMs (which is technically a sandbox) and make system backups.

   I have used Sandboxie, Toolwiz Time Freeze, and Bufferzone which can all be found at the MajorGeeks page for Virtual PC and Sandboxes. All seemed to work fine. Time Freeze and Bufferzone are freeware but Sandboxie becomes "nagware" in 30 days. However, if you're willing to spend money then Shadow Defender is probably the way to go (and maybe buy Sandboxie). You'll find a 30-day trial of Shadow Defender at the link (FYI - Shadow Defender has been offered on GOTD at least once).

   At the same link you find VirtualBox and VM Player, both of which provide excellent test beds (or permanent solutions as desired).

   I can't help with paid anti-virus, I'm currently using Avast! freeware and it probably wouldn't have stopped the malware. Of course, what you and I call "malware" is "adware" if you're paying me to whitelist it.

   Posted 9 years ago #
4. 

   mikiem2
   Moderator

   Nowadays malware can be pretty sophisticated... it doesn't have to rely on files, but can be stored in the registry -- it can infect the PC's/Laptop's UEFI bios -- it can be written to the hard drive's firmware -- you don't have to install or run or click on anything to get infected, e.g. Malvertising, where they buy ad network placement on major, otherwise safe sites, & where the malware ads can silently redirect your browser to a site where malware is downloaded & installed.

   I like this site http://www.av-test.org/en/
   Their 2014 overall awards should tell you what you need to know http://www.av-test.org/en/award/2014/

   Based on 2012 & 2013 ratings I downloaded trials of Kaspersky & BitDefender when McAfee stopped working on our AMD PC a couple years ago [not saying it's definitely related, but it was soon after McAfee was purchased by Intel]. I liked Kaspersky a little bit better, but my wife liked BitDefender, so that's what we've been running -- I can make do. I'm also running McAfee again on a couple of copies of Windows -- it was part of a rebate promotion where if I installed it & set it to auto-renew for 10 months [after which I can cancel] I got a nice SSD for $25.

   About all I can say about Kaspersky is that when I installed it fresh to win7 64 & 32 bit VMs as a test, it allowed GOTD installs without problems. BitDefender isn't bad, but it greatly delays Vista startup -- XP Pro wouldn't start at all. Most of the time it's unnoticeable, though I do have to turn off real time scanning when I run my Sony media or Paragon apps. I also haven't seen any good sales on BitDefender for quite a while, though SOS still has it for $30 I think [I paid $14 last year].

   McAfee isn't bad performance wise -- you'd have to check the ratings to see how well it protects -- but it has some PITA scans [e.g. vulnerabilities, where it checks for updates for all software installed] that need to be turned off. Anyone in the US considering McAfee might want to check their promotions over at Tigerdirect.com.

   --------

   As far as testing games/software goes...

   I monitor software installs in a win7 XP Mode VM -- I've added the POS hack so I still get updates. For practical purposes monitoring installs there's no real difference compared to later versions of Windows & it's much easier/simpler in XP. The basic, modified XP Mode ISO is available free for everyone at microsoft.com -- it's the Microsoft Virtual PC host & license that's limited to certain versions of win7, & apparently lots of folks run it who don't have one of those versions of win7. I have win7 32 & 64 bit VMs, along with win8.1 & 10, but they don't work as well monitoring, & no VM is great for games because of emulated hardware.

   As far as virtualization software goes, I still run an old GOTD, TimeFreeze from Wondershare. When turned on it writes to a VHD rather than the hard drive, & everything's restored after a re-boot. There's a different free app of the same name that seems to be well spoken of. That said, Karl, who always posts of the GOTD download page, once mentioned a similar app he used, & explained why he thought it was better. Personally I've felt that more involved apps like Sandboxie are too much work & bother, and I like to keep things as simple as possible, in part because the more complicated things get, the more complicated troubleshooting will be. Something always breaks sooner or later.

   That said, these are not ideal setups for detecting or testing for malware. For one thing malware can check to see if it's running in a VM, & shut down without doing anything. Software that's clean in a VM may go on to infect your main system when you install/run it there. Malware may also spread to non-virtualized environs. These might provide a decent enough intro...
   https://zeltser.com/build-malware-analysis-toolkit/
   https://blog.malwarebytes.org/intelligence/2014/02/a-look-at-malware-with-virtual-machine-detection/
   http://resources.infosecinstitute.com/environment-for-malware-analysis/

   Posted 9 years ago #
5. 

   mikiem2
   Moderator

   I decided to go ahead and download a game from this site to test it to make sure there were no hidden extra's included; unfortunately there was and I became infected with malware.

   I'm NOT saying don't run whatever scanners to get rid of whatever. You might learn what you need to know using Google -- I'm sure someone somewhere has posted details on what happens with downloads from the site, & I'm sure someone has posted identical symptoms that would tell you what's bitten you.

   Rather I wanted to post what I've done in the past in case it's useful at all... I've got an old app called InstallWatch Pro in a couple of 32 bit VMs, as well as installed to a minimal copy of Windows on my HDD. InstallWatch Pro or Regshot will let you monitor changes to files &/or the registry. Before & after snapshots to see what files were changed or added takes time, which is why I do this on minimal Windows installs with few apps making for fewer files to catalog.

   In a case like this I'd install/run the same app/game, monitoring everything it did, then undoing everything recorded. If you get a list of added registry entries, go into the regular or main copy of Windows & delete those entries, & so on. I've also used Process Monitor [from Sysinternals at microsoft.com] to create logs of what a program or installation does. This is Much more granular [you get tons of data], & lets you pinpoint just when & where something happened, e.g. where a program start failed.

   Real world I've found where an app install failed because it didn't/couldn't create some necessary registry entries, & I found that when an app stalled on starting the problem occurred when it read an incompatible .dll file.

   Posted 9 years ago #
6. 

   Whiterabbit-uk
   Games Guru

   Thanksfor your advice guys, much appreciated.

   Posted 9 years ago #

RSS feed for this topic

Reply

You must log in to post.