scrubbing downloaded utilities

[momonan]

 In another post, CarolHaynes gave a list of tasks she performs to "scrub" a downloaded utility before installing it.  This is what she said:

Read user reviews - if there aren't any I am already suspicious
Do a google search on the app name + Review
Do a google search on app name + Spyware/AdWare/Malware etc.
Download the software and virus scan
Unpack the archive/installer and virus scan again
Use SpySweeper to check the unpacked folder contents
Set a system restore point
Install app but don't run it
Run virus & spyware check on installation folder, memory and registry

Only if it is still clean do I run the app.

If it unexpectedly asks to connect to the internet I check to see if there as automatic update and switch it off. If it still wants to connect to the internet for no good reason than I block it. Anything odd starts to happen it is uninstalled and the system restore point applied.  Am I paranoid? Probably - but it takes a hell of a lot of hours to sort out a screwed up system ....

Since I recently had huge trouble that I suspect was caused by something I downloaded, I would love to hear more detail about what you do, CarolHaynes, in more detail, and it would be great to hear techniques others use, as well.  Do any of you have anything that absolutely positively workd every time?  If so, could you explain it in a way the rest of us could duplicate?

[Veign]

I run all applications through Virtual PC from Microsoft.  No worries about viruses and if my system gets screwed up I just delete the Virtual PC file and restore my clean install VPC file.

Testing software on various OS's has never been easier - I run WinXP Pro on my development system and can load Win98, Win2K and Vista Beta all running at the same time.  What I have is VPC files for OS's at different points: clean installs, SP's applied, and some that are just run and never cleaned...

This has been a life saver for me and save me countless hours of testing and restoring OS's for testing software (all OS's have their own, single file that can be restored in seconds).

Download the 45-day trial and see what you think (especially if you are a developer)

[zridling]

Okay Veign, that's really cool. Thanks for the suggestion. I could have been using this all along! I primarily rely on Total Uninstall, which has been very good to delete everything installed, even tricky Adobe stuff in the registry.

[mouser]

there is no doubt that the safest way to *test* software is to install it in a virtual machine tool like vmware or virtualpc.

second safest might be to test new software on a secondary machine which you have a good drive image for and don't mind restoring to its previous state every once and a while.

those two methods really let you install stuff without worrying, since your plan is always to go back to a safe state, and anything short of that dictates that you be a little careful of what you install.

being pro-active and checking out the reputation of a program before installing it (which was much of carol's procedure) is probably the best approach.  you might also add to that the guideline of not installing something until it's been out for a while, to give other people a chance to test and report any issues.

another thing i do is i do a full drive image of my machine every month, like say on the 1st of each month.
so i save any testing of apps that i might be worried about (or major upgrades) until right after that drive image.
that way if something goes wrong, i know i can restore back easily to the recent backup.

[Veign]

The reason I like VPC better than another PC is that the entire virtual PC is contained in a single file.  I have the file backed up on my external 250Gig hard drive and when I need a restore I just have to delete and move a copy over (new system in seconds).  The other reason is that it lets me stay in one environment, this means I only need to worry about upgrading a single computer as each VPC uses the hardware of the host system.

VPC is well worth the price considering the hours it takes to restore a system..

In theory is you are writing a review you could take a clean install of Win2K or WinXP and load it up with all your applications to test.  Do your tests and then delete the file when done (all gone)..

Attached is a screenshot of my system running 3 OS's

[mouser]

it would be nice to update our review of virtual machine software to include info about latest virtualpc edition, but in case people are more interested in what veign is talking about, read our review of virtual machines from April 9th of this year, where vmware won our award for best virtual machine tool:

https://www.donation...alMachine/index.html

bottom line imho though is that it doesn't really matter whether you choose vmware or virtualpc, they both do the job well, and are fantastic tools to have.

[Veign]

That's funny - Didn't know you guys did a review of Virtual Machines. 

Taking a look now....

[Mark0]

Speaking of virtualization, another viable option is the free QEMU, by Fabrice Bellard (remember the good old LZEXE for 16bit DOS EXE compression? Yes, it's that Fabrice!)

It started as a (very fast, trough dynamic translation) emulator, but now it's also available a so-called "Accelerator", that can skip on the CPU emulation if both host & target CPU are x86.
On Linux it can be used both as a full system emulator, than as a user mode emulator, so it that it can run code for one kind CPU on another CPU (PowerPC, for example).

An impressive software.

Bye!

[Carol Haynes]

I think I pretty much covered what I usually do. I too have used virtual PCs (trail versions of VMWare and the MS product) but don't really feel I can justify the costs.

Another possibility is to have a parallel installation (i.e. a separate partition with another version of Windows installed). I have four such partitions each with Windows XP. These partitions are specific to kinds of taks:

1) General Office + messing about type stuff (used mostly)
2) Audio + Video
3) Graphics
4) Development

4 is more wishful thinking at the mo but 2/3 allow me to run software without extra baggage (even Virus/Firewall as I don't have internet connections active).

I used to use 4 as a 'testbed' partition where I could play with new software. I always kept an image file, and after testing restored it so I always had a clean installation.

Nowadays I usually try things out on my general installation and follow the procedure I described above (more or less depending on the title, author, recommendation). So far I have avoided any serious nasties, or caught them before they got into my system.

I also have TotalUninstall, though I do find there is a lot of editing to do before it can be used totally effectively - it catches too many other actions in the registry that are unrelated to the installer to be useful straight out of the box. In the past I have also tried Ashampoo Unistaller - which is OK but I found it a bit irritating.

[Mark0]

Another intresting option is to use a sandbox tool, for example the free Sandboxie.

Once an app is run trough Sandboxie, all disk & registry access go trough a transient temporary area.
That is, if you run Notepad trough Sandboxie, open a file, modify and save it, that file will results modified for that Notepad instance, but the "real" file (outside the sandbox) will remain intact.

You could also run a virus trough it, without worrying about it infecting/modifying the registry or any files, so it come handy if you need to run some EXE that you don't trust too much.

Bye!

[mouser]

thanks mark0, i've never heard of sandboxie, it looks very interesting.

[mouser]

carol, i think what momonan was asking, which i think would be kind of useful if you have the energy, is a more detailed description of the steps you listed, in terms that a newbie could follow.

[Carol Haynes]

OK Here goes ...

Let's say someone say 'You should use TWADDLE its a great utility to ...'

If I know and trust the person I may skip some of these steps but if I don't know them and have never heard of twaddle ...

1)

Read user reviews - if there aren't any I am already suspicious

Go to the download site for TWADDLE and see if any reviews are given by users (not the developer's blurb)

See if it is downloadable anywhere else (Google "TWADDLE download") and see if reviews are posted elsewhere

Do a google search on the app name + Review

Look for specific reviews Google "TWADDLE review", you could also try looking for the type of software to see if there are other more favoured alternatives.

I find it is often useful to do this initial trawl as it not only gives a general impression of user response to the software but helps you to identify the current version. There are often multiplte versions out there and not all download sites are efficient at ensuring you get the latest version.

2)

Do a google search on app name + Spyware/AdWare/Malware etc.

See if there are any known issue with the software Google "TWADLLE spyware" for example will turn up references on sites relating to anti-spyware products. If you don't turn up specific problems then you are unlikely to encounter spyware problems (but it isn't guarnateed).

3)

Download the software and virus scan

Download to your hard disc and run your virus scanner to check it. I use NOD32 anti virus, so I just right click on the download and hit the appropriate link to virus check it. You can also use download managers (such as GetRight) that can be linked to your antivirus program so that all downloaded files are scanned automatically.

4)

Unpack the archive/installer and virus scan again

Most downloads come insome sort of compressed format (such as Zip files). Many of these can simply be unpacked to a folder on your hard disc. If so do this and virus scan the folder agin (sometimes files in archives can be missed by virus scanners before they are unpacked)

5)

Use SpySweeper to check the unpacked folder contents

I use SpySweeper to detect spyware etc. so I run a quick scan on just that folder to see if there are any recongnised files (such as DLL files) which may cause a problem. If something turns up I investigate what the problem file is (usually using Google). Often they are simply common library files which are of no threat in themselves but over zealous anti spyware programmes flag them up as problems (I found CounterSpy was esp. bad at this sort of false positive).

6)

Set a system restore point

You can do this in Windows XP (and Windows ME if you are still daft enough to use this). This simply takes a snapshot of important system files and registry settings so that if something goes wrong you can restore the system to its previous setting. To do this (on WinXP) go to Start>Accessories?System Tools>System Restore.

7)

Install app but don't run it

Run virus & spyware check on installation folder, memory and registry

If you are still happy run the installer application but don't run the programme when installation has finished. Some files may have been packed in password protected archives within the installer package and therefore couldn't be checked by you AV software. Run you antivirus software and antispyware on at least the installation folder (usually c:>program files>TWADDLE or similar) and also on C:\Windows.

Only if it is still clean do I run the app.

If it unexpectedly asks to connect to the internet I check to see if there as automatic update and switch it off. If it still wants to connect to the internet for no good reason than I block it . Anything odd starts to happen it is uninstalled and the system restore point applied.  Am I paranoid? Probably - but it takes a hell of a lot of hours to sort out a screwed up system ....

Don't forget some software will NEED to connect to the internet - but whether TWADDLE needs to is a matter of judgement, and to a certain extent trust at this point.


Now go and have a strong drink and take a couple of the little pink pills ...

[momonan]

Thank you everyone -- and especially you, CarolHaynes.  Thank you so much for taking the time to expand on this topic.