Is Your Security Software Even Working? Here’s How to Check

Unless you built it yourself, your PC almost certainly came with a trial installation of an antivirus or security suite product. Did you renew when it expired, or maybe install some other protection? Let’s hope so. Once you get past that trial period, you theoretically don’t need to think about your security software unless it pops up to tell you it zapped some malware. However, for best results you should shine a light on it from time to time to make sure everything’s humming along the way it ought to be.

Here are a dozen simple steps you can take to make sure you get the most out of your security systems.

1. Keep Your Antivirus Up to Date

In the early days of computer viruses, antivirus programs simply scanned files for signature patterns of known threats. These days, most malware coders make their code polymorphic, not detectable by simple pattern-matching. And modern antivirus utilities use behavior-based detection systems, so they can stop malware they’ve never seen before. That said, simple malware signatures and behavioral detection patterns both need frequent updates, to keep up with evolving malware. Is your antivirus up to date? Open it up and have a look. Do you see a message about needing to update the databases? Even if you don’t, poke around to find and trigger the command that runs an on-demand check for updates. It couldn’t hurt!

Also check whether an update is available for the program itself. In fact, check all your security products for available updates. Typically, you’ll find an option to check for updates in the File or Help menu, or in the menu that appears when you right-click the product’s icon in the notification area. It’s possible that in doing this you’ll discover that the subscription expired—renew right away!

When you do renew, consider signing up for automatic renewals. You’ll get a notification email before the renewal happens, so you can still change your mind. Auto-renewal gets you a virus protection promise from some companies, among them Norton, McAfee, and ZoneAlarm. When you’re on auto-renewal, the company promises to track down and terminate any malware that gets past the basic antivirus protection.

2. Use the Best Security Software

Look at each of your security products and consider how you came to choose it. Did you see an ad on TV? Did a friend suggest it? Did it just come with the computer as a trial, and you signed up when the trial ended?

To make sure you’ve got the best, visit PCMag and read our review of the product. In addition to antivirus, we have reviews of security suites, password managers, parental control software, VPNs, and much more. If we found flaws in the product’s protection, or just didn’t give it a top rating, check out our Editors’ Choice products for the category. You may want to level up to something better.

3. Sanity-Check Your Antivirus

If you want to check whether your image-recognition app can tell apples from oranges, you can just put an apple (or an orange) in front of it and see if it gets the right result. Things aren’t as easy if you want to know whether your antivirus can tell good software from malware. Most of us don’t (and shouldn’t) keep malware on hand for that kind of sanity check.

That’s where the EICAR test file comes in. EICAR, formed in 1991, used to stand for European Institute for Computer Antivirus Research, but after a while the group dropped the acronym in favor of just plain EICAR. The test file is a minuscule program that antivirus vendors worldwide have agreed to detect, even though it’s not malicious. Just visit the EICAR website and try to download the file. Your antivirus should prevent the download and will probably identify the “threat” as the EICAR Test File.

4. Get Help From the Experts

The Anti-Malware Testing Standards Organization (AMTSO) is an international group whose aim is to improve cybersecurity testing. At a high level, that means creating standards and encouraging discussions between companies that create antivirus tools and companies that test those tools. However, the AMTSO also maintains a bank of feature tests that anybody can use to make sure their own protection is working. Full disclosure—I am a member of this group’s Advisory Board.

From the Security Features Check page, you can launch several different tests. Some of them exercise the way different components detect the EICAR file, for example, by manual download, by drive-by download, or in compressed form. And AMTSO has created a standard (harmless) file to stand in for those less virulent but annoying Potentially Unwanted Applications. You can check whether your antivirus scans inside compressed files of ten different kinds.

Remember, all files involved in these tests are harmless. It’s just that many security companies have agreed to react as if they are harmful, creating a safe way to run tests like these. When your antivirus passes one of these tests, that shows it’s working. If it doesn’t pass, well, it’s possible the publisher didn’t choose to participate.

5. Verify Your VPN

Every time you visit a website, your browser sends your IP address with a request for information. That’s a necessity because the site needs an address to send back the requested data. Your IP address locates you physically, as well, though with no great accuracy. You can check this right now by visiting whatismyipaddress.com, whatismyip.com, or any of the dozens of such sites. Do that now, with no VPN active. You’ll probably find that it gets the right city, but not much more detail.

When you run your communications through a Virtual Private Network, or VPN, the website never sees your IP address. Rather, it sees the IP address of the VPN server. So, connect your VPN to a server far away and run that geolocation test again. Does it show that you’re in, say, Paris now? Then it’s working!

Every time your browser tries to visit a domain like pcmag.com, it has to send a DNS (Domain Name System) request to translate that into an IP address that machines and apps can use. If your VPN isn’t configured properly, it can leave this DNS request data exposed, meaning a spy or hacker could at least see what sites you’re visiting. At dnsleaktest.com you can run a simple or advanced test to confirm that your VPN isn’t leaking DNS data.

6. Review Your Router Security

Every wireless router comes configured with a default username and password, credentials that are necessary any time you want to change important settings. Older routers in particular may come with simple-minded values like “admin” for both username and password, and you can be sure that all those defaults are known to hackers.

You may also find that the default username and password appear on a sticker on the bottom or side of your router. That’s safer than using dumb default credentials, but anybody who enters your den or office could snap a pic of those credentials. You might even be giving away those credentials in your video meetings, if your router is visible in the background.

If you don’t know whether your router is using default credentials, check with your internet provider’s tech support. Once you can log in, change the router password, and record it in your password manager. While you’re logged in to the router, check what kind of encryption your Wi-Fi connection is using. WEP and WPA are old, insecure encryption methods; not good! You want WPA2 with AES. Chances are good you can simply choose the new encryption method from a drop-down list. One warning; some older devices such as Nintendo DS and Sony PSP aren’t compatible with WPA2.

7. Check Your Mobile Devices

Apple has made iOS pretty airtight, but Android devices aren’t as secure. There are millions of malicious programs specifically aimed at wreaking havoc on Android devices. If you don’t have a security program on your Android, you’re taking a risk.

The typical Android security tool offers both malware protection and antitheft features. That’s important, because you’re just as likely to lose your Android or have it stolen than to encounter serious malware in the wild.

It’s possible you already have Android protection available as part of your desktop security suite. Many modern suites cover multiple platforms. Check out our roundup of the suites that offer the best Android protection.

8. Scan the Internet of Things

Your computers and mobile devices aren’t the only things communicating over your home network. Chances are good you have many other devices on that network, things like game consoles, video doorbells, baby monitors, and whatnot. The problem is, you can’t install security software on most of these devices, so you can’t be sure they’re secure.

Or can you? There’s a growing category of free home security scanners, both standalone apps and suite components, that do two useful things. First, they let you know exactly what devices are on your network. You may be surprised at the length of the list. Second, they check for security problems with those devices.

Bitdefender Home Scanner goes one step beyond simply reporting on unsecured ports and other possible vulnerabilities. It pops up a notification when a new device joins the network and offers to scan it. It’s also a heads-up for you that someone, or something, just joined the network. If that’s unexpected, some sleuthing is in order.pa

9. Analyze Your Passwords

You’re using a password manager, right? That’s good! But just what is it managing? Getting all your passwords into the system is only the first step. Step two is replacing any weak or duplicate passwords with strong ones.

Most password managers include a report on password strength. The best ones give you a list that you can sort by strength. If your report shows numerous weak and duplicate passwords, start fixing them. Do the worst five, or however many you have time for. Fix some more tomorrow. Keep at it until the password manager gives you a gold star.

Of course, all this effort is wasted unless you’ve protected those passwords behind a strong master password. Passwords saved by the password manager can be totally random, like GYDH31A^u6h1!udK, but the master is one you’ll have to remember yourself. Check out our advice on creating a super-strong master password that nobody else would guess.

10. See If You’ve Been Pwned

Data breaches happen every week, and personal information leaks into the Dark Web all the time. Yours may be exposed, but how would you know?

Fortunately, the handy website Have I Been Pwned can help. Just enter your email to find out whether that information turned up in a known breach, or in a data dump on a site like Pastebin. If you get the “Oh no—pwned!” message, change the affected passwords immediately. Many password managers notice the password change process and automatically update their data.

Your email address is no big secret, unless you use a special system to mask it behind disposable email addresses. Sending an email address to Have I Been Pwned is no great security risk. The site also maintains a list of over half a billion passwords that have been breached, so you can check whether your passwords have been exposed. Despite the site owner’s detailed explanation of how this is done without risking your privacy, I’m reluctant. If you really want to check for Pwned Passwords, your safest bet is to download the database and do a local search.

11. Review Your Social Media Security

It goes without saying that your social media accounts (except for Twitter) should be set to private, so only your friends can see your posts. But have you checked to make sure yours are configured for best security? Log in, navigate to settings, and review anything related to security or privacy. On Facebook, for example, you want only Friends seeing your posts, and only Friends of Friends allowed to send new friend requests. And you don’t want search engines linking to your profile.

Facebook also lets you review all the devices that are logged in to your account. Review the list, and if any of them look fishy, log out remotely.

You may not realize it, but even if your own settings are tight, friends and apps can leak your data. On Facebook, you can close that leak by disabling the sharing API. Doing so does mean you can’t play Farmville or other thrilling Facebook games, but the sacrifice is worth it. You can also download and view data saved by Facebook and Google.

12. Check Your Credit

How would you feel if you opened your credit card bill and found a charge for a fancy exercise system that you didn’t order, sent to any unfamiliar location? Yeah, that would be bad. But you can get ahead of the game by proactively checking your credit.

We like Credit Karma, a free website and mobile app that keeps an eye on your credit scores. Yes, you can get your credit reports from each of the three big agencies once a year at no charge, but Credit Karma works directly with TransUnion and Equifax to check your scores as often as once per week. It also automates getting the full yearly reports on a regular basis. If you see a new account you didn’t open, or a precipitous change in your score, you can straighten things out before the thief starts getting buff on your dime.