Find and remove hidden tools
YOU’LL NEED THIS
GLASSWIRE 3.2
(free), 20 minutes
EVER WONDERED HOW many programs on your computer are using your internet connection? Network-monitoring tool GlassWire shines a light on exactly what each online program is up to, helping you identify any dodgy tools that shouldn’t be accessing the internet. Even better, the latest free version (3.2) includes a selection of powerful tools that were previously available only in the paid-for version. We’ll explain how to use them here. –NIK RAWLINSON
1 GET GLASSWIRE
To install the latest version of GlassWire, go to www. glasswire.com/download, click the green Download button, then run the EXE file that downloads. Follow the installation process, then run GlassWire. The ‘Graph’ tab [ Image A] will be displayed by default and shows all internet activity on your computer (orange sections represent data being downloaded, and purple shows uploads). The graph updates in real time and displays up to 24 hours of data (select the time period using the dropdown box, top right). To find out which programs were accessing the internet during a specific time period, click and drag across the relevant area on the graph. The program that was using your connection most in this period will now be displayed—hover over this to see a list of other programs.
2 RUN GLASSWIRE
When you first run GlassWire, you’ll see plenty of notifications about programs accessing the internet for the first time. Don’t be alarmed, these messages appear because you’ve only just installed GlassWire—this should settle down once you’ve had it running for a few hours. If you prefer, you can hide these notifications—click the GlassWire button [ Image B], then Settings followed by Security in the left-hand panel. Select ‘First network activity’, then untick the ‘Notify me…’ box. However, we recommend leaving them active, as they’ll alert you to programs that you might not realise you had installed or ones you may not want accessing the internet.
3 CHECK ACTIVITY
If you do spot a program that you don’t like the look of, or you just want to find out how many programs on your computer are accessing the internet, select the Security tab [ Image C] (one of the previously paid-for features that is now available for free). You’ll now see all programs that have recently used your internet connection. The ‘GW Score’ column gives an indication of how popular each program is with GlassWire users. A low score means that relatively few GlassWire users have the program installed (hover over the score and click the ‘i’ icon for more details). Don’t assume that any program with a low score is malware (it might just be relatively new or niche), but do investigate further.
4 DETECT ANOMALIES
GlassWire 3.2 includes another new free tool: Anomaly Detection. This monitors all programs that use your internet connection and flags any that suddenly see a spike in internet activity—an indication that the program might be under the control of malware. There are two columns [ Image D]: Traffic In (which shows how much a program is downloading data to your computer); and Traffic Out (how much it’s uploading). If a warning triangle appears next to either of them, it means that GlassWire has detected suspiciously high network activity. In our example, GlassWire has flagged Chrome as using our internet connection to download more data than what might reasonably be expected—on this occasion, it’s simply due to us downloading a large
file, so is nothing to worry about.
5 SQUASH VIRUSES
Another way to verify a program’s authenticity is to check it with VirusTotal (Google’s online service that lets you scan programs using multiple antivirus engines). First, enable VirusTotal scanning by going to the Settings window (as in Step 2), select VirusTotal on the left, then tick the ‘Enable manual file…’ box. Click OK and click the program you want to scan. A pop-up window will appear, displaying additional information about the program. Click the VirusTotal button [ Image E]. After a few seconds, you’ll see the VirusTotal score (here, ‘0/68’ indicates that none of the 68 antivirus engines used by VirusTotal consider this program to be malware). If you find one that’s flagged as potentially dangerous, click the ‘i’ icon to get more details from the VirusTotal website.
6 TERMINATE ACCESS
If you’ve followed the previous three steps and still don’t trust a particular program, you can terminate its connection to the internet by clicking the slider to the left of its name. The first time you do this, you’ll be prompted to turn on GlassWire’s firewall (another tool that’s now free). Once you’ve clicked the slider (turning it from green to orange [ Image F]), the program will no longer be able to access the internet. If you later decide the program isn’t a threat, reinstate its access by clicking the slider, turning it back to green.
7 CONTROL ALERTS
Depending on how many programs you have installed, you may receive a lot of alerts and messages. Click the Alerts tab [ Image G] to review messages generated by GlassWire over the past 24 hours (you’ll need the paid-for version to view older messages)—unread messages are marked with a red dot. GlassWire also lets you find out how many devices are connected to your home network. Select the Things tab, then click Scan. You’ll see a list of devices. The ‘Details’ tab lists additional information for each, such as the device type and manufacturer (if known).