By Tan Chong Yaw

MIND your behaviour online - you could be laying a welcome mat for malware to waltz into your computer. One click based on a wrong assumption and such software could destroy or disrupt your system, causing much pain.

Here are some assumptions and scenarios you should avoid.

I am safe in Facebook as I do not surf much Hackers head where crowds flock. Crowds are flocking to social networking sites such as Facebook and MySpace.

Security technology firm McAfee expects such sites to "eventually" overtake the e-mail as the channels for the spread of most malware.

Security specialist Trend Micro has spotted bogus Facebook updates and phishing - online tricks to make you reveal personal data such as passwords and credit card numbers.

In the first ploy - status updates - the latest ploy of which was reported last month, bogus testimonials on how so and so lost weight through colon cleansing were posted. Hackers were able to enter an area reserved for your friends on Facebook.

Here, a URL was posted leading to colonrevi.com, mainly to push a diet product. The site no longer exists.

In another case in August, users of a Facebook application called Stream were brought to a phishing site and asked to log in with their password.

Once that was done, the contacts in that account were harvested and spammed.

Facebook has since removed the app.

So, be vigilant: Be wary when being asked for your password even if the site looks like a Facebook one - check the URL to see if you are still in Facebook.

For details, go to: countermeasures.trendmicro.eu/ get-intimate-with-facebook and facebook.com/security.

I download PDF files with confidence

To make PDF files more useful, some can come as forms to be filled in while some contain multimedia like Flash movies.

Great stuff, except that these forms also open the backdoor for hackers to get into the PDF files.

Security firm Fortinet issued at least two warnings this year on the gaps in PDF files.

Do not download PDF files willy nilly. Use the latest software version - like the free Adobe Reader 9.2 released last month.

Also, make sure that your anti-virus software is updated at all times.

I download software for "extra" virus protection

Beware messages like "If this ad is flashing, your computer is at risk".

Such alerts merely masquerade as a "cure" and trick you into buying or downloading software to supposedly remove the threat.

The bogus sites they lead to are well-designed and the credit card payment goes through without a glitch.

You are even issued a receipt with a serial number via e-mail.

But you guessed it: pay and your money is gone.

Worse, the bogus software weakens your PC's security.

Virus alerts that pop up in browser windows are not likely to be legitimate security software. Ignore them.

An e-mail from a trusted friend or company cannot be spam

It may bear your friend's e-mail address but his PC may have been infected and used to send spam to the contacts in his address book.

Or the e-mail may look like one from your bank - down to the logo and colour scheme.

Be suspicious. Check with your bank over the phone. Refrain from even opening an e-mail from a familiar name if the subject sounds weird like: "Jonathan sent you a private message; please respond."

Call your pal or send him an e-mail to ask if he had indeed sent you the message, but do not forward the suspect mail.

I want to see photos of Michael Jackson's body

Spam e-mail offering "hot" news or photo links is a common ploy to lure those curious and hungry for the latest sensational gossip.

Surely, the news and photo links dished out by search giants like Google and Yahoo should be legitimate, right?

Sadly, no. Search engines can be tricked - for a while - to rank bogus sites high in searches.

According to a McAfee Lab blog, most of such spams will lead to sites advertising drugs like Viagra and Cialis. Some will try to load malware onto your computer.

McAfee offers a software - download from siteadvisor.com - that rates websites based on their safety level. Sites are rated with traffic light colours - do not enter if a website is flagged with a red signal.

So stick to mainstream news sites - curiosity may just kill your PC.

cytan@sph.com.sg

This story was first published in The Straits Times Digital Life.

For more The Straits Times stories, click here.