(drive) or 
(directory) then those drives or directories are being "shared" or made available to other computers via the networking system. To unshare them:
On March 15th 2004, after receiving a number of reports from WICEN members of virus messages that apparently came from other WICEN members, I sent a message to the WICEN email list outlining how the more recent viruses operated. In this article I'll expand on the virus scanner & mailer information I included in that message, summarise the responses I got to the quick anti virus survey I conducted, and pass on some tips for recognising virus messages. After a quick look at firewalls I'll explain the measures WICEN has taken to protect members from spam, and finally discuss spyware and operating system configuration before concluding.
Here's the message I sent on March 15th:
|
From: "Mark A. Dods" <madods1@optusnet.com.au> To: WICEN email list <sc@vic.wicen.org.au> Date: Mon, 15 Mar 2004 09:24:31 +1100 Subject: WICEN SC: Recent Virus Messages WICEN Members, As I'm sure you know, for some time virus writers have used the address books on infected systems as a source of email addresses to spread the virus to. More recent viruses also use addresses selected randomly from the address book to forge the FROM address in the message rather than using the address of the infected machine. This means that if you get a virus message the chances are that it DID NOT come from the address in the FROM field! The viruses target Microsoft Outlook address books in particular as a source of email addresses. Unfortunately, it seems that a WICEN member using Microsoft Outlook and with a number of WICEN member email addresses in their address book has been infected by such a virus. To minimise the problems caused by this, can I ask you to do the following: 1. Make sure your anti-virus software is up to date 2. Manually initiate a check of your PC by the virus checker 3. Ignore any virus messages you receive: Just delete them. (Fortunately the messages are not large, just annoying) 4. If you are using Microsoft Outlook (or Outlook Express) please consider changing to some other email package. Eudora & Pegasus Mail are both capable email packages, and both are free. If you would like clarification of anything above, please contact me. What I really want to avoid is an unproductive round of finger pointing and blame allocation. Regards,
--- |
Although some members reported selecting their anti-virus software on user interface or reputation, unsurprisingly, the overwhemling majority seemed to base their choice on price. Many used commercial packages supplied by their employers on their home machines which were therefore effectively free. Others used free or evaluation versions of commercial software, and some used free online virus scanners. Of those who purchased commercial software, price again influenced the selection.
I should say at this point that I use Vet from Computer Associates, and have done since the original author (Roger Riordan) wrote the first version to clean up his PCs at Chisholm Institute infected with the first DOS viruses. I've stuck with it as it was a local product with responsive support and of world class quality. Its now owned by the Computer Associates company.
Top of page
For those interested in the raw figures, here is the number of survey respondents using each anti-virus package:
| Package | Users | Licensing | Website | Notes
| Norton Antivirus | 16 | Commercial & Trial
| http://www.symantec.com.au
| Norton Internet Security includes this, Norton Personal Firewall & other security packages
| Vet Anti Virus | 14 | Commercial
| http://www.vet.com.au
| See declaration of bias above!
| McAffee VirusScan | 6 | Commercial
| http://www.macaffee.com/
| Also supply a personal firewall
| AVG | 3 | Free, Trial & Commercial
| http://www.grisoft.com
| Also supply Kerio Personal Firewall
| EZ Anti Virus | 3 | Commerical & Trial
| http://www.my-etrust.com/
| Computer Associates product based on Vet virus scanner. Also supply EZ Firewall
| Sophos | 2 | Commercial & Trial
| http://www.sophos.com.au/
| Huge range of platforms: Windows, Mac, Linux, DOS, OS2, Netware, FreeBSD, SCO Unix, Solaris . . .
| Trendmicro Housecall | 1 | Free
| http://housecall.trendmicro.com/
| Online scanner. Not installed on local PC. Consumes no resources when not running. Check only, not constantly monitoring.
| F-Prot Antivirus | 1 | Free & Commerical
| http://www.f-prot.com/
| Supports Linux, BSD & DOS as well as Windows
| |
One user supplied a good tip: As each product will have strengths & weaknesses, if you run two, the second should pick up anything the first misses.
A good feature of Norton Antivirus, Vet Anti Virus & McAffee VirusScan is that they monitor the incoming POP3 stream when your messages are being downloaded. This allows them to detect viruses before they even get written to your hard disk. Other products may do this also, check their web pages.
Top of page
However, despite all your best efforts, a virus message may slip through your defenses. Here are some suggestions to avoid activating the attached virus:
Traditionally firewalls are highly secure computers set up between a network and the Internet to protect the whole network from attack. In recent times, 'Personal' firewalls running on and protecting a single PC have become popular. You'll note that many of the anti-virus suppliers in the table above also supply personal firewalls. Several survey respondents reported using such firewalls and one uses a commecrial package called Black Ice Firewall (web site at http://blackice.iss.net/). Another user recommended the free ZoneAlarm firewall available at http://www.zonelabs.com/
Microsoft have had some bad press lately due to the raft of security patches they have had to issue. However this at least indicates they are reacting to the discovery of flaws in their software. Windows XP has its own personal firewall, but it may be worth using another instead or as well.
One personal firewall I've had some experience with is Sygate Personal Firewall (SPF) which is freely available at http://soho.sygate.com/ Once installed, SPF allows no traffic in or out of your PC. Instead, each time there is an attempt to communicate, a dialogue box pops up saying which program is trying to communicate with what Internet service. You can then 'train' SPF to remember whether to allow that type of communication or not. Sounds complicated? Not really. Once you've surfed the web and sent & received email once, SPF will hardly bother you again unless you get attacked.
Those with or wanting to set up home networks to share an Internet connection might like to check out Smoothwall Express at http://www.smoothwall.org/ Smoothwall Express is a free Linux distribution that can be installed on an old PC which will then act as a firewall between the Internet and your network. Don't Panic! Smoothwall can be installed & configured without a Linux tech-head. (Using old ISA network cards requires a bit more knowledge however.) Smoothwall works particularly well if you have an 'always on' Internet connection like Optus Cable or an ADSL connection, but I've also configured it for use with a modem connection as its Internet link.
Some spam comes with instructions on how to remove yourself from the spammer's list at the bottom. Following these instructions is generally futile as it just confirms to the spammer that your's is a valid mailbox that gets read regularly.
The best way to deal with spam without having a coronary is to just delete it. However there is technological help for that available. The well known MailWasher software scores emails based on them containing certain words or phrases. It then suggests whether to delete, bounce (return to sender) or download each message. The user can override MailWasher's suggestions at this point. Email marked for downloading is then downloaded to your mailer normally. MailWasher is available at http://www.mailwasher.net/
The Windows networking configuration can also reduce the security of your system. You should only make resources on your PC available to others if there is some reason for doing so. This means don't run the personal web server unless you actually want your machine to serve web pages to others. Have a look though your hard disk directory structure with Explorer. If you see any drives or directories marked with a cupped hand like so: (drive) or (directory) then those drives or directories are being "shared" or made available to other computers via the networking system. To unshare them:
If you're going to share your internet connection, you can save some load on your PC by handing the firewall function off to a commerical firewall/router or a Smoothwall firewall or similar. As I still have a relatively slow PC, I'm running Vet on the PC itself, and Smoothwall on an old Pentium 133 which shares my Internet connection to my network stations. I have Adaware standing by to check for spyware, and I deal with the spam manually.
Although there is some excellent commerical software available to secure your PC, as you can see, there is free or evaluation software available to protect it adequately also. Please do it! If you need help, ask. Send a message to the WICEN email list sc@vic.wicen.org.au outlining your problem, and someone who runs that software is bound to see it. Securing your PC is analagous to public health measures. The more people who are protected, the harder it is for anyone to be infected, and the less rewarding it is to mount an attack. Eventually, if a large majority of PCs are protected, the effort required to mount a spam, virus, or spyware attack will not be worth the returns.
Mark A. Dods, VK3XMU madods@optusnet.com.au 16-03-2004
with contributions from Peter Wesltey VK3DXD vk3dxd@wia.org.au