NWA-PCUG Newsletter Article, October 2003
What We Should Have Learned By Now
by Ira Wilsker
ira-wilsker@apcug.org
(click to email author)


Hopefully by the time you read this column the attack of the SOBIG-F worm should be history, as it was scheduled to self destruct on September 10. That does not mean that all attacks will cease, as there are still many users who have incorrect dates on their computers. That means if your date is “slow” then any Sobig-F worms that may be residing on your computer will not know to self-destruct, and will continue to send infected emails to others without your knowledge.

I routinely received readers’ messages which have headers placed by their email program giving the wrong year. Unless the computer is under the control of an administrator who does not allow changes, the time and date can easily be reset by simply clicking on the clock and resetting the date and time. If for some reason the clock is frequently incorrect that may be an indication of a more serious error, and possibly a pending problem. For those who would like to keep their computer clocks correct there are several programs available that will automatically reset the clock to some standard, such as the Naval Observatory, NASA, or the National Bureau of Standards. My personal favorite is “About Time” available for free download at http://www.vps.arachnoid.com/abouttime. I use About Time to reset my computer clock to U.S. Naval Observatory time on an almost daily basis.

Sobig-F, and its predecessors, flooded our inboxes with undesirable emails that eventually became easy to detect and identify. I would estimate that on all of my email accounts I received over 10,000 Sobig-F emails. Since each was about 100k in size, I received about a gigabyte of trash email due to Sobig-F alone. If I had to download those messages before deleting them, that would be an enormous amount to download. At broadband speeds, the time needed to download all of those bogus emails would be considerable; at dialup speeds the volume and frequency of Sobig-F emails may mean that downloading all of the email could be interminable. Since I still get along at home with dialup internet access, I needed a method to screen my email before downloading it to my computer. This allowed me to delete or otherwise process spam, and delete possible virus-bearing and other unwanted email. My local ISP accounts provide for some type of web based method to view email without physically downloading it to my computer. By viewing suspicious emails using web mail without physically downloading them, a degree of protection from dangerous content is provided. I choose to view online email in text only, and not in HTML. Almost all web mail systems offer this option, and I strongly advise that users choose to view emails in text format only, and configure their web mail to that setting.

In local discussions, I have found that many internet users are unaware of the availability of web based email from their ISPs. I suggest that such users either check their ISP website support link, or contact their ISP to inquire about web based email. One warning; many web mail systems place deleted messages in some form of online trash folder. Please remember to purge that folder frequently. Once unwanted email has been deleted using the web based email viewer, there is less email to download, and a decreased chance of catching an email borne virus or worm.

There is an excellent utility available that can provide assistance in identifying email that possibly contains spam or viruses, and I use it on all of my computers. It is MailWasher, published by Firetrust, of New Zealand. Available in a free version, or a more powerful “Pro” version ($29.95), MailWasher allows for the easy screening of emails. MailWasher is very fast, even on a dialup connection, because it only downloads the message headers, and a selected number of lines in the body of each email, rather than the entire email. Utilizing some of the internet “blacklists”, services that compile information on spammers, many suspicious emails are labeled by MailWasher as possible spam. Using the integral “bounce” feature, spam can be bounced back to the sender giving the appearance of a defective email address. While I can give no proof that spammers delete bad email addresses, and there is always a risk of a forged email address, it is fun to bounce those critters. Many of the Sobig-F infected emails were labeled as “possible virus” making them easy to identify and delete. Since Sobig-F infected emails were about 100k in size, I sorted the list of emails by size, and the Sobig-F emails all clustered together, enabling fast deletion of them all from the mail server. Emails can also be sorted by any column, such as date sent, size, from, subject, status, and other factors. MailWasher can be set to automatically check for new email at any desired interval. MailWasher is available for download at http://www.mailwasher.net.

A companion product, “Benign”, works with MailWasher, and is available from Firetrust at http://www.firetrust.com ($34.95). Benign adds additional email screening and filtering functions for viruses (in addition to your antivirus software), malicious code, and other possibly harmful content from email before reaching your computer.

Ira Wilsker is the Advisor for Region 8, APCUG Representative & Bylaws Chair for the Golden Triangle PC Club, a columnist for The Examiner in Beaumont, Texas, and has two radio shows. He also graciously shares his articles with the APCUG editors.

There is no restriction against any non-profit group using this review as long as it is kept in context with proper credit given the author. This review is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member.



==================================================================