Just yesterday [Feb 27 2004] I had to handle the MyDoom worm. It is a testimonial to the Norton AntiVirus software that the worm was totally contained and that the repeated cycling of the worm was enough to cause an apparent 81 instances of the software having to intercede.
That there was a period of all-consuming ferocity when dealing with the computer means that those who have not handled an infection of this sort might panic and reboot or shut down the computer.
The mode of operation was that I turned on the computer because the absent owner had indicated that there was a networking problem. I turned it on and evidently the worm was just waiting to pounce. The Norton AntiVirus panels kept coming so fast that it appeared that there were about thirty of them in succession. When I finally was able to get caught up with the onslaught, the cleanup phase started and it was found that I had to initiate the correction of 81 separate files that had been infected.
While I had not seen such ferocity before, the patient deletion and response to the automatic activation of the worm was effective. Norton AntiVirus stated that the worm could not be quarantined but that the file could, in each case, be deleted.
Once Norton AntiVirus had finished with the worm, the cleanup phase was instituted. All parts of the computer were updated including the Security Updates for Win98 in this case and also Norton AntiVirus. While the computer was set on automatic update, it seems to have been compromised in some manner as that function had slipped for two weeks. Time will tell on this one as the setup showed to be correct.
Then, to be sure, Norton AntiVirus was requested to scan the entire computer for viruses and it found four instances which were duly corrected at operator request.
Finally, as a check function, the Norton AntiVirus scanner from Symantec's site was downloaded and run. There were no remaining infections found.
The reason that I am telling you all this is to give you some insights into how to treat your computer when you are in the middle of an infection and the responses are flooding in your direction and you need to act quickly as though you were in a firefight. In this case the task bar showed about 30 infections waiting for eradication and I was hard pressed to do treatments fast enough to be able to get the number to zero while it was busy creating. The activity stopped when I deleted faster than it could create. At least that is how it appeared.
The moral of the narration is to keep your anxiety level high enough that you will keep your anti-virus programs current, run your Spy Bot, use your Mail Washer assiduously, scan the hard drive daily, and scratch your left ear simultaneously to keep your computer pristine.
If you do, your computer will not be invaded.
If you happen to be in the process of purchasing some Wi-Fi equipment, and realize that not all of the equipment is the same, then you should take the effort to specify equipment that has AFH (Adaptive Frequency Hopping) or its equivalent. If you choose equipment in the 2.4 GHz range, then you had better plan to have your equipment be somewhat agile in the frequency department as that is the same frequency of microwave ovens, cell phones, and some cordless phones. The most recent installation that was having troubles was approximately 14 inches from a 2.4 GHz frequency generator called a cordless phone. A frequency-hopping wireless device would be able to select or utilize frequencies that were other then the ones(s) used by the telephone in close proximity. The smarter action is to place the cordless on the other side of the room.
There is a new anti-spam protocol that is being talked about that just might work to some great degree - at the price of privacy and anonymity. The protocol is a means of registering in a central repository that allows you to be part of huge "club" of people who are identifiable enough such that you all can send each other email precisely because you are identifiable.
Yes, there are problems with it, but because there is a trail of servers that handled the messages, there is traceability back to the originating computer.
I think the plan has some merit and should be tried.
Over the past year the philosophy of having an extra hard drive in each computer has proven to be a great asset in protection of data and more importantly, when setting up a new computer - especially when Acronis True Image is also present.
If do some action that takes a lot of time, I take under two minutes to make a copy of all that I have on the "C" drive onto the "D" drive without even rebooting. Two minutes to protect 30+ minutes' work seems like a good tradeoff. If something goes wrong, I have only a two-minute reload.
The effectiveness of this system is dependant upon having Acronis True Image in place which, in itself, takes some time, but is a worthwhile tradeoff.
The thing that is unique about Acronis True Image is that when the program encounters a file that is open, and thus is not available for copying, the program closes the file, copies the data, and then opens the file again. Thus running in standalone mode is not necessary as the files do not have to be all closed by rebooting to a DOS equivalent.
I suggest you purchase both the Acronis True Image 7.x and an extra 7200 rpm hard drive and bring them to a Clinic if you need assistance in installation and operation.
There was a break for coffee and cookies, and a lot of networking.
Officer Jeff Keegan, Menlo Park Police Dept. Web Services whose duties include investigation of Identity Theft, High Tech & Computer crime, financial fraud related crime, DUI enforcement, and computer component theft, gave a scary but informative presentation on recent developments in Identity Theft. He gave us many valuable tips on how to prevent ID theft, how to recognize scams and attempts to steal our IDs, and lots of good advice. Officer Keegan also gives an Identity Theft training course for Investigators and Detectives, so he was able to give us good advice and answer our many questions.
Some useful URLs he recommends are:
N.B. - PC Magazine's Cover Story is about Identity Theft, a timely subject that complements the presentation, and includes a list of places to contact when your identity is stolen.
Identity Theft issues can be addressed by accessing the Attorney General's website: http://caag.state.ca.us/idtheft/index.htm. The Attorney General's office is the lead organization on ID theft. You can get information on the six key steps for entering your name into the Identity Theft Data Base, find links to other sites you should inform, get forms and file a complaint on their website. If you would like to notify an agency about identity theft schemes and other frauds you receive, you can send the original message (with complete header information) to the California Attorney General at caspam@doj.ca.gov [N.B. if you don't know how to find the full header display, Google email header full display, find the instructions for your email program; LavaNet technical support has quite a few, including the elusive Eudora Blah Blah Blah button].
I sent an email to Assemblymember Joe Simitian's office asking what to do with the spam I still receive, despite the CAN-SPAN (Controlling the Assault of Non-Solicited Pornography and Marketing) act that recently was enacted by Congress. Here's his reply:
Report it to the Federal Trade Commission. Send a copy of unwanted or deceptive messages to spam@uce.gov. The FTC uses the unsolicited emails stored in this database to pursue law enforcement actions against people who send deceptive spam email.
Let the FTC know if a "remove me" request is not honored. If you want to complain about a removal link that doesn't work or not being able to unsubcribe from a list, you can fill out the FTC's online complaint form at www.ftc.gov. Your complaint will be added to the FTC's Consumer Sentinel database and made available to hundreds of law enforcement and consumer protection agencies.
Whenever you complain about spam, it's important to include the full email header [N.B. if you don't know how to find the full header display, Google email header full display, find the instructions for your email program. LavaNet technical support has quite a few (including the elusive Eudora Blah Blah Blah button)]. The information in the header makes it possible for consumer protection agencies to follow up on your complaint. Send a copy of the spam to your ISP's abuse desk. Often the email address is abuse@yourispname.com or postmaster@yourispname.com. By doing this, you can let the ISP know about the spam problem on their system and help them to stop it in the future. Make sure to include a copy of the spam, along with the full email header. At the top of the message, state that you're complaining about being spammed.
Complain to the sender's ISP. Most ISPs want to cut off spammers who abuse their system. Again, make sure to include a copy of the message and header information and state that you're complaining about spam. The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them. To file a complaint https://rn.ftc.gov/dod/wsolcq$.startup?Z_ORG_CODE=PU01 or to get free information on consumer issues, visit www.ftc.gov or call toll-free, 1-877-FTC-HELP (1-877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, identity theft and other fraud-related complaints into Consumer Sentinel www.consumer.gov/sentinel, a secure, online database available to hundreds of civil and criminal law enforcement agencies in the U.S. and abroad.
The Direct Marketing Association also has an EMail Preference Service to help you reduce unsolicited commercial emails. To "opt-out" of receiving unsolicited commercial email, use DMA's online form at www.dmaconsumers.org/offemaillist.html . Your online request will be effective for one year. (This information was posted on the FTC website.)
The California Attorney General's Office is looking for examples of spam e-mails being sent to consumers in violation of California law, particularly from persons operating in California.
While we have valuable leads from spam posted in various newsgroups and mailing lists, we would like to obtain certain examples directly from individuals who would be prepared to verify, in a written statement under oath, information about the spam they received. Please send your examples (as attachments, with all header information) to:
caspam@doj.ca.gov
If you prefer to submit spam samples in printed form, you can download and print our complaint form for that purpose, available at: http://caag.state.ca.us/contact/unsolicited_email.pdf. If you are submitting spam on paper, please be sure to include all headers.
The Attorney General's Office is looking for samples of spam that meet all of the following conditions:
Please let me know if you have further questions.
Best Regards,
Melissa Millsaps
Office of Assemblymember Joe Simitian
160 Town & Country Village
Palo Alto, CA 94301
Phone: 650-688-6330
Fax: 650-688-6336
I was favorably impressed by the depth of research in the reply. It's information that has been gleaned from many sources. I sent a similar request to Senators Barbara Boxer and Diane Feinstein, but their replies were less than helpful - full of political speech, sympathy and commiseration, but no real help.
Available to you while they last for $5 and your pickup, is a Tripp-lite 700 VA UPS (Uninterruptable Power Supply [current product description here]) which is over 2.5 years old and has been taken out of service working. They have been replaced by current units. They have the following characteristics:
The good news is that Norton Anti Virus and (presumably) the other anti virus programs will catch the viruses, such as MyDoom and its variants, that are going around.
The bad news is that some of the computers that come into the Clinic were not updated enough, and are not current enough to detect the most recent viruses.
Intelligent Updater is a manual procedure that Symantec has made available to all users and is updated DAILY and thus can allow you to plug your computer if you see that 1) You are badly out of date or 2) You need to get the latest because some reliable website has reported a "new" virus and Wednesday has passed.
For future reference, if there is a really virulent recent virus running around and you want to go to Norton's Intelligent Updater, you can go here:
securityresponse.symantec.com/avcenter/download/pages/US-N95.html.
Note that the date of the most current weekly Norton AntiVirus release is dated today (February 25) and that Live Update will pick it up as Wednesday is usually the day that the weekly virus list is released.
Your Live Update should be scheduled DAILY and should probably be after 3 p.m. on each day.
This is the story that provoked this notice: Latest MyDoom Outbreak Spreading, Deletes Files.