Email Viruses & Phishing

..Geoff, Jan 22/07

Phishing - an emerging trend in identity theft
Email viruses
Should I open file attachments?
What happens when I get an infected email?
Bounced messages that I didn't send
Is my anti-virus program up to date?
Hoax viruses
Virus information resources
Checking and Repairing Your System

Related pages:
Computer Security
Tuning up your computer
Computer system troubleshooting

Phishing - an emerging trend in identity theft
Here is a good description of the process, and how to avoid being caught.
http://www.psepc.gc.ca/prg/le/bs/phish-en.asp

Email Viruses
Are we safe from email viruses? No.

Computer viruses travel to millions of computers in a few hours. Anti-virus companies react quickly, but there are several hours from the time the virus appears until our systems are protected. In those hours, the anti-virus vendors first learn of the virus, then reverse engineer it, then publish their results, then distribute the virus definitions to their customers.

Our email goes first through AppRiver, which scans all inbound email for viruses, which catches well-known (but not brand new) threats, then to Uniserve. Our computers run Symantec Anti-Virus, which scans all files that get saved on your computer. These two lines of defence catch most viruses. We update our Virus Definition Files every few hours. But that's not fast enough to catch all viruses.

Should I open file attachments?

Here is an example of a virus that Symantec Anti-Virus did not catch:

Executable Program Virus

Is it a virus? YES! What happens if you click on ADDREG.EXE? Well, as it turns out, it would overwrite your hard disk, corrupt your system BIOS (so your computer could not be booted), and email confidential information to everyone who has ever sent you an email. And here's a cheery note from Symantec: "This virus contains bugs which will corrupt some files while attempting to infect them, as well as when the first payload activates. These files cannot be repaired; they must be restored from backup." Quite a mess.

Viruses can destroy or alter files on our network too. If you open this type of virus, you could corrupt every file in the 'Shared' directory, or every AutoCAD file, or all our photos, or our parts system. If the problem wasn't detected, the corrupted files would be backed up, overwriting the good files. Computer systems are inherently fragile--so YOU NEED TO BE CAREFUL.

One moment's inattention can cause hours of work, or thousands of dollars of damage in damaged files and lost time.

What is a suspicious file attachment?

If you get a suspicious file attachment:

Microsoft Word 97 does have some protection against macro viruses: Go to the menu option Tools | Options | General | Macro virus protection and put a check in the box. This isn't complete protection -- all it does it give you a warning when a document or template you open has a macro in it. The macro may, or may not, be a virus. Word 97 gives you no idea what they are -- just the choice to Enable or Disable the macros. Unless you are absolutely sure the document doesn't have a virus, you should click on "Disable Macros." This will open the document but not run any macros, good or bad.

What Happens When I Get an Infected Email?

found the Eicar test virusCall Geoff or Daniel, as every virus infection is important.

All going well, Symantec Anti-Virus will catch it, and pop up a warning box.

Have a look at who sent you the infected email. Tell them, so they will stop passing it on!

Some viruses disguise or fake the "from" field, so they are impossible to trace.

Daniel or Geoff will then clean and test your system.

Bounced messages that I didn't send

A further wrinkle: As many virues spoof (or forge) their 'from' address, someone else's computer is sending emails that look like they come from YOU. If they are mis-addressed, they will bounce, and you will get 'could not deliver this email' messages from mail servers.

The bounceback message might come back with 1 or 2 attachments, 1 of which will be a virus-infected email (supposedly sent from your computer). So you don't open the attachment, right??

Is My Anti-Virus Program is Up To Date?

1) Make sure that you have Symantec AntiVirus running on your computer at all times. There is a little yellow shield in the system tray, in the the lower right corner of your Windows screen when it is active, next to the clock. Move your mouse over it, and it will say "Symantec AntiVirus Corporate Edition"

2) Our system updates the virus information every day around 10am, and scans your hard disk every Thursday afternoon. However the auto-update feature does not always work. To check it, open Norton Anti-Virus.

Symantec Anti-Virus Corporate Edition screenshot

If the virus definitions date is more than a few days old--there is a problem. Call Geoff or Daniel so we can solve it.

Hoax Viruses

Virus hoaxes are meant to confuse and frighten people into sending out an email to all their friends. Don't do it! When you receive an email about "a very important virus that has been confirmed by Microsoft", or something equally hysteric, check it out first. If it is a hoax, email the person back and ask them to check first before spreading rumours.

If you think about it, a hoax virus is just like a regular virus, except that it uses YOU to spread it.

To find out if a virus is a hoax, check
http://securityresponse.symantec.com/avcenter/vinfodb.html

http://www.symantec.com/avcenter/hoax.html

or http://vil.mcafee.com/hoax.asp

Virus Information Resources

General virus info:
http://www.symantec.com/avcenter
http://www.mcafee.com/anti-virus

Virus encyclopedia:
http://www.symantec.com/avcenter/vinfodb.html
http://vil.mcafee.com

Checking and Repairing Your System

updated April 20/04

Here is what Daniel and Geoff will do when you tell us about a virus on your system:

1. Identify the virus. Then check http://www.symantec.com/avcenter to find out what damage the virus has done, and any notes on how to handle this virus.
2. Sometimes Symantec suggests downloading running a particular virus-eradication tool. The tool may fix the damage done, or we have to dig deeper into your system and manually delete, repair or replace files.
3. Run LiveUpdate to ensure that your virus definitions and SAV (Symantec Anti-Virus) are up to date
4. Send a message to whoever sent you the virus informing them that their computer is infected. Also send along links to the pages on Symantec's website that describe the particular virus, and links to any virus-removal tools.
5. Delete the infected email. Also empty the 'Deleted items' folder. Click on File > Folders > Compact All Folders
6. Delete the item from SAV Quarantine.
7. Run a SAV full system scan.
8. Run Windows Update to download any new security patches from Microsoft
9. Outlook Express > Tools > Options > Security > Select the Internet Explorer Security Zone to Use: > Restricted Sites Zone (more secure)
10. Uninstall any suspicious programs. To see a list of programs, open a Command Window and run PSINFO -s. Investigate anything suspicious on Symantec's Security Response website.
11. Run \winutils\autorun to see all the programs that are running during system startup. Investigate anything suspicious on Symantec's Security Response website. You can use MSCONFIG to disable most suspicious items. Some items will require you to edit the registry.