Quarantining Virus Outbreaks

With the new threat of many viruses. This article is useful in ways to prevent them distroying your computers. Even it is helpful with ways to clean your system if it get infected.

Greg February 01, 2004

How would you disable inbound SMTP on an Exchange 5.5 server? Is it in the Internet Connections settings?

Rhonda Crouse February 04, 2004

We are losing ground to the virus writers, THE MALWARE WRITERS, AND THE SPAMMERS. The reason is extremely simple - YOU are using the wrong model, shooting at the wrong target, fixated on a solution for the wrong problem.....(more?)

I just read your Windows & .NET Mag piece. I found it interesting, but I think I can add a few verbs to the battle. The problem is that nobody takes the time to step-back from the "Problem" and look for real solutions.

In engineering, it is acknowledged that it is always better to stop a problem as soon as possible, and not have to fix up after it. "Fixing up" is what the current spam, malware, and virus model is focused on.

Maybe you can add your influence to a REAL solution to the spammer, malware, and virus problem (in one tight bundle). Here is my input to this issue:

Actually, ALL of the spam efforts (including the recent "canned spam" legislature) are aimed at the wrong target. It reminds me of a game that a friend delighted in playing with his dog. He would shine a laser pointer beam on the wall, and the dog would frantically try to catch it (I asked him not to torture the poor dog). The point, however, is the dog NEVER THOUGHT OF BITING THE HAND THAT WAS HOLDING THE POINTER!

You guys can try until the proverbial cold spell in Hades, and you will NEVER beat the spammers, malware writers, and virus writers. Virus writers have their own agenda, but the spammers and malware writers are just the beam on the wall. The hand that is holding the laser pointer (and paying the spammers and malware writers) are the unscrupulous advertisers who hope to get some responses to their advertisements.

DING! DING! DING! For spammers and malware, go after the advertisers! Look for embedded URLs, mailto: and phone numbers. The spammers can change their email addresses every-minute-on-the-minute, and change their subdomains almost as quickly. Changing registered domain names takes a little longer, but they have nothing invested in those arbitrary domain names, either. ON THE OTHER HAND, the advertisers NEED to keep their return URL (don't forget to catch the mailto: and phone numbers also) until they can get a return on their advertising (spamming) expenses. In other words, use the same model to develop "spam signatures" as the virus industry does.

But after the signatures are published, here is where the virus model hits the wall!

THE SIMPLE ANSWER: Quit depending upon the dumb end-users who are trying to (or not trying to) understand the problem. Stop the problems at the input side. Consider the web as a cloud, with stuff on the inside, which works pretty well as it is. The point of failure is the "input" doorways. These are (or should be) controlled by the ISPs and by a few of the "doorway" web switching vendors. Require the ISPs and doorway portal operators to filter for and BLOCK inbound spam, viruses, and malicious packets using frequently updated "signatures."

The current model just lets the stuff fly "into" the web, and then hopes that EVERY end-user will be able to detect and throw it away, after it arrives. This is INSANITY! In the meantime, the web is melting-down, with garbage traffic, and nobody in the industry seems to be concerned with stopping it at the sources.

When you remove the profit motive from spamming, the spammers will look for other ways to exploit the internet - but our spam problems will die out to just a trickle. The same solution will also stem the flow from script-kiddies and out-of-control worm propagation, and from unsuspecting "zombie" end-user computers. A few HI TECH virus writers may slip through, but the same model, being self-correcting, will stop the spread of it, as soon as it is identified - in hours ... not months or years, as it is now......



Will Harper February 04, 2004

Have a look at assp.sourceforge.net - a platform independant, server side smtp proxy written in PERL.

Goat Tosser February 05, 2004

I received the following this morning from AVERT_DAT_Release@avertlabs.com. Check the 2nd paragraph... what's up with this?

Today updating DAT files is more important than ever. We have made some
changes to how you access these downloads going forward to ensure your
products are supported and updated as they need to be.

Customers downloading Engine/DATs packages from the NAI Downloads page
will now be informed of the need to have a Prime Support License Agreement
with NAI as they enter the download process. When choosing one of the
packages to download from this page you will be asked to verify you have a
Prime Support License Agreement with NAI and to either agreeing or
disagree to to that statement.

Upon agreement you will then be directed to the DAT file you’ve asked to
download. If you disagree you will not have access to the files and will
need to purchase a Prime Support Agreement in order to gain access.

Our goal is to continue to provide you with the best protection available,
and at the same time provide our customers with a set of services that are
backed by our award winning Support and Service team.

We appreciate your cooperation, and understanding of this new process.

Best Regards,

McAfee AVERT - Anti Virus Research, Analysis, and Outbreak Management
visit us at www.avertlabs.com

Keith Lory February 05, 2004

If this is what passes for a technical article, I should be writing them....this was a waste of the 30 seconds it took me to read the page. Are you trying to market to IT professionals, if so you need to step up the level of detail.

Bruce February 05, 2004

Anyone expecting Microsoft to save the Internet from these plagues is delusional, the measures they have historically takes are short-sighted, and tend to render useless features that users refuse to do without -- like email attachments for instance. I can't count the number of clients, friends and associates that have asked me how to make email attachments in OL Express work again. This kind of draconian crap protects no one, users can't function with it in place -- imho, it's positively idiotic.

These worms with built-in SMTP engines can be shut down so hard and so easily with IPSec rules in local or group policy, it blows me away that none of the trade mags are on it. I have IPSec rules defined for dozens of networks that restrict port 25 traffic on workstations to known servers. Simple, very effective, costs next to nothing -- no license required.

Further, the overwhelming majority of viral attachments come as PIF files. PIFs are an obsolete mechanism that almost nobody has a legitimate need for. So I wrote a shell-extension that intercedes, warns the user of the attempt to execute a PIF, indicates where it is located, allows the user to permit execution if desired. Again, simple, effective, inexpensive...

I keep talking but nobody wants to listen, "too technical," I'm told; "requires too much user knowledge," God forbid we should ever expect any of that... Sometimes the way this industry centers on the lowest common denominator [in terms of user expertise] makes me physically ill... this would be one of those times.

Mark McGinty February 05, 2004

If you can't disable incoming SMTP mail (because your organisation won't let you do this), you can disable any large distribution lists that you use for contacting large numbers (or all) of your users. This prevents the virus spreading to all your internal mailboxes in one go.

Martin February 06, 2004

I think this is a great article- Thanks!

bb February 06, 2004

You could supply links to knowledge based articles on how to do what you say to do. e.g. turn off smtp

Bill Weiss February 06, 2004