Charlie Register's Home Page

Table of Contents

Late-breaking Advice for the Unsophisticated Computer User

OUCH! Bad people are trying to trick you into revealing your credit card numbers, Social Security numbers, and worse. These issues of OUCH: Report On Identity Theft and Attacks On Computer Users are a must-read. These are written for the non-technical computer user.

Computer viruses are not natural phenomena. They are computer programs written by people for the purpose of disruption, theft or just plain meanness. More than just a nuisance, they have to potential to zap power grids, telephone systems, emergency rooms and air traffic control systems. Every computer user has a responsibility to keep their systems virus free.

If you have been told that you might have a virus...

Windows users should run a special program called Stinger. Stinger is free, and is available by clicking one of these links:
- stinger.exe (a copy on this web site)
- stinger.exe (from the folks who make the McAfee anti-virus software)
– Download Stinger to your desktop and double-click on its icon, then press the "scan" button.
– If you use Windows ME or Windows XP, you must turn off the "system restore" feature, so read this first.
– Easy-to-follow step-by-step instructions for downloading and running Stinger are available on the McAfee / Network Associates Inc. web site: http://vil.nai.com/vil/stinger/.
– Stinger detects and removes many of the most common viruses and worms, including Bagle, Netsky and Sasser. See below for more comprehensive information on viruses.
If you have an Apple Macintosh computer, it is very unlikely (although not impossible) that you actually have a virus. Over 99% of the virus incidents today affect only computers running some version of Microsoft Windows. For example, Bagle, Netsky and Sasser (mentioned above) cannot run on Macintosh computers.

Timely non-technical articles:

Are hackers using your PC to spew spam and steal? – USA Today, September 8, 2004
Tech industry presents less-than-unified defense – USA Today, September 9, 2004

Computer Help for Friends

Like many computer geeks, even in retirement I frequently offer geekly assistance to friends and family. Don't feel bad if you are confounded by email or troubled by viruses and hackers ... that's good! It meas you're paying attention. If you think you know all there is to know, then you're toast.

In the end, there are only two kinds of computer users:
• Those who have lost – or through ignorance and negligence caused others to lose – huge amounts of time, data and money because of computer problems; and
• Those who will.

Here are a few tidbits and reference items that many have found useful:

Viruses and Virus Hoaxes:

Anti-virus (AV) software

Get it. Make sure it's ALWAYS running. The McAfee VirusScan and Norton (Symantec) Anti-virus products are most common and often available free (via site license) to students, faculty and staff at many colleges and universities. Here are links to the anti-virus site license sites at Duke (McAfee) and UNC (Norton). (Note: You must be affiliated with the respective institution in order to download this software.)
Update the program's virus database DAILY. No kidding. New viruses come out every day. Your AV software is practically worthless if it's out of date. Updates are free.
Frequent updates are especially important for people who have full-time Internet connections through DSL or cable modems. You can set your computer to do this automatically using (for example) McAfee's AutoUpdate or Norton's Intelligent Updater (which I recommend over the Norton LiveUpdate).
Run a full scan on your computer at least once a month. Scan all files, not just executable files.

Viruses and Worms can spread through email messages

Be wary of email attachments from people you don't know.
Never open email attachments that you weren't expecting, even from people you do know. Unfortunately, many viruses spread through email messages that appear to come from one person when they actually come from someone else. See next item.
HELP! I just got a complaint from someone who said I sent them an email message with a virus, but I know that my AV software is up to date and working properly.
It is likely that the message in question had your return address, but that it was a forgery (this is quite easy to do). You are just an innocent bystander. In such cases the virus actually comes from a third party who just happens to have your email address stored in their address book. This is called email "spoofing" and it is often impossible to identify the real culprit.
Do not use your email program's "preview" mode, which automatically opens your messages (possibly exposing you to any virus attached).
Disable JavaScript in your email and news program.

Virus Hoaxes are email messages, often from people you know, warning you about a new "virus," often advising you to delete files on your computer, and always telling you to forward the message to everyone you know (a dead giveaway). Don't trust anything that does not come directly from an information technology professional.

Don't do anything until you've verified the "warning" through a credible source, such as:

The computer Virus Myths web site: www.vmyths.com
The Urban Legends web site: urbanlegends.about.com

Common virus hoaxes making the rounds lately (in 2002 and 2003):

The "JDBGMGR.EXE" virus warning.
The "SULFNBK.EXE" virus warning.

Phony "security patches" from Microsoft arrive as email and often look quite genuine, but they are quite deadly to your computer. Microsoft never distributes any software by email. Never open messages that claim to be software or patches from Microsoft.
Microsoft security updates are published frequently (although never distributed by email). If you use Windows, run the Windows update utility every few weeks, or check the Windows Update web page.
On the lighter side, my two favorite "viruses" are

The Amish Virus
The Gullibility Virus (it's real, folks!)
(This also contains some good references on hoaxes and evaluating the credibility of Internet resources.)

Hoaxes, Scams and Phishing Expeditions:

Phishing attacks use 'spoofed' emails and fraudulent web sites designed to fool recipients into divulging personal financial data such as credit card numbers, account user names and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them. (Source: www.antiphishing.org) This is a relatively new, and particularly insidious technique designed to separate you from your money. Some recent examples include:
- a bunch of eBay and PayPal scams;
- and dozens of false bank account notices.
Scams often arrive as "make money fast" chain letters -- all quite illegal and all guaranteed to make you lose money fast. Among the most pervasive (and ridiculous) are:

a plethora of variants on the Nigerian money-laundering scheme;
more and more money from Microsoft and other "something for nothing" junk.

Hoaxes are in never-ending supply. They can be wasteful, stupid, and sometimes sick. But they're essentially scams; they are all sucker bait. Among these are:

the insipid Exxon/Mobil gasoline boycott;
an endless stream of bogus petitions, such as the one to save NPR, PBS anf the NEA;
and the infamous Penny Brown missing child hoax. This last one is a good example of a sick hoax that's taken in a large number of smart people.

Don't forget: when you power on your computer, keep your brain powered on too!

Adware and Spyware:

Spyware is software running on your computer that transmits information back to a third party without your knowledge or permission. That information can be anything: lists of web sites you visit, or passowrds and credit card numbers. You never really know.
Adware is software running on your computer that displays advertising. Some software can be adware and spyware at the same time. Not all adware is spyware, and most spyware does NOT display advertising.
You put it there. Adware and spyware software usually offers to deliver some amusement or useful service. You install it, and it takes over. Some of the most common examples include:
- Bonzi software, including Bonzi Buddy, Internet Boost, Internet Alert, Intruder Alert, and Voice E-Mail.
- Comet Cursor
- Gator, including Gator eWallet. By Claria, "The Leader in Online Behavioral Marketing"
Get rid of it. Some anti-virus products detect and remove adware and spyware, but sometimes removal is easier said than done, because the makers of these software products do not want to lose your data. The best bet is to install special adware/spyware removal software. There are two excellent, and free, adware/spyware removal program available:
- Ad-aware, by Lavasoft. Easy to use.
- Spybot Search & Destroy, by Safer Networking. Very thorough. Some configuration options may be a bit intimidating to novice users.
- Note: Just like viruses, new adware and spyware programs are coming out all the time. So, just like anti-virus programs, adware/spyware removal systems must be updated frequently. Updating is free and easy, but you have to remember to do it before you run an adware/spyware scan.

Email Issues and Good Practice:

Use BCC (blind copy) when sending a message to a large and/or diverse group of people. From the recipient's perspective this makes the message much shorter (and easier to read) because the other recipients' addresses cannot be seen. This also serves to protect the privacy of the recipients who have been "BCC-ed".

Outlook and Outlook Express do not provide the BCC capability by default (that is, when they are first installed). Instead, you have to turn on this function by hand (it's easy but not intuitive):

When viewing the "New Message" window, click on the "View" menu item and select "All Headers". This will open up a BCC address area (which is used exactly like the normal TO and CC address areas).

Outlook and Outlook Express (a component of Internet Explorer) are simple and easy to use, but they have been unusually vulnerable to viruses sent through email. The problem has been so serious that companies and institutions are starting to prohibit the use of these programs on their systems. Microsoft has published patches for these programs to make them (your PC, that is) less vulnerable, but installing these patches may be a daunting task to many people. Other email programs, such as Eudora and Netscape Messenger for example, offer the same features (and sometimes more) as Outlook but without the hazards.
Email headers are like postmarks on US Mail -- they show where a message came from and how it was delivered. Since the basic FROM information can be forged easily, headers are important when trying to determine the actual sender of a message.

Most email programs do not normally show a message's full email headers by default. The method for displaying full email headers depends on the program you're using. The SpamCop FAQ has good program-specific instructions. When displayed, a typical message's full headers look something like this:

Return-Path: <myfriend@email.unc.edu>
Received: from poserver.mail.duke.edu (localhost [127.0.0.1])
        by poserver.mail.duke.edu (Cyrus v2.0.17); Tue, 01 Apr 2003 14:06:41
        -050X-Sieve: cmu-sieve 2.0
Received: from incoming.mail.duke.edu (incoming.mail.duke.edu [152.3.xxx.x])
        by poserver.mail.duke.edu (8.12.9/8.12.9/Duke-5.0.0) with ESMTP id
        h31J6fof016433
        for <frobob@poserver.mail.duke.edu>; Tue, 1 Apr 2003 14:06:41 -0500
        (ESTReceived: from smtp.unc.edu (outgoing.mail.unc.edu [152.2.yyy.y])
        by incoming.mail.duke.edu (8.12.9/8.12.9/Duke-5.0.0) with ESMTP id
        h31J6UiQ020290
        for <frobob@duke.edu>; Tue, 1 Apr 2003 14:06:31 -0500 (EST)
Received: from email.unc.edu (workstation.dept.unc.edu [152.2.zzz.z])
        (authenticated bits=0)
        by smtp.unc.edu (8.12.2/8.12.2) with ESMTP id h31J5l4H009239;
        Tue, 1 Apr 2003 14:05:47 -0500 (EST)
Message-ID: <3E89E30B.11C51DB@email.unc.edu>
Date: Tue, 01 Apr 2003 14:05:47 -0500
From: My Friend <myfriend@email.unc.edu>
X-Mailer: Mozilla 4.78 [en] (Windows NT 5.0; U)
MIME-Version: 1.0
To: "Sly O. Frobobnowitz" <frobob@duke.edu>
Subject: Meeting on Friday
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-milter, Duke University (http://amavis.org/)

When reporting spam (junk mail) or offensive email, you will need to forward the full email headers to your ISP's postmaster or abuse department. You are wasting everyone's time if you complain without forwarding the offending message's full email headers.
The EarthLink Support Center has a good basic description of email headers.
The StopSpam site has a more thorough description of email headers.

Odds ‘n’ Ends

I worked at Duke University,

in the Office of Information Technology,

where I was the University IT Security Officer.

That means I got to think about computer hacking, phone phreaking, and other ways our privacy can be disturbed and our computer systems compromised by people who may not have our best interests at heart.

For starters, here are a few of the common computer security hazards at Duke (and elsewhere).

In my work, I tried to live by the SAGE Code of Ethics, and at the same time live up to the expectations my boss had for me.

And in my not-too-abundant spare time, I served on the Board of Governors of the Durham Savoyards, Ltd., a non-profit organization dedicated to the performance of the operettas of Gilbert & Sullivan. In 1997, I developed the original DSL web site which, happily, is now under different management in a different venue. However, for my own reference purposes I still keep a collection of Durham Savoyards Archives and Projects.

I also served on the Board of Directors of Hemophilia of North Carolina, an affiliate chapter of the National Hemophilia Foundation, and an independent agency of North Carolina citizens with bleeding disorders.

Way back when I had time to eat lunch, my pals and I invented an interesting variant on the card game Hearts. We called it IncreduHearts©.

There are other things I could list here, making this a more typically egotistical home page, but there's already too much of that kind of thing on the Internet. Don't you agree?

Charles M. Register