Spam and virus's has been a problem for many years but only until recently has people started to become disgusted with it. Performance could also be a concern for many people. One of those people is me. I do not like to use an additional program to combat something that should not be there from the start. Some of these viruses in emails could potentially bring harmful consequences, even identity theft. That is why I have decided to take a stand against the spam in my inbox, and I will show you how.
This guide explains how I fight spam and gives a few pointers as to what you can do without downloading an additional program. I also have included information on how to spot an E-Mail virus without any additional software. Only thing it takes is a little knowledge and the ability to refrain from opening every E-Mail you get, regardless of where it came from. What people do not understand is that the user must do something to get a virus. It is not magic. That something, a very high percentage of the time, is click and open an infected E-Mail. DO NOT DO THIS!
Something to consider is the fact that the E-Mail filters and spam filtering do NOT work with HTTP E-Mail accounts, such as Hotmail and Yahoo. Most of those kind of services offer filtering of their own. Use it.
This guide also offers a sneak peek inside Black Viper's inbox.
As of this writing, I use Outlook Express 6, but most "newer" E-Mail clients have the same or similar type of features. In reality, the E-Mail client you chose could be much better than OE in many respects. I would love to use a more "feature rich" E-Mail client, but, sometimes I am rather hard set in my ways.
You also need to note two very important things:
1) Shall we begin? (Image 1.1)
After a small break away from the computer, I had quite a few E-Mails sitting around. Note: According to the screen shot, not one of them is in my "Inbox." What I have done is used filters to distribute them according to predefined rules. This screen shot was taken right after I opened OE. More on filters later, but first, a tour of the results of the filters.
2) Deleted Items. (Image 1.2)
Out of 275 E-Mails, 58 of them were automatically deleted without any actions by me. What this filter does is take ALL E-Mail not directly addressed to me and delete it. Absolutely no legitimate E-Mail sent by a "real" person or company will ever falsify where the E-Mail is going TO!
Initially, I had recommended in my E-Mail Filtering Guide to automatically forward to email@example.com and delete all E-Mails that did not pass my spam filters. This procedure was flawed with respect to how Outlook Express handles the action. What Outlook Express does is remove the spammers from address and replace it with the E-Mail account currently in use. After realizing this problem, I removed the recommendation. However, this step opened up a whole new can of worms.
For the E-Mails that actually are going to me, these are caught by my "Blocked Senders List" filter that automatically deletes E-Mails originating from a particular domain or person on a domain. Again, more on the actual filters later.
3) blackviper.com Inbox. (Image 1.3)
After removing a few "important" E-Mails, I have taken the screen shot displayed as Image 1.3. Many people ask "Why do you automatically place a subject line in your E-Mails?" This is the reason. It is extremely easy to see that these people have visited my web site and actually clicked on the link located on my domain to contact me. I have little fear as to whether or not it is spam. Also, a VERY important note: Look at the "average" size of these E-Mails. Most are between 3KB and 6KB with none of them over 10KB. This will be important in the next screen shot of the "Filtered Spam."
Something else to understand. Even though I removed the "From" column for these screen shots, I always look to see "who" it came from. In the above screen shot, the From column is not removed and you can actually see the pathetic E-Mails addresses and names that these spams "seem to come from."
4) This is my Filtered Spam. (Image 1.4)
Some of these E-Mails are legitimate. Some are virus's. Others are spam. Can you spot each?
I have a filter to catch "common" subject matter and code it in Red. Very rarely (especially using a "default" subject line) does my filters ever tag a "real" message with Red.
I must thank all spammers that attempt to confuse E-Mail filters by adding random characters to the end of a subject line. When this pathetic attempt at getting through to E-Mail users started, it annoyed me. However, after it became a "wide spread practice," I expanded my subject line column way out and scan only the end of the line. If it contains gibberish, it is gone. It has reduced the time I take to filter E-Mails considerably. You will also notice that several E-Mails display "..." on even the short subject lines. This means that the full subject does not fit in the column and more information exists. This common practice just shows that spammers add many spaces to their messages and then place the random characters out of "normal" view. Expanding the column reveals the truth.
Also here, you see MANY messages that are well over 100KB. These are absolutely, positively a virus. Zero doubt. Why? Because any "real" person that would send any attachment would actually "attach" the file. Look on the far left column of the next shot.
5) Attachment reporting. (Image 1.5)
Not one of these E-Mails, sorted by size, reports having an attachment. Now, understand that an E-Mail that is 180KB is a rather large amount of typing. This should give you the first clue about the origin of these E-Mails and the destructive intent. However, some E-mail programs, if using "HTML" stationery and such, do not report attachments of .jpg and .gif's if they are part of the layout. For example, a background picture and a .jpg signature block. Take note: Out of 8400 E-Mails in the last year, only 16 of those have had "large" images (over 50KB worth) included with them as "normal" E-Mails. Please, for the love of dial-up users around the world... Do not send 295KB picture as a "normal" part of your E-Mail. For the sake of time, I now bounce all E-Mails that are larger than 50KB.
Can you confirm that this E-Mail is a virus without "opening" it? Yes, and I will show you how following this short disclaimer:
ABSOLUTELY, NEVER, EVER double click these files to open them! You WILL be infected.
This method is NOT intended to substitute a virus scanner with the eyes of an average user. However, my network has never been infected by a virus. Ever. What AV software do I run daily? None. I do not visit "questionable" web sites, I utilize a hardware firewall and never open an attachment sent via E-Mail. What is the best defense anyone can have? Common sense.
Do I own AV software? Yes. When do I scan the network? Before anything major, like an OS install or massive hardware change. That way, I know that all of my backed up data has been scanned with the latest virus protection and clear of anything up to that date. I then install the OS clean and retrieve my safe data and continue as usual without AV software sucking up resources 24/7.
Another reason I have avoided infection is I use a computer strictly for E-Mail. That's it. If anything should happen, such as unexplained memory, hard disk activity, network activity or many other ways to spot a malicious program, I can stop it before catastrophe hits. This also greatly reduces the chance of "important" files being infected across the network because the system that I use for "normal" activities has NO shared resources.
Most people cannot afford having a dedicated system taking care of such types of tasks. However, a pretty clever way of discovering a virus or worm that is scanning the always targeted Windows Address Book is to place a "unique" address that is never used for anything other than to seed. Most providers have options of multiple E-Mail accounts. Have a disposable one that is used for all "sign up, place E-Mail address here" forms, one is used for "close friends and family" and another could be "firstname.lastname@example.org." This extended garbage would "attempt" to ensure dictionary spammers would not easily hit it and, if you ever get an E-Mail to that address, it would be the first clue of possible malicious activity. Not a guarantee by no means, but at least it could prompt additional investigation.
AGAIN: I will always recommend my readers use a virus scanner daily and keep it up to date. There is no reason not to. If you have a single system directly connected to the internet you WILL have virus and firewall protection installed. Security is no laughing matter. Enough said.
6) Check the "real" contents of a suspicious email. (Image 1.6)
Practice this technique on a REAL E-Mail and not a virus infected one.
This information pertains to Outlook and Outlook Express. Your E-Mail client may vary.
7) Details Tab. (Image 1.7)
The Details tab displays all kinds of geekie information. Where the E-Mail came from, who it was from and who it REALLY was from. Also, this tab contains information on what servers it passed through on the way to your computer.
What we are interested in here is the Message Source button.
8) Email Source. (Image 1.8)
The contents of the E-Mail attachment is not readable by humans. However, what the file REALLY is and what it will do IS readable.
Highlighted, I have the actual MIME encoding format; it tells the E-Mail client what to do with the attachment. In this case, it is:
The funny thing is, the actual file name "height.pif" has nothing to do with "audio." PIF is a shortcut to a program. Like what you would find on your desktop. Again, a real person would NEVER send you an "audio" file saved as a "shortcut."
Why is the file a .pif? It is automatically executed by the E-Mail client and the OS regardless of what the MIME encoding says.
This is just one of the many examples I have in my inbox.
"Have you tweaked your OS lately?"
Choose the look:
Most Content is converted. Please see http://www.blackviper.com for the lastest information.
Windows Service Configurations!
Includes explanations of each service and advice on which services you can safely disable.