 |
| BBS-LA E-Mail Virus Scanning |
|
| BBS-LA E-Mail Virus Scanning |
|
BBS-LA has been virus scanning incoming and outgoing mail for several years with good results. Unfortunately, this scanning was not complete as it could not scan attachments that were mime encoded (as most attachments are). We are happy to announce that we have added scanning of mime encoded attachments to our virus scanning routines. The VOPMAIL (our mail server software) USER's GROUP developed an effective application for scanning mime encoded attachments which Steve Foster spent several days improving upon. At present, mail you send (outbound mail) and mail addressed to you (inbound mail) is scanned completely both for virus in the body of the e-mail and/or in the attachments. In addition, we are updating virus definitions every 24 hours under normal circumstances and every hour in crisis situations like with the ILOVEYOU virus. DO NOT, HOWEVER, RELAX YOUR VIGILANCE. FOLLOW THE RULE OF NOT OPENING E-MAIL ATTACHMENTS UNLESS YOU HAVE CONFIRMED WITH THE PERSON THAT SENT YOU THE MAIL THAT THEY REALLY SENT IT TO YOU, AND THAT THEY ATTACHED THE ATTACHMENT. We can only screen for known virus and virus types. Every new virus has a time period before it is discovered and virus definitions used by virus scanning software incorporate methods of removing it. Attachments containing new unknown virus will get through any scanning routine so be careful. Don't be the first person on your block to discover a new virus by opening an attachment without first checking it's source. At present, the new virus scanning software works as follows: OUTBOUND MAIL (mail you send): If the scanning routines discover that mail you have sent contains a virus, the mail will be stopped at our mail server, quarantined, and you will be sent a message like the one below: OUTBOUND FROM BBS-LA USER From: <security.check.agent@bbs-la.com> Sent: Wednesday, May 10, 2000 7:38 PM An email from
userid@bbs-la.com was routed via our
network. The e-mail did not reach all of its intended recipients. For more information, please contact
postmaster@bbs-la.com. Postmaster
If you receive this message, it means YOUR COMPUTER is infected with the virus identified in the body of the warning message. You need to update your virus definitions for your Anti-Virus software and virus scan your system. ALL OUTBOUND MAIL FROM YOUR SYSTEM WILL BE STOPPED AT OUR SERVER UNTIL YOUR SYSTEM IS FREE FROM VIRUS. (Actually, all mail that scans positive for virus will be stopped which will probably be most or all of it until you clean up your system) At present, all outbound virus infected e-mail is effectively stopped at our mail server and will not be sent to the final recipients that it was addressed to. The persons you addressed the e-mail to will, however, receive an e-mail like the sample below, informing them that an e-mail sent by you was stopped at our server and not delivered because it contained a virus. You will receive a message like the sample above. This notification process lets you know that your system is infected and that your mail was not delivered. It also lets your recipients know that mail you sent to them was not delivered because it was infected with a virus. By doing this, we let both parties know that the mail has not gone through and why. We also prevent you from accidentally infecting the systems of the people you have sent mail to from an infected PC. RECIPIENT MESSAGE From: <security.check.agent@bbs-la.com> Sent: Wednesday, May 10, 2000 7:42 PM
An email from
userid@bbs-la.com was routed via our
network. There may have been other recipients. The e-mail was scanned
before --Scanning incoming mail from userid@bbs-la.com 5/10/00 7:38 PM Scan Started SYSTEM On Demand Scan For more information, please contact postmaster@bbs-la.com. Postmaster INCOMING MAIL (mail sent to you) If the scanning routines discover that mail sent to you contains a virus, the mail will be stopped at our mail server, quarantined, and you will be sent a message like the one below: INBOUND MAIL MESSAGE TO BBS-LA USER From: <
security.check.agent@bbs-la.com
>
An email from
somebody@somewhere.com was routed via
our network. There may have been other recipients. The e-mail was scanned
before --Scanning incoming mail from somebody@somewhere.com 5/10/00 7:38 PM Scan Started SYSTEM On Demand Scan For more information, please contact postmaster@bbs-la.com. Postmaster If you receive this message, it means THE SENDER'S COMPUTER is infected with the virus identified in the body of the warning message. The sender needs to update their virus definitions for their Anti-Virus software and virus scan their system. ALL INCOMING MAIL FROM THE SENDER WILL BE STOPPED AT OUR SERVER UNTIL THEIR SYSTEM IS FREE FROM VIRUS. At present, all inbound virus infected e-mail is effectively stopped at our mail server and will not be sent to the final recipients that it was addressed to. The person sending you the virus infected mail will, however, receive an e-mail like the sample below, informing them that an e-mail sent to you was stopped at our server and not delivered to you because it contained a virus. This notification process lets them know that their system is infected and that their mail was not delivered to you. You will receive a message like the sample above. This lets you know that their mail sent to you was not delivered because it was infected with a virus. .By doing this, we let both parties know that the mail has not gone through and why. We also prevent their mail from accidentally infecting your system. MESSAGE TO ORIGINATING SENDER From: <
security.check.agent@bbs-la.com
>
The e-mail did not reach all of its intended recipients. For more information, please contact
postmaster@bbs-la.com. Postmaster And now for the boring legal stuff: BBS-LA is doing everything possible to protect your e-mail and/or your systems from being infected by virus. This is because we're the good guys and we try harder than the other guys. It's also because we need to protect our systems from the effect of the overwhelming flood of e-mail that can result from cascading cross-infection when virus like the ILOVEYOU virus get loose on the Internet. We figure that you feel it is our responsibility to keep our servers up and running at all times as that's the service we're selling to you and that you are paying for. WE ARE NOT, HOWEVER, GUARANTEEING THAT THE SYSTEMS WE HAVE PUT IN PLACE WILL PROTECT YOU FROM BEING INFECTED BY VIRUS. WE ARE ALSO NOT RESPONSIBLE IF YOUR SYSTEM GETS INFECTED BY VIRUS. We're doing the best we can but it is not perfect. You still need to run anti-virus software on your system and practice safe e-mail. In Lawyer language this means WE ARE NOT LIABLE FOR DAMAGES YOU MAY SUSTAIN FROM YOUR COMPUTER GETTING INFECETED WITH A VIRUS THAT GOT THROUGH OUR SCREENING. In plain language we can all understand, "Please don't shoot the piano player, he's doing the best he can". Many ISP's will not virus scan e-mail because their lawyers told then they would create a liability for themselves if they did. We think it is dumb to not do everything we can to help protect you from virus infection. We also think you're smart enough to understand that what we are doing doesn't guarantee you won't get infected by a virus, and that if you do it isn't our fault. (We also think the other guys should get new lawyers or ignore the ones they've got, but that is another story.) End of boring legal stuff. Please remember also that although most of the recent virus scares have involved e-mail, virus are often spread by sharing floppy disks. Always scan floppy disks you receive from any source before using them. A good way to accomplish this is to set your anti-virus software to scan all removable disks (floppies and ZIP disks) on insertion. Virus, trojans and other bad things are also spread in NewsGroups, FTP file transfers, and disguised as programs you can download from various sites. Always be sure you know who you are dealing with when accepting file transfers or downloading programs. You should have your anti-virus software set to screen all files you download as part of the download process. ABOUT ANTI-VIRUS software: There are a number of good anti-virus applications available for a reasonable price. I use Norton Anti-Virus personally, but McAfee is good, and so are most applications provided by large publishers. It is important to use an anti-virus application that updates the virus definitions on a timely basis and that provides you with an easy way to get them by downloading the updates from the company's WEB site. Anti-Virus software is only as good as the virus definition file and the anti-virus definitions are no good if they are old. KEEP YOUR VIRUS DEFs CURRENT and scan your system on a regular basis and more often if you have reason to believe you've become infected. Always scan removable drives and downloads. Keep your anti-virus software in the always running auto-protect mode if you're doing risky things like IRC and Instant messaging with attachments or just generally to be safe. Remember that Anti-Virus software can't protect you if you don't use it. The resident auto-protect mode will slow your system down somewhat depending on how beefy your system is, so you may not want to run it all the time. If your system will handle it, it's a good idea in these troubled times to run your anti-virus software all the time. IF YOU DON'T HAVE ANTI-VIRUS SOFTWARE ON YOUR SYSTEM, GET SOME TODAY! ANTI-VIRUS SOFTWARE IS NOT OPTIONAL EQUIPMENT. (You really don't want to find out first hand what a nasty virus can do to your system. But a hint.... think "reformat the hard drive and start all over again" for a nasty virus and "Flash the motherboard BIOS chip and then reformat the hard drive and start all over again." for a really nasty virus. Either way, it's no fun.) |
Top