Does your Network have Spam Zombies? (Part 3)

So, you've read part 1 and 2 of this series, and you've determined you have at least one spam zombie on your hands. Your network may have been responsible for thousands or even millions of junk emails. It's a miracle your ISP hasn't shut you down already.

So, what to do now?

The prognosis is not good. The problem is that even if you manage to disarm the software that's sending the spam, you still don't know how it got installed in the first place.

In other words, just because you've been successful at stopping the spam, doesn't mean you've secured the system. The only way to kill a zombie is with a stake through the heart (yes, I know, that's for vampires).

The best practice in any situation you've had a security compromise that you can't account for 100% is to "torch" the computer in question.

1. Disconnect the system from the network - do this now!

2. Backup any important data (just get your data- try to avoid copying any installers or executables that could've been the source of the zombie or exploit)

3. Format all drives

4. Take at least a few steps to secure your network.

Windows XP as it ships from Microsoft is loaded with exploits. If you expose a fresh installation of Windows to the naked internet, you could find your computer compromised and sending spam again within a few minutes. Windows XP Service Pack 2 (SP2) comes with a reasonably decent built-in firewall. The problem is, to get SP2, you'll need to get your system back online. It's kind of a Catch-22.

The easiest way to avoid this problem is to deploy an inexpensive firewall. Your existing Cable or DSL modem / router may already provide this functionality. A quick way to check is to look at the IP address of another computer on your network (select Start/Run, type 'cmd' and then 'ipconfig'). If the first two digits are 10.0 or 192.168 you have at least a minimal level of security known as NAT (network address translation).

If you're still not sure, adding a second firewall can't hurt (no, I'm not joking).

Without going into detail, I'll recommend going down to the local Best Buy or Fry's and asking the salesperson to help you pick out a firewall. Linksys is a fairly good brand. You should be able to get something reasonable for under $80.

5. Re-install Windows

6. Go to www.windowsupdate.com and install all the updates. This may take several passes and several hours.

7. At some point in the update process, you'll have the option to enable automatic updates. Do so.

At this point you have a system which is at least behind a firewall and patched. It should also be automatically downloading the latest updates from Microsoft. You're probably in much better shape from a security standpoint than you were.

The scope of this article isn't intended to include comprehensive education on the kind of behavior that can lead to becoming a zombie. Here are a few tips though:

1. Consider using Firefox instead of Internet Explorer. It is generally more secure. It also sucks less.

2. Think twice before downloading software from sources you don't personally trust. This goes for both (pirated) file sharing services and apparently legitimate shareware download sites.

3. If you get an attachment in email that you weren't expecting, don't open it. This even applies if you know the sender. Running email filtering software like SpamButcher can help prevent messages with suspicious attachments from getting in your inbox in the first place.

4. Consider investing in reputable anti-virus software from a major provider.

5. If you tend to surf "shady" portions of the internet, all of the above applies double. You know what I'm talking about.

Back