Killing Spam Zombies Made Easy - Killing the Zombie

So, you've determined you have at least one spam zombie on your network. Your network may have been responsible for thousands or even millions of spam email messages. You're lucky that your ISP hasn't already disabled your account.

So, what should you do?

1. Disconnect the system from the network - do this now!

2. Backup any important data (just get your data- try to avoid copying any installers or executables that could've been the source of the zombie or exploit)

3. Format all drives

This may seem a bit extreme, but is generally a good idea. The best practice in any situation you've had a security compromise that you can't account for 100% is to "level" the computer in question.

The problem is that even if you manage to locate and remove the malicious software that's sending the junk email, you still can't be sure how it got installed in the first place.

The culprit may have left "backdoors" into your system which they could use to take control again at any point. The only way to kill a zombie for certain is to drive a stake through its heart (yes, I know, that's for vampires).

4. Take at least a few steps to secure your network:

Windows XP as it ships from Microsoft is loaded with exploits. If you expose a fresh installation of Windows to the naked internet, you could find your computer compromised and sending spam again within a few minutes. Windows XP Service Pack 2 (SP2) comes with a reasonably decent built-in firewall. The problem is, to get SP2, you'll need to get your system back online. It's kind of a Catch-22.

The easiest way to avoid this problem is to deploy an inexpensive hardware firewall. Your existing Cable or DSL modem / router may already provide this functionality. A quick way to check is to look at the IP address of another computer on your network (select Start/Run, type 'cmd' and then 'ipconfig'). If the first two digits are 10.0 or 192.168 you have at least a minimal level of security known as NAT (network address translation).

If you're still not sure, adding a second firewall can't hurt (no, I'm not joking).

Without going into detail, I'll actually recommend going down to the local Best Buy or Fry's and asking the salesperson to help you pick out a firewall. Linksys is a fairly good brand. You should be able to get something reasonable for under $80.

5. Re-install Windows

6. Go to www.windowsupdate.com and install all the updates. This may take several passes and several hours.

7. At some point in the update process, you'll have the option to enable automatic updates. Do so.

At this point you have a system which is at least behind a firewall and patched. It should also be automatically downloading the latest updates from Microsoft. You're probably in much better shape from a security standpoint than you were.

Next: Decreasing the risk of future infections >>