Small Business Computer Advisor

Dear SBCA Reader:

The statistics don't lie. Spam, along with its nefarious relatives, continues virtually unabated and despite the passage of the CAN-SPAM Act in early 2004. In fact, the nuisance is growing.

Some of the side effects of spam can be far more damaging than just having to delete an unwanted offer of prescription drugs or low mortgage rates. A specific type of spam, called phishing, can deliberately trick users out of their personal or financial information. In addition, spam continues to be the preferred way to deliver and duplicate damaging viruses and worms.

Our goal is to help you minimize the damage and even to help protect you against spam through technology and user education.

As always, we're eager to hear what you think about this issue and to receive suggestions for topics you would like to see covered in the future. Please send an email to Newsletter Comments.

Thank You,

All Covered

In this issue...

What is Spawned from Spam?
Spam is More Than a Nuisance

The junk food of email isn't going away. In fact, it's on the rise. Some organizations don't realize the costs, from lost productivity to damage as a result of viruses and worms, or even financial or personal information theft. Read more…

Tech Talk
Phishing: It Sounds Phun, but It's No Laughing Matter

PayPal, Wells Fargo, Citibank, Visa, Washington Mutual, e-Bay – each of these well-known companies were and continue to be used in phishing scams. Don't let a fishy-sounding email and an imposter web page fool you. Read more…

Virus Update
September 2004

The number of Level 3 viruses released in the last two months was down dramatically since the first quarter of 2004's onslaught. Two variations of the Beagle virus and a variation of Mydoom are featured in this update. Read more…

Customer Spotlight
Ike Kligerman Barkley Architects

Ike Kligerman Barkley Architects, high-end residential architecture and interior designers, use All Covered to help them maintain a reliable, secure and up-to-date IT network. Read more…

Tech Tip
Is Someone Watching You?

Have you noticed your PC slowing down? This could be due to spyware, programs secretly loaded onto your computer that track your movement on the Internet. Read more…

Quick Tip
Fall-Proofing Your Home

With summer nearly behind us, it's time to think about getting your home ready for Fall and cooler weather. Here are some things you can do to ensure your home is ready for the change in seasons. Read more…

What is Spawned from Spam?
Spam is More Than a Nuisance

Is your email inbox choking on spam? Does it seem like the number of unsolicited emails is increasing? According to spam vendors such as Brightmail and Postini, spam messages have continued to rise even with the passing of the CAN–SPAM act in early 2004. Analysts estimate that the number of spam messages will continue to increase because of the low cost and ease of sending mass email; in fact, the brunt of spam-related costs and resources are borne by the recipient or company (server storage space, lost productivity, software/hardware to combat spam). And the worst news may be this: spammers are getting better at getting around spam filters.

What are the side effects of spam?
Is email spam really more than just a nuisance? Yes, and here's why: spam can wreak havoc on your computer, even affect your personal online accounts. But there's more.

Lost productivity and increased costs. For many people, it's not uncommon to spend 30 minutes or more a day deleting unwanted email or reviewing lists of blocked emails. That adds up to 15 work days a year! In addition, companies are spending thousands of dollars annually in hardware and software to combat spam. In fact, Ferris Research reports that companies spent more than $10 billion last year to combat spam.

The courier of choice for viruses and worms. Spam (or what looks like spam) is also used to carry viruses and worms. Clever hackers use email engines to send worms and viruses from infected computers. These viruses are so insidious that they even "spoof" (or fake) the sender's email address so that it appears as though the message is from someone you know. (That should get you to think twice before you flame a colleague or friend about sending you an email spam or virus.) Once your system is infected, viruses and worms can turn off your anti-virus software, spam everyone in your address book, or worst case, make your computer vulnerable to a hacker who may take control of your system and steal valuable information. Read about the latest viruses and their common characteristics in this volume's Virus Update.

Don't get hooked by a phishing scam. Another side effect of spam is phishing. Internet scammers cast (or phish) for people's financial or personal information such as credit card or bank account numbers, Social Security information or other sensitive personal information by tricking people into thinking a spam message is email from a legitimate site. The way it works is deviously simple: a spam email lures the reader to verify their account number and password on a web page, the link for which is contained within the message. In fact, the web page is to a dummy site and the phishers steal the reader's critical information. Find out how to spot a phishing scam in our Tech Talk.

Be Your Own Filter
Here are some tips to help you minimize the amount of spam that ever enters your email inbox.

Be careful about giving out your email address. When you are filling out forms or applications, don't give out your email unless it's absolutely necessary. If you must, read the privacy policy on the site to determine if your email address can be given or sold to other companies. The same is true about publishing your email address to a user group, newsgroup, directory (white pages for example) or other public web site. Spammers can get your email address from these places. Lastly, when doing any kind of transaction that includes your email address, look to see if there's an automatic "opt-in" box at the bottom of the page or form, or in small print and deselect it if you don't want to receive ongoing news, promotions, newsletters, etc.
Do not reply to spam, even to unsubscribe. Unsubscribing or replying to spam only shows the spammer that your email address is a legitimate or "live" address. On the other hand, if you have subscribed to receive news, newsletters or other types of ongoing information from a site, if you unsubscribe, your request will be honored. Legitimate sites must abide by your request, otherwise they could be fined. Any serious business will not risk their reputation or company by not following these guidelines.
Create one or more accounts for online usage. It is wise to have one or two other email accounts, outside your main business email. By having an additional email account, especially for online subscriptions, online shopping, etc., you can protect your business email account from getting overloaded with spam. If your email account somehow gets into the hands of spammers, you can just cancel it or stop using it. However, create and use these free email accounts with caution – if you create too many, you may not remember which ones you have used for which sites. You may soon find that you've overloaded yourself with multiple email accounts and lost sight of the purpose of these alternate accounts.
Report spammers. If you see repeat offenders sending you spam, report them to the Federal Trade Commission (www.ftc.gov) and your Internet Service Provider. Many spammers are located outside the U.S. and may be difficult to prosecute, but nevertheless, it's worth the effort to report them.

Technology Solutions
Even if you're diligent about protecting your email address, spammers are still good about guessing email business addresses. For that extra inoculation from spammers, you or your company should consider implementing some type of technology to trap the spam before it reaches your inbox. Here are just a few types of spam solutions that you might choose to use.

Desktop software. This is installed on each PC/mail box and requires installation, configuration and ongoing management by the individual user. This kind of solution could be used in conjunction with other alternatives listed below.
Server software or hardware appliance. Both of these solutions generally achieve the same results, but are implemented in a different manner and vary in price. Spam server software is installed on your email server and filters email before arriving to an email inbox. A spam appliance is a hardware device that is placed on the network entry point and filters email before arriving to an email inbox. Both solutions are centrally managed and can be globally configured for companywide settings.
Managed service solution. A managed solution is similar to a server or appliance solution, but all the spam management is done by another company and the solution is managed off-site. These solutions are generally more comprehensive and normally include spam filtering and anti-virus checking.

No matter what solution you choose, the bottom line is that every organization should have some type of solution installed to protect against spam as well as best practices or written guidelines on what individuals can do to proactively protect themselves against getting onto a spammer's list.

If you need assistance in selecting a spam control solution, contact your local All Covered office. To find the location nearest you, go to www.allcovered.com/locations.asp.

Tech Talk
Phishing: It Sounds Phun, but It's No Laughing Matter

What is Phishing?
Phishing is a scam – a dangerous scam – that lures its victims using spam. And while phishing doesn't harm your computer as a virus or worm can, it can damage something even worse: your personal financial accounts.

A phishing email appears to be from a business that you may deal with regularly, such as your bank, an Internet service provider (ISP), an online payment service or a credit card company. The scammers instruct you to "update," "validate," or "confirm" your billing information in order to keep your account active. The email contains a link to an identical, but fraudulent web site, where you are asked to confirm personal information, such as your name, address, phone number, Social Security number, account number, or credit card number. Because the site has the business' logo and look, many people are tricked into sharing this sensitive information. That's when the damage is done. It's as if someone stole your wallet or purse. The scammers now have the ability to order goods and services or apply for credit using your credentials. They may even steal your identity.

Phishing is especially devious because it abuses a person's good and trusting nature to do what we're told, especially when it appears legitimate. These scammers prey on people who aren't as knowledgeable or experienced with online banking; so they miss many of the clues that make this scam smell, well, fishy.

For example, phishing messages often contain awkward wording, or the URL is a string of numbers such as 111.22.33.44 instead of words, or the navigation buttons (Go, Next, Submit) look out of place compared to the rest of the web page.

Don't Get Caught in a Phishing Scam
With these fraudsters lurking on the 'net, what can you do? According to the Federal Trade Commission, to avoid getting caught by a phishing scam:

If you get an email that warns you, with little or no notice, that an account of yours will be shut down unless you reconfirm your billing information, do not reply or click the link in the email. Instead, practice safe log-ins by opening a new browser window and entering the web site's URL; log in using your standard account information and password, and then make any necessary changes. When you are done, remember to log out of the site and close the browser window. Alternatively, you can contact the company via phone to verify that a request was sent from them.
Avoid emailing personal and financial information. Before you submit any financial information through a web site, look for the "lock" icon on your browser's status bar, or check that the web site address has "https" in it for secure transmission.
Review your credit card and bank statements as you receive them to determine if there are any unauthorized charges. If your statement is late by more than a couple of days, call your credit card company or bank to confirm your billing address and account balances.
Report suspicious activity to the FTC. Send the actual spam to uce@ftc.gov.

"What if I'm a Victim?"
If you fall prey or believe you may have been scammed, here are some steps to follow in case you've given out personal financial information:

Report the theft to your bank, credit card company, or business where the account information was stolen as soon as possible.
Cancel your account and open a new one.
Review your billing statement carefully after the loss and report unauthorized charges. It's best to send written confirmation to the company. They are likely to send you a form to report unauthorized activity.
Make sure you understand your maximum liability with your bank, credit card company or other business if there is fraud. In many cases, federal law mandates the maximum liability.
Immediately file a complaint at www.ftc.gov. Visit the FTC's Identity Theft web site at www.consumer.gov/idtheft. to learn how to minimize your risk of damage from identity theft.

There are several other great web sites that you can visit for more information about phishing or identity theft. We suggest www.antiphishing.org or www.usdoj.gov/criminal/fraud/idtheft.html.

Virus Update
September 2004

The good news is that there were only a few Level 3 (medium risk) or higher viruses since our last update. The bad news is that the "old standards" are still being spread via email. Continued vigilance is an absolute must to maintain control over these worms and viruses.

Beagle Worm
Beagle (also known as Bagle) spreads via email, has random subjects, bodies and attachments and can also open a back door on your computer. This worm has variations that attempts to terminate antivirus software. The Beagle worm can also copy itself to shared network folders and could spread via your local area network. The two variations seen in the last two months are a little more specific than previous variations.

In one instance the subject says "foto" with an accompanying attachment called "foto.zip" or "foto1.zip". Beagle.AQ also stops and disables the Internet Connecton Firewall/Internet Connection Sharing service on Windows 2000, XP and Windows Server 2003 machines. Beagle.AO uses "price" or "new price" in the body with a related attachment using the same name.

Mydoom
Mydoom.S (also known as Mydoom.Q or Ratos.A) spoofs or fakes the "From" address so it appears to be from someone you know. This variation is fairly specific, as well, using a common subject "Photos" and an attachment that includes the same name.

This worm gathers recipients from several sources such as the Windows address book to target and infect other recipients. It can also open a "back door" on your computer that may allow hackers to take control of your system.

This worm only affects computers running Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, and Windows XP.

Protecting Your Computer
All Covered continues to recommend the following approaches to protect users from viruses and worms:

Keep your antivirus software definitions updated.
Be wary of email attachments if you have not requested information or if the email and attachment name are vague (document, info etc.).

Make sure to look at the name of the attachment extension. Many worms use .pif, .scr and .exe extensions.

Watch for patterns of emails that have the same subject or attachment name, even though they are from different people. Many times the subjects and attachments are vague, such as "file, document or info."
If in doubt of an email or attachment, throw it away; ask the sender if they recently emailed you and give them the name of the attachment.

If you would like to be notified by e-mail any time a serious virus is on the loose, you can subscribe to All Covered's complimentary Virus Alerts.

Customer Spotlight
Ike Kligerman Barkley Architects

Ike Kligerman Barkley Architects is headquartered in New York City and focused solely on high-end residential architecture and interior designs. They employ a team of architects, interior designers, and administrative staff to handle up to 50 projects at a time.

In April of 2002, Ike Kligerman Barkley lost its longtime IT freelance technician. Over the years the firm was pleased with the service they had received from their technician yet the employees sensed that more could be done when it came to having a highly reliable, secure, and up-to-date IT network. According to Matthew Miles, an architect at Ike Kligerman Barkley, "In fact, some of us are so far removed from pencils and T-squares that, if the network went down for an extended period, we wouldn't know how to work."

Once All Covered became the strategic IT partner for Ike Kligerman Barkley, they helped the firm turn their aging IT network into a robust, highly reliable infrastructure. "Three or four years ago, we were clearly behind in IT technology. But, in the last two years especially, we've made an incredible leap forward with new workstations, servers, storage capability, and software," said Miles. "We've had to make investments, sure. But I'm afraid to think how much more we might have spent, and how much less we would have gotten in return, if we didn't have a knowledgeable and trusted IT partner in All Covered." All Covered also delivers All Covered Care services to Ike Kligerman Barkley Architects.

To find out more about Ike Kligerman Barkley Architects and their services, contact them by phone at (212) 268-0128 or visit them on the web at www.ikba.com.

Tech Tip
Is Someone Watching You?

Spyware is the dirty little secret of web browsing. It consumes system resources, slowing computers to a crawl – or worse, rendering them unusable.

What is spyware? Spyware is loaded secretly onto your PC to gather information on your Internet traffic patterns – which web sites you visit and how often. This allows nefarious web sites and third parties to track your movement on the Internet. The information is collected, usually without your knowledge, and sent to third party vendors without your consent. Almost every web site you visit attempts to install spyware on your machine.

So, what can you do to protect your PC from spyware? Yahoo and Google are both introducing their own spyware blocking tool bars, and there are several free anti-spyware programs available to help you remove these files. One way to quickly stop spyware from being loaded is to change your Internet settings for ActiveX controls, but only if you are comfortable with changing these settings. If not, you should contact All Covered to assist you. For the highest level of security, but the least amount of web browsing functionality – meaning you may be prompted multiples times on sites that use ActiveX controls – you can change your settings to the following:

Highest Security Setting

In Internet Explorer, go to the Tools Menu, select Internet Options.
Select the Security Tab.
Click Internet Zone
Move the lever to High for the Security Level of that zone.

Custom Setting – Medium to High

In Internet Explorer, go to the Tools Menu, select Internet Options.
Select the Security Tab.
Click Internet Zone
Click the Custom Level… button and scroll down to the ActiveX Controls and Plug-ins settings. We recommend:

Download Signed ActiveX Controls – Enable
Download Unsigned ActiveX Controls – Prompt
Initialize and Script ActiveX Controls Not Marked as Safe – Prompt
Run ActiveX Controls and Plug-ins – Enable
Script ActiveX Controls Marked as Safe for Scripting - Enable

Spybot and Ad-Aware are two free anti-spyware programs that you can download and use to remove spyware from your machine. Spybot even has an immunization function to block spyware from being installed, but you still need to update the software and run it monthly or more often, depending on how often you surf the web. Just remember, if your system starts running slowly or if you notice your browser is being redirected no matter what your homepage settings say, you should check for spyware on your system and use the removal tools.

To download the free anti-spyware programs mentioned, go to www.download.com and search for Spybot and Ad-aware, then follow the instructions for removing the spyware.

A word of caution on anti-spyware products: many are scams that produce false positives to entice you to purchase their product. The worst of these are products nicknamed "extortion ware," according to PC Magazine. These products actually block removal of spyware, cause Internet connection problems, and sometimes are actually spyware themselves! One way to determine legitimate spyware from rogue spyware is to go to www.spywarewarrior.com. This web site lists nearly 100 spyware applications that have been tested or are suspected of being dubious or questionable.

Information Technology Solutions for Small to Medium size Businesses (SMBs)

All Covered is the only nationwide information technology (IT) outsourcing services company that focuses solely on the needs of SMBs and branch offices of larger companies. We can help your organization manage the spyware threat. All Covered can also help you strategize, manage, maintain and maximize your technology resources so you can maximize your business.

Quick Tip
Fall-Proofing Your Home

With Fall just around the corner, now is the time to begin preparing for cooler weather and, soon, the winter season. It is important to ensure that a few items around the house are functioning properly and that you have emergency precautions in place. Here are a few quick tips on preparing for the fall season:

Remove all birds' nests and debris from chimney flues and outdoor electrical fixtures. Nests covering or around electrical features can cause a fire. A bird nest atop a chimney flue may cause clogging in chimneys and prevent proper venting.
Check around the house for water leaks. Broken and cracked pipes can create major problems for a homeowner. Water damage can ruin valuable possessions as well as destroy your furnishings. Be proactive and check for leaks and cracks. It may save you time and money.
Review your fire escape plan with your family. Have a realistic fire drill with your family to ensure the plan for quick evacuation from your home or premise is well understood. You don't want to practice this for the first time when a real fire occurs.
Protect your home from frozen pipes. Insulating all exposed pipes can keep them from freezing or exploding. The more insulation that is used, the safer your pipes will be during the cold winter months.

There are many other proactive measures you can take for the upcoming months to protect yourself and your personal belongings. For more information on these tips and other ideas, go to www.statefarm.com.