Home Office: Your Second Line of PC Defense

By Steve Bass, PCW Print Sep 25, 2001 1:00 AM

Complete Coverage

There's a new breed of Internet-borne troublemaker on its way to your PC. The tried-and-true security precautions you've been following (religiously, right?) will protect you to an extent, but to be really safe you need to take them to the next level. I'm telling you, security is a habit you'll be glad you formed.

I assume you've protected your PC with antivirus software and a firewall. Well, that's not enough anymore, and I have one word for anyone who doesn't believe me: SirCam. Call me paranoid, but ever since that Internet worm wreaked havoc this summer, I've suspected everything--e-mail attachments, downloads, and even some of the Web sites I visit. (Watching for black helicopters is another story.)

To get the upper hand, I use Finjan's free SurfinGuard 5.51, a cool utility that intercepts all the active content I download: e-mail attachments, Java applets, scripts, ActiveX files, and executable files. SurfinGuard flags the items and drops them into a virtual holding tank. It then pops up an alert box so I can block the file's activity, allow it to run, or--get this--watch to see what it's trying to do.

If the downloaded content attempts any hanky-panky, such as opening a network connection, deleting a file, formatting my drive, or changing the Registry, SurfinGuard stops the action cold. And the program doesn't depend on virus signatures the way an antivirus package does. Instead, SurfinGuard works by watching for abnormal behavior. The utility can monitor your Palm-to-PC sync connections and ICQ exchanges, and it can prevent your PC's microphone or camera from being turned on by a Trojan horse that makes its way onto your PC.

For a genuine eye-opener, visit Finjan Software and run the company's harmless Visual Basic Script, JavaScript, and executable attacks to see whether your PC's antivirus program protects you. SurfinGuard is a freebie for personal use. Go to our November Downloads list to obtain it and the other utilities mentioned here.

Hey, You're Infected

Reader Alex Censor has devised a neat trip wire of sorts that protects your e-mail contacts from infection and stops a virus in its tracks: Create an invalid entry in your Outlook or Outlook Express address book. Enter a bogus first and last name starting with a non-alphanumeric character ( *virus-trap, for example). Enter <illegaladdress as the e-mail address, being sure to include the less-than symbol. Outlook and Outlook Express will alert you that this entry is not a valid e-mail address (it's not supposed to be) and will ask if you still want to add it. Click Yes and then OK.

When a virus tries to mail itself to the addresses in your address book, this will be the first entry it encounters. The mail server will reject the fake address--and probably all other addresses in the message's 'To:' and 'cc:' fields. Some servers may send the message to the valid addresses, but you'll be alerted when the bogus address bounces.

Viruses may masquerade as a harmless file type, so you need to be able to see your file-name extensions (.exe, .gif, and so on). My user-group buddy David Jung wrote a free utility--called Extension Manager--that hides and unhides extensions, including ones that are usually viewable only by tweaking the Registry. Or use Ontrack's PowerDesk 4, a free Windows Explorer clone that shows extensions--and outdoes Explorer for managing files.

One of the SirCam attachments I received was loaded with some guy's Hotmail passwords. This unnerved me so much that I now use PowerDesk's DES key-coding encryption to encode all my sensitive files and folders.

Follow these steps, and the next time a virus attempts to send something nasty to your PC, just smile and say, "Return to sender. No forwarding address."

PC World Contributing Editor Steve Bass runs the Pasadena IBM Users Group. Sign up for his Home Office newsletter. You can write to him at steve_bass@pcworld.com.

SUMMARY