Has your PC become a spammer's botnet zombie?  | By Scott Dunn Worldwide spam traffic dramatically dropped after a major spam server was temporarily shut down last fall, raising public awareness of botnets: networks of PCs that have been turned into spam-spewing robots. Most antivirus applications are ill-equipped to stop this kind of malware, but you can reduce the risk of having your PC become zombified. |
Last November, a provider of Internet connectivity named Hurricane Electric pulled the plug on hosting company McColo. Immediately, the worldwide volume of spam dropped a whopping 65%, according to some estimates.
As explained by Brian Krebs in an article at WashingtonPost.com, Hurricane — one of the two companies McColo depended on for its Internet connection — took the action after the newspaper informed the provider of McColo’s role in hosting all sorts of Internet bad guys.
According to Krebs, McColo’s clients included “international firms and syndicates that are involved in everything from the remote management of millions of compromised computers to the sale of counterfeit pharmaceuticals and designer goods, fake security products, and child pornography via e-mail.”
The spam reduction held for a couple of weeks before rebounding, according to a Nov. 26 story at InfoWorld.com.
McColo’s servers didn’t send out the spam themselves. Instead, they provided the command and control for a vast network of PCs infected with malware. A collection of hacked PCs that have been turned into automated spamming machines is known as a robot network or “botnet.” Security professionals name these botnets after the malware that runs them, which include Asprox, Rustock, Cutwail, and Srizbil.
The malware creators rent their botnets to spammers, who in turn use the control servers to coordinate the transmission of huge amounts of junk mail, as explained in another Washington Post story.
Your computer could be a spam zombie and you might never know it. And if you think your security software is keeping your computer safe from botnet slavery, you’d better think again.
A recent study by security firm FireEye revealed that antivirus products detect bots less than half the time. The study tested AV programs using Virus Total’s free malware-scan service; consult that site for a list of the AV products tested.
Your four-step spambot-safety program
What can you do to prevent becoming a botnet victim? Although there are no perfect solutions, the following actions will help prevent your system from being compromised. (My thanks to the security blog written by Wiz Feinberg for many of the tips.)
Step 1: Keep your security products up-to-date. Although the FireEye study found little protection against bots from antivirus products, the study’s author, FireEye chief scientist Stuart Staniford, did note that “AV works better and better on old stuff — by the time something has been out for a couple of months, and is still in use, it’s likely that 70% to 80% of products will detect it.”
Update your antivirus program regularly with the latest patches and virus definitions; even if the app doesn’t catch the latest bot, your AV protection will reduce your risk of catching older malware still circulating around the Internet.
Step 2: Use a software firewall. By carefully monitoring your Internet connection, you’ll reduce your risk of infection by botnet malware. By default, the firewalls built into Windows XP and Vista monitor only incoming connections. The firewalls can be configured to monitor outbound traffic, but doing so is technical and problematic for most users. The differences between the firewalls in XP and Vista are described in this Microsoft TechNet article.
Many free, third-party software firewalls are bidirectional. Third-party firewalls sometimes require updates after you install Patch Tuesday fixes from Microsoft, but the added functionality of these firewalls can make this inconvenience worth living with. WS senior editor Ian “Gizmo” Richards describes the best products in his July 31, 2008, column.
Step 3: Get a free diagnosis. Some security products are intended specifically to combat the botnet plague. For example, RUBotted is a free utility from Trend Micro that sits quietly in your system tray and monitors suspicious activity (more info). If the program spots an infection, it alerts you to take action. The program is currently a beta, but it worked fine for me.
According to a post by security blogger Feinberg, RUBotted encourages you to scan your system with Trend Micro’s free HouseCall online virus-scanning service, which detects and removes many malware infections. Note that on my system, RUBotted uses 8MB of RAM.
Figure 1. Scan your system with Trend Micro’s RUBotted to ensure that your PC is bot-free.
Full disclosure: Feinberg’s blog is sponsored in part by RUBotted’s manufacturer, Trend Micro. But I don’t consider this to be an argument against using RUBotted.
Step 4: Try Norton AntiBot. Another bot-specific security product is Symantec’s Norton AntiBot (more info). This $30 program claims to monitor, detect, and remove bots before they can cause harm. Norton AntiBot uses behavioral analysis rather than definitions for specific bots and received an Editor’s Choice award from PC Magazine in 2007.
Security sites such as Marshal continue to report spam-bot activity. The buggers are delivering junk mail, malware, and other odious data to millions of victims. By using the above bot-prevention tools and techniques, you’ll reduce the chances that your machine’s a spammer’s helper.
Scott Dunn is a contributing editor of the Windows Secrets Newsletter. He has been a contributor to PC World since 1992 and currently writes for the Here’s How section of that magazine.
