Re: Balsa and e-post viruses

["Scott Alexander" <oxygen dnc net>]

On 5 May 00, at 11:55, Preben Randhol wrote:
> I'm wondering if you have given some thought into what to do to
> prevent viruses like the resent ILOVEU virus from spreading through
> Linux systems? 
There are two main fronts that I've heard.  The first one has already 
been brought up here.  That is not using root.  This provides 
rudementry protection of the system as mentioned and is true that 
it does not protect user data.
The second is that you use a diversified environment.  At work,  
We use a few different e-mailers (only a few outlook clients for 
home users).  A bunch of our people got hit with the file,  Only two 
people actually opened it.  One was my boss and he just did it out 
of early morning stuber(this was 7:30).  To make matters worse,  
about 2 seconds later, a different person sent out the all-company 
warning saying don't open these letters....
The other main example i look at is the school I used to attend.  A 
pure NT/98 shop. They got nailed.  I told the admins before they 
switched from a staff outlook/student NS mailer to an all outlook for 
e-mail that they would run into this problem.  Well,  This is the forth 
time.  Previously they got lightly touched but the infection was 
pretty slow.  This time they got around 99% infected.  

Running a diversified client list would have slowed it down and 
allowed them to at least prevent any of the student machines from 
being infected or prevent the staff machines from being infected.  
One more thing to mention as to why it was 99%... The reason 
they wanted outlook was so they could use a simple address book 
that had every student and facualty member in it...<G> oh yeah  
briliant idea.

Anyway,  The diversified e-mail client system is probably the more 
effective to prevent the spread of the virus.  At max only 1/n (with n 
being the number of clients used assuming an equal distribution 
between clients) will actualy be capable of re-sending the virus.  
the rest may recieve it and run it, but won't be able to re-send it.


Scott