I went to a friend’s house the other evening, and installed Spybot Search & Destroy and avast! on his computer. It got rid of 30 viruses and trojans. He said he got viagra spam that said it was from his own address. He’s been using IE and Outlook. The popups in IE execute viruses, and something infected his address book, or worse.
I told him that we have to wean him off of Microsoft browsers and mail programs, and get something that isn’t so prone to hacking and executing viruses. I figure to get him Firefox to start. But he has a business, and all of his e-mail functions are handled by Outlook. I know nothing about Outlook, I refuse to use MS products to access the internet. But I do want to help him, if possible.
Is there another mail program that does pretty much exactly what Outlook does, that’s more impervious to malicious attack? He’ll need something that he can export all of his current mail and whatever else is in Outlook to, and have it perform the same mail managing tasks. Does such a program exist? Is it farily straightforward? This is out of my realm of experience, so I come seeking the knowledge to help him out.
Can he not just be a bit more careful? I use Outlook and sometimes Internet Explorer, I’ve never had a serious problem* with viruses or spyware (using AVG.)
One option he could look at is migrating to gmail but using Outlook to access his gmail account. That way the gmail server is taking the initial email and filtering it using its junk mail filters before it gets to his computer.
*I pick up something malicious once every six months or so.
Crikey. If Spybot and Avast detected and removed that big an infection, it’s actually quite possible there will still be something else on there that they didn’t detect. I’d run a few more scans with a few more tools, first (SuperAntiSpyware and Trend Housecall, for example).
I think Thunderbird is fantastic for email - better in many ways than Outlook, because of its pluggable design (and the huge range of plugins available for it) it deals with spam quite nicely. But it doesn’t have the collaborative integration that you get with Outlook, and even though you can get a calendar plugin for it, again, the integration isn’t like Outlook has (I can’t - at least as far as I can tell - flag an email to become a ‘to do’ or appointment entry in my calendar, for example).
Without knowing a bit more about which features your friend uses, it’s difficult to say what other client might be a suitable replacement.
Apparently not. If it were even on his list of priorities, he wouldn’t be in this predicament. It doesn’t help any that his daughter isn’t any more knowledgeable or cautions about internet security, either. The first virus caught on boot-time scan was in an .exe file in her download folder. This is why I want to try to find something that they can use in safety, without having to take a course in how to use it, because it ain’t gonna happen.
I’ve been reaing good things about Thunderbird. I will research it, look at its features, and then try to determine which functions he uses Outlook for, that can be replicated.
Just because the spam said it came from his email does not mean it actually came from his account, let alone his Outlook. It’s vastly more likely the ‘from’ address was just spoofed, which is trivially easy.
I’d just have him run with good anti-virus software and be done with it.
From your description, I have a hard time believing that the problem is Outlook and IE. I think it’s far more likely the problem exists between the desk and the chair
Outlook is actually pretty good at preventing executables from being downloaded and run. I’ve had to jump through hoops at times to get legitimate executables sent via attachments to get to their recipients correctly.
You can get the guy and his daughter changed over to all non-MS stuff, but I’d be willing to bet that they’re going to have the same problem in a few months.
Firefox and Thunderbird aren’t a panacea against threats, either. As Athena points out, careless users make the best software’s capabilities moot when it comes to social engineering attacks. And, as a recent episode with Firefox demonstrated, the vast array of plug-ins is actually a security weakness for those applications.
Have you considered trying to get them to use a Webmail service instead? No downloading necessary. They should be able to check their non-Gmail email addresses using Gmail, for instance. Or they could use their ISP’s webmail service.
Attachments can still be downloaded and the computer infected when using webmail (happened in my previous job). As pointed out, this is fundamentally a PEBCAK problem.
An antivirus/antispam/safe surf security suite may provide a better level of protection. I don’t know if the newer AV suites (Norton, McAfee…) work hand-in-hand with Mozilla/Thunderbird, though, but I’d still consider moving away from the “I’ll let anything in that bats its eyes at me” Microsoft apps.
Would the users be amenable to surfing and emailing on a Macintosh or Linux box? Most viruses target Windows apps.
