How to Reduce Spam and Virus Email

My main email address was virtually spam-free for years. Unfortunately, one day I started to get bombarded by virus email. Possibly, somebody who had my address in their address book contracted a virus. This virus uses the victim’s address book to mail out copies of itself, picking a random name to put in the From: and To: parts of the email. Of course, after this, my email address gets distributed all over the net and not surprisingly, managed to get into the spammers’ email lists.

After trying to bear with it for a month, I’d had enough and actively tried to find a solution that didn’t require me ditching my long-time email address. Below are some of the tips I have learned along the way. I’ll try to limit my software suggestions to free or cheap solutions to the problem. As I am a Windows user, my suggestions are usually also Windows-based solutions.

Filtering:

• Use antivirus software to catch virus email. I’ve used both the free versions of AVG and avast!, with avast!, in my opinion, being the better of the two in terms of presentation, fuss-free automatic updates and has the full functionality of the paid version.
• Enable junk mail filtering on your mail client. If it doesn’t have one, or it’s inadequate, use third-party plugins or get a POP3 proxy that will do the same. One of the more popular email filters is MailWasher. I’ve been using an Outlook plug-in called SpamBayes. This requires you to train it to differentiate between ham (good email) and spam. Another similar software is POPFile.
• Enable spam and virus filtering through your ISP if they provide it, or switch to email providers like Google Mail and Yahoo! Mail that have them (I think I remember reading that Yahoo! Mail only scans for viruses on demand).
• Avoid free webmail providers that spam you. I’ve had free email addresses from certain webmail providers that have never been used and yet they received spam constantly. Good thing they were throw-away addresses. Of course some spammers use a dictionary attack to guess email addresses such as jsmith@someemailprovider.com and admin@someemailprovider.com so maybe it wasn’t the webmail provider’s fault. Maybe.

Prevention:

• Do not put your email address in web pages, chat rooms or newsgroups. Spammers have software that trawl the net, looking for any piece of text that look like email addresses. If you have to leave your address at a public place, disguise it by using techniques like these: jsmith (at) someemailprovider (dot) com, jsmithNOSPAM@someemailprovider.com. Anybody really wanting to contact you will hopefully be intelligent enough (and motivated enough) to get past the disguise. Displaying your email address as a bitmap file, javascript or Flash are also quite effective.
• Use antivirus and antispyware software to prevent malware that may use your computer to send out virus emails or spam. I quite like Microsoft Defender. Ewido also has a good reputation.
• Don’t open suspicious attachments, especially ones that are executable e.g. those that have extensions of .exe, .com, .bat, .pif. Some malicious attachments masquerade as images e.g. have extensions of .jpg or .gif but are actually executables. Some of these come from people you don’t know so they are easy to catch. Harmful attachments that come from those that you do know can still be detected if the subject of the email or the written content is out-of-character from the person that you know. A little harder to detect are authoritative emails that pretend to have come from your internet provider or some other authority, asking you to run the attached software to protect you from something nasty. Attachments may turn out to be malware such as viruses, spyware, trojans or worms. Some worms can carry payloads that can turn your computer into a spam zombie i.e. unknown to you, your computer will be doing the spammers work for him.
• Don’t trust software from questionable sites. Software from sites containing warez, porn, free screensavers, free electronic greeting cards, etc. may contain malware.
• Use a firewall. This can prevent worms and hackers from entering your system. Or if they got in, a firewall can notify you and block attempts by malicious software to get out onto the net. I use Kerio Personal Firewall. Another good one is ZoneAlarm.
• Keep your software up-to-date. Hackers, spammers and malware authors are ingenious and will try many ways to infiltrate your computer, sometimes using techniques that your software may not have accounted for. Always apply legitimate patches to all your software, especially the operating system, as soon as possible to prevent known weaknesses from being exploited. Similarly, your antivirus and antispyware utilities will need to be regularly updated to keep up with the ever increasing number of viruses and spyware.
• Configure your mail client to not display images in HTML-based email. This prevents web bugs embedded in HTML-based email from loading and thus verifying to a possible spammer that your email address is active. If your mail client cannot do this but you have a flexible software firewall (Note: ZoneAlarm Free isn’t one), you can set it to limit your mail client to connecting only to certain ports (e.g. ports 25 and 110, the standard ports for SMTP and POP3 respectively, and preventing it from connecting to port 8080, the standard port for HTTP i.e. the Web). The downside is that certain legitimate emails that use images in their email are also stopped from being displayed properly.Some free webmail providers may provide this feature of deactivating images in HTML-based email, but if they don’t, try to avoid opening obvious spam email to minimise the risk.
• Don’t reply to spam. Replying to spam notifies the spammer that you have an active email address and will result in you receiving more spam. However, a lot of spam these days have spoofed senders i.e. a fake email address is used, or it could be the real address of some innocent bystander. There are some software, like MailWasher, that allow you to send a “bounce” message back to the sender, fooling the sender into thinking that your email address does not exist. This would be useful if the sender is the spammer but maybe not so much if the sender was spoofed and it went to a poor, innocent computer user just like you.
• Use disposable email addresses. Google Mail’s plus addressing, Yahoo! Mail’s AddressGuard and spamgourmet among others gives you the ability to create disposable email addresses for those times when you want to enter competitions, email subscriptions, etc. from companies that you don’t completely trust. I suggest that you do this to almost everyone, even those you trust (you’ll never know, your dear friend might send some cheesy chain letter to everyone he knows with your email address, and everyone else’s, clearly visible in the To: or CC: field). This way, you can filter out mail that are using the compromised email addresses and identify which flaky companies have been sharing your email address. Of course, when it comes to online banking, it might be more secure if you give them your original email address.Personally, I’ve been using the mail-forwarding feature of www.cjb.net. Yes, they are a nasty, spy-ware injecting, site-forwarding service which I, ummm, very guiltily, still use with my old website. They weren’t this bad when I first started using them a few years ago to give my site a user-friendly address. I severely suggest that you do not use any Internet Explorer-based browser without security settings on high when visiting a cjb.net site. In spite of all that, their email-forwarding service has been a nice convenience, giving me very flexible disposable email addresses and I haven’t noticed any spam due to them.
• Don’t forward chain letters. Using chain letters is one method where spammers can harvest email addresses. If you are feeling fearful that some ill-luck will befall you if you don’t immediately send that chain letter to 20 of your most trusted friends as the letter advises, please have the courtesy to use the BCC: field so that you are not compromising your friends’ email addresses.Sometimes you may get forwarded an email about some critical piece of information such as a new computer vulerability, or that a common household item is actually dangerous, or how to protect yourself from some dangerous people, or a little girl in hospital needs your help, or a fast way to make money, and then it would say that by forwarding that email, you get to help someone or help yourself. These are other common chain mail letters that are probably being used by spammers to harvest email. If you get one of these, do a bit of research to check its accuracy. One good site to use is Snopes.com. It collects a lot of stories being passed around by email and verifies or debunks it. Another place to look is the email itself. Does it mention some kind of well-known organization? If so, go to that organization’s website and see if it has something more to say about it. More than likely, you will find that the story is a hoax. If so, give the sender a note about the falsity of the information, show your sources to back it up, and mention that such types of email are used by spammers to get at email addresses. It also wouldn’t hurt if you can give a little advice on how they could check the facts on their own when they receive another one like it.

Three months later, my spam has reduced to a trickle. Maybe it was my lack of response to web-bugged email, maybe my address dropped off the spam list to be replaced by newer, confirmed active email addresses, maybe certain vulnerable computers that had my address were cured from being spam and virus zombies. Whatever the case, I think this list of tips would be helpful to the average computer user. If you have other tips, don’t hesitate to email me at mike (at) mikebliv (dot) cjb (dot) net or just leave a comment here.