Introduction to Email Watchdog

Email Watchdog is a gateway application through which all email sent from or received on your computer must pass through.  Email Watchdog removes any executable content that it finds in email attachments or scripted inside the email itself.  This includes any references to executable content from the Internet.  During removal, it will pop up an alert indicating the name of the attachment and the sender and subject of the email.  All executable attachments are removed and placed into a quarantine area on the computer’s hard drive.  Microsoft Office files containing macros will have their macros removed; files without macros will be allowed through.  A copy of the original file with the macros intact is then placed in the quarantine area.


Scope of today's virus epidemic
Scope of today’s virus epidemic

The practice of using email as the preferred method of distributing malicious code has dramatically increased the spread of viruses and the rate at which they spread.  According to a survey from ICSA, 87% of all virus infections originate from an email.1  Also, the likelihood of a company receiving a virus has approximately doubled over each of the past five years.2  Early viruses spread slowly through the transfer of floppy diskettes or by users transferring files over a network or attached to emails.  The recent epidemic of viruses like LoveLetter is the result of a programming shift that enables viruses to use the email program and the system address book to find potential victims.  This makes it possible to infect computers worldwide in just a few days.  Viruses like LoveLetter do not require the user to manually attach an infected file to an email and send it.  The virus itself creates and addresses emails and attaches a copy of the viral code for the next victim to execute.  The virus can use addresses from your Windows address book, Outlook contact list, unread email, or sent email.  The effect of this is that users must be suspicious of any email attachment, regardless of who sent it.

1 Lawrence M. Bridwell and Peter Tippett, ‘ICSA Labs 6th Annual Computer Virus Prevalence Survey 2000’, http://www.trusecure.com/html/tspub/pdf/vps20001.pdf, pg. 32

2 Lawrence M. Bridwell and Peter Tippett, ‘ICSA Labs 6th Annual Computer Virus Prevalence Survey 2000’, http://www.trusecure.com/html/tspub/pdf/vps20001.pdf, pg. 6


Difficulty of writing a virus

It used to be that writing a virus was a complicated task that required an in-depth knowledge of computers and complex computer programming languages.  Nowadays, a basic knowledge of computer programming and access to online documentation is all it takes.  Scripting and macro languages exist that are powerful and easy to learn and use.  Windows 98, ME, and 2000 all come with the VBscript and Javascript scripting capability.  Windows 95 and NT can also run scripts in these languages if Internet Explorer 5 is installed.  Microsoft Office versions 97 and above include the VBA macro language.  VBA adds functionality to Office applications, but also enables the creation of malicious code.  Numerous programming examples exist on the Internet to aid the user in creating their own scripts and macros, including instructions on accessing the Outlook application and the system address book.

This ease of programming with scripts and macros, combined with the readily available online documentation, account for the high number of macro and script viruses that get created every day.  Among the viruses that were in the wild (i.e. actively infecting computers) in September of 2000, 93% of them were script or macro viruses. 1  Two of them are the infamous Melissa and LoveLetter, which exploit the Microsoft Outlook email application to spread copies of themselves by email.  Furthermore, it is even easier for a malicious code programmer to take an existing macro or script virus and modify it to create a new variant that will be unknown to conventional antivirus scanners.  As an example, the LoveLetter virus has 28 variants.

1 ‘VB Prevalence Table, September 2000’, http://www.virusbtn.com/Prevalence/200009.html


Problems with conventional anti-virus programs

Most anti-virus software programs find viruses by searching files for a unique signature; a fingerprint that uniquely identifies a file as being infected.  With this approach, a virus signature must exist in order for the virus to be found.  Some anti-virus programs analyze scripts and macros and use heuristics to guess whether a file is harmful.   Anti-virus programs, however, have been slow to adopt heuristics.  The LoveLetter virus used the same technique as Melissa to mass mail itself, and yet, very few anti-virus programs were able to catch it.  No matter how good these heuristics are, new viruses will come out that use undiscovered methods.  To deal with them, an anti-virus program must create a signature and distribute it.  It takes, on average, six hours to get a sample of the virus and create a signature to identify it.  According to the survey by the ICSA, “increasingly, it is common for a virus to be released and to be infecting a large proportion of corporations within a few hours, or at least within days”. 1  This poses a danger for the home users and corporations who are the first to encounter this new virus.  In addition, for an outbreak like LoveLetter, many people cannot download the newest signature files because the antivirus vendor’s download sites are clogged with customers trying to download them.

1 Lawrence M. Bridwell and Peter Tippett, ‘ICSA Labs 6th Annual Computer Virus Prevalence Survey 2000’, http://www.trusecure.com/html/tspub/pdf/vps20001.pdf, pg. 51


Viruses that infect when reading emails

It used to be a myth that simply reading an email could cause your system to become infected.  That was true before email programs were capable of processing HTML formatted email.  HTML formatted emails, like web pages, can contain small script programs that are capable of calling ActiveX controls.  These script programs execute when you view, or even preview, the email.  ActiveX controls are small programs that provide additional features for Web pages or a Web browser.  Email programs normally restrict ActiveX controls.  Only ActiveX controls that are deemed safe are allowed to execute.  However, humans are prone to error and there have been several unsafe ActiveX controls that were marked as being safe.  In response, Microsoft has issued patches to mark these controls as being unsafe.  Nevertheless, viruses have used these ActiveX controls to successfully infect computers.  Kakworm, for instance, has been active in the wild since December of 1999, well over a year.  As more ActiveX controls are created, viruses will take advantage of newer ones that have been mistakenly marked safe for scripting.

Besides enabling viruses, security holes also allow hackers to steal confidential information and invade your privacy.  Just recently, a security hole was disclosed that could be used to find comments made when forwarding an email.  A simple javascript inside the email enables this vulnerability.


Customizing Email Watchdog
Customize Email Watchdog

version 1.00, build 1.009

To customize Email Watchdog, double-click on [image] in the system tray, or right-click on it and select Options.  You will get a window where you can set the following options:

Macro Options

The default option is to remove all macros that exist in Microsoft Office files.  Other options are to only remove suspicious macros, or to not remove any macros at all.

Active Content

The default options are to remove all scripts in email, remove all executable files attached to emails, and disable all ActiveX controls in email.  Any of these options can be disabled.  ActiveX controls are disabled by removing all references to them from the email.  These references cause ActiveX controls that exist on your computer or on the Internet to execute.

Quarantine

With the default option, executable files and Microsoft Office files with macros attached to emails are placed in the quarantine directory.  This lets you access the removed executable files and macros.  You can limit the size of the quarantine directory with a maximum size.  The quarantine will be emptied when it reaches the maximum size.  You can also have the quarantine emptied after every specified number of days.


Disable Email Watchdog

To disable Email Watchdog, right-click on [image] in the system tray and select disable.  To re-enable it, right-click on the icon again and select enable.


Browse the Quarantine

The quarantine is located in the path c:\emailqua.  All files have the extension ndp appended and have the icon [image].  To open a file, double-click on it.  This will open a dialog box that asks you if you are sure about opening the file.   The dialog box will show the sender and subject of the email the file came from.  It would be smart to scan the file with an anti-virus program before continuing to open it.  This can be done with most anti-virus programs by right-clicking on the file and then selecting the scan option.  After the file is opened and closed, an option will be given to save it with its original name.


View the Report

To view the report, right-click on [image] in the system tray and select Report Viewer, or select Start Menu –> Programs –> Broderbund Email Watchdog –> Report Viewer.  Email Watchdog reports everything that it removes from emails, and every file that it quarantines.  The sender and subject of each email is shown to identify each email.  Email Watchdog also reports when a quarantine file has been opened.

With the report viewer, you can delete the report, refresh it, print it, sort it, search for text, save it to a file, and copy selected report entries.  The report can be saved to a tab delimited or comma delimited file that can be imported into Excel.

Clicking on a column heading of the report will sort it.  Double-clicking on a report entry will give you a dialog box showing the information in the report entry.  With this dialog box you can go to the next or previous entry.


Support

Technical Support is available to assist you with any issue regarding this product.  Technical Support can be reached through the internet at:

http://support.broderbund.com

The Technical Support Web Site contains common questions and answers and an Interactive Technical Support Contact Form for an email response to your question.

Broderbund Technical Support

1700 Progress Drive

Hiawatha, IA 52233-0100

Attn: Broderbund Email Watchdog


License
SINGLE USER SOFTWARE LICENSE AGREEMENT

SINGLE-USER PRODUCTS

THIS IS A LEGAL AGREEMENT BETWEEN YOU (EITHER AN INDIVIDUAL OR AN ENTITY) AND BRODERBUND LLC, AND ITS SUBSIDIARIES AND AFFILIATES (“BRODERBUND”).  THIS AGREEMENT IS GOVERNED BY THE INTERNAL SUBSTANTIVE LAWS OF THE STATE OF CALIFORNIA (AND NOT BY THE 1980 UNITED NATIONS CONVENTION ON CONTRACTS FOR THE INTERNATIONAL SALE OF GOODS, AS AMENDED). BY INSTALLING OR USING THE SOFTWARE, YOU AGREE TO BE BOUND BY THE TERMS OF THIS AGREEMENT.  IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, REMOVE THE PRODUCT FROM YOUR HARD DRIVE AND PERMANENTLY ERASE ALL COPIES OF THE SOFTWARE. IF YOU ARE THE ORIGINAL INSTALLER OF THE SOFTWARE YOU MAY PROMPTLY RETURN THE SOFTWARE (INCLUDING PRINTED MATERIALS) WITH PROOF OF PURCHASE TO THE PLACE WHERE IT WAS PURCHASED FOR A FULL REFUND OF THE AMOUNT PAID OR STORE CREDIT (AS APPLICABLE).

BRODERBUND SOFTWARE LICENSE

GRANT OF LICENSE.  This License Agreement permits you to use one copy of Broderbund software (the “Software”), which may include electronic documentation, on a single computer/workstation. The Software is “in use” on a computer when it is loaded into the temporary memory (i.e., RAM or Cache) or installed into permanent memory (e.g., hard disk, CD-ROM drive, or other storage device) of that computer. This License does not constitute a sale and does not authorize a sale of the Software or anything created thereby. All intellectual property (including copyright, trademark and patent) in the Software, including all animations, audio, images, maps, music, photographs, video, and text incorporated into the Software, are owned by Broderbund and its affiliates, suppliers and licensors, and are protected by United States laws and international treaty provisions.  Broderbund and its affiliates, suppliers and licensors retain all rights not expressly granted. You must treat the Software like any other copyrighted material, except that you may make one copy of the Software solely for backup or archival purposes. You may transfer your rights under this Agreement on a permanent basis provided you transfer the license granted by this Agreement, and the Software and all associated printed materials, and you retain no copies, and the recipient agrees to all of the terms of this Agreement.

•	You may not use the software on or over a network or any other transfer device (including the Internet) except in a manner using the network and online functions included in the Software, if any. Use of the Software on more than one computer constitutes copyright infringement and may be punishable by civil fines, criminal penalties, or both.

•	You may not rent or lease the Software, but schools and libraries may lend the Software to third parties provided the Software is in CD format and each end user is given a copy of this License Agreement which will govern the use of such Software.

•	You may not modify, translate, reverse engineer, decompile, or disassemble the Software, except to the extent that this restriction is expressly prohibited by applicable law.

•	You may not remove any proprietary notices or labels in the Software.

•	You may not copy the printed materials accompanying the Software or distribute printed copies of any user documentation provided in electronic format.

•	You may not publicly perform or publicly display the Software.

The restrictions contained herein apply equally to hybrid CD-ROMs which may contain multiple versions of the Software for use on different operating systems.  Regardless of the type of media you receive, you may use only the portion appropriate for your single-user computer/workstation. In the event you fail to comply with any of the terms or conditions of this license, your rights to use the Software will end, you will stop using the Software, remove the Software from your computer, and permanently erase all copies of the Software. You may not export or reexport the Software or any underlying information or technology except in full compliance with all United States and other applicable laws and regulations.

LIMITED WARRANTY

LIMITED WARRANTY.  Broderbund and its affiliates, suppliers and licensors warrant to the original installer of the Software, for a period of ninety (90) days from the date of purchase, that the media on which the Software is distributed is substantially free from defects in materials and workmanship. ANY AND ALL OTHER IMPLIED WARRANTIES WITH RESPECT TO THE SOFTWARE AND THE ACCOMPANYING WRITTEN MATERIALS, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE EXPRESSLY DISCLAIMED.

REMEDIES.  Your exclusive remedy will be, at Broderbund’s sole option, (a) the refund of the amount you paid for the Software or (b) repair or replacement of the Software, provided that the defective Software is returned to Broderbund (at Broderbund, Dock Door #9, 120 Hidden Lake Circle, Duncan, SC 29334. Telephone: (319) 378-7319) along with proof of the date of purchase within ninety (90) days from the date of purchase. This Limited Warranty is void if failure of the Software has resulted from accident, abuse, neglect or misapplication. Any replacement Software will be warranted for the remainder of the original warranty period or thirty (30) days, whichever is longer. Except as set forth above, the Software is sold “as-is”, without any express or implied warranties of any kind.

LIMITATION OF LIABILITIES.  IN NO EVENT WILL BRODERBUND OR ITS AFFILIATES, SUPPLIERS AND LICENSORS BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, ECONOMIC, COVER, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE, USER DOCUMENTATION, OR RELATED TECHNICAL SUPPORT, INCLUDING, WITHOUT LIMITATION, DAMAGES OR COSTS RELATING TO THE LOSS OF PROFITS, BUSINESS, GOODWILL, DATA, TIME OR COMPUTER PROGRAMS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.  IN NO EVENT WILL BRODERBUND’S AND ITS AFFILIATES’, SUPPLIERS’ AND LICENSORS’ LIABILITY EXCEED THE AMOUNT PAID BY YOU FOR THE SOFTWARE REGARDLESS OF THE FORM OF THE CLAIM (INCLUDING, WITHOUT LIMITATION, ANY CONTRACT, PRODUCT LIABILITY, OR TORT CLAIM). BECAUSE SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU.

MISCELLANEOUS

Broderbund may cancel, change, modify, discontinue, terminate or charge a fee at any time for any reason for the online services available in conjunction with this Software.

No change or modification of the License will be valid unless it is in writing and is signed by Broderbund. The provisions of this Agreement are severable; if any provision is held to be invalid or unenforceable, it will not affect the validity or enforceability of any other provision. If the Software was acquired outside the United States, then local law may apply.

U.S. GOVERNMENT RESTRICTED RIGHTS.  The Software and user documentation is provided with RESTRICTED RIGHTS AND LIMITED RIGHTS.  Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 or subparagraphs (c)(1) and (2) of the Commercial Computer Software--Restricted Rights at 48 CFR 52.227-19, as applicable. Broderbund LLC, 500 Redwood Blvd., Novato, CA 94947 U.S.A.


Remove all macros from any Microsoft Office file.


Remove only suspicious macros from any Microsoft Office file.


Do not remove macros from any Microsoft Office file.


Remove any scripts.


Disable ActiveX controls.  This is done by removing any references to them.


Remove any executable attachments.


Removed executable files are placed in the quarantine directory.  Microsoft Office files that had their macros removed are placed there also.  They still contain their macros.


Limit the maximum size of the quarantine directory.  When the quarantine reaches the maximum size, it is emptied.


Empty the quarantine after every specified number of days.


Place no limit to the size of the quarantine directory.


Delete the contents of the quarantine directory.


Advanced options.


Accept any changes made and close the dialog box.


Cancel any changes made and close the dialog box.


Provide help for this dialog box.


Email Watchdog removes potentially harmful scripts from the body of email messages and quarantines any executable attachments, including Microsoft® Office files containing suspicious macros.

To examine a file in quarantine, open Windows Explorer and browse to:

C:\EMAILQUA

If you attempt to open a file in quarantine, a subsequent alert will appear.  This is for your protection.  Files in quarantine should be considered viral until proven otherwise.