WormStopper is one of the primary selections within the advanced options of Activeshield. Since it is designed to monitor my computer system for signs of wormlike activity, I believe that configuring this feature of Activeshield in order to protect my machine from worms is an excellent idea. Plus, it is easy to configure and use.
Understanding how worms get onto a computer and what they can do to disrupt the functioning of it is behind my decision to use WormStopper. After all, I think that it is very important to understand what it is that I am dealing with in order to make an informed decision regarding the security of my computer and personal information.
Worms are self-replicating programs that can run themselves. Although they are not usually dangerous, they can usurp a lot of my computer system’s resources. Plus, I know from personal experience how irate the people in my address book can get whenever a worm infects my computer and sends annoying emails to all of them. The cycle just keeps repeating itself with the people in their address book until the worm is removed from every computer that becomes infected.
To locate Activeshield’s WormStopper, I need to look at the configuration box for the advanced options. Within the box that pops up for advanced options of Activeshield, I have four options. WormStopper is to the far right hand side near the top of the box. The first entry that I can make beneath this is to enable WormStopper to function by clicking the box or to elect not to enable it by not clicking the box. Beneath this entry, I discover several additional options.
The first entry here allows me to set up pattern matching. Selecting this entry enables the WormStopper function of Activeshield to scrutinize network and email activity for any patterns that are considered basic to the manner in which worms behave.
I can also set up alerts that would notify me whenever an e-mail is sent to a number (one that I specify through a drop down menu) of recipients. Plus, I can also set up alerts that would notify me whenever a certain number (one that I specify through a drop down menu) of e-mails are sent within a certain number (one that I specify through a drop down menu) of seconds. Each of these thresholds is used to define what activity on the computer is identified as wormlike activity.
More specifically, these checkboxes let me set the parameters that define suspicious wormlike activity on my computer. Since I know that worms are often propagated via email, it only makes sense to target this type of activity as suspicious. After all, how many times have I sent one email to everyone in my entire address book? I know my answer is zero times, so this type of activity would definitely be a red flag for me. Yet, I might very well send a single e-mail to at least five people, so I wouldn’t set the parameter at five individuals.
Alternatively, computer users who have this application can leave these options blank and just rely on WormStopper to identify all suspicious activity for them. Plus, if WormStopper starts to flag personal emails, the options on these last two options can always be adjusted.
Susan Keenan | June 1st, 2008
You can leave a comment, or trackback from your own site.
