Computer News No. 108, Mar-Apr 2004

Preventive Measures against Port Scanning Attacks from Your PC

1. Recent spread of viruses on the Internet
2. Precautions against computer viruses and trojan horses

1. Recent spread of viruses on the Internet

Recently there has been a surge in spreading of computer viruses on the Internet, and  inevitably the University's campus network is affected.  In recent weeks, the Computer Centre has received reports about slow network connections in a few halls of student residence and occassionally at some other parts of the campus network.  Upon investigation, we  found that most incidents of degraded network performance were caused by virus infection of PCs in the certain halls and departments.  Most of such cases were related to the 32.HLLW.Gaobot (Gaobot) virus.

A computer infected with the Gaobot virus and other similar viruses will scan for vulnerability of other computers (especially PC's) on the network by probing a lot of the network ports of the operating systems of the computers (called port scanning), thereby trying to infect those computers with the virus.  This kind of port scanning usually generates an enormous amount of network traffic and will cause severe network congestion or even make the network halt.  These viruses not only affect the network traffic, they also slow the delivery of email because the email servers have to do so much work in scanning and filtering the viruses.  Besides affecting the email service, some viruses may generate lots of unnecessary HTTP traffic that would severely slow down Web surfing activities of all other users.

For those computers which we detected to be doing port scanning, we would send an alert email to their owners and disable their network accounts and their computers' network card addresses before the port scanning and virus infection of other computers aggregated and the network performance deteriorated to a very poor state.  Their network card address and network account will only be re-enabled AFTER we receive an acknowledging email from the computer owners confirming that the virus has been cleaned.

If you find that you suddenly cannot connect to the network from your office, hall residence or home, please follow the precautions described below.  Also, check your email to see if any alert email has been sent from the Computer Centre.  You can also enquire at our Help Desk or send email to ithelp@hku.hk to find out why you cannot connect to the network.

Please note that the Computer Centre would not send email attachments to our users, so do not open any attachment even if the sender address is from ithelp@hku.hk as it is likely a virus-infected email sent with a spoofed email address.

-Back To Top-

2. Precautions against computer viruses and trojan horses

As network attacks can be brought on by Windows vulnerabilities, computer viruses, or can be effected by trojan horses, we should take the following precautions at all times.

(1) Do all Windows Critical Update in your PC monthly or when reminded to do so.
(In the Internet Explorer, click the 'Tools' menu => 'Windows Update' => 'Scan for Update'.)

(2) Install anti-virus software on your computer and update regularly (daily) for the latest virus pattern from the vendor of your anti-virus software.

(3) Remove viruses and trojan horses: (Some viruses would disable anti-virus software and special tools are required to remove them.)

- See pointers to common viruses and removal instructions at http://www.itservices.hku.hk/faq/virus.htm.

(4) Do not open suspicious mail or attachments from unknown or suspicious sources. Always scan an attachment before opening it.

- If you are using Outlook or Outlook Express for reading email, be careful that the attachment preview setting might open a virus-infected attachment.

(5) Avoid file sharing with unknown or suspicious sources, such as using Peer-to-Peer (P2P) software. Many viruses can spread through P2P file sharing software.

-Back To Top-

Mabel Chau 
Tel: 2859 8934 
E-mail: chaumabc@cc.hku.hk