Email Virus Filtering at UIUC

As almost everyone on campus is aware from the recent virus alerts, email-borne computer virus attacks directed at Internet users around the world are becoming more common. With one million daily email messages flowing through the Urbana-Champaign campus, a significant number of those emails are carrying viruses. The following information is provided to give faculty, staff, and students a sense of what CITES is currently doing to minimize the impact of these viruses and what some of our plans are for dealing with viruses and spam in the future.

 Where does email get filtered for viruses?

CITES offers two email services, the larger free service (Express) and the fee based Microsoft Exchange service provided by Departmental Services (predominately faculty and staff). At present the larger free email system only filters for particularly notorious viruses though CITES is planning to deploy a more rigorous virus filtering system in the near future. The Exchange service is already scanning for and removing all identified viruses.

How many copies of email viruses are filtered by CITES?

From 1/18/2004 through 2/3/2004, Cluster and Express filtered approximately 2.4 million copies of viruses, and CITES DS Exchange Services filtered over 300,000.

Is that all of them?

No.

·         For Express Email and cluster accounts these figures only represent the top 5 viruses of this period: Mydoom, Bagle, Klez, bugbear, and sobig.f. A number of other viruses are filtered for.

·         Email for CITES DS Exchange Services is filtered for all viruses.

·         Departmental email servers are not controlled by CITES and may or may not be filtered for viruses.

(See http://www.cites.uiuc.edu/101/email101.html for information on how email messages reach their destination.)

 Don't you filter all viruses from email?

Express Email is not yet filtered for all viruses. CITES is presently evaluating alternative architectures for scanning all incoming email to Express; we hope soon to release timelines for the implementation of such a process.

While CITES DS Exchange Services email is filtered for all viruses, users are predominantly faculty and staff, not students.

Since you're filtering virus-carrying emails, do I still need to run antivirus software on my computer?

Yes!  Not all email goes through campus filters. Additionally, some viruses and worms spread themselves by means other than email. Therefore, it is critical that you still run antivirus software, keep it updated, and continue using antivirus practices (e.g., using caution with email attachments, reading virus alerts) for the protection of your privacy, personal information, and personal files, and those of the other 50,000 people using the University network. Download free antivirus software from the Software WebStore at http://webstore.cites.uiuc.edu.

Are most people running antivirus software on their computers?

It's actually very difficult to determine how many people either install or update their antivirus software. We do know that between 1/22/04 and 1/30/04 (during which time the Bagle and Doom viruses were very active), CITES recorded 16,458 unique computers updating their antivirus software; of those, only 1,193 updated their software 9 times in that 9-day period. CITES recommends you update your antivirus software one or two times a day; it takes only 30-45 seconds. (See http://www.cites.uiuc.edu/antivirus/#winupdate for instructions on updating your Windows antivirus software).   

How can I find out if there is a virus attack or alert going on?

You can check any of these sites regularly:

• http://www.cites.uiuc.edu
• http://www.cites.uiuc.edu/security
• http://www.uiuc.edu look under announcements

An overview of CITES provided email services can be found at http://www.cites.uiuc.edu/email/index.html.