Linux, like all platforms, is susceptible to hosting and spreading viruses and malicious code; and today’s security requirements demand protection on all operating systems within a network. With this new solution, Bytware gives iSeries users who are taking advantage of the box’s ability to run multiple operating systems in multiple partitions a key tool needed to ensure that their iSeries and network stay free of malicious code.

Support for scanning and cleaning Linux and AIX partitions is now an added functionality of the StandGuard Anti-Virus for iSeries product and provides users with the convenience of a single set of virus definition files and a centralized control center for all OS/400, i5/OS, Linux, and AIX installs on a single eServer box. StandGuard Anti-Virus will automatically mount and unmount guest operating systems for unattended, scheduled scans eliminating the need to install copies on each individual partition. With this added functionality, StandGuard Anti-Virus users enjoy the most streamlined virus protection system available for managing all aspects of their iSeries system using the safety and integrity of OS/400 and i5/OS.

By using OS/400 or i5/OS to manage and initiate scanning and cleaning of Linux and AIX partitions, users can reduce the risk of Linux and UNIX viruses from migrating to OS/400 partitions while leveraging McAfee’s industry-leading scanning engine to provide the same level of protection across all operating systems on the iSeries.

Support for scanning and cleaning Linux and AIX partitions is licensed on a usage count basis to allow users the flexibility to scan the operating systems and number of installs that best fits their system configuration. For details on licensing options, please contact Bytware Sales at 775.851.2900 x2. For more information on StandGuard Anti-Virus and support for Linux and AIX scanning, please visit http://www.bytware.com/products/sgav.html.

The highlight of the new enhancements is the addition of Object Integrity Scanning (OIS), previously available only in the V5R3 release. OIS gives StandGuard Anti-Virus the ability to alert iSeries managers to changes made to IBM’s digital signatures by patched programs. Many applications modify the operating system in order to achieve functionality not available on a given release of the OS. Regardless of whether a “patched” program does something good or something bad, such programs can create potential problems for the integrity of the operating system.

In addition to being key to a healthy iSeries, awareness of modifications to the system is an important aspect of compliance with new regulations such as Sarbanes-Oxley.

StandGuard Anti-Virus V5R2M0 is available now. For details about StandGuard Anti-Virus, visit http://www.bytware.com/products/av/. Existing StandGuard Anti-Virus 1.11 users can request the free upgrade by contacting Bytware Support at 775.851.2900 or by visiting the StandGuard Anti-Virus V5R2 Support Page (Support Central Username and Password will be required.)

A free upgrade to StandGuard Anti-Virus version 5.31 is available to Bytware customers with valid support contracts at www.bytware.com. The upgrade includes the new 4441 engine. Users should visit the StandGuard Anti-Virus section of Support Central for instructions.

For more information on StandGuard Anti-Virus, visit
http://www.bytware.com/products/av/ or contact Bytware Sales at 775.851.2900.

Building upon object integrity and digital signature APIs that IBM has included in OS/400 since V5R1, OIS provides an easy way to identify patched programs and modifications to the operating system, allowing managers to decide what action — if any — they should take. In addition to being key to a healthy iSeries, awareness of modifications to the system is an important aspect of compliance with new regulations such as Sarbanes-Oxley.

Version 5.31 also incorporates various enhancements that have been made to StandGuard Anti-Virus since the release of version 5.30 in June of 2004.

StandGuard Anti-Virus is the award-winning native virus scanner for OS/400 and i5/OS. Designed specifically for the iSeries and powered by McAfee’s industry leading scanning engine, StandGuard Anti-Virus provides the power to ensure total coverage of computer networks to protect against viruses, Trojans, and malicious code and programs, even finding viruses that PC-based solutions simply cannot.

For more information on StandGuard Anti-Virus and OIS, visit
http://www.bytware.com/products/av/ or contact Bytware Sales at 775.851.2900.

As a recent IT Jungle article by Alex Woodie points out, “running patched programs presents risks. The potential negative effects of running patched programs range from being merely a nuisance to posing a real security problem.” In some cases patched programs can even create security exposures.

Building upon object integrity and digital signature APIs that IBM has included in OS/400 since V5R1, OIS provides an easy way to identify patched programs and modifications to the operating system, allowing managers to decide what action — if any — they should take. In addition to being key to a healthy iSeries, awareness of modifications to the system is an important aspect of compliance with new regulations such as Sarbanes-Oxley.

OIS will become available on December 1, 2004, and will initially be available only on V5R3. Versions for V5R2 and V5R1 will be released at a later date. OIS is an added feature to StandGuard Anti-Virus. There is no additional charge for the tool. Current users of StandGuard Anti-Virus V5R3M0 will receive the tool through the program’s automatic update feature, and shipments of StandGuard Anti-Virus V5R3M0 after December 1 will include the tool.

StandGuard Anti-Virus is the award-winning native virus scanner for OS/400 and i5/OS. Designed specifically for the iSeries and powered by McAfee’s industry leading scanning engine, StandGuard Anti-Virus provides the power to ensure total coverage of computer networks to protect against viruses, Trojans, and malicious code and programs.

For more information on StandGuard Anti-Virus and OIS, visit http://www.bytware.com/products/av/ or contact Bytware Sales at 775.851.2900.

StandGuard Recycle Bin will save you money by eliminating the need to pull out backups and restore lost files in the traditional way. The nearly instantaneous process means that files can be restored as quickly as they can be deleted. Plus, StandGuard Recycle Bin protects files created throughout the day for on-the-fly restoration, something that traditional backups just can’t do.

Like anti-virus software, StandGuard Recycle Bin is one of those inexpensive forms of insurance that helps you avoid much more costly problems. At just $995 per copy it represents a revolutionary price breakthrough in the iSeries industry. And as if the price tag weren’t nice already, you also get the first year of support for free. Cool tool. Sweet deal.

Plus, there’s a special offer. To celebrate the launch of this great new file protection solution, Bytware is giving one copy of StandGuard Recycle Bin to each of the first 25 customers absolutely free—including one year of free support.

For more details visit http://www.bytware.com/products/rb/ or contact Bytware at 775.851.2900.

Beginning with V5R3, IBM has enabled the operating system to support virus scanning, including On-Access scanning. The enablement itself does not scan, detect or clean viruses, but instead provides the necessary enhancements to allow StandGuard Anti-Virus to scan files upon open and close (On-Access).

To help ensure iSeries customers realize the maximum security potential in a networked environment, Bytware redesigned StandGuard Anti-Virus to exploit the new V5R3 enablement. The result is a seamless integration of StandGuard Anti-Virus with i5/OS V5R3. By shipping StandGuard Anti-Virus with all V5R3 systems and upgrades, customers will have the ability to immediately test the new function on their new operating system.

StandGuard Anti-Virus for iSeries V5R3 will begin shipping with all iSeries V5R3 servers, and upgrades to V5R3, and will be available as a try-and-buy offering. Customers can request full-featured trial activation by contacting Bytware directly at http://www.bytware.com/enableav.html or calling 775.851.2900. Bytware will work directly with customers, and, to ensure timely support, Bytware has expanded its US-based operations to include 18 new Partners in 10 time zones worldwide.

Bytware, Inc., an industry innovator and leader since 1986, offers award winning security, user and system monitoring, and notification solutions for the IBM iSeries server. For more information on the StandGuard Security Suite, including StandGuard Anti-Virus for V5R3, please visit the main security page or call 775.851.2900.

To ensure iSeries customers are realizing the maximum security potential, Bytware has worked very closely with IBM’s Security and Integrated File System team to re-engineer StandGuard Anti-Virus to take advantage of the new V5R3 enablement. The result is a seamless integration of StandGuard Anti-Virus with OS/400 V5R3, and the closure of the virus threat to iSeries servers.

StandGuard Anti-Virus is an award-winning, native anti-virus solution for the iSeries. Developed with the unique features of the iSeries in mind, StandGuard Anti-Virus offers all of the power and protection of the industry-leading McAfee scanning engine found on other platforms while meeting the specific needs of OS/400. You’ll find StandGuard Anti-Virus easy to use in either graphical or green screen modes, and a breeze to keep current with the latest .DATs directly from McAfee and software updates from Bytware. With StandGuard Anti-Virus you have the essential tools to ensure that your iSeries is protected from the threats of viruses, worms, and malware.

StandGuard Anti-Virus for V5R3 will be available for OS/400 V5R3 upon IBM’s announcement of general availability. Bytware, Inc., an industry innovator and leader since 1986, offers security, user and system monitoring, and notification solutions for the IBM iSeries server. Customers with V5R3 systems can request full-featured trials of StandGuard Anti-Virus v5r3, and Bytware’s other security solutions, by contacting Bytware directly at http://www.bytware.com or call 775.851.2900.

Like earlier variants of Mydoom, this new worm launches distributed denial of service (DDoS) attacks, this time against Microsoft and the Recording Industry Association of America (RIAA). In addition, Mydoom.F searches for and deletes files on local and mapped drives. Primarily the worm targets images files and Microsoft Word and Excel documents and searches for extensions .bmp, .avi, .jpg, .sav, .xls, .doc, and .mdb. The worm runs in a loop and deletes additional files on each pass.

Mapped drives need not be physically located on the infected system in order to be affected by Mydoom.F. Drives located on other platforms that can house Windows files can be equally affected.

Bytware, Inc., the Reno, Nevada-based developer of StandGuard Anti-Virus for the IBM eServer iSeries, has been contacted by several iSeries shops that have suffered data loss caused by Mydoom.F infection of networked PCs. The iSeries is generally viewed as invulnerable to viruses. A common practice of scanning the iSeries with a Windows PC through a mapped drive can open a door for worms and viruses to the iSeries.

In addition to file deletion and DDoS attacks, the Mydoom.F worm opens TCP port 1080, and additional ports in the range of 3000 to 5000, in an attempt to allow the author access to infected machines.

Mydoom.F arrives as an e-mail attachment of a variety of files types, including .zip. Upon identifying shared or mapped drives, the worm makes copies of itself as .zip archives or .exe files in different directories using random file names. It also propagates by harvesting e-mail addresses from infected systems and mass mailing itself using its own SMTP engine.

Most AV vendors have added definitions for Mydoom.F and experts urge users to update their anti-virus software and to protect all systems, including non-Windows platforms that may act as file servers and are attached to Windows PCs via mapped drives.

For more information about Mydoom.F, visit the Network Associates Virus Information Library at http://vil.nai.com/vil/content/v_101038.htm

For more information about iSeries anti-virus protection, visit the main StandGuard Anti-Virus page.

StandGuard Anti-Virus, the award-winning anti-virus solution that runs natively on OS/400, has been detecting and removing copies of Mydoom found on the iSeries, according to Bytware customers. StandGuard Anti-Virus is powered by the McAfee scanning engine from Network Associates, rated the top scanning engine by the University of Hamburg Virus Test Center for three consecutive years.

Mydoom can enter the iSeries either through mail that passes through OS/400 or by copying itself to the iSeries from a client PC without the user’s knowledge. Only active scanning of the iSeries can detect the worm once it finds its way onto the system. Leaving the worm undetected can spread the infection to client PCs on your network as well as to other companies and networks with which you exchange information.

Experts say that the best way to fight Mydoom is through the use of standard anti-virus solutions. “Companies that are following recommended practices relating to secure e-mail use should be largely protected against the Mydoom virus and its variants,” explain experts in a new article on Computerworld’s Security website. These practices include vigilantly maintaining up-to-date virus definitions. iSeries security experts, including Carol Woodbury and Patrick Botz, recommend that administrators apply the same virus prevention procedures to their iSeries systems that they apply to their other platforms as a general security best practice.

More about Mydoom

The Mydoom worm has been labeled the most prolific worm ever by some security experts according to an article at SearchSecurity.com. It has shattered the records set in 2003 by the Sobig.F virus, and a new CNN article cites infection rates as high as one in three e-mails. Sobig.F peaked at an infection rate of 1 in 17 e-mails. British security firm MessageLabs reports that they have caught 1.8 million copies of Mydoom in more than 168 countries as of Wednesday, January 28. StandGuard Anti-Virus users are also reporting infections appearing on the iSeries.

The worm is particularly difficult to manage as it utilizes new techniques called “social engineering.” Using these techniques, virus writers attach their work to mail that appears to be a machine-generated error message. The idea is that users trust messages that they believe were generated by a computer as they are accustomed to receiving such messages from administrators and mail servers, especially in corporate settings.

Mydoom arrives as an attachment that can carry one of a number of different file extensions, some of which are routinely allowed by companies including the ZIP format. Many report an attachment that appears to be a text document, but has 60 spaces between the .txt and .exe extensions, preventing users from seeing the true file type. Many users view text documents as innocuous. Security experts say that these techniques are convincing many users who are normally very cautious to open and execute the worm. Mydoom also attempts to spread through file sharing services such as Kazaa if the software is found on an infected system.

The purpose of Mydoom appears to be multifaceted. Both variants target SCO, the Utah-based software company embroiled in a legal battle with IBM over Linux, for a denial of service attack (DOS) on Sunday, February 1, and install a key logger that captures any text entered into the computer, including credit card numbers and passwords. The worms also open ports on the infected system, including ports 80, 1080, 3127, 3128, 8080, and 10080, and can allow the attacker to gain complete control of the computer. The Mydoom.B variant also targets Microsoft for a DOS attack on Tuesday, February 3, and modifies systems to prevent them from utilizing anti-virus software or accessing security websites.

Mydoom is also know as Novarg, Shimgapi, and Mimail.R.

Learn more in the Midrange Server, Four Hundred Stuff article by Alex Woodie.