By William LaMartin, Editor, Tampa PC Users Group
lamartin@tampabay.rr.com

Spam We all hate it, and at times there seems little can be done about it. I know people who periodically change their email addresses to cut the flow of it. Sometime within the last 12 months I started keeping a blocked senders list in Outlook Express, along with several “mail rules” that blocked messages containing certain words in the subject line, messages with certain words or phrases in the body of the messages, and messages from certain domains.

I got so desperate at one point that I was blocking all mail from yahoo.com and hotmail.com, since they seemed unable to stop the flow of spam from their servers. Of course, the mail wasn’t really blocked; it was simply automatically dumped into my deleted folder, where I would carefully look at the senders to make sure that I wasn't deleting a message that wasn’t spam-surprisingly there are actually people with yahoo and hotmail address who are not spammers.

I found myself spending way too much time on adding people to the blocked senders list and updating the “mail rules”. After all, I was getting from 40 to 70 such messages per day-and 95% of them were coming in on my NetCom account. The Road Runner account luckily has stayed fairly spam free.

What to do? Earthlink, the company that absorbed NetCom several years back had the answer: Spaminator, their spam blocking program that stops messages from ever leaving their servers if the senders are on Spaminator’s Spam list. I enabled it for my account, and the result was amazing. I am now getting, perhaps, three spam messages per day in my NetCom account, and when I go check at Earthlink to see what messages have been blocked-all of the messages are spam, and there are a lot of them. For example, around 11:00 PM I deleted all the blocked messages at Earthlink that had accumulated during the day-30 or so. And this morning there were 38 more messages that had been blocked between 11:30 PM and around 8:30 AM. By the way, if you don’t delete the blocked messages, Earthlink will automatically delete them after three days.

Since I am having a bit of trouble filling the newsletter this month, here are the subjects of the 30 deleted messages last evening:

Pay for Placement Have you used a search engine lately? Certainly you have, but did you know that the links appearing at the top of the list were probably “paid links”. Yahoo calls them Sponsor Matches and describes them as follow: “Sponsor Matches are search results that are paid for by businesses or organizations and provided through an alliance with Overture Services (formerly GoTo.com).” Google calls them Sponsored Links and has two types-those that appear at the top of the returned search results like those of Yahoo and ads that appear in boxes to the right of the results. More on Google’s little ad boxes later, for that is the only paid placement that I have actually used.

The situation is the same for all the other search engines, I believe. It is just another manifestation that the Internet is really not free, and when the venture capital runs out someone has to pay. In my opinion, though, it is unfortunate that sponsored ads, I mean links, are appearing right in among the search results. It is sort of like a newspaper running ads as news stories and putting them on the front page at the top.

At Overture (http://www.overture.com), the company that Yahoo mentioned as providing the sponsored matches, potential advertisers actually bid on key words. The person bidding the most, gets the highest listing. What they are bidding is how much they will pay for each click on their ad, I mean sponsored match. The price for the top placement can be anywhere from a few pennies to several dollars. Yes, there are companies willing to pay as much as $5 if you click on their link for life insurance. To verify this, go to http://www.overture.com and put in the search phrase life insurance. Today the top listed “life insurance” link there costs $5.08, and number 40 on the same page costs $.54. Of course, Overture had better have some pretty sophisticated software to detect pranksters from doing multiple clicks on that link, for at $5 per click, it will add up. Additionally, I think Overture also has a $20/month fee.

I got into all of this because someone called and wanted to know why his real estate page had disappeared from Google. It had been there for months when you searched for his city and the words real estate. Having followed the pay for placement situation for the past year, I advised that the only sure way of being listed was to pay. And the best option to me seemed to be Google’s AdWords program where you say what you are willing to pay for your ad to be displayed when certain keywords are searched. The more you pay above their minimum price for a particular keyword, the better your placement. Most small town names can be had for a nickel, but the phrase “real estate” has a minimum price of $.32 at Google AdWords. But you don’t want to use just “real estate” since that would not be specific enough. Instead you use a phrase like “Tampa real estate”

I chose a collection of about six keywords and phrases and started the program. After about a week, 4006 people have viewed pages at Google with the ad, and 71 have clicked on the ad for a click-through rate of 1.7% at a total cost of $12.13 ($.18/click). By the way you can set a limit to how much you will spend in a day. We chose $5, and you can see that we have not come close to using that amount.

But that is just for Google, where, by the way you can still get a commercial site listed for free-there is just no guarantee that it will ever be returned in a search. What about other search engines? Well, Yahoo now charges $299 (double that if it is adult entertainment) just for submitting a commercial site to them-with no guarantee that they will list your site-and no refund if they don’t. Also, Yahoo, Lycos, AOL (AOL might be dropping it) and MSN, I think, use the Overture service, so to get a decent placement on them you will need to go to Overture and bid on your keywords and phrases. I just hope life insurance is not one.

Nimda My son is visiting now, and he has been doing a lot of work with his software development over the Internet. I just give him a connection to the router, and everything was working fine. But yesterday when a thunderstorm came through, I said that I wanted to shut everything down and disconnect. I did that, but then he said that he would like to keep working since it didn't seem so bad. So with all my computers disconnected, I connected his computer directly to the cable modem. In less than 10 minutes he noticed strange activity on his machine. He disconnected the connection to Road Runner, but it was too late. He had the Nimda virus.

Here is how he got it. He had a new laptop computer on which he had hurriedly installed all his necessary programs before the trip. It runs Windows 2000 Server. That means that it also has Microsoft Internet Information server (IIS)--and he and not bothered to install the patch that protects IIS from Nimda. With IIS running (he didn’t even need it but it runs automatically) when he connected directly to the cable modem without the protection of the router's firewall, within 10 minutes one of the Nimda infected computers on Road Runner's network--and there appear to be plenty of them--had nailed him.

Earlier he had purchased McAfee's antiviral program for 2000 Server off the Internet, but it wouldn't work and he was, in fact, trying to get his money back from them. Norton's version costs $400, so he hadn't bought that. What to do? The regular Norton Antivirus program couldn't be installed on 2000 Server, but I suggested reestablishing the network connections, mapping his C drive as a network drive to one of my computers (the Windows Me one), and letting my Norton AV on that computer scan the mapped drive for viruses. We did that--and it found 48 infected files on his computer, cleaning up all the ones that had originally been his (except Netscape.exe) but failing to clean up the ones that the virus had added--but quarantining them. He then downloaded from Symantec the cleanup up tool for this virus and ran that. So his computer now seems OK.

But after reconnection to the network, my XP computer had a message from Norton saying that it had detected a file with the Nimda virus. And every time you clicked OK to that message another message popped up with the same message but for a different file. This went on for at least 20 files. All the files were in the C:\Documents and Settings\All Users\Documents folder, the only one on the XP computer that I had shared with all users on the network. Note that I reconnected the XP machine to the network at the same time I did the Me computer, and the virus apparently immediately went to work on both of them, but could only get to that one folder on the XP machine. Norton seemed to have taken care of everything, since none of the offending files were still there. I then did a full system scan with Norton that found no infections.

When I began testing my main programs, all worked except Photoshop. Photoshop would load, but when I tried to open a file, nothing happened. I rebooted the computer, but that didn't help, so I reinstalled Photoshop, and everything was OK. I can't figure how Photoshop got damaged, since it should not have been accessible to the virus. Perhaps Norton damaged it somehow in its repair efforts.

My son now has the patch for IIS, but still no antivirus program for the laptop. He can't bring himself to buy Norton AV for 2000 server at $400. By the way, even if you are running behind a router, if you have port 80 open for a computer running IIS you are at risk--unless you have the IIS patch. u