Yea I know I started posting a song each day but I thought this gift would be a little bit better. Basic Troubleshooting Virus/Worm/Trojans When viruses, such as SoBig, are released, they wreak havoc across the Internet and flood email inboxes with files carrying the infection. Users of uninfected computers receive notices from distant system administrators telling them, erroneously, that their computers are sending out these email messages and are likely infected. ISPs (Internet service providers) shut down communication ports used by the virus. Email systems are overloaded. Internet communication slows. Computer Economics, a company specializing in guesstimating things, such as the economic impact of viruses, approximates that the rampage of Blaster and SoBig cost companies around $2 billion in clean-up and lost productivity. And that doesn't begin to figure in the pain-in-the-rear factor to nonbusiness household PC users. What makes all this such a shame is that there is rarely any reason a personal computer should be infected with a virus. Viruses are often easy to spot and a snap to avoid, but every time one user is careless, dozens more pay a portion of the penalty. Viruses, Worms & Trojan Horses. Virus has become the generic term for any malicious program that spreads itself from one computer system to another. Accurately speaking, however, there are three broad categories of such software. Viruses. By strict definition, a computer virus is code that doesn't function on its own, but attaches itself to other, legitimate programs. In this way it resembles a biological virus, which cannot replicate on its own so it has to invade a host body's cell and use that cell's DNA to reproduce. When you begin running software infected with a virus, the virus runs along with the program. It then finds an uninfected program somewhere on the same system and adds the virus code to it. Now the virus will run again when either program executes. Worms. Worms are self-replicating files that don't need a host program as viruses do. They exploit some network security flaw to travel from computer to computer, or sometimes replicate themselves throughout a single computer, as well. Once the program is copied to a new site, it seeks out a security hole leading to yet another site and copies itself there. Although a worm can contain programming to work any kind of mischief, it doesn't have to do anything at all in order to be a danger. Simply by replicating itself wildly, it can overload systems and bring networks to a halt. Trojan horses. Unlike viruses and worms, Trojan horses do not necessarily self-replicate, although many of them do. These pests pretend to be something beneficial when they are really a means of attacking your computer. A Trojan horse may be disguised as a game or utility software, for example. It may actually contain what it says it does, but when you go to play the game or use the utility, another part of the program will be doing its dirty work. The important thing about Trojan horses is that they cannot automatically spread to your computer—you have to actively bring them in and start them running. That makes them easy to avoid, if you're cautious. Throughout this discussion, we'll be using the term "virus" in a generic sense incorporating true viruses, worms, and Trojan horses. What Can Viruses Do? A virus can, in theory, do anything that a computer's operating system is capable of. In short, if your computer can do it, the virus can make it happen. In practice, however, viruses tend to be limited to things that can be done with a relatively small program. A virus needs to be able to download and install pretty rapidly in order to be practical. Back in the "good old days" of online life, viruses were primarily gotchas. They were frequently nasty practical jokes that the writers released as a way of showing off. The whole purpose of such viruses was to announce their presence and let people know they'd been "got." The least destructive ones would do things such as display a message on the screen. The worst of them would destroy files or even reformat hard drives. Although showing off remains a motive for some of today's virus writers, others have more mercenary and insidious purposes. Some viruses, for example, deliver keyloggers. These are programs that record all your keystrokes in a file and then periodically email that log to the virus creator without your knowledge. People receiving that log can look through it and often extract items, such as your passwords or even credit card information. With that knowledge, they can log onto your ISP as you, using your account to do whatever they wish, from sending spam to using costly services. They could use your credit card number to buy things for themselves or sell your card information to others. Viruses are frequently used to open back doors into your computer. This allows a virus creator to gain access to your computer whenever you are connected to the Internet and use your computer for his own purposes. A common use of viruses—and of the back doors we just mentioned—is to hijack use of your computer for use in DDoS (Distributed Denial of Service) attacks. A basic DoS (Denial of Service) attack is a means of attacking some computer system so that others can't use it. By way of illustration, imagine that somebody with a grudge against you spends his day calling you on the phone and hanging up as soon as you answer. The moment you hang up, he calls again. If he keeps this up all day, you can't call out and your friends can't call you. This is a DoS attack against your phone. Now, imagine that you put in a 10-line telephone so that the fellow can't tie up all your lines with his one phone. So he gets 20 friends all over town to keep calling you and now all 10 of your lines are constantly tied up and useless. That is a DDoS because the attack is distributed among several callers. Suppose now that a virus maker is able to put a program on your computer and 100,000 others. That program will activate at noon on a given date, and for six hours it will try to connect to the XYZ Web site as often as possible. On that date, the XYZ Web site is flooded with connections to the point where it's unable to function and legitimate users can't log in. The Code Red worm of 2001 was a prime example of this type of attack. This worm worked its way across the Internet, infecting more than one quarter of a million servers. It was set to flood the White House Web site at a specific time. The attack failed, however, because the programming in the worm was discovered and the White House Web site was moved to a new Internet address before the attack could be launched. Signs Of An Infection. Although viruses now often try to hide, it still pays to be aware of the classic symptoms of infection. Not all of these necessarily indicate a virus. You could instead be the victim of a hard drive problem or a Windows glitch. Still, whenever you see these signs, you'd do well to take a closer look and check for viruses. •The amount of free space on your hard drive drops dramatically and suddenly due to virus files copying themselves all over your system. •Your computer runs noticeably more slowly, especially after opening a new file or starting a new program, and continues to run sluggishly even after you have closed that file or program and rebooted your computer. •Your computer takes longer to load after you turn it on, even though you haven't made any significant changes to your system. •Windows refuses to start, but you haven't made a single change to it or your system. •Windows won't start and an error message tells you that it's because certain important files are missing. •Software that always ran without trouble starts frequently freezing up, and the program continues to freeze even after you uninstall and reinstall it. •The size of some program files suddenly and dramatically increase even though you haven't modified them in any way. •Windows Task Manager refuses to run. •You get frequent "Out of Memory" error messages, even though you know you have sufficient memory for everything you're doing. •Your antivirus program is suddenly disabled or will not load. •Unfamiliar icons appear on your Desktop, even though you haven't installed any new software •Unfamiliar messages or dialog boxes pop up (other than legitimate error messages), especially if they're unrelated to programs you're running or if they ask for confidential information such as passwords. •Your modem shows excessive activity even when you aren't working online. •Several serious hard drive errors appear when a disk scanning utility, such as Scandisk, runs. •Your computer plays music or sound effects that are unrelated to programs you're using. Symantec's Norton AntiVirus, like McAfee and several other antivirus companies, provides a free online service that scans your system for virus infections. •Your computer often freezes when you turn it on, coming to a halt before the Desktop loads fully. •Windows spontaneously starts from time to time. •Software begins to disappear from your computer even though you have not uninstalled it. Some possibly important indicators deserve special attention because they can be deceptive: •You get a notice from a system administrator, postmaster, or virus scanning service saying that a file you sent by email was infected with a virus, but you know you didn't send the file. •You hear from friends and associates that they've received email from you that you never sent—especially if a file is attached. •You receive a bounce-back notice from another system that an email message you sent was undeliverable, but you never sent that email message. Here's the catch. Once upon a time, if you caught a virus that spread by email, the virus would scan your address book and mailboxes for other email addresses. The virus would then send copies of itself to some or all of those addresses. The virus creator's hope was that those who received it would think it was from a friend (you), download it, run it, and get infected, too. You, of course, would never know you were infected or that the virus was using your computer and email account to replicate. For that reason, system administrators would send warnings back to people who were apparently infected and sending email messages unknowingly. That alerted them to find and destroy the infection. The McAfee's Virus Map at us.mcafee.com/virusInfo/default.asp shows you where viruses are most active. Select a world view or zoom in to ZIP-code level. You can also check the Regional Virus Info to find out which viruses are busiest around the world. Today's viruses don't work that way. They still do everything described above, but with one big difference. Viruses choose random email addresses from the many found and send email messages out so that they appear to be coming from one address rather than from the person whose computer is infected. This is called spoofing the address. For that reason, if you get a virus-spreading email from YourPalFred@isp .com, you can be reasonably sure that it did not come from YourPalFred. It came from someone who had both YourPal-Fred's email address and your address on her computer. So, if you get a notice saying that an email message you sent carried the such-and-such worm, that does not mean that your computer is infected. Wise administrators have now stopped their systems from sending those alerts because they are less than useless. Unfortunately, many admins still send them. Prevent & Fight Viruses. Here are some tips on how to fight viruses. Watch your downloads. The best way to fight a virus is to not catch it in the first place. You can avoid the vast majority of viruses by following one very simple rule: Never open any program file if you are not 100% certain what it is. Ever! That means when you get the email message from YourPalFred that says, "This is the best game I've ever seen, you'll love it!" do not open the attached file. Email YourPalFred, or better, call him to see if he really sent it and if he knows for certain that the message is safe. Avoid files that have double extensions. The extension is the part of the file name that comes after the period. For example, in the file MapGraphic.jpg, the extension is .JPG(Joint Photographic Experts Group). This indicates a common graphic file format that cannot carry a virus. Other file extensions that indicate formats unable to carry viruses include .GIF (Graphics Interchange Format) files and .TXT (plain text). Because many people know that these formats are safe from viruses, some virus makers will give their files names such as Mypicture.jpg.exe or Information.txt.pif. Without knowing better, you may see the .JPG or .TXT extension and think the file is safe. But those second extensions (.EXE and .PIF) indicate executable files. These are not graphic or text files; they are programs and probably viruses. Then, even when you have every reason to believe that a file is probably safe, don't open it until you've checked it out with up-to-date antivirus software. Have a boot disk ready. A really bad virus can destroy your boot sector, the section on your hard drive that allows your computer to start running. Protect yourself by making a boot disk. Put an empty floppy diskette into your floppy drive, open My Computer, and right-click your floppy drive. Click Format and put a check in the Create An MS-DOS Startup Disk box. Click Start and when the floppy is formatted, put it someplace safe. Should you ever need that floppy, you'll be in deeper problems than we can address in this article, but you'll find the boot disk a lifesaver. Always run antivirus software. If you don't have antivirus software, then stop reading right now and buy some before finishing this article. You can buy it online. The two leading antivirus programs are Symantec's Norton AntiVirus ($49.95; symantec.com/nav/ nav_9xnt) and McAfee Virusscan ($49.99; us.mcafee.com). Other options are posted in the sidebar, "Other Antivirus Software." Whichever program you select, set it to scan all incoming email and files and to do full scans of your computer at least once a week. It's important to note that just having antivirus software is not enough. It must be up-to-date. New viruses are detected every day, and during times of heavy virus activity, last week's antivirus software is next to worthless. That's why antivirus software comes with a subscription for free updates to the catalog of viruses the software will detect and defend against. Select the automatic update option and your software will check its company's Web server regularly for newly added virus definitions and will install them without any effort from you. Most subscriptions are for one year, so be sure to renew when your subscription is up. Do you have reason to suspect a virus infection? Then, if you already have antivirus software, make sure you have the latest definitions installed and run it right away. If you don't have any, both McAfee and Norton let you do an online scan for viruses at no charge. Run either scan immediately. The McAfee free online service is called FreeScan. You'll find it at the bottom of the company's home page at us.mcafee.com. You will need to register and download an ActiveX control before running the scan. Norton's version is its Free Online Virus And Security Check. You'll find it at securityresponse.symantec.com under Virus Definitions. Run nontargeted software. Viruses thrive when most people use the same software. Most email-spread viruses immediately look for email stored in Outlook Express, for example. A few years ago, there was a rash of viruses programmed directly into Microsoft Word documents using the powerful Word macro features. Consider, then, using alternative programs, such as Eudora (www.eudora.com) for email, WordPerfect for word processing instead of Word, or the Netscape Navigator Web browser instead of Internet Explorer Don't reboot. Do not reboot your computer if you suspect a virus. With some viruses, it's possible for a reboot to make the situation worse. Your best bet, when you detect a virus, is to follow whatever instructions your antivirus software gives you. Often, the antivirus software will take care of everything on its own, but the situation can change with each new virus. If your software is up-to-date, it will have the latest available information for you. You can also find instructions for removing viruses on the McAfee and Norton Web sites. For Norton's instructions, go to securityresponse.symantec.com. For McAfee's, go to us.mcafee.com/virusInfo. How Not To Fight A Virus. One of these days, if you haven't already, you'll receive an email message telling you of some dire new virus. It probably will tell you not to open email with a certain name because that will activate a virus that will do terrible things, and that no antivirus software yet knows how to protect against it. It will tell you that the author of the message checked it out with Norton or McAfee or Microsoft or IBM and received verification that this tale of horror is true. It will then tell you to forward the email to all of your relatives, friends, associates, co-workers, and nodding acquaintances. Please heed this: That email message will be a hoax. A lie. A total fabrication. It probably will have been forwarded to you by a well-meaning friend with a note that says something like, "I don't know if this is true, but I'm passing it along just in case." Do not pass it along just in case. There is no in case. In fact, the admonition to "forward this letter to all your friends" is virtually always the sign of a hoax, except in the case of certain online petitions, many of which are also erroneous. These chain letters actually do harm by flooding servers and mailboxes, which is what the hoaxers are after. They are but one step up from viruses themselves. The worst, ironically, are the messages that have a small basis in fact. These email messages warn recipients to search their hard drives for a certain file and delete it immediately because it's a virus. This began not with a hoax but with an error. Someone did indeed catch a virus that attached itself to a file of that name. He mistakenly thought that the file was the virus and started the email message that spread the misleading information across the Internet. The file is a legitimate, although not critical, part of Windows. More and more errors crept into the ensuing chain letter as it spread, and a number of people were tricked into deleting a file that they might need someday. These email warnings refuse to die. They fade away for a year or two and then start making the rounds again. If you get one, ignore it. If you can't help but worry, "What if this one is real?" you can check out the Computer Incident Advisory Capability Web site run by the U.S. Department of Energy. It keeps a database of hoaxes at hoaxbusters.ciac.org. In Summary. Despite all the hullabaloo about computer viruses, they'll rarely if ever be a real threat to you as long as you follow the rules: •Never download a file until you're 100% sure of its safety •Keep antivirus software up-to-date and running at all times •Do frequent and regular scans of your full system Then, your biggest problem with viruses will be deleting all the virus-carrying email messages from those who failed to be as careful as you. by Steve A. Glaser & Elizabeth Lewis Brought to you by; http://www.smartcomputing.com/Editorial/article.asp?article=articles/2004/w1509/38w01/38w01.asp&guid=
Log in to comment