Protecting Your System from Viruses and Worms

Protecting Your System from Viruses and Worms

One of the less appealing aspects of the Internet has been security and the potential for becoming the victim of a virus (a program that reproduce by infecting--or copying itself into --other files or computers). More properly, a virus is a self-reproducing program that can infect files on one computer but needs help in order to find other systems to infect (like people sharing programs), while a worm is a self-reproducing program that can send itself to other systems (e-mail viruses are actually worms). Some viruses and worms are just annoying, taking up space on your system or displaying an annoying message, but many others are destructive, deleting or altering files or clogging up Internet e-mail systems with thousands of unwanted messages. The sidebar "How Do Viruses Spread?" contains more information.

John M. Goodman, author of many computer books, says, "If your computer is in good health (with regular backups), a virus is annoying and can waste several days work. If your computer's health is shaky (with irregular or no backups), a virus can kill you."

Types of Virus Files

Viruses and worms can be stored in several types of files:

* .exe, .com, .bat, .msi, .mso, or .pif (program files); scraps; or shortcuts These viruses and worms run when they are opened (clicked or double-clicked in Windows Explorer or your e-mail program, for example). If Windows is configured not to show file extensions, you may not be able to tell easily which files have these extensions. (Tell Windows to display filename extensions by choosing Start | My Computer, choosing Tools | Folder Options, c the View tab, and deselecting the Hide Extensions For Known File Types check box.)
* .doc (Word docu<i></i>ments), .xls (Excel spreadsheets), or .mdb (Access databases) These files may contain viruses and worms written in Microsoft Word, Excel, or Access macro languages. The macros (customized automation instructions) usually run when you open the file. Because Word and Excel are the most popular programs that run macros, Word docu<i></i>ments and Excel spreadsheets are the most common macro virus carriers.
* .vbs (Visual Basic script files) These viruses and worms are written in Visual Basic and run when you click or double-click them. Visual Basic is a programming language used, among other things, to write macros for the Office suite of applications, including Outlook 2002.

For a more complete of file types that might contain viruses, see article Q262631, "Information About the Outlook E-mail Security Update" in Microsoft's Knowledge Base: go to htp://support.microsoft.com and search for the article number.

caution Scraps, a Windows file type created by cut-and-paste operations, can contain executable files (including viruses and worms) that appear to be other types of (harmless) files. An article on this issue is at http://pc-help.org/security/scrap.htm.



How Do Viruses Spread?

The commonly cited psychological reasons for individuals to open suspicious e-mails are fear, greed, and sex. Greed is the least enticing of the dastardly trio. While fear can cause people to open an e-mail to find out how to stop something bad from happening, sex is the most effective motivator.

The notorious Melissa worm by David Smith was started by simply being posted to the alt.sex newsgroup. Smith asked that the file not be circulated, so of course, it was. That single posting to a newsgroup was the only action that Smith performed to spread his worm throughout the world, causing millions of dollars in damages and, in some cases, days of mail server downtime for some major companies.

A new tactic is to appeal to the recipient's ego. The more recent SirCam worm draws in the viewer by asking for sage advice on the "subject" included in the attached "message." The attachment is really the worm in disguise.

So, the moral of the story is: If you receive a message from someone you don't know, or from someone you know but didn't expect to receive a file from, approach it with caution. If it has an attachment, just delete it. If you're not sure, let it sit unopened in your inbox for a few days, while you check the anti-virus and e-mail hoax Web sites. A six- or eight-hour delay in opening the ILOVEYOU virus would have been enough for most people to have heard about the danger of the virus.

Preventing Infection by Viruses

The best prevention for viruses is to avoid getting infected in the first place (practice safe computing). If you do get infected, tools are available to clean your system.

Avoiding Getting Infected

The generally accepted method of preventing viruses from successfully attacking your computer is the use of antivirus software--programs that detect known viruses before they run and infect your computer. Of course, there is the tried-and-true method of not downloading or opening anything that you cannot verify, validate, or otherwise determine the source of.

note The Internet isn't the only way to catch viruses. If you commonly move files from one place to another using removable media (for example, floppy disks, writable CD-ROMs, Zip disks, or Jaz disks) then you need to be careful with these as well. The data on a disk, whether it be from school, office, or library, likely came from the Internet. This simple fact makes it possible for the disk to contain a virus. Office networks are typically more secure, because your LAN administrator has probably installed antivirus software, but don't take that for granted. School networks can be less secure because of insufficient staffing resources. Public access points like ones in libraries, copy shops, or cyber caf0xe9s are a mixed bag. Your best bet is to be wary of any data coming to your computer from the outside. Even commercial software has been known to be a transmission source for viruses. Trust no one. When in doubt, wait at least 24 hours before opening attachments, and check an anti-virus Web site in the meantime. And back up your entire system regularly!
(4)Antivirus Programs

Take our word for it and do not wait until you have contracted a virus to install an antivirus program. An antivirus program can't prevent infection if it's not running. Buying and installing an antivirus application is a small price to pay, compared to losing all of your work for a week, all of your carefully collected bookmarks, the hours that you spent making all of your CDs into MP3 files, your family pictures from last year's picnic in Hawaii--whatever your most treasured files include. Here are some of the most popular and effective antivirus programs:

* Symantec Norton AntiVirus, at (http://www.symantec.com/nav) Norton AntiVirus is a complete solution. You can go with the simple Norton AntiVirus or pop for the complete Internet Security Family Edition suite of security applications--the Family Edition is a particularly good deal, including a personal firewall application that is particularly well suited to protecting broadband (cable and DSL) users.
* McAfee VirusScan, at http://www.mcafee.com McAfee has lately turned many of their programs into online applications--online information services that are updated 24 hours a day. They also offer an application update service that tracks what you have and sends you updates as they become available.

After you install an antivirus program, make sure that you arrange to get regular updates. Some antivirus programs can update themselves by downloading lists of viruses from the manufacturer's Web site automatically. You can also visit the manufacturer's Web site and download new virus lists yourself. An antivirus program won't protect you from the latest virus if your virus lists are months old.

Once you have an antivirus program installed, configured, and running according to the docu<i></i>mentation that came with the program, the antivirus program scans all incoming files (via e-mail and Web) for viruses. For example, the antivirus program might display a dialog box while you are retrieving your e-mail, reporting that a message contains the SirCam worm and offering to delete it for you. Some antivirus programs also scan your hard disk regularly to look for viruses that might have sneaked through. If the program sees a virus, it displays a message telling you what to do.
(4)Practicing Safe Computing Online