click here to download file Document that tells what a virus do when it is in your computer
Disinfecting Viruses/Spyware/Adware from Your Computer
If you have virus or spyware/adware problems, these instructions will guide you through the process
of removing them from your computer. You can obtain virus removal software through your SNAP network connection by logging
in through Clean Access or from http://antivirus.kenyon.edu. If you cannot access the network, you can bring your computer
to the HelpLine for assistance.
Spyware/adware removal software (such as Spybot and Adaware) is available from the Internet. Their
web addresses are listed in the section Remove spyware and adware below. Although the HelpLine does not disinfect viruses
and spyware/adware on your computer, we will answer questions and offer guidance in removing them.
Note: If your network port was disconnected by LBIS:
- If you were notified by LBIS that your network port has been disconnected because of virus-like activity,
you must disinfect your computer before you can be reconnected to the network. If you need assistance, bring you computer
to the HelpLine.
- Once it is cleaned off, you must bring your computer to the HelpLine to have it confirmed
clean by an LBIS staff member.
- At the HelpLine you will have to run a virus scan to confirm that it is clean, so plan to come least
one hour before the HelpLine closes (by 3:30pm weekdays, 4:00pm weekends) to allow time for scanning, which can possibly
take an hour.
- Once your computer is verified clean by a member of the LBIS staff, a request will be sent to the
LBIS security systems manager to have your port reconnected to the network, which may take a day or two.
Software tools needed for addressing virus/spyware/adware problems: In
order to remove viruses or spyware/adware and to maintain your computer's security, it is essential that you have certain
software installed (listed below):
- Kenyon's antivirus software: Symantec (Norton) AntiVirus Corporate Edition (SAVCE)
- Up-to-date virus definitions
- Critical software updates from the Internet (for Windows or Macs)that are set for automatic updating
on your computer
- Up-to-date spyware/adware removal software: Spybot and/or Adaware
Follow
the instructions in the following sections. If you already have some of the software installed, just skip those sections.
You may want to print out this document before beginning.
Install Symantec (Norton) AntiVirus Corporate Edition (SAVCE):
Note: If unable to access the network to download (SAVCE), bring your computer to the HelpLine
for assistance.
- Locate the software: Login to the network. Go to Installing Kenyon Antivirus for Students at http://internal2.kenyon.edu/patches/antivirus/index.htm
- Print these installation instructions there before actually downloading the software.
- Download Symantec (Norton) AntiVirus Corporate Edition (SAVCE) from the network by selecting
the Mac or Windows ddownload link.
- Disconnect your network cable or disable your wireless connection. (If using wireless with
Windows XP Home, you must disable the radio).
- Important!! After you download SAVCE but before you install it, you must uninstall
any existing anti-virus software on your computer. (Instructions for uninstalling this software are in the installation instructions
you just printed.
- Install SAVCE using the above installation instructions.
Note: If you are unable to install SAVCE or access it once it is installed, you may have spyware/adware
on your computer that is causing your problem. You will have to remove it first before continuing. See later section Remove
spyware and adware from your computer for instructions.
Check virus definition date and update if necessary:
- Once SAVCE is installed, reconnect to the network by plugging in your network cable or enabling wireless.
- Immediately open SAVCE by double-clicking the gold shield icon in the bottom right corner of screen.
- Check if your SAVCE virus definitions are up to date. If they are more than a week old, you must update
the definitions by running LiveUpdate. See Running LiveUpdate at http://antivirus.kenyon.edu/winnavce/liveupdate.html
- Note: If unable to access the network, contact the HelpLine on how to proceed with updating
your virus definitions.
Download critical software updates from the Internet
- It is very important to protect your computer by keeping it updated with critical software updates
(recommended weekly). Download these updates now:
Scan hard drive for viruses:
- Scanning the hard drive can take an hour or more, depending on the number of files you have, so don't
start until you have the time!
- To run a virus scan, see Perform a Full System Scan at http://antivirus.kenyon.edu/winnavce/scan.html. You may want to print this out for reference because
you will have to disconnect from the network to run the virus scan.
- Disconnect your network cable or disable your wireless connection. (If using wireless with Windows
XP Home, you must disable the radio).
- Before running a virus scan, it is recommended that you backup your data on the hard drive.
- Then start your computer in Safe Mode as follows:
- Shut down and power off your computer. Wait 30 seconds and then turn the computer on.
- Immediately start tapping the F8 key every half second. You will soon see the black-and-white Starting
Windows moving bar at the bottom of screen. The black Windows Advance Option screen will appear after that.
- Make sure that the Safe Mode option is selected on this screen. In most cases it is. The computer
will then start in Safe Mode, which takes a few minutes.
- Once the desktop appears, open SAVCE through the Start | Programs menu (When in Safe Mode, there is
no SAVCE gold shield icon in the bottom right corner of screen).
- If any viruses are found by the scan, they will show up in the Scan Results or Virus History. If their
status is "quarantined," they have been rendered inactive. After the scan completes, you can safely delete them by highlighting
their names and clicking on the red "X" at top of window.
- Scan your hard drive a second time to confirm that the computer is clean. There should be no
viruses remaining in the Scan Results screen after the second scan.
- If any viruses still remain, check their status. If it is "active" or "quarantine failed," you will
have to manually remove them. You may have to come to the HelpLine or a public lab to print out the manual removal instructions
for those viruses, which can be found at www.symantec.com. Also print out If SAVCE Reports Your Computer is Infected at http://antivirus.kenyon.edu/winnavce/virus.html.
- Do not reconnect your computer to the network until all viruses are completely cleaned off!!!
- When finished with virus removal, restart your computer as you normally do. You can now reconnect
to the network unless your room's network port has been disconnected and you must first have LBIS verify your computer is
clean.
Note: If your computer still exhibits strange symptoms or poor performance after checking and
clearing any viruses, you may have adware or spyware on your computer. They must be removed before your computer will
work properly. (See next section).
Remove spyware and adware from your computer:
- If you run spyware/adware removal software on your computer, you must understand that there
is some risk of unpredictable consequences to your computer. However, we have used Spybot and Adaware at the HelpLine
for some time and find that they have been reliable removal tools.
- Download and install Spybot and Adaware:
- Spybot (freeware) and Adaware SE Personal Edition (free version) can be downloaded from
the Internet (www.spybot.info and www.lavasoftusa.com).
- Consult their websites and especially the Help sections for details on how to use these spyware/adware
removal tools to scan your computer. You can also bring your computer to the HelpLine for assistance.
- After downloading them, double-click their Setup icons on your desktop to install each program. When
the Install Wizard opens, follow the instructions, accepting the defaults.
- Note: If you can't access the Internet to download this software, you can bring your computer
to the HelpLine for assistance. If you bring your computer in, we cannot remove the spyware/adware for you, but we can advise
you in installing and running the spyware/adware removal software.
- Because of licensing restrictions, we cannot offer Adaware. However, you download the "personal" version
yourself from the Internet. Once you run Spybot, it often cleans off enough spyware that you can get to the Internet to download
Adaware and run it.
- Run Spybot and Adaware:
- Before running these removal tools, it is recommended that you backup your data on the hard drive.
- It is advisable to run both Spybot and Adaware for the most complete removal of unwanted spyware/adware.
They should both be run regularly on a weekly basis to keep your computer relatively clean.
- All spyware/adware removal software will require periodic updating, similar in concept to updating
virus definitions, so always check for updates before scanning your computer.
- If asked to Create a backup of the registry, Immunize, etc., do so.
- After scanning is done, a list of "problem" files will display. Checkmark them for deletion and then
delete them.
Does Anti-virus Software Work? Do Spam Filters Work?
since many of our friends have lost computers to a virus or viri... i thought i'd make
a quick observation:
if one feels they must use Microsoft, then i use Eudora version 1.5.2 for such situations
it is so basic that it does not allow you to make too many mistakes... nor a virus to take over your
life.
and i set attachments to go to the floppy drive (usually a: )
this will greatly reduce (though not eliminate) your risk
remembering... separate software for separate tasks will help secure you. read email with an email
reader only (never a web browser.)
another replied: yes, except Microsoft has made the html control applet part of the operating system... so
it is hard for a modern email client to ignore the Microsoft widget that displays/interprets/executes email
so stikin' to old clients is good .. but soon will not work with new Microsoft Windows
yet another asked: presently I'm using Hotmail. does this constitute an e-mail reader? if not, what
would?
i respond: hmmm... web based email is a weird thing. it is safer in some ways... most importantly
that you read your email on the server. however, since you use a webbrowser to read your email, you actually do download the
webpage/email to your cache.
so, webbased email may help stop virused attachments from auto downloading onto your computer. but,
the webbrowser/reader will allow other types of viri in... in particular html coded viri. (of course, you can't see the virus
html code with the web browser... you need to look at it through a text only viewer.
here is an example of some virus code that you would not see if using a webbrowser to read your mail.
by just reading the email, the code uses your webbrowser to take over your computer:
(i've changed all the greater than/less than signs to * so it is not dangerous. also to note, some
of these viri come in the subject line, etc... meaning you do not even have to open the email... just having it in your "in
box" is enough to toast you.)
*HTML**HEAD**/HEAD**BODY* *jframe src=3Dcid:ASQ3D47Fmqd8Do height=3D0 width=3D0* */jframe* *FONT**/FONT**/BODY**/HTML*
a funny thing happened when we sent out the above email
one of the recipients' ISP auto blocked and returned the email (stopping / censoring important antiviri
information from getting to the intended recipient.)
again, this brings up the huge problem of spam filters and antivirus software. there are 2 main issues:
1) false negatives. this type of software is not foolproof. just because it says you are blocking
spam or a virus, doesn't mean you stop them all. and how do you know when you have not detected an unwanted entry? (giving
the user a false sense of security.)
2) false positives. in the above mentioned blocking instance... and the recent AOL mess (where AOL blocked all our mail without a valid reason. click here for more information)... their software gave a false positive -- saying something is spam when it is not... saying something
is a virus when it is not.
the false positives usually result in more trouble... people's email is unknowingly being censored...
other people are falsely being accused... many innocent people are having viri sent to them by these faulty programs.
though i have not done a thorough analysis, i'd guess that at this point in time... more people are
having their human rights abused by spam and viri filters than any other single "tool"
... at least that's what's happened to me in the last week.
ps though we got AOL to stop blocking our mail, they still have not produced any proof as to why they
blocked us... making it appear as though they made a costly false positive.
Computer Virus Information
What are some of the common misperceptions about computer viruses?
I cannot get a computer virus because:
- My computer, which is relatively new, came with antiviral software.
- I don't read e-mail attachments.
- I don't read e-mail from anyone I don't know.
1. What are the costs and consequences of getting a virus on my computer with or without my knowledge?
The worst a virus can do to a computer is to delete information. The cost of this varies by individual
-- how much data was lost, whether the data can be restored to its most current status, whether applications and/or the entire
operating system must be reinstalled.
2. What are the costs and consequences of spreading a virus from my computer with or without my knowledge?
This is most typically done, these days, via e-mail viruses. The consequences of this are:
- Burden on e-mail systems.
- The anger of colleagues and friends whose machines are infected.
The costs are those for:
- Time spent communicating to everyone you have infected.
- Time spent by recipients in sorting through e-mail to attempt to determine infected messages from
safe messages.
- Time spent by each infected person as described in question 1.
3. Does my computer need to be connected to an UNM network to be more vulnerable to virus infections?
No. However, the more probable route for virus spread is via e-mail these days, so connection to any
network (not just UNM's) does raise the chance of getting infected. Viruses typically are spread via these methods, in this
order of likelihood:
- E-mail
- Shared drives
- Removable media (e.g. floppy disks, zip disks, CD's)
A. How can I protect my computer from infection?
- Make regular backups of important data .
- Install antiviral software on your computer and use it daily.
- Update the antiviral software with the latest signature files weekly. Antiviral software does no good
unless it is frequently updated to protect against the most recent viruses.
- Upgrade the antiviral software when new releases are provided.
- Never open or execute a file or e-mail attachment from a source you don't know. If you are unsure
of the source, delete it. Recent viruses have been written so that they come from friends and colleagues. Be cautious with
attachments even from trusted sources. If it was sent knowingly, an attachment could still contain a virus. Saving it as a
file and running the virus scan software will catch any virus that it has been set up to find, therefore will catch most of
them.
You can use the viewer that comes as part of Mirada. When you open an attachment within Mulberry, it
invokes the viewer, which allows viewing of the attachment without any chance of invoking a virus. Once viewed in this manner,
it can then be deleted or scanned.
B. How much money and time does this protection cost?
CIRT offers the following software for departmental machines:
- $6/workstation/year for Command Antivirus for Windows workstations.
- $16/workstation/year for Norton Antivirus for Macintosh workstations.
The UNM Bookstore offers those same antiviral software applications for personal workstations for a
discounted cost of about $25 - $30 per workstation.
Using this software daily and updating it weekly will cost no more, for the extremely diligent person,
that about 5 minutes per week.
Using caution with e-mail will cost a diligent person at most 1/2 hour per week.
4. What kind of connection to the UNM network makes my computer more vulnerable to viruses? E.g.,
dial-up, direct, school-wide network, etc.?
The type of connection has no effect on virus vulnerability. Rather, it is the type of service one
is using (e.g. e-mail).
5. What kind of operating system makes my computer more vulnerable to viruses?
At this time, Windows operating systems are far more vulnerable than other operating systems. This
can change. Macintoshes have limited vulnerability, mostly from cross-platform macro viruses. Linux machines do not appear
to be vulnerable to viruses at this time.
6. What kind of web browser software makes my computer more vulnerable to viruses?
None of the mainstream browsers are more vulnerable than others. It is a good idea to keep the browser
updated to the current version.
7. What kind of e-mail system software makes my computer more vulnerable to viruses?
At this time, Microsoft Outlook is more vulnerable to viruses than other e-mail clients, because viruses
can infect a machine when an infected e-mail message is opened. Other mail clients typically are vulnerable only via attachments.
A. How can I build protection for MS Outlook, Eudora, Mirada, etc. on my computer?
If you are using Outlook or Outlook Express, be sure to frequently visit the Microsoft web site and
apply the most recent patches they suggest. Other e-mail clients typically are only vulnerable to viruses through attachments,
so the protection would be the same as suggested in answer 3.
8. What kind of web-hosting software makes my computer more vulnerable to viruses?
Web hosting does not make your machine open to more attacks. It is wise to secure a web server so that
it cannot be used to propagate viruses to others.
9. What other software (e.g., MS Word, MS Excel, etc.) makes my computer more vulnerable to viruses?
Microsoft Office applications (like Word and Excel). Any software that makes use of macros is more
vulnerable than others. Again, making sure software is up to date with the latest patches, and using antiviral software, will
help to protect a machine.
10. Is there any monitoring software available that would tell me if my computer has been infected
by a virus?
Antiviral software.
11. What are the roles of different groups at the UNM in providing me with this protection or updated
information about it?
A. Role of CIRT
CIRT does periodic "cleaning" of its mail servers, so any infected mail that can be detected via this
method will be deleted prior to being opened. CIRT negotiates volume discounts with antiviral vendors, and provides it to
departments at relatively inexpensive cost. To inform UNM, CIRT used various e-mail lists or, when appropriate, news media.
B. Role of my department
This will vary by deparment, but surely departments can play a role by encouraging the use of antiviral
software and the careful use of e-mail.
C. Role of my school's network administrator
This will vary by department. The best way to find this out is to ask the person, if your department
has such support.
D. My role
To keep informed about current viruses. To obtain and regularly update and use antiviral software.
To back up important information. To exercise caution when reading e-mail, as described in the answer to question 3.
Stay informed. Download new signature files weekly. Check the web site of the antiviral supplier frequently
to determine if there are new releases.
What is a Computer Virus?
By Sandy Berger
Computer viruses are everywhere. Their very names give computer users a scare — Klez, Melissa,
W32, Michelangelo.
With the use of the Internet and endless communication between computers, viruses are spreading faster
than ever. The only way to prevent their growth is through public awareness of safe computing.
It All Boils Down to the Code
A computer virus is simply a set of computer instructions or computer code that is written by some
unscrupulous person. This code is attached to some part of the normal computer operating system or computer program. Instructions
in this code tell the computer to perform some task. This task is often a destructive one, such as deleting important information
or crashing the hard disk. However, there are other benign viruses that may be only a slight aggravation. Some viruses have
been known to do nothing more than put a large happy face on your computer screen.
How Does a Computer Get a Virus?
Just as a human virus is passed from person to person, a computer virus is passed from computer to
computer. A virus can be attached to any file that you copy to your computer. If you download files from the Internet or copy
programs or files from friends on floppy disks, you are very susceptible to viruses. Actually, anytime that you download files
or put a floppy disk into your computer, you are susceptible to viruses.
Many viruses are spread through e-mail. Generally, you cannot get a virus from simply reading e-mail.
Certain types of today's viruses, like Klez, are different. They are very dangerous because you do not even have to open an
e-mail attachment to release the virus. Just opening the e-mail itself can release the dangerous bug.
Under normal circumstances, a virus becomes active when you execute a program that contains the virus.
For instance, if you download a program from the Internet and it is infected with a virus, the virus will attack your computer
when you activate the program. Viruses are everywhere. Although it is rare, viruses have even been found in commercial shrink-wrapped
software.
How Do I Know If My PC Has a Virus?
The trigger that activates the virus can be almost anything. For instance, the virus can be activated
the minute it is installed. On the other hand, it may initiate its dirty work the next time you start your computer. In many
cases, a virus resides inside your computer in an inactive state, waiting for a certain event to happen. Like having a physical
virus in your body, you can have a virus in your computer system and not even know it. A virus can wait patiently in your
system and attack only on a certain date. Of course, in the time between the moment you contracted the virus and the time
it made itself known to you, you may have innocently spread the virus to others.
Stop Viruses Before They Attack
A computer virus can do extensive damage. It can crash your hard disk. It can destroy all or some of
your data. Many viruses do weird little things that adversely affect your computer. The most usual symptom of a computer virus
is erratic behavior. The destruction can happen at any rate of speed and can affect almost any part of the computer. Viruses
can spread quickly through today's intricate cyber world. If your computer starts to act a little weird, the first thing to
do is to check for a virus.
If you are smart, you will stop viruses before they enter your computer. You can do this by purchasing
a good virus protection program. Such a program will check all files for viruses. Once installed, an antivirus program can
be set to work in the background. It will check all files before they enter your computer and will alert you if a virus is
detected before it contaminates your system. If a virus is detected, your antivirus program will quarantine or eliminate it
so that it cannot harm your computer.
Be very careful to purchase a virus protection program that matches your operating system. If you use
a Mac, buy a virus protection program made especially for Macintosh computers. If you use Windows 98 or Me or XP, select a
program that was written specifically for your operating system. Don't try to use a virus protection program that was written
for Windows 95 on a Windows XP machine; this will really mess up your computer.
Keep Virus Protection Software Up-to-date
New viruses are written everyday. It seems that there are many people in the world who have a lot of
time on their hands and a slightly warped idea of how to use their intelligence. Luckily, companies like McAfee, Symantec, and Panda Software are constantly scouting for new viruses and updating their antivirus software tools. They use any of
a growing arsenal of weapons to detect and fight viruses.
In order to take advantage of these new antivirus shields, you must update your antivirus program on
a regular basis. The company that manufactured your antivirus software will provide constant updates as they find new viruses.
You should make arrangements to get these updates regularly to be sure that your computer is completely protected. Go to the
Web site of your antivirus manufacturer to download new virus updates, or definitions as they are often called. Some newer
antivirus programs automatically update your antivirus protection as well as the antivirus definitions when you log onto the
Internet through a process called live update or online virus scan.
When you purchase a virus protection program, be sure to check out the company's update program. Some
manufacturers give you free updates; others do not. If you already own a virus protection program but have never updated it,
see the documentation that came with your program or contact the company that created your program to check on their update
policy. If your program did not come with free updates or if you have already used up your free updates, you can purchase
additional updates, usually for a nominal fee.
To keep you protected as much as possible, I recommend purchasing antivirus software that updates automatically.
If you update your virus protection manually, a weekly update is mandatory; a daily update may be a good idea in today's virus-infested
atmosphere.
Viruses and the people who write them are intriguing subjects. For more detailed information on the
different types of viruses and how they work, visit the Symantec AntiVirus Research Center or check out the Virus Bulletin. Although the Virus Bulletin is a technical journal, it will give you good solid information and
links to virus information and antivirus products
.
What is a virus?
A computer virus is a program that can make copies of itself. Most computer viruses do nothing more
than this and are more of an annoyance than a danger. Some computer viruses, though, may also harm data and programs stored
on a computer.
What types of viruses are there?
- Program viruses infect computer programs and become active when the infected
program is run.
- Boot sector viruses infect diskettes and hard disks and become active
when an infected disk is used to start the computer. (On a Macintosh, merely inserting an infected disk can activate a virus.)
- Macro viruses infect documents (files) through the macro programming capabilities
of some newer programs. Macro viruses become active when an infected document is opened, and the program opening the document
has its macro capabilities turned on (enabled). As of late 1997, only documents created with Microsoft Word version 6 or later
(Windows and Macintosh versions), Excel (5.0 for Windows 3.x and Windows NT, and 7.0 for Win95), and Lotus Ami Pro have seen
infections. However, in the future, it is likely that viruses will be created that can infect other types of documents.
What is not a virus?
Trojan horse programs are designed to do something (usually something malicious) other than their supposed
purpose. Trojan horse programs are sometimes classified with viruses. However, because they don't make copies of themselves,
they are not true viruses.
Some programs are designed as a joke, or prank, but are not viruses. For instance, warnings of a virus
incorporated in a mail message with the phrase "Good Times," "Join the Crew," or "Penpal Greetings" in the header have, at
times, been rampant. The only thing that spreads, however, with these "viruses," is the messages warning people to look out
for the supposed virus in their e-mail. And, it's the person sending the message, not the computer, that causes the message
to be copied and spread.
Virus Hoax or the Real Thing: How to Tell the Difference
You’ve probably seen the urgent alert in your mailbox warning you of a new virus
transmitted by email that will erase your hard drive or crash your machine if you read it. The warning usually appears
to come from the Federal Communications Commission (FCC), Microsoft, or the technology department of a major university.
It goes on to urge you to forward the message to all of your friends and colleagues. You may panic, run your virus software,
keep an eye out for suspicious emails, and then forward the message to everyone you know. In reality, this is one of
the dozens of virus hoaxes that are maliciously created but are spread by well-intentioned people. They both cause needless
panic and fill our mailboxes with junk mail.
Because computer viruses can be very serious and can cause irreparable damage to your
computer and/or data, it is important to be able to recognize the difference between real virus warnings and virus hoaxes
and to protect your data and computer using virus software and the latest virus definitions.
Signs of a virus hoax:
- The message tells you that your hard drive will be erased or your computer destroyed
if you open an email message. Only executable files can cause the type of damage described. Simply reading an
email message can not spread a virus. Be aware, though, that an executable file disguised as an attachment could be
a virus. Make sure your virus program scans downloaded files and attachments. When in doubt, check your attachment
for viruses before opening it and do not execute a program that does not come from a reputable web site or manufacturer.
- The author of the message encourages you to pass it along to all of your friends
and colleagues.
- The warning includes very technical-sounding language.
- The warning appears to come from the FCC. Monitoring computer viruses and warning
users is not a job of the FCC.
If you receive a virus warning, it is important to rule out the possibility that
it is a hoax. Before forwarding the message to anyone, please:
- Contact LRDC Computing Services. We will investigate the message to determine
if it is a hoax.
- Check reputable web sites that provide lists and descriptions of known virus hoaxes:
Click here to read Stopping Chain Letters and Hoaxes on the Internet (feature article in AntiVirus Online)
Signs of a Real Virus:
- Your virus software reports an infected file.
- Someone you share your files with tells you that their software detected that your
file is infected.
- While using a word processor, you are suddenly forced to save all of your files as
a template.
- You receive a message that a program is trying to write to your boot sector or that
your boot sector has been changed.
- An unusual message (not an error message) appears on your machine.
If you suspect that you have a computer virus, please run your anti-virus program
or contact LRDC Computing Services (x47033) for assistance. If you find a computer virus, please inform any colleagues
with whom you share files.
Prevention:
- Make sure that you have an anti-virus program on your computer and that it is running
in the background.
- Make sure that your virus definitions are up-to-date
- Make sure that your program is set up to automatically scan floppy disks, attachments,
and downloaded file.
VIRUS
TYPE OF VIRUSES
Virus Type A virus is a program that has two functions:
proliferate (make more copies of itself) and activate (at some signal count, date, and so on, do something-usually something
bad like delete the boot sector). A virus does not have to do damage to be a virus.
Boot Sector Boot sector viruses
change the code in the master boot record (MBR) of the hard drive.
Executable Executable viruses
reside in executable files. They are literally extensions of executables and are unable to exist by themselves.
Macro Macro viruses are specially
written application macros. These viruses will auto-start when the particular application is run and will then attempt to
make more copies of them-selves.
Trojan Trojans are true, freestanding
programs that do something other than what the person who runs the program thinks they will do. An example of a Trojan would
be a program that a person thinks is a game but that is actually a CMO eraser. Some Trojans are quite sophisticated. It might
be a game that works perfectly well, but when the user quits the game, it causes some type of damage.
Worm A worm is a very special
form of virus. Unlike all of the other viruses described, a worm does not infect other files on the computer. Instead, a worm
replicates by making copies of itself on other systems on a network by taking advantage of security weaknesses in networking
protocols.
Bimodal/Bipartite A bimodal or
bipartite virus uses both boot-sector and executable functions.
Antivirus Tools The only way to
protect your PC permanently from getting a virus is to disconnect from the Internet and never permit any potentially infected
software to touch your precious computer. Because neither scenario is likely these days, you need to use a specialized antivirus
program to help stave off the inevitable virus assaults.
Polymorphics/Polymorphs A polymorphs
virus attempts to change its signature to prevent detection by antivirus programs, usually by continually scrambling a bit
of useless code.
Stealth The term “stealth”
is more of a concept than an actual virus function. Most stealth virus programs are boot sector viruses that use various methods
to hide from antivirus software.
Virus Prevention Tips The secret
to preventing damage from a virus attack is to keep from getting one in the first place. As discussed earlier, all good antivirus
programs include a virus shield that will automatically scan floppies, downloads, and so on. Use it. It is also a good idea
to scan a PC daily for possible virus attacks. Again, all antivirus programs include TSRs that will run every time the PC
is booted. Last but not least, know where software has come from before you load it. Although the chance of commercial, shrink-wrapped
software having a virus is virtually nil (a couple of well-publicized exceptions have occurred), that illegal copy of “Unreal
Tournament” you borrowed from a local hacker should definitely be inspected with care. Get into the habit of having
an antivirus floppy disk-a bootable, copy-protected floppy with a copy of an antivirus program. If you suspect a virus, use
the diskette, even if your antivirus program claims to have eliminated it. Turn off the PC and reboot it from the antivirus
diskette. Run your antivirus program’s most comprehensive virus scan. Then check all removable media that were exposed
to the system and any other machine that may have received data from, or is networked to, the cleaned machine. A virus can
often go for months before anyone knows of its presence.
General System Sluggishness Every
PC gets slower and stodgier overtime. You load and unload programs, you download stuff off the Internet, the system crashes
and scatters temp files all over the place-all of these factors contribute to the decline of snappiness. Sometimes the decline
comes in a more dramatic fashion, though. A client of mine recently bought a new Pentium 4 system with all the bells and whistles.
Viruses and Other "Rogue Programs"
Computer viruses, worms, trojan horses, and other "rogue programs" are a serious
problem for all computer users.
- If your computer is connected to the Internet, or, for that matter, to any network,
- if you send and receive e-mail,
- if you share files or disks with friends or colleagues, or
- if you allow other people to use your computer,
your computer
may be affected by these rogue programs.
Therefore, it is imperative that every University of Delaware computer user learns how to protect his
or her computer(s) from these programs.
Doing so will protect your computer from damage, protect the information you have stored on your computer,
protect the networks to which your computer is connected, and protect other computers connected to the networks to which your
computer is connected.
Computer Virus Disinfection in Nebula
There is some excellent information at the C&C Protecting your computer from viruses" page. A virus's most common "vector of infection" currently is via an email attachment. Viruses rely on a user to
spread: opening the infected attachment actually runs the virus program. The virus then sends itself to other computers
(usually by emailing itself to any email addresses found on the host computer). It can also:
- Disable any antivirus software that's running.
- Damage and delete files on the available drives of the host computer.
- Send information to web servers or install software to distribute other files (including copyrighted
material). Often, this behavior can overwhelm computer networks.
- Record keystrokes or steal sensitive data such as passwords.
This behavior is different from a worm, which can spread itself across a computer network, or a trojan, which is used to break into a host computer.
- Do not open unknown attachments, ever, even if they profess to be from Microsoft, a UW entity,
or some kind-hearted soul who wants you to open the attachment to clean your infected system!
- Leave your system on 24/7, so it receives virus updates regularly.
- Use Ctrl-Alt-Del and choose "Log Off" at the end of your shift each day. When you log in at
the beginning of the next shift, you ensure that you have the latest patches installed.
- Any email claiming that you have a virus should be ignored, including those coming from campus
sources. The only exception is if it's from an individual Nebula support person, and even that will never have a legitimate
attachment. For more fun reading on this, see the C&C pages on "Who sent this email using my computer or UWNet ID?" and "What should I do about notices of email viruses?"
- Do not delete files from your system based on an email message, and do not re-send such messages
to others. Check the Nebula Hoax page for more information.
- The most reliable source of information about a virus infection will come from your computer's McAfee
program. If this tells you that you have a virus, do notify Nebula Support.
There are a variety of strategies to keep users from opening attachments accidentally. One such strategy
is what UW has done recently: strip possibly problematic attachments from all email. The signifier of "problematic" that we've
chosen is file name extension. These are the three characters that follow the filename of typical documents. The original
intention behind file extensions was to tie files to particular programs. This gave you an easy way to launch the appropriate
program: anything ending in .DOC opens MS Word; .XLS opens Excel, .ZIP opens a decompressor program. Unfortunately, this "auto-open"
means the virus' damaging programming can be started just by clicking on it.
The current list of attachments that are being stripped is found on the C&C Alerts page. For more information about handling attachments, please see the Handling Attachments page.
Most viruses can be detected and removed using virus detection software such as McAfee VirusScan. In
Nebula, we configure this package to be loaded at startup and watch for any signs of viruses. If McAfee VirusScan detects
a virus in a file you're working with, it will notify you and give you some basic instructions on what to do next. You can
also check the list below for instructions on dealing with some of the more pervasive virus infections. If you get a virus,
you should always notify the person who gave you the file, by telephone if possible, so they can get rid of it on their computer,
too.
If you are not sure if your computer is virus-free, try removing a virus from the hard disk as described
below.
- Shut down your machine, then start it up and log in; this ensures you have the latest virus update
files on your system.
- Choose Start - Programs - Network Associates - VirusScan to begin a virus scan on your computer.
- In the box labeled "Scan in", make sure the drive you wish to search for viruses is selected, typically
C:. If it isn't, click "Browse" and choose the right drive (and folder, if desired). Do not scan the I:\groups or H: drives;
they are scanned regularly by the engineers.
- Note that the "Include subfolders" checkbox should be selected, so Viruscan looks through all subdirectories
of the location you've chosen.
- Note also that by default only program files are scanned; this includes Word and Excel document files.
If you wish to scan all files, click the "All files" radio button.
- Click "Scan Now" to start the search.
- If a virus is found, click on the file name and choose Clean Infected Files.
- If Viruscan reports that it cannot clean a file, close the box and restart your computer. Then repeat
the scan. If Viruscan repeats the report, contact Nebula Support. If possible, use the Nebula Support icon on your desktop;
this will include other information about your system that may help to solve the problem.
- Remember, don't respond to an email telling you that you have a virus. It's either a hoax (in which
case you just get more spam now that they know your address is valid), or a response to an infected message that only looks
like it came from you--the latest viruses disguise their "From" addresses.
|
This web site was created to help people understand today's computer viruses and assist them in
cleaning their own systems. Questions are answered using a Q & A format with straightforward terminology. Some general
information is listed below dealing with common questions being asked today. Unfortunately, I am unable to keep this site
up-to-date. However, I will still respond to your email questions, see a link below.
Frequently Asked Questions
I received an email that said I have a virus, what do I do?
There are a few viruses that forge the from field when emailing themselves to others. Therefore,
it may seem to others that the virus came from you when in fact it was sent by someone else's infected system. If you receive
notification that you have sent a virus to someone, ensure that you have an up-to-date virus scanner on your computer and
run a full system scan. If nothing is detected, then it is likely the virus did not originate from your system.
I have a virus, what do I do?
Should you receive a detection with an anti-virus scanner, you should choose to have the scanner
clean/repair the infected file. If repair fails, you should choose to delete the infected file. Often, scanners are configured
to take this action automatically. If you are concerned that the virus was not removed, simply run a full system scan to ensure
that the virus is no longer present.
There is a distinction between having an infected file on your computer and being infected by that
file. It is commonplace to receive viruses in email messages now-a-days. If those viruses are not run, then your system is
not affected by the virus and it did not propagate on your system. To remove the virus, simply delete the file and you're
done. Now, if the virus was run on your system then significant changes may have been made. To be on the safe side, you can
read a description of your virus to learn about the changes that occur when the virus has run.
How can I protect myself from viruses?
It is essential to have an anti-virus scanner loaded and running on your system at all times. It
is also necessary to update you virus definition files once a week. McAfee VirusScan has recently received several outstanding
reviews. I recommend this product to anyone who does not have a scanner or whose scanner is now a few years old. If you are
installing a virus scanner because you do not have one and you got infected, it can be necessary to remove that virus prior
to installation. If this is the case, use a stand-alone virus remover before installing an anti-virus product. Stinger is a great stand-alone removal tool.
Alerts
See http://vil.nai.com/vil/default.asp for the most recent virus information.
Keep your anti-virus software up to date to avoid infection of these common threats.
McAfee VirusScan users can download the latest engine and DATS here: http://www.mcafeesecurity.com/us/downloads/updates/default.asp
Definitions A Trojan horse (a.k.a
Trojan) is a program that appears to do something amusing or useful and actually does something else. It may destroy data
or compromise your systems security. However, a Trojan horse does not replicate itself or transmit itself to other computers.
A virus is a program that carries out a specific function and infects other programs in the process.
In many cases the whole function of the virus is to replicate itself, nothing more. Other viruses rewrite data files making
them useless.
A worm is a virus that does not infect other programs. It still replicates itself to other computers,
but will always arrive in the same program.
Hoaxes There are many messages
floating around telling you that if you receive an e-mail message with the subject _____ delete it right away, and do not
open it as doing so will wipe out your hard drive. These messages might claim to have been verified by IBM, Microsoft, CBS
News, or whomever. These messages always encourage you to pass along the warning as well. Please delete such messages and
refrain from spreading these hoaxes. Below is a list of the common hoaxes being passed around today. You can recognize a hoax
if the message makes reference to one of these names:
- Budwiser Screen Saver - JDBGMGR.EXE - Frog Blender - SULFNBK.EXE - Good Times -
It Takes Guts to Say Jesus - Lump of Coal - Elf bowling, Frogapult, Y2KGame - Wobbler/California
Computer Viruses
Any unprotected computer system can fall victim to viruses, which can cause serious
damage in a short time. The results of a virus can range from merely annoying to disastrous, and the loss of software and
data can be time-consuming and expensive. With corporations increasingly using computers for enterprise-wide, business-critical
computing, the costs of virus-induced downtime are growing along with the threat of viruses.
What is a computer virus? It is a program designed to replicate and spread while the user is oblivious to its existence. Computer viruses spread
by attaching themselves to other programs (e.g., word processor files) or to a disk's boot sector. When an infected file is
executed, or when the computer is started from an infected disk, the virus is also executed. A virus often lurks in computer
memory waiting to infect the next activated program or the next accessed disk. Viruses can rename system files so they cannot
be accessed and make systems unbootable.
How does a virus infect your system? Viruses can spread by almost any means two computers share information. The old-fashioned way, through an
infected disk, is the most common. Most often, diskettes brought to the office from home are responsible for introducing a
virus into a corporate network-computing environment. Most at-risk servers on a network have software that detects incoming
viruses, but infections do occur in networked environments, making the rapid spread of a virus a serious risk. With networking,
enterprise computing, and inter-organizational communications on the increase, infection during telecommunications and networking
is on the rise. You can acquire viruses while downloading software from the Internet or from an electronic bulletin board
service. Viruses can also replicate themselves via e-mail attachments.
How do you know if your system is infected with a virus? The most common viruses are without any symptoms, so anti-virus software is necessary to identify
infections. However, many viruses are flawed and provide tip-offs to their infection. Below is a list of indicators that your
computer may be infected. These symptoms can be the result of a problem other than a virus.
Changes in the length of programs. Changes in the file date or time stamp. Longer
program load times. Slower system operation. Reduced memory or disk space. Bad sectors on your floppy. Unusual
error messages. Unusual screen activity. Failed program execution. Failed system boot-up when booting or accidentally
booting from the A: drive. Unexpected writes to a drive.
Virus protection software, such as VirusScan, is your first line of defense
against viruses. Make sure the data the software uses to locate viruses is updated regularly. Viruses proliferate and spread
only as long as they exist undetected. The opportunities for infection are increasing with the Internet's growth, and there
will be more damaging viruses. Windows-specific viruses have already appeared.
In response to the explosion of virus types and transmission opportunities, virus
protection must expand to meet these challenges, too. Knowing where a virus can come from, how it spreads, and the symptoms
can help you contain the effects of a virus within an organization.
With such a large variety of new viruses, you'll want to keep up-to-date
on the latest bug buzzwords. Here are some of the major virus categories and a few other terms you'll need to know.
- Executable file virus. This virus attaches itself to an executable
file, such as an .EXE or .COM file, and runs whenever the executable file is run. Our example above fits this description;
it infected a .COM file.
- Boot sector virus. This virus infects the boot sector of a disk,
where it is executed whenever the disk is used to boot from. If you boot from an infected floppy, the virus infects the hard
drive's boot sector. Every floppy that you put into your infected machine will also pick up the virus. Boot sector viruses
are particularly dangerous, since they run every time the computer is turned on.
- Trojan horse. This virus masquerades as something desirable when
its real aim is destruction. That cool game your brother-in-law gave you on a floppy might actually be a Trojan Horse virus.
When you play the game you are also infecting all your boot sectors. It's just another reason to avoid your brother-in-law.
- Polymorphic virus. This virus changes on the fly—making it
difficult to detect. A polymorphic virus has a unique sequence of bytes in its code, known as its "signature."
- Stealth virus. Stealth viruses escape normal antivirus detection
efforts because they contain a unique code. The stealth is a type of polymorphic virus. For example, a boot sector virus may
copy the original boot sector to somewhere else on the hard disk, then wait for attempts by other programs to look at the
actual boot sector. If the virus detects such an attempt by, say, an antivirus program, it intercepts the attempt and redirects
the antivirus program to the original boot sector sitting out on the hard disk. The antivirus program then reports that all
is well with the boot sector, and the virus goes undetected.
- Trigger event. Some viruses do their dirty work immediately upon
execution. More commonly, though, the virus lies in wait, biding its time until some event chosen by its author causes it
to "wake up" and deliver its "payload." It may be a date, or a time. It may be a certain number of boot ups, or a certain
number of times a command is executed.
- Payload. Just like in missiles, the virus payload is whatever damage
the virus ultimately delivers. It may be fairly innocuous, like a message appearing on your screen. It may be annoying, like
letters falling to the bottom of the screen. Or, it may be horribly destructive, like deleting every file it can find on both
your computer and the network.
Computer viruses cross picture barrier
WASHINGTON (AP) — A new computer virus is the first ever to infect picture
files, an anti-virus firm reported Thursday, making sharing family photos on the Internet a potentially dangerous activity.
The virus, dubbed Perrun, is not currently infecting computers but worries anti-virus
experts because it is the first to cross from program infection into data files, long considered safe from malicious data.
"Our concern is more for what might be coming," said Vincent Gullotto, head anti-virus
researcher at McAfee Security. "Potentially, no file type could be safe."
Until now, viruses infected program files — files that can be run on their
own. Data files, like movies, music, text and pictures, were safe from infection. While earlier viruses deleted or modified
data files, Perrun is the first to infect them.
Perrun still needs some tweaking to become dangerous. The virus arrives via e-mail
or a floppy disk as an executable file. Security experts always warn against opening programs sent as e-mail attachments.
Once run, the file drops an "extractor" component onto the victim's hard drive. When
a computer user clicks on a picture file with the extension .JPG — a common picture file found on the Web — it
is infected before it appears. Because the picture displays normally, Gullotto said, the victim may not know there's anything
wrong.
In its current form, an infected JPG file sent to a friend or placed on a Web site
isn't dangerous without the extractor file. But Gullotto said there's no reason a virus writer couldn't stuff the entire virus
code into the JPG, making the picture file a virus itself.
That evolution should make computer users think twice about sending pictures —
or any other media — over the Internet, Gullotto said.
"I think there's a possibility that this could change the playing field," he said.
"Going forward, we may have to rethink about distributing JPGs."
McAfee researchers received the virus from its creator. Gullotto declined to identify
the author, and McAfee anti-virus software can detect and remove Perrun.
Perrun is known as a proof-of-concept virus, and does not cause damage. Gullotto
said he fears that virus writers may use Perrun as a template to create a more destructive version.
How Computer Viruses Work
Inside This Article
1.
Introduction to How Computer Viruses Work
2.
3.
4.
Computer viruses tend to grab our attention. On the one hand, viruses show us how
vulnerable we are. A properly engineered virus can have an amazing effect on the worldwide Internet. On the other hand, they
show how sophisticated and interconnected human beings have become.
For example, experts estimate that the Mydoom worm infected approximately a quarter-million computers in a single day in January 2004. Back in March 1999,
the Melissa virus was so powerful that it forced Microsoft and a number of other very large companies to completely turn
off their e-mail systems until the virus could be contained. The ILOVEYOU virus in 2000 had a similarly devastating effect. That's pretty impressive when you consider that the Melissa
and ILOVEYOU viruses are incredibly simple.
In this article, we will discuss viruses -- both "traditional" viruses and the newer
e-mail viruses -- so that you can learn how they work and also understand how to protect yourself. Viruses in general are
on the wane, but occasionally a person finds a new way to create one, and that's when they make the news.
Computer viruses are called viruses because they share some of the traits of biological viruses. A computer virus passes from computer to computer like a biological virus passes from person to person.
There are similarities at a deeper level, as well. A biological virus is not a living thing.
A virus is a fragment of DNA inside a protective jacket. Unlike a cell, a virus has no way to do anything or to reproduce by itself -- it is not alive. Instead, a biological
virus must inject its DNA into a cell. The viral DNA then uses the cell's existing machinery to reproduce itself. In some
cases, the cell fills with new viral particles until it bursts, releasing the virus. In other cases, the new virus particles
bud off the cell one at a time, and the cell remains alive.
A computer virus shares some of these traits. A computer virus must piggyback
on top of some other program or document in order to get executed. Once it is running, it is then able to infect other programs
or documents. Obviously, the analogy between computer and biological viruses stretches things a bit, but there are enough
similarities that the name sticks.
When you listen to the news, you hear about many different forms of electronic infection.
The most common are:
- Viruses - A virus is a small piece of software that piggybacks on real programs. For example,
a virus might attach itself to a program such as a spreadsheet program. Each time the spreadsheet program runs, the virus
runs, too, and it has the chance to reproduce (by attaching to other programs) or wreak havoc.
- E-mail viruses - An e-mail virus moves around in e-mail messages, and usually replicates itself by automatically mailing itself to dozens of people in the victim's e-mail
address book.
- Trojan horses - A Trojan horse is simply a computer program. The program claims to do one thing
(it may claim to be a game) but instead does damage when you run it (it may erase your hard disk). Trojan horses have no way to replicate automatically.
- Worms - A worm is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that
has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from
there, as well. We'll take a closer look at how a worm works in the next section.
Question ---Thank you for your suggestion about the fdisk method and I understand that the Fdisk
is for hard drive partitions and I don't know how it is related fixing virus problems. I went to the CMOS and as able
to see the C: drive and floppy drive but why is it that I cannot format the C: drive with the Startup disk. I did it many
times with other computers and they worked out successfully. I do have the latest version of the Norton System works. But
how do I install it to make it work when the computer is not in good condition to install anything. Thanks again for you attention.---------------------- Followup
To Question - I have a computer that has been infected with virus. A month ago, it was very slow when connecting
to the internet and as time goes by. It does not connect anymore and what is worse is it does not work at all. I cannot access
the c drive and floppy drive. I tried to format the the C: drive by using the win98 start up foppy disc and it does
not work. Could it be that the cmos is infected. How do I use the antivirus to get rid of the virus. Answer - Hi Jasper,
Sounds
like you let the virus go too far. Follow the directions given at the following site to FDIDK the hard drive:
McAfee-Question : Is Windows a virus ?
No, Windows is not a virus. Here's what viruses do:
- They replicate quickly - okay, Windows does that.
- Viruses use up valuable system resources, slowing down the system as they do so - okay, Windows does
that.
- Viruses will, from time to time, trash your hard disk - okay, Windows does that too.
- Viruses are usually carried, unknown to the user, along with valuable programs and systems. Sigh...
Windows does that, too.
- Viruses will occasionally make the user suspect their system is too slow (see 2) and the user will
buy new hardware. Yup, that's with Windows, too.
Until now it seems Windows is a virus but there are fundamental differences:Viruses
are well supported by their authors, are running on most systems, their program code is fast, compact and efficient and they
tend to become more sophisticated as they mature.
So Windows is not a virus.
It's a bug.
Protecting Your Computer Against Viruses
The popularity of the Internet has led to the recent widespread outbreaks of computer viruses. Viruses
have become so widespread that they are now mentioned in newspapers and network news programs. It is extremely important for
anyone who uses a computer to be aware of viruses, especially when accessing the Internet. Viruses can be carried in anything
from a floppy disk to an email message. About a million computers worldwide are infected with a virus every day. If your computer
becomes infected with a virus, you could loose all of the data on your hard drive.
What is a Virus?
Computer viruses are self-replicating programs which cannot exist without a host. These programs have
existed since the 1960's, but did not get the name of "virus" until 1984. These programs can be relatively harmless, or can
completely incapacitate your computer. The damage done to your computer is called the payload, and can range from a
harmless message or image being displayed to destroying files and reformatting the hard drive of your computer.
With the popularity of the Internet, viruses have become more widespread and common. Originally, the
viruses were passed by floppy disks, but now they are often passed through Internet downloads and especially email attachments.
Over 50,000 viruses have been identified, and around 200 more are created each month.
There are other types of programs associated with viruses and sometimes seen to be subsets of viruses.
These are worms and Trojans. Many recent viruses have incorporated viruses, worms, and Trojans into one virus.
Worms are also self-replicating, but they do not have the payload that viruses have. Worms
use the internet or a network to send copies of itself to other computers, often using email programs. They are often incorporated
into viruses, and are to blame for the spreading of most of the recent viruses, such as Loveletter and SirCam.
Trojans on the other hand do not replicate themselves. Like the Trojan horse of legend, Trojans
seem harmless but transport harmful information to other computers. Trojans can allow a hacker complete access to your computer
so they can corrupt files, steal passwords, and modify the system registry. Often, Trojans are used to attack websites by
having thousands of computers under their control trying to access one site at the same time.
Additional information about viruses and/or virus hoaxes is available from the LTS Help Desk Virus Information site and on the Internet at, Computer Virus Myths.
Protecting Your Computer from Viruses
With the prevalence of viruses today, it is important for any computer accessing the Internet to have
protection against viruses. In addition to safe operating procedures, there are many different programs which can help you
to protect your computer. Viruses can come from many different sources, so you must be aware to protect yourself from getting
a virus from any source. Remember that virus scanners can only catch the known viruses, so do not rely solely on virus protection
software. Viruses may take months before they are discovered and solutions are found.
Some hints for preventing virus infections:
Don'ts
- Never use disks from an untrustworthy source
- Never download files from a site or person that you don't trust
- Never open an email that looks unusual or suspicious
- Never open an email attachment from a person you don't know
- Never open an email attachment that looks unusual or suspicious
To check email attachments against
known infected attachments, see About.com's Infected Attachment Names
Do's
- Disable preview screens when using Eudora or Microsoft Outlook
- Scan disks and zip disks before using them
- Use a real-time virus scanner or frequently check your system with an online virus scanner
- When using a real-time virus scanner, download virus updates every week
- Backup important files often
- Use personal firewall software to prevent unauthorized Internet access to and from your computer
- Use of the RTF (Rich Text Format) file format preserves document content and formatting AND reduces
the spread of viruses. The Word .doc format has been a popular target for those creating viruses. (Refer to Saving a Document in RTF Format.)
Virus Protection Software
There are many different programs which scan for and correct viruses which are on your computer. Many
times you will not even know you have a virus until you scan for viruses. There are many options for scanning and curing viruses.
There are free software, free online scans, downloadable trial versions of software, and software which you may purchase.
The vast number of software companies offering virus protection makes it difficult to include all companies, but we have compiled
a listing of the best rated virus protection solutions. The downloadable virus software scans for viruses in real-time, which
means that as your computer receives files, the software checks the files for viruses. The software also constantly monitors
the computer files to search for viruses. It is very important when using a real-time virus scanner to download updates frequently,
so the software can detect all of the newly found viruses.
Sites offering free online virus scans:
Some of the companies which offer free trial versions of their software are:
Some of the best rated virus protection software is:
Personal firewall software controls what programs are allowed to access the internet, and prevents
people from hacking into your computer. This can prevent Trojans which are already on your computer from accessing the internet.
There are companies which offer free and paid software for personal firewalls as well.
Some personal firewalls available are:
ILS : SOLVE > EMAIL VIRUS PROTECTION
|
January 23, 2001
Due to the recent on-campus proliferation
of Windows viruses spread by e-mail, ILS is installing an anti-virus detection program on the Bates E-mail server. This program
will disinfect a virus in a mail message sent to a Bates e-mail address before sending the message to the recipient.
WHAT THE NEW VIRUS PROTECTION
PROGRAM WON'T DO:
The detection of a virus relies upon the virus
definition files in the detection program. Therefore brand new viruses still may get through this system before their signature
gets put into the definition file.
Mail messages already downloaded to a user's computer
via netscape, outlook, eudora or other pop mail programs are not being scanned by ILS and may contain messages with attachments
that have a virus and can damage your files or computer. To prevent these viruses from infecting your computer, you must have
a virus detection program installed on your computer and have the virus detection signature files up to date.
Mail messages saved in mail folders in elm or pine
will not be scanned and may contain viruses.
Email sent to you using accounts other than your
abacus account will not be scanned and may be able to infect your computer.
WARNING: Computer viruses can infect
your computer from other sources. Internet downloads, shared files and infected floppy disks can also cause your computer
to be harmed by a virus. A local virus detection protection program will protect your computer from these virus sources. Virus
detection programs can be purchased at 110 Russell St, Bates Computer Sales and Service, or at any computer store.
WHAT THE NEW VIRUS PROTECTION
PROGRAM DOES:
All incoming e-mail traffic will be scanned by
this virus detection program. If a virus is found in an e-mail message, a security warning is added to the message and the
attachment with the virus in it is "sanitized". The message is then sent to the recipient's incoming mailbox.
If you get an e-mail message with this security
warning , you will be able to read the text portion of the message but you will not able to open the attachment.
WHAT ABOUT E-MAIL RECEIVED
BEFORE JAN 23:
In addition to adding this active virus protection,
this virus protection program will scan incoming mailboxes on abacus containing messages already sent to each user and left
in the incoming mailbox on abacus. Infected e-mail messages will be changed to include the security warning and the attachment
will be sanitized.
As noted above, messages already downloaded to
a user's computer must be scanned by a virus protection program on the user's computer.
TO RECOVER A LEGITIMATE
SANITIZED FILE:
A "sanitized" attachment is given a new filename
that will not allow the attachment to be opened without deliberate steps being taken. This ensures that the person really
wants to open the attachment, knowing either that the attachment is harmless or that it may harm the files or the computer
they are using.
To read a "sanitized" attachment, please call the
Computing HelpDesk for instructions.
As always, Have a virus detection program
running on your computer.
Have your virus definition files updated
to the most recent version.
Never open an attachment unless you
know it is clean. Choose to save the file to your computer and scan it before opening |
Virus Hoax or the Real Thing: How to Tell the Difference by Shari Kubitz
You’ve probably seen the urgent
alert in your mailbox warning you of a new virus transmitted by email that will erase your hard drive or crash your machine
if you read it. The warning usually appears to come from the Federal Communications Commission (FCC), Microsoft, or
the technology department of a major university. It goes on to urge you to forward the message to all of your friends and
colleagues. You may panic, run your virus software, keep an eye out for suspicious emails, and then forward the message
to everyone you know. In reality, this is one of the dozens of virus hoaxes that are maliciously created but are spread by
well-intentioned people. They both cause needless panic and fill our mailboxes with junk mail.
Because computer viruses can be very
serious and can cause irreparable damage to your computer and/or data, it is important to be able to recognize the difference
between real virus warnings and virus hoaxes and to protect your data and computer using virus software and the latest virus
definitions.
Signs of a Virus Hoax:
1 The message tells you that your hard drive will be erased or your computer destroyed if you open
an email message. Only executable files can cause the type of damage described. Simply reading an email message can not spread
a virus. Be aware, though, that an executable file disguised as an attachment could be a virus. Make sure your virus program
scans downloaded files and attachments. When in doubt, check your attachment for viruses before opening it and do not execute
a program that does not come from a reputable web site or manufacturer.
2 The message encourages you to pass it along to all of your friends and colleagues.
3 The warning includes very technical-sounding language.
4 The warning appears to come from the FCC. Monitoring computer viruses and warning users is not a
job of the FCC.
If you receive a virus warning, it
is important to rule out the possibility that it is a hoax. Before forwarding the message to anyone, please:
Contact LRDCComputing
Services S we will determine if the message is a hoax.
Check reputable web sites that
provide lists and descriptions of known virus hoaxes:
· ciac.llnl.gov/ciac/CIACHoaxes.html
· www.kumite.com/myths
· www.symantec.com/avcenter/hoax.html
· www.nai.com/services/support/hoax/hoax.asp
Signs of a Real Virus:
1 Your virus software reports an infected file.
2 Someone you share your files with tells you that their virus protection software detected an infected
file.
3 While using a word processor you are suddenly forced to save all of your files as templates.
4 You receive a message that a program is trying to write to the boot sector of your hard drive or
that your boot sector has been changed.
5 An unusual message (not an error message) appears on your machine.
If you suspect that you have a computer
virus, please run your anti-virus program or contact LRDC Computing Services (x4-7033) for assistance. If you find a computer
virus, please inform any colleagues with whom you share files.
Virus Prevention:
1 Make sure that you have an anti-virus program on your computer and that it is running in the background.
2 Make sure that your virus definitions are up-to-date.
3 Make sure that your program is set up to automatically scan floppy disks, attachments, and downloaded
files.
A computer virus is sometimes misused. It is not always a program that is
going to take over your computer and destroy it. It is not an accident. Someone wrote destructive viruses for the purpose
of making things hard for other people. A virus is also a program that is put on your computer without your consent.
A virus may have been written to multiply, destroy data, or damage a program
or your computer. It may take years for the virus to be noticed. It may just sit there and do nothing; or, you may get it
and it will immediately take down your computer.
How Exactly Does a Virus Work?
The first thing a virus will attempt to do is take over your operating system.
Next, it will find some means of spreading. A virus tries to take over as many computer systems as possible before it executes.
It would not be worth the virus programmer’s time to have it take out one computer immediately. Basically, a virus lives
in a "host" program. When you execute that host program, you execute the virus.
Take the "Word macro Virus" as an example. It was harmless outside of Word;
but when you used Word, it could be deadly. You may have heard of programs like Trojan horses, logic or time bombs, and worms.
These are all names referring to computer viruses. A Trojan horse is a virus that sneaks into your computer like the Greeks
at the siege of Troy. It creeps into your computer and hides until you execute the program in which it is hidden. A worm is
exactly like a Trojan horse, but easier to deal with because it does not reproduce itself. Logic or Time Bombs are similar
to a Trojan horse except that they have a built-in timer. On a certain date, it goes into action. All of these can be detected
with a good anti-virus program.
What is a Good Program to Use?
The great debate over who has the best virus protection has been going on
for years now. Everyone says that their program will protect you better than anyone else's. It is difficult to tell much difference
between the virus protection programs. I do not like to say what I think is best because that would be an opinion for the
Opinions section. When deciding on an anti-virus program, you must take many things into consideration:
- Am I on the Internet a lot, or am I just gaming at home?
- Does the company have free virus definition lists, or do I have to
buy them?
- Are product upgrades free?
- Have I heard good things about this product?
The virus definition list is what tells your computer about the new viruses.
That way, when a new virus crops up, your computer has it on its list of viruses for which to scan. Several computer specialists
in our area can not only provide more information on viruses, but can also show you available programs.
Check this section every Saturday for more computing tips. | |
Computer Virus Prevention
In recent years there have been major outbreaks of computer viruses on campus causing significant damage
to student computers and substantial problems for the College data network. To protect all computing resources, Knox College
is requiring current antivirus software on all computers connected to the campus network. This includes all computers connecting
to the campus network through modems.
Since these viruses began to infiltrate the Knox campus, the Computer Center has helped many students
with computers infected with a full array of viruses. At least ninety percent of the infected systems either had no antivirus
software installed or had outdated antivirus software. New viruses are released every day meaning that “lapsed”
antivirus software results in a system being open to the risk of losing documents and/or installed software. Individual infected
computers can also have a negative impact on the performance of the overall data network infrastructure.
It is worth noting that many viruses will not and can not be noticed by the Computer Center. Rather,
they will destroy files and damage local systems without impacting the network.
It is the responsibility of each individual
to keep his/her system as “virus free” as possible by purchasing, installing and updating antivirus software.
What are computer viruses or worms? Computer viruses and worms are computer programs
that are designed to harmfully impact the way your computer works without your knowledge or permission. These malicious computer
programs are pieces of programming code that usually comes from the Internet or via e-mail and ?infect? your computer or system.
Once your computer becomes infected, the virus/worm can spread and do damage to your operating system, your program files,
and data and infect other people in your e-mail address book
How does my computer get a viruses? Viruses maybe sent to your computer through
file sharing, e-mail or downloads from the Internet. The virus program code becomes activated when you open the infected file,
boot the computer with and infected disk, or use an infected floppy disk or by ?clicking? on an infected program file sent
as an attachment.
When a computer becomes infected by an e-mail attachment,
it can be spread to other users that are in your e-mail address book. Some of the more widely known viruses and worms, such
as KLEZ, ?I Love You? and Code red viruses started as an e-mail attachment. Clicking on the attachment to view it can launch
the propagation of the computer virus.
How can I prevent virus infections? It is strongly suggested that you do not open e-mail attachments
from an unknown sender.
Another way to protect your computer is to install anti-virus
software. Hofstra University provides Anti-Virus software for all computers connected to the Hofstra computer network. In
addition, members of the Hofstra community can download a free copy of McAfee VirusScan 8.0 Enterprise Edition software.
Some signs of virus infection: a program or file is
suddenly missing; an unusual message or graphics is displayed; size of a file changes without explanation; a program or file
does not work as expected.
Be sure to install anti-virus software on your computer
and keep the virus signature files up-to-date. Once a new virus is introduced, the anti-virus program identifies the virus
through a virus signature. By setting the anti-virus program to update the virus signatures automatically, you can prevent
virus infections.
Make a bootable recovery disk to restart your computer
in case it becomes infected. Be sure the recovery disk is write-protected by sliding the write protection tab to the top of
the disk.
Never open an e-mail attachment without scanning it
first. You can perform this task by changing this setting in the McAfee virus preferences.
Set your anti-virus software to check all downloads
from the Internet for viruses.
Backup your files frequently.
The nature of online volunteering means a lot of contact between computers -- emails, attachments, transfers of files,
etc. Because of this interaction, volunteers and organizations can be at risk for transmitting computer viruses between each
other.
Most computer viruses are merely annoying -- the most common reported by online volunteers are those that alter Microsoft
Word macro functions, and those that attach meaningless files to emails. But there are a few that can lead to system crashes
and other serious problems, such as the "Melissa" virus of April 1999, which launched emails with a virus attached to everyone
in a user's address book without the user knowing about it.
Often, nonprofit and public sector organizations don't have a lot of understanding about computer viruses. They often don't
know how to distinguish between real virus warnings and the many "hoax" warnings that permeate the Internet, or they don't
know how to tell when a computer is infected by a virus, let alone how to clean it.
Online volunteers assisting an agency should ask the organization what kind of anti-virus software is on the agency's computers
and if it is updated regularly. Online volunteers should also tell the agency what kind of virus software they use and should
make sure that they, too, upgrade it regularly (most manufacturers post free updates on their web sites at least every quarter).
A good online task for a volunteer could be to let the organization know when an upgrade for their particular virus software
is available, and how to download it and install it on their various computers. If the organization does not have anti-virus
software, an online volunteer could help them identify some options. And if the organization does not have anti-virus software,
it is especially important that online volunteers have it on their computers!
PLEASE NOTE: these are merely suggestions, with no expressed or implied warranty, guarantee, or formal commercial endorsement.
Please read carefully all manufacturer's materials regarding software before downloading any product. UNV nor organizations
you are assisting can be held responsible for problems on your computer that may arise from your downloading and use of the
materials referred below, or for viruses your computer may encounter as part of an online volunteering assignment.
Various online volunteers have provided the following index of links to sites to educate others about computer viruses,
and to help online volunteers prevent computer viruses from infecting their computers and from being passed on from their
computers to others.
You have
visited my page for: |
|
seconds! |
|