|
Battling
viruses and hackers requires software, hard work
By
Michael Dunn
Cox Newspapers
We've
all heard of the Melissa virus and the 'Love' Bug, both
causing billions of dollars in damage. What can you do to
protect yourself? The first way to avoid contracting a computer
virus is to use common sense. Don't open e-mail attachments
or applications from people you don't know.
If you are using Outlook, you can contract a macro virus
by opening an e-mail or downloading an attachment. If the
subject of an e-mail message looks strange, don't open it.
For example "IloveYou". If you use a free web-based e-mail
, Hotmail or Yahoo for example, you don't have to worry
about contracting a virus by opening an e-mail, but by downloading
and running an attached virus.
If you use chat programs such as an Internet Relay Chat
Client, AOL Instant Messenger, MSN Instant Messenger, ICQ,
or any other chat rooms/programs that may support file transfers,
you are at risk of contracting a computer virus. All these
programs by default ask whether or not you want to accept
files sent to you. The easiest way to stop viruses transmitted
this way is not to accept the files.
Common file extensions viruses use are .exe, .com, and .vbs.
If you don't know the person sending you a file with one
of these extensions, don't accept it. All new versions of
AIM and MSN now support file transfers; this opens another
door for your PC to be infected.
There are many anti-virus programs out there, but they can't
replace common sense. The two most popular are Norton Anti-Virus
and McAfee's Virus Scan.
Both offer good protection. A couple of drawbacks with both
is that they cost money, and both need to be constantly
updated. Norton AntiVirus 2000 version 6.0 allows you to
quarantine infected files and get help directly from Symantec
researchers, and it can be scheduled to automatically retrieve
new anti-virus definitions from Symantec as often as once
a week. Which is a great feature since McAfee's Virus Scan
5.1 no long offers the ability to have new anti-virus definitions
automatically downloaded, as Virus Scan 4.0 did.
Both programs offer free trials. For more information on
Norton's Anti-Virus 2000 visit www.symantec.com/nav/nav_9xnt/.
For more Information on McAfee's Virus Scan visit http://download.mcafee.com/eval/evaluate2.asp.
As with most Windows programs, users of both programs have
complained about receiving errors causing Windows to crash,
forcing them to reboot their PC.
Another way to prevent hackers entering your computer system
is a firewall. It allows you to see who is attempting to
enter your computer system, and through which port. Some
firewalls allow you to report the attempt to the intruder's
ISP, who will, if responsible, will discontinue their Internet
service. You can find many firewalls at www.downloads.com,
some freeware, shareware, and demos. Also Norton's and McAfee
both offer a Personal Firewall. McAfee's firewall is accessed
online instead of having the software installed onto your
computer, all for a yearly rate. Norton's Personal Firewall
is installed on your PC and is sold for a flat price. Both
offer a free trial. I personally haven't tried either out,
but they are worth taking a look at. More Information on
Norton's Personal Firewall can be found at http://www.symantec.com/sabu/nis/npf/
and information on McAfee's Personal Firewall can be found
at http://www.mcafee.com/myapps/firewall/.
Your PC is infected with a virus; now what? Before you can
remove the virus you have to find out what type of virus
it is. Computer viruses are categorized into four main types:
boot sector, file or program, macro, and multipartite viruses.
Boot sector viruses are usually transmitted when an infected
floppy disk is left in the drive and the system is rebooted.
The virus is read from the infected boot sector of the floppy
disk and written to the master boot record of the system's
hard drive. The master boot sector is the first place your
system reads from when booting up from the hard drive. Then,
whenever the computer is booted up, the virus will be loaded
into the system's memory.
Program or file viruses are pieces of viral code that attach
themselves to executable programs. Once the infected program
is run, the virus is transferred to your system's memory
and may replicate itself further.
Macro viruses are viruses that infect documents run by applications,
that use macro languages, like Microsoft Word, Excel, and
Outlook. The virus looks like a macro in the file, and when
the file is opened, the virus can execute commands understood
by the application's macro language (examples of this type
of are the Melissa virus and the Love Bug).
Multipartite viruses have characteristics of both boot sector
viruses and file viruses. They may start out in the boot
sector and spread to applications, or vice versa. (Examples
of this type of virus are Net Bus, Back Orifice, and Sub
Seven.)
Net Bus, Back Orifice, and Sub Seven can also be subcategorized
as a Trojan Horse virus. A Trojan Horse Virus enters the
victim's computer as a game, or even an "Anti-Virus" program.
These viruses usally have the extension .exe or .com. The
default name of the virus is server.exe, if someone tries
to send you server.exe don't accept it.
These viruses are easier to find on the net, and even easy
to use.
These viruses are not active until victims run what they
think is a game, anti-virus program, or whatever the infector
told the victim it is. Once this program has run, it opens
a port allowing the infector to enter your computer and
then it inserts itself into the Windows registry, windows.ini,
and/or system.ini, so that when your computer is restarted,
the program will run again, and the infector is usually
notified by e-mail that you are online, along with your
IP address and the port number the virus opened.
These viruses in particular give the infector access to
you PC via a TCP/IP protocol. They can do anything from
controlling your mouse, opening your Cd-Rom to viewing stored
information, such as passwords, and even your name and address.
If you noticed that your cd-rom opens for no reason, your
printer prints on its own or your mouse moves on its own,
you more than likely have one of these viruses or one like
it. If Norton's or McAfee's doesn't get rid of the virus,
try "The Cleaner", a Trojan horse remover, which works fairly
well. You can download it for free at www.moosoft.com/download.php
It is hard to determine if you have been infected by a macro
virus or not. The only way is to view a Word, Excel, or
any other Microsoft Office document, but Microsoft Office
applications including Microsoft Word and Microsoft Excel
are designed to protect you from macro viruses, provided
the macro virus protection in these applications is turned
on (which is the default setting).
With the macro virus protection turned on, every time you
open a document that contains macros, a dialog box appears
and asks you to choose whether to enable or disable included
macros. You should always disable macros when you are not
certain of their purpose or functionality. By choosing to
disable the macros, you will prevent any macro viruses from
running, preventing infection by the virus.
The virus is only activated if you open the attached document
and choose to enable the macros or if your macro virus protection
settings have been previously turned off and you open the
attachment.
If your computer is infected with a virus that attaches
itself to an application, and Norton's or McAfee's doesn't
correct it, and if your hard drive is backed up, as it should
be, you can back-up your system, as long as it was backed
up before the virus infected your PC. If you don't have
a back-up, you will have to format your hard drive and re-install
Windows and all your other programs. Don't forget to make
a back-up this time
With a little common sense you can prevent any would-be
hackers, and viruses, from infecting your PC.
Michael Dunn is a computer operator at Community First Credit
Union in Appleton. Contact him via e-mail at [email protected].
|
