|
Parker's Mailbox
~~Parker
Renaud, IT Manager, Colliers Keenan, Inc.
Viruses,
Worms, Trojan Horses & Hoaxes
My article this month does not apply
only to Outlook in a networked environment. It concerns the greatest
danger of using e-mail – the possibility of your PC being infected by a
virus, a worm or a Trojan horse. For simplicity, I will refer to them all
as viruses. The problem of viruses in e-mail and e-mail attachments
affects anyone who receives e-mail, no matter what program they use.
Outlook, however, is the biggest target of virus writers since it is the
most widely used e-mail program in the world.
What are worms, viruses, and Trojan
horses?
A
Worm
is
a program that operates independently (it does not attach itself to other
programs), leaves destruction in its path, such as re-formatting your hard
drive, deleting system files, opening security portals, etc., and may be
able to transmit itself, via networks, e-mail, or the Internet, to other
locations.
A
Virus is a program that searches out programs and infects them by embedding a copy of itself in them. When
these programs are run, the embedded virus is run too, thus spreading the
infection and damage. This normally happens invisibly to the user. Unlike
a worm, a virus cannot infect other computers without assistance. It is
spread by such things as opening e-mail attachments or downloading
infected files from the internet. Some particularly nasty viruses do
irreversible damage, like deleting all the user's files.
A
Trojan Horse
is a computer program
that carries a hidden virus or worm. It may be a free game program, a low
cost version of a popular program, or even a new disk from a manufacturer.
A
Hoax is simply a lie about a mythical
virus. The intent of the creator of a hoax is to spread the lie as widely
and as long as possible.
There are four sources that can
introduce viruses to your computer – removable media (floppy disks, Zip
disks & CDs), the Internet, e-mail, & networks. In order to
absolutely avoid getting and spreading computer viruses:
1. Never open an
e-mail.
2. Never use the
Internet.
3. Never use any
removable media.
4. Never network
your computer.
If you follow these rules you will
never, ever get a virus. You will also be doing business like it was
done 15 years ago, so obviously these rules are not workable!
E-Mail is the culprit.
The most common method of infection
today is e-mail. And, just when you thought you were safe from viruses if
you did not open e-mail attachments, along comes a smarter worm.
Just highlighting an e-mail in your inbox or having Outlook set for
previewing can activate a worm. No human interaction is required! Windows
has the ability to run scripts and controls automatically. Outlook
Express, and in some case, Outlook, will automatically activate certain
types of files just because they are in the viewing windows and therefore,
considered active.
It is dangerous to preview e-mail
because the preview itself can activate some types of worms. Virus writers
know this, which is why they are now creating these more advanced types of
worms that run independently.
It's much safer to use Outlook than
Outlook Express. Think about how you have to double click on a picture and
view it in another application when using Outlook. But, if you use Outlook
Express, you'll see it right away because Outlook Express will activate
the .jpg or .gif file. Outlook, however, has been designed for
corporate use as part of the Microsoft Office suite. Microsoft seems to
pay more attention to security in that program than in Outlook Express,
which comes free with Windows and Internet Explorer. So if you have
Outlook, use it - it’s safer.
What can you do to protect against these
new viruses?
-
Use a good anti-virus
software and update the definitions weekly (or immediately if you hear
of a new virus infection).
-
Be suspicious of all
attachments, even if they are from your Mother! Most of today’s
e-mail viruses are propagated by the virus sending itself to everyone
in the address books on your computer. Whose address books are you in?
The address books of your friends, relatives, and business associates,
that’s whose. So if any of them happens to open an infected e-mail,
you will be one of the recipients of the virus laden e-mail. And who
is more likely to open an infected e-mail, your mother - who
probably just learned how to turn on a computer, or you – with all
your computer savvy? In this case, you can’t even trust your own
mother!
-
Do not open any files
with a double file extension such as loveletterforyou.txt.vbs and make
sure Windows is configured to show the file extensions for ALL file
types.
-
Many viruses are
disguised as jokes, pictures, or pleas for help. These types of
e-mails should be treated with extra suspicion.
-
Configure your virus
scan so you can scan all e-mail and attachments from within Microsoft
Outlook. Do not save attachments to your hard drive before scanning
them. That used to be the safest way, but it can activate some worms.
-
Be careful about what
files you download from the Internet and scan any file you download
before you open it.
-
Don’t have
unprotected SEX. (Software EXchange). Scan any diskette or CD you
receive from someone else before opening it.
-
Configure Outlook to
send you a confirmation for each e-mail you have sent.
If you work at home, make sure that you
follow the same procedures there that you do at work. Viruses can
easily be brought into a network by work that has been done on a home
PC.
How can you tell if you are infected?
Look for these warning signs:
-
You get confirmations
for e-mails you did not send.
-
Your system seems
unusually slow or certain programs will not run.
-
You have hardware
problems such as stuck keys that repeat the same character over and
over, keyboard locking in CAPS mode, black rectangles appearing on the
screen at random, system lock-ups, etc.
-
You have software
problems such as program lockups for no reason, menu items react
strangely, mode indicators like "CAPS LOCK" stop working,
etc.
-
Error messages like
"Incompatible file error" or "Not enough memory,"
appear for no apparent reason.
-
You get unusual
messages on your monitor, such as “Hacked by Chinese”.
What do you do if you strongly suspect
you are infected and are in a corporate environment?
1.
Turn off your
computer. DO NOT click Start>Shut Down>Shut Down the Computer. That
takes too long. Simply push the power button and hold it until the
computer shuts off. This will prevent continued spread of the virus.
2. Inform your
IT department immediately and let them handle the problem. Do not panic or
interrupt other users.
What if your company does not have its
own IT department? What if you are infected with a virus on your home PC?
What should you do?
1.
The first
thing to do when you realize you are infected is to disconnect your
computer from your Internet connection. This will limit the spread of the
virus. If you have an “always on” connection, such as a network, cable
modem, or DSL, physically unplug the connection from your PC.
2. If your virus
definitions are up to date and you simply neglected to scan an attachment,
scan it now to determine which virus has infected your computer.
3. If you need
to update your definitions in order to scan for the virus, try to download
the definitions using another computer and transfer them to your PC using
diskettes or a CD.
4. Once you have
determined the name of the virus, find the removal instructions on the
website of your anti-virus software (again, using another computer), and
follow them step-by-step. It is very important to follow the instruction
precisely. If you skip a step, you can exacerbate the problem. Be very
careful when making changes to the registry and other system files. You
can inadvertently do more damage than the virus if you delete the wrong
file.
What about virus hoaxes?
There has been a proliferation of
viruses in the computer world (over 50,000), and now we have a
proportionately large proliferation of virus hoaxes. If you receive a
virus warning by e-mail how can you determine if it is a legitimate
warning or a hoax? If you have an IT department, forward the virus warning
to them. They can confirm whether or not it is a hoax.
Isn’t it better to be safe than sorry?
Shouldn’t you warn all your co-workers, friends, and relatives? NO!
Do
not forward these warnings to anyone else. If you forward the warning to
25 people and each of them send it to 25 people, and they each send it to
25 people, and they each send it to 25, and they each send it to 25, the
result is 9,765,625 e-mails! If it takes each person 60 seconds to read
the message, that is 162,760 hours spent reading the hoax message. At a
pay rate of just $15.00 per hour, that is a cost of $2,441,400 in
lost productivity! Additionally, all those e-mails clog the worlds e-mail
systems with junk messages.
How can you recognize a hoax?
Remember
these 10 warning signs:
-
The number one warning
sign is the fact that the virus warning arrived by e-mail. Unless you
are subscribed to a reputable anti-virus mailing list, you will
probably not receive valid virus warnings through e-mail.
-
Valid virus warnings do
not come from “a friend of a friend of a friend who heard it from a
reliable source”. They are instead sent by various anti-virus
companies and government agencies directly to the news media.
-
The request to
"send this to everyone you know" or some variation of that
statement. This should raise a red flag that the warning is probably a
hoax. No valid warning from a credible source will tell you to send it
to everyone you know.
-
“THIS IS NOT A
HOAX!” Many hoaxes put this statement somewhere in the body of the
message. If it says it’s not a hoax, it couldn’t be a hoax, right?
-
The statements that
this is the “worst virus ever” and will “completely erase your C
drive” or that “there is NO remedy for it at this time” are
typical hoax phrases.
-
A LOT OF UPPERCASE
LETTERS AND EXCLAMATION POINTS!!!! URGENT!!!!! WARNING!!!!!!! The
message must be true if it has a lot of caps and exclamation points,
right?
-
“The warning was
announced by IBM, Microsoft, AOL, or another well known technology
company.” This gives the message credibility, except that IBM,
Microsoft, and AOL do not issue virus warnings.
-
Meaningless technical
jargon in the message, such as this from the “2400 Baud Modem
Virus”:
"The virus distributes itself on the modem sub-carrier
present in all 2400 baud and up modems. The sub-carrier is used for
ROM and register debugging purposes only, and otherwise serves no
other purpose. The virus sets a bit pattern in one of the internal
modem registers, but it seemed to screw up the other registers
on my USR. A modem that has been 'infected' with this virus
will then transmit the virus to other modems that use a subcarrier.
The virus then attaches itself to all binary incoming data and infects
the host computer's hard disk. The only way to get rid of this virus
is to completely reset all the modem registers by hand, but I haven't
found a way to vaccinate a modem against the virus, but there is the
possibility of building a subcarrier filter.
-
“The virus was just
discovered yesterday” or “not many people know about it”. You
are one of the first to hear about it - how lucky is that?
-
If the story sounds
familiar, then it is probably a hoax. Many hoaxes use almost identical
terminology in the messages. The creator of the hoax most likely
copied it from an old, successful hoax.
The following is an actual virus hoax
e-mail. Many thousands of people have forwarded the "Budweiser
Frog" virus hoax to other e-mail users, thus keeping it in
circulation for years. See how many of the hoax warning signs it has:
Subject: READ IMMEDIATELY
AND PASS ON!
Someone is sending out a
very cute screensaver of the Budweiser Frogs. If you download it,
you will lose everything! Your hard drive will crash and someone from
the Internet will get your screen name and password!
DO NOT DOWNLOAD IT UNDER ANY
CIRCUMSTANCES!
It just went into
circulation yesterday. Please distribute this message. This is a new, very
malicious virus and not many people know about it.
This information was
announced yesterday morning from Microsoft. Please share it with
everyone that might access the Internet.
Once again, pass this along
to EVERYONE in your address book so that this may be stopped.
AOL has said that this is a very dangerous virus and that
there is NO remedy for it at this time.
If a virus warning you receive passes
the warning signs test, you should still verify it before forwarding it.
You can check with one of the sites that debunk hoaxes and urban legends,
such as:
http://hoaxbusters.org/
http://www.europe.datafellows.com/news/hoax.htm
http://hoaxbusters.ciac.org/
http://www.urbanlegends.com/
http://www.scambusters.org/legends.html
http://www.snopes2.com/
As you can see, using e-mail makes you a
target of virus and hoax writers. Is e-mail worth all the trouble?
Apparently so, since it is used by hundreds of millions of people around
the world and many businesses could not even function without e-mail. Are
some e-mail programs more secure than others? Certainly, but none are
secure if you do not take these precautions and exercise some common
sense.
So, as
Sgt. Phillip Esterhaus, of Hill Street Blues always says:
© MTM Enterprises, Inc.
Parker Renaud is the one-man IT
department at Colliers Keenan where he manages 90 PCs on 5 servers.
|