[ABC home]    [ABC Archives by Issue]   [ABC Archives by Author]  [Search]  [Privacy]

 

ABC Home Page
ABC Home

 

Advertise in ABC

 

Learn more
about
Parker Renaud
Parker Renaud

Read
Parker's Archives

Parker's Archives

Online classes
at Eclectic Academy
 Instructor led online courses at Eclectic Academy

PowerPoint to Exe
convert PowerPoint presentations to exes

Lock 'n Hide
Folder Security

Hide files and folders in Windows 9X

 

 

ABC ~ All 'Bout Computers
The Online Web-azine for Computer Enthusiasts
-- brought to you by
Visit Linda's Computer Stop

contents page for this issue

My Newest Book
Excel 2003 Study Guide

published by Wiley
get it at Amazon,
at Barnes & Noble,
or at Borders

 


 Support ABC

Linda's Ebooks
Ebooks on Access, Excel, Outlook, PowerPoint, Publisher, and Word

Linda's CD
Order Linda's CD and learn all of the Office programs

The Newbie Club
Learn all about computers the easy way

Online classes
at Eclectic Academy
 Instructor led online courses at Eclectic Academy

FrontLook
Add-ins
& Screen Capture


 

 

Parker's Mailbox
~~Parker Renaud, IT Manager, Colliers Keenan, Inc.

Viruses, Worms, Trojan Horses & Hoaxes  

My article this month does not apply only to Outlook in a networked environment. It concerns the greatest danger of using e-mail – the possibility of your PC being infected by a virus, a worm or a Trojan horse. For simplicity, I will refer to them all as viruses. The problem of viruses in e-mail and e-mail attachments affects anyone who receives e-mail, no matter what program they use. Outlook, however, is the biggest target of virus writers since it is the most widely used e-mail program in the world. 

What are worms, viruses, and Trojan horses?

  A Worm is a program that operates independently (it does not attach itself to other programs), leaves destruction in its path, such as re-formatting your hard drive, deleting system files, opening security portals, etc., and may be able to transmit itself, via networks, e-mail, or the Internet, to other locations.

  A Virus is a program that searches out programs and infects them by embedding a copy of itself in them. When these programs are run, the embedded virus is run too, thus spreading the infection and damage. This normally happens invisibly to the user. Unlike a worm, a virus cannot infect other computers without assistance. It is spread by such things as opening e-mail attachments or downloading infected files from the internet. Some particularly nasty viruses do irreversible damage, like deleting all the user's files.

   A Trojan Horse is a computer program that carries a hidden virus or worm. It may be a free game program, a low cost version of a popular program, or even a new disk from a manufacturer.

A Hoax is simply a lie about a mythical virus. The intent of the creator of a hoax is to spread the lie as widely and as long as possible. 

There are four sources that can introduce viruses to your computer – removable media (floppy disks, Zip disks & CDs), the Internet, e-mail, & networks.  In order to absolutely avoid getting and spreading computer viruses:

1.     Never open an e-mail.

2.     Never use the Internet.

3.     Never use any removable media.

4.     Never network your computer.

If you follow these rules you will never, ever get a virus.  You will also be doing business like it was done 15 years ago, so obviously these rules are not workable! 

E-Mail is the culprit.

The most common method of infection today is e-mail. And, just when you thought you were safe from viruses if you did not open e-mail attachments, along comes a smarter worm.  Just highlighting an e-mail in your inbox or having Outlook set for previewing can activate a worm. No human interaction is required! Windows has the ability to run scripts and controls automatically. Outlook Express, and in some case, Outlook, will automatically activate certain types of files just because they are in the viewing windows and therefore, considered active. 

It is dangerous to preview e-mail because the preview itself can activate some types of worms. Virus writers know this, which is why they are now creating these more advanced types of worms that run independently. 

It's much safer to use Outlook than  Outlook Express. Think about how you have to double click on a picture and view it in another application when using Outlook. But, if you use Outlook Express, you'll see it right away because Outlook Express will activate the .jpg or .gif file. Outlook, however,  has been designed for corporate use as part of the Microsoft Office suite. Microsoft seems to pay more attention to security in that program than in Outlook Express, which comes free with Windows and Internet Explorer. So if you have Outlook, use it - it’s safer. 

What can you do to protect against these new viruses?

  1. Use a good anti-virus software and update the definitions weekly (or immediately if you hear of a new virus infection).

  2. Be suspicious of all attachments, even if they are from your Mother! Most of today’s e-mail viruses are propagated by the virus sending itself to everyone in the address books on your computer. Whose address books are you in? The address books of your friends, relatives, and business associates, that’s whose. So if any of them happens to open an infected e-mail, you will be one of the recipients of the virus laden e-mail. And who is more likely to open an infected e-mail, your mother -  who probably just learned how to turn on a computer, or you – with all your computer savvy?  In this case, you can’t even trust your own mother!

  3. Do not open any files with a double file extension such as loveletterforyou.txt.vbs and make sure Windows is configured to show the file extensions for ALL file types.

  4. Many viruses are disguised as jokes, pictures, or pleas for help. These types of e-mails should be treated with extra suspicion.

  5. Configure your virus scan so you can scan all e-mail and attachments from within Microsoft Outlook. Do not save attachments to your hard drive before scanning them. That used to be the safest way, but it can activate some worms.

  6. Be careful about what files you download from the Internet and scan any file you download before you open it.

  7. Don’t have unprotected SEX. (Software EXchange).  Scan any diskette or CD you receive from someone else before opening it.

  8. Configure Outlook to send you a confirmation for each e-mail you have sent.

If you work at home, make sure that you follow the same procedures there that you do at work. Viruses can easily be brought into a network by work that has been done on a home PC.

How can you tell if you are infected? 

Look for these warning signs:

  1. You get confirmations for e-mails you did not send.

  2. Your system seems unusually slow or certain programs will not run.

  3. You have hardware problems such as stuck keys that repeat the same character over and over, keyboard locking in CAPS mode, black rectangles appearing on the screen at random, system lock-ups, etc.

  4. You have software problems such as program lockups for no reason, menu items react strangely, mode indicators like "CAPS LOCK" stop working, etc.

  5. Error messages like "Incompatible file error" or "Not enough memory," appear for no apparent reason.

  6. You get unusual messages on your monitor, such as “Hacked by Chinese”.

What do you do if you strongly suspect you are infected and are in a corporate environment?

1.     Turn off your computer. DO NOT click Start>Shut Down>Shut Down the Computer. That takes too long. Simply push the power button and hold it until the computer shuts off. This will prevent continued spread of the virus.

2.     Inform your IT department immediately and let them handle the problem. Do not panic or interrupt other users. 

What if your company does not have its own IT department? What if you are infected with a virus on your home PC? What should you do?

1.     The first thing to do when you realize you are infected is to disconnect your computer from your Internet connection. This will limit the spread of the virus. If you have an “always on” connection, such as a network, cable modem, or DSL, physically unplug the connection from your PC. 

2.     If your virus definitions are up to date and you simply neglected to scan an attachment, scan it now to determine which virus has infected your computer.

3.     If you need to update your definitions in order to scan for the virus, try to download the definitions using another computer and transfer them to your PC using diskettes or a CD.

4.     Once you have determined the name of the virus, find the removal instructions on the website of your anti-virus software (again, using another computer), and follow them step-by-step. It is very important to follow the instruction precisely. If you skip a step, you can exacerbate the problem. Be very careful when making changes to the registry and other system files. You can inadvertently do more damage than the virus if you delete the wrong file. 

What about virus hoaxes?

There has been a proliferation of viruses in the computer world (over 50,000), and now we have a proportionately large proliferation of virus hoaxes. If you receive a virus warning by e-mail how can you determine if it is a legitimate warning or a hoax? If you have an IT department, forward the virus warning to them. They can confirm whether or not it is a hoax. 

Isn’t it better to be safe than sorry? Shouldn’t you warn all your co-workers, friends, and relatives? NO!

Do not forward these warnings to anyone else. If you forward the warning to 25 people and each of them send it to 25 people, and they each send it to 25 people, and they each send it to 25, and they each send it to 25, the result is 9,765,625 e-mails! If it takes each person 60 seconds to read the message, that is 162,760 hours spent reading the hoax message. At a pay rate of  just $15.00 per hour, that is a cost of $2,441,400 in lost productivity! Additionally, all those e-mails clog the worlds e-mail systems with junk messages.

How can you recognize a hoax? 

Remember these 10 warning signs:

  1. The number one warning sign is the fact that the virus warning arrived by e-mail. Unless you are subscribed to a reputable anti-virus mailing list, you will probably not receive valid virus warnings through e-mail.

  2. Valid virus warnings do not come from “a friend of a friend of a friend who heard it from a reliable source”. They are instead sent by various anti-virus companies and government agencies directly to the news media.

  3. The request to "send this to everyone you know" or some variation of that statement. This should raise a red flag that the warning is probably a hoax. No valid warning from a credible source will tell you to send it to everyone you know.

  4. “THIS IS NOT A HOAX!” Many hoaxes put this statement somewhere in the body of the message. If it says it’s not a hoax, it couldn’t be a hoax, right?

  5. The statements that this is the “worst virus ever” and will “completely erase your C drive” or that “there is NO remedy for it at this time” are typical hoax phrases.

  6. A LOT OF UPPERCASE LETTERS AND EXCLAMATION POINTS!!!! URGENT!!!!! WARNING!!!!!!! The message must be true if it has a lot of caps and exclamation points, right?

  7. “The warning was announced by IBM, Microsoft, AOL, or another well known technology company.” This gives the message credibility, except that IBM, Microsoft, and AOL do not issue virus warnings.

  8. Meaningless technical jargon in the message, such as this from the “2400 Baud Modem Virus”: 

    "The virus distributes itself on the modem sub-carrier present in all 2400 baud and up modems. The sub-carrier is used for ROM and register debugging purposes only, and otherwise serves no other purpose. The virus sets a bit pattern in one of the internal modem registers, but it seemed to screw up the  other registers on my USR. A modem that has been 'infected' with this virus will then transmit the virus to other modems that use a subcarrier. The virus then attaches itself to all binary incoming data and infects the host computer's hard disk. The only way to get rid of this virus is to completely reset all the modem registers by hand, but I haven't found a way to vaccinate a modem against the virus, but there is the possibility of building a subcarrier filter.

     

  9. “The virus was just discovered yesterday” or “not many people know about it”. You are one of the first to hear about it - how lucky is that?

  10. If the story sounds familiar, then it is probably a hoax. Many hoaxes use almost identical terminology in the messages. The creator of the hoax most likely copied it from an old, successful hoax.

The following is an actual virus hoax e-mail. Many thousands of people have forwarded the "Budweiser Frog" virus hoax to other e-mail users, thus keeping it in circulation for years. See how many of the hoax warning signs it has:


Subject: READ IMMEDIATELY AND PASS ON!

Someone is sending out a very cute screensaver of the Budweiser Frogs. If you download it, you will lose everything! Your hard drive will crash and someone from the Internet will get your screen name and password! 

DO NOT DOWNLOAD IT UNDER ANY CIRCUMSTANCES!

It just went into circulation yesterday. Please distribute this message. This is a new, very malicious virus and not many people know about it.

This information was announced yesterday morning from Microsoft. Please share it with everyone that might access the Internet. 

Once again, pass this along to EVERYONE in your address book so that this may be stopped. AOL has said that this is a very dangerous virus and that there is NO remedy for it at this time. 


If a virus warning you receive passes the warning signs test, you should still verify it before forwarding it. You can check with one of the sites that debunk hoaxes and urban legends, such as:

http://hoaxbusters.org/

http://www.europe.datafellows.com/news/hoax.htm

http://hoaxbusters.ciac.org/

http://www.urbanlegends.com/

http://www.scambusters.org/legends.html

http://www.snopes2.com/

As you can see, using e-mail makes you a target of virus and hoax writers. Is e-mail worth all the trouble? Apparently so, since it is used by hundreds of millions of people around the world and many businesses could not even function without e-mail. Are some e-mail programs more secure than others? Certainly, but none are secure if you do not take these precautions and exercise some common sense.

So, as Sgt. Phillip Esterhaus, of Hill Street Blues always says:

Oval Callout: Let’s be careful out there.

© MTM Enterprises, Inc.

Parker Renaud is the one-man IT department at Colliers Keenan where he manages 90 PCs on 5 servers.

Privacy Policy, Disclaimer, and Legal Stuff

Pay Per Click Ads by Pay Per Click Advertising by Kontera

This page was last updated on Tuesday, September 23, 2008 . copyright © 2000 - 2008, Linda F. Johnson, Linda's Computer Stop, ABC ~ All 'Bout Computers. All rights reserved..