NWA-PCUG Newsletter Article, September 2004
Letters to “Late Nite”
Hosted by Marty Shinko
From July/August, 2004 Capital PC User Group Monitor
(click to email author)

Q04Vii.0 Is It possible to get a computer virus just by visiting a Web page?

A0: The short answer is that YES, I’ve heard it said that theoretically it could be possible to get a virus just by “clicking” on a malicious URL, although, also theoretically, it shouldn’t be possible using simple Web browser software (BTW, almost nobody uses simple Web browser software anymore).

This is similar to the situation with e-mail, in that e-mail software should simply display the text content of a message, and therefore should be impervious to computer viruses when all you do is view text messages. However it isn’t as simple as that, as now most people expect their e-mail software to play any catchy, attention-getting music that comes with messages, preview attachments, etc. Those features can be security loopholes.

It’s the same way with Web browser software. A simple Web browser program merely displays on the screen the text of a file retrieved over the Internet (or even one retrieved locally from somewhere on your own computer). When you visit a Web site, you are merely accessing a file somewhere on a remote computer, retrieving a copy of it, and displaying its text content on your computer. Files intended to be viewed by Web browser software are just text, with embedded keywords that direct the browser software to display some text larger, some smaller, some highlighted, some text centered, or left-justified, some with different colors, etc. The text is written in HTML (HyperText Markup Language, a computer language for creating Web pages) other files, including images, e.g., GIF files (GIF is a Graphics Interchange Format developed by CompuServe in 1987).

So, how could a computer get a virus just by viewing a file? On the one hand, it can’t, unless there are bugs in the software that allow data to get out of control (see below). On the other hand, Web browser software doesn’t stop at simply presenting files for view anymore; it allows Web pages to play tunes, show animated images, display other data that require the running of other applications or applets, and, through ActiveX controls, even the Registry and operating system files can be tampered with.

Q04VII.1: How can I stack the odds in my favor to avoid getting any computer virus while browsing the Internet?

A0: Some of the suggestions to avoid problems are:

    • First, make sure that the security settings on your browser software are set for highest security level
    • Deactivate ActiveX features
    • Don’t click on any URL in an email message, or on a “suspicious” Web page. The reason is that the actual link could be different from the text displayed as the link by your browser software, because that’s the way HTML works. The author of a Web page can display the text “Click Here” on a Web page, and “underneath” that (so to speak) is a link to a Web address (e.g., http://mywebpage.org).

    Similarly, they can display the text “microsoft.com” but put a link to “badplaces.net” as the actual URL that the link takes you to.
    • Don’t accept downloads or install software from over the Internet unless you initiate the transaction, and trust the source.
    • Stay clear of pornography sites, which have a reputation of using underhanded techniques to try to “hijack” your Web browser software. Also avoid sites you suspect might be involved in illegal activities, such as distributing pirated copies of copyrighted software for cheap or free.
    • Run software utilities that monitor for suspicious activity, like attempts to make new entries or change entries in the Registry, attempts to modify operating system files or delete large groups of files, or attempts to send out a flood of e-mail messages or Internet packets, etc.

Q04VII.2: What do you mean by software bugs that let data get “out of control”?

A0: Simply viewing a file, treating data as data, should be “safe” unless there are bugs in the software doing the viewing that allow data to be executed as machine code by mistake. This is what the term “buffer overflow errors” hints at, that there is some exploitable weakness in the software that allows a clever cracker to get the faulty software to execute a few bits of their own, usually to gain broader access before ultimately wreaking their destruction. Well written software that’s undergone careful testing doesn’t have flaws like that, but stuff hastily thrown together and dumped on an unsuspecting and naive market population that thinks it has few if any alternatives is likely to be riddled with them.

Q04VII.3: Is there a way to check where a hypertext link links to, other than just clicking on it?

A0: Yes, if you select it using the right mouse button, then select “view properties,” that shows the target URL of the hypertext link. I find I often need to do this again, selecting the text of the link, as shown in the properties window, using the right mouse button again, to be able to capture and view the entire text of a long URL. I “select all,” then COPY, and then EDIT/PASTE using Notepad software. From that point you can also use the right mouse button to select the address text box of your browser software, then select PASTE and then go directly to that site, instead of clicking on the link on the Web page itself. Some Web browser software I’ve used shows the URL underlying any hypertext link in a small area of the screen, whenever you dwell the mouse over the hypertext on the screen, but generally the area where that data is displayed is too small to see much of the URL or to tell where the link leads.

Q04VII.4: How can I display a file that’s stored on my own computer, using Web browser software?

A0: To view a file that’s on your own computer, in the address text box of the Web browser software (where the URL of the Web page normally goes), enter FILE://C:\FULL_PATHNAME\FILENAME.EXT. Long file names are OK, but file names that include spaces (“blank” characters that you get when you type the spacebar key) can be problems. The same is true for every folder name in the pathname leading to the file, e.g., DOCUMENTS AND SETTINGS isn’t a proper folder name on the Internet, which is heavily based on UNIX. As Robert Simanski wrote “It was a dumb idea for Microsoft to allow spaces in the name of a file or folder, because these spaces can still cause problems today.” I agree with him completely. If the file is on a drive different from drive C: (such as on a CDROM drive), replace the “C” in the “C:” with the letter designation of the drive containing the file. Microsoft software may allow some other special characters, like “/”and “%”in file names and path names that may cause trouble, too. In case the long file name doesn’t work, use the equivalent DOS file name (visible via the “dir /x” option).

Some browser software I’ve used allows you to select local files by selecting them via its FILE/OPEN/BROWSE menu options.

Be aware that under Microsoft Windows software, filenames are not case sensitive, but under UNIX, filenames with uppercase letters are completely different from the same filenames using lower case letters.

Q04VII.5: Beyond viewing the Web site, are there other hazards to be aware of?

A0: Be careful where you click on a Web site. Remember that the nature of HTML is that when you click on one thing (like the text “Click Here”), you can actually activate something else, such as the URL for accessing and viewing another file at a different site. Those links are the hypertext links that make the World Wide Web (or simply the Web) so easy and convenient to use. Beware of fake “windows”that are really just images that are part of the Web page. They look exactly like error messages or warning messages produced by Microsoft Windows, e.g., “Warning! You are running low on Memory!”, with a button for OK or CLOSE, but they are just advertisements or a ruse to get you to click on an area of the screen, perhaps to take you to some sort of sales site.

For the most part,Web sites have no intent to deceive. However, unless you examine the HTML underlying an image, you never know what you’re assenting to by clicking at any particular screen coordinates. HTML also allows the display of “transparent” images, so apparently blank locations on a Web page could be hiding invisible images that link to other Web sites — a URL reference associated with the unseen graphic image file. There are some data constructs where only the server at the site that sent you the image can translate the screen coordinates where you clicked into link information.

So next time you’re interacting with some Web page animation, trying to see where and when to click to toss an icon of a cow the farthest, you may be activating Web page options that are downloading spyware and installing it on your computer (as you requested by that last click).

Marty Shinko has been involved with the CPCUG since the early 1990s, as a volunteer instructor and advocate for beginners. He’s used computers for over three decades, from PCs to supercomputers. His interests include sub-atomic physics, astronomy, epistemology, mathematics, engineering simulation and computer modeling, satellites, brain psychology, sail boating and amateur radio. He can be reached via e-mail at mshinko.cpcug@juno.com or via phone at (301) 253-1743, or come to the CPCUG General Meetings and meet in person at the “Late Nite” sessions after the meetings.

Click here to return to top