NWA-PCUG Newsletter Article
Protecting your computer from viruses, worms, and trojans
by Ira Wilsker, GTPCC, July 2001
ira@apcug.org
(click to email author)
If you have been following the news recently, you have undoubtedly heard of viruses; "worms," programs that "eat" through your files; and "trojans," programs that hide under the guise of other more innocent looking programs.
Regular listeners to my radio show (KLVI 560AM, 6-7 p.m. Tuesdays) have heard warnings about these threats to computers, and a multitude of callers who have been the victims of these software creatures. A virus, worm, or trojan is a piece of software that was written to be mischievous, and loaded discretely onto the victim's computer. According to some computer security publications, there are now over 60,000 identified viruses, worms, and trojans; new ones appear at a rate averaging 100 - 400 a week! It is imperative that all PC (and MAC) users have a modern antivirus installed, properly configured, and updated frequently, at least weekly. There is no good reason not to have an antivirus program installed, other than they slightly degrade performance as they scan incoming data for "signatures" of potential threats. They do this by comparing this data to a file of known threats.
Most antivirus programs can also identify some new threats, because they are often minor variations of existing threats, or use otherwise known code. Cost should not be a problem; a review of the Sunday sale books in most weeks will reveal that the local electronics or office supply stores have the top selling antivirus software titles (NAI's McAfee ViruScan, or Symantec's Norton Antivirus) on sale, often for as little as $5 - $10 after rebates. There are several dozen other publishers of quality software as well. For those who like "free," there is the excellent InoculateIT Personal Edition from Computer Associates Inc., one of the largest software publishers in the world. This can be downloaded from http://antivirus.cai.com. After a simple registration (free), a serial number is issued, and free updates and support become available. CAI posts frequent updates almost daily to the Net, and they can be downloaded and installed by opening the program, and clicking on TOOLS AUTO DOWNLOAD. In the past, most viruses were transmitted by the exchange of floppy disks, but now most are transmitted by e-mail, often as attachments. Some e-mail programs, especially the widely used Microsoft Outlook and Outlook Express, are very vulnerable to attack. This vulnerability is often the target of virus authors, who create viruses to utilize the fact that the Outlook products are directly connected to a browser (Internet Explorer), the Windows operating system, and utilities that can execute viruses written in the popular Visual Basic (the recent Anna virus was a simple Visual Basic program), machine code, Microsoft Office scripts, or the Java language.
While the old adage "don't run an e-mail attachment from someone you don't know" may still be a good idea, the majority of newer viruses will be e- mail attachments from people you do know, maybe even with a message title replying to one you sent. This is because many of the new viruses, worms, and trojans actually hijack the Outlook address book and replicate themselves to the e-mail addresses in the address book. AOL mail is also another common target, simply due to the large number of AOL users. While still vulnerable, users of other popular e-mail programs such as Eudora and Pegasus are much less frequently the targets of the virus writers. Web based e-mail, such as Hotmail, Net Address, and Yahoo Mail are not immune, especially if attachments are run or downloaded. The modern rule of thumb is either do not open or download attachments, or be very suspicious. To get around the suspicion, many virus authors attempt to hide their evil within a nice or innocent looking name or extension. The recent Anna attacks were made to look like a common JPEG image, but with the otherwise unlikely file extension ".jpg.vbs." This looked at first like a typical JPEG image file, but the VBS indicated to the observant user that it was a program written in visual basic script.
While the antivirus software can typically detect and remove most viruses, worms, and trojans, there are also other threats that are now becoming more common. Any time users are online, or connected to a network, their computers are vulnerable to a variety of additional threats. In reality, with a Windows PC, there are about 65,000 "ports" or places of entry for the exchange of information. While online in any fashion, a PC can be a target of either someone trying to electronically break in, or a previously undetected "backdoor" secretly installed on the user's computer may attempt to send information from the computer to someone else. Trojans with the names of Back Orifice or Backdoor-G have become extremely common; there are hundreds of others as well. These programs allow someone else almost unrestricted access to anything on the user's computer any time they are online. Ranging from a simple irritant to industrial espionage or sabotage, these trojans are just one type of threat to the online user. Another surprisingly common threat is someone trying to break into the user's computer while it is online. If successful, then everything from keystrokes typing usernames and passwords, to data theft and manipulation become possible.
In order to minimize the chance of an outsider gaining access to a user's computer while online, a program generically called a "firewall" is often a necessity. Originally only used by large institutions on their networks, firewalls have become a security essential on millions of home or small business computers on a network or online. A firewall functions by either closing vulnerable ports, or monitoring incoming and outgoing data, issuing an alarm when a suspicious data transfer is found. While a lesser (but still common) problem with dial-up Internet access, a firewall may be a necessity on a computer with DSL or cable modem access. Being "always online" makes a computer an easily identifiable target. While there are some very good commercial firewalls for PCs, such as BlackIce, Norton Internet Security, and McAfee Firewall, one of the most popular is the top-rated Zone Alarm from Zone Labs. Zone Alarm is free for personal use, and available for download at http://www.zonelabs.com. Just like the antivirus software, the firewall publishers often make updates available on the Internet. There are a variety of free websites that can identify online security breaches. One of the most popular is the Shields Up test available free at http://grc.com. To paraphrase a popular unrelated warning, all computer users "need to practice safe HEX."
Editor's note: Ira Wilsker is an Instructor IV of Management Development at Lamar Institute of Technology. Ira has been working with computers since 1965 when he took his first computer class at the Illinois Institute of Technology in Chicago. Ira is a frequent guest on the local television news, and has lectured internationally on a variety of computer topics ranging from computer and Internet basics, to CyberCrime, and Community Oriented Policing. Ira is a member of the Golden Triangle PC Club and a member of APCUG's Board of Advisors. Please let him know if you publish his article. Email: ira@apcug.org
There is no restriction against any non-profit group using the article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an International organization to which this user group belongs.
Click here to return to top
==================================================================