NWA-PCUG 09/99 NewsLetter Article 18861 N. Hwy 112, Springdale, AR 72762-9303 Virus Season by Brian K. Lewis From 6/99 Sarasota PC Monitor via 7/99 Boca Bits, Boca Raton Computer Society, Inc. Recently the news has been full of virus warnings. Melissa and Chernobyl are good examples. But these are only the tips of the iceberg. There are many others out on the Net or on floppy discs just waiting to infect your hard drive. My first example is of a seemingly harmless "worm" variety of virus called Happy99. This program comes as an attachment to an email letter from someone that you may correspond with on a regular basis. The text is quite innocent "I thought you might enjoy this." When you open the attachment, you see a lovely picture of a fireworks display with a "Happy New Year 1999" title. What you don't see is a program modifying and adding files to your hard disk. This program can then send itself to people on your email list. The information on the anti-virus Websites indicates Happy99 is active only when you are connected to the Internet. However, there is one variation that can activate your dialer, connect to your email services and start sending out letters. In most cases, you will receive this virus from someone you know who is not aware that the email was sent. The people on your email list will assume that you sent the letter and them and since they know and trust you, they will open the attachment. This has resulted in a very rapid spread of this particular program through the Internet and on AOL. So how do you defend yourself against something like this? Yes, you may have an anti-virus program, but when was the last time that you updated the definitions? You don't necessarily need to buy a new version of the program. You do need to download a free definitions file at least once a month. Only if your definitions file had the information on Happy99 could you have blocked it before it arrived on your hard disk. Although the Happy99 doesn't damage the files on your computer, it can really wreak havoc on email systems because of the volume of mail it generates. Melissa is similar to Happy99 in that it generates outgoing mail. However, if you have a very long address list, it only sends to the first 50 names In this case it sounds like something that you requested, but turns out to be a list of pornographic Websites. While you are trying to figure out why you received this document, Melissa is working away on sending out more duplicated of itself. The volume of mail it generated managed to overload several Web servers and shut down some Internet sites. The next example also involves a virus transmitted by email. I received an email from an auto dealer with a MS Word document attached. As it was being downloaded from my email serve to my computer, a full-screen warning came up. "This file has a Virus! What do you want to do?" The file was named in the message and I had a choice of ignoring the warning, deleting the file or disinfecting it. I took the choice of deleting this file so it never arrived on my computer. It was obviously a Word Macro virus, a type that did not exist a few years ago. If you have your anti-virus software set to check only program files, then you will not catch these macro viruses. You must check all files to check them. In addition, you must have the most recent definition files on your computer. Another example that demonstrates how easy it is to receive a virus if you aren't careful. An individual was installing software from floppy disks from a friend. As the installation began, he received a virus warning. However, since he felt certain the message was in error, he told the program to ignore it and continue. After he finished the installation, he had to reboot the computer. As the computer booted, the MS Windows logo came up, vanished and was replaced with the notice "The command interpreter is missing or damaged. Type in the path to the location of command.com." Nothing that he did would allow him to get his computer running again. So, he took an emergency floppy, booted the computer and ran a program from it to try to restore his files from his second hard disk. The recovery program ran and said all was well, recovery was complete. However, the computer still would not boot, no COMMAND.COM. I booted the system with a floppy and found COMMAND.COM on the hard drive in the root directory. However, it was the wrong size and it had a date on it from the day before and the year was 1999. It had also been made a read-only file so you could not delete it or write over it. Diagnosis, this computer was infected with a virus. As we found, even formatting the hard disk did not remove the virus. Why not? I turned out to be a boot sector virus that was apparently providing the right messages from the command.com file but was not allowing any activity on the hard disk that would destroy it. Only when we ran an anti-virus program from a write- protected, bootable floppy were we able to remove the virus from the boot sector and restore the computer's full function. So what are the lessons to be learned from these examples? If you surf the net, receive email, or copy programs from floppy disks, be protected. Always run your anti-virus program in the background. Your software should be set to check floppies, check email attachments and any other documents or programs you download from the Internet. Even email from people you know may be contaminated. They may not even know that their computer was sending out letters to their address list. Keep your virus definitions up to date. If you don't have current definitions, you may not be able to identify newer viruses. I slipped up and ended up with the Happy99 worm and had to try to manually delete it. Then I downloaded the latest definitions and my antivirus program found parts of it still in my recycle bin. It was still trying to dial out and send copies to people on my address list. So the first delete step, transfer to the recycle bin, doesn't always prevent these programs from functioning. They must be totally erased from your hard disk. The best way is to have your anti-virus program erase or disinfect the file. Finally, when your virus program says you have a virus, believe it! You can turn off the virus checker when you install software from a CD-ROM. Just be sure you have a legal, licensed copy of the software. Some of the illegal copies made overseas have been known to carry viruses. There are thousands of viruses out there and more are being created every day. Just protect your computer and if in doubt, destroy a suspect file rather than let it take control of your system. Dr. Lewis, a former university & medical school professor, is a computer consultant doing instruction, hardware/software services and system upgrades.