NWA-PCUG Newsletter Article, February 2003
New Computer Viruses Are Deadlier Than Ever
From Kim's column
submitted by Pat McAlister, Secretary
(click to email author)

Computer viruses have been a problem for many years. But in recent weeks, ominous concept viruses have appeared. One of these--known as Simile.D or Etap.D--can change its characteristics, making it harder to detect and remove.

Worse, it easily jumps between Windows and Linux operating systems. Many corporate systems run on Linux servers and Windows client computers. Presumably, virus writers will attempt to infect entire corporate systems.

The other, Perrun, infects data files, such as those with JPG extensions. These are used to distribute pictures on the Internet. Open an image and you get a virus. That has not been seen before. Researchers worry that the virus could easily be modified for MP3 files, millions of which are exchanged daily.

Anti-virus developers do not expect problems in developing antidotes to these viruses. But far too many users fail to protect themselves today.

As concept viruses, Perrun and Simile.D do not carry harmful payloads. Their developers are really just showing off. The anti-virus companies quickly developed defenses against them. Perrun currently needs a second file, called an extractor, to run. But future variants are likely to be much more dangerous.

The authors passed the concept viruses to anti-virus researchers in recent weeks. There is an unwritten rule in the anti-virus research community that new viruses will be shared. Perrun, for instance, reportedly was given first to the Anti- Virus Emergency Response Team at McAfee. They quickly shared it with their competitors and the rest of the industry.

The anti-virus antidotes, however, are not shared among the companies. They are the products that anti-virus companies sell and use to differentiate themselves.

The people who write these concepts are looking for recognition. By giving the virus code to researchers, the authors know their efforts will be disseminated and their work widely recognized. How nice.

Anti-virus software typically uses heuristic techniques to find new viruses. This means that they look for a size, a type of behavior or perhaps certain strings of code. Because new viruses change size, this will be a problem in the future in detecting and eradicating chameleon viruses.

More schemes will need to be built into anti-virus software. That potentially will slow computers as more files will need to be scanned before you can take a peek at them. Anti-virus researchers believe they can make the process fast, but that remains to be seen.

There's nothing mysterious about this. There are a number of commercial anti-virus programs available. They're all good. But they have to be updated regularly. And they have to be run. The safest procedure is to run them in the background while you are computing.

Perhaps the most worrying aspect of this is the danger posed by infected MP3 files. This hasn't happened yet, but it is coming. The massive trading in these files could find thousands--perhaps millions--of computers damaged.

People don't just download these files at home. They're doing it at work, too. Entire corporate systems could be at risk if they aren't protected. People who keep their software updated, and scan the downloaded files, are likely to be protected.

It is only a matter of time before variants of these concepts hit public networks. There is always the possibility that you could be among the first victims. Be prepared. Keep your anti- virus software updated. Any major brand is fine. You also need a firewall, another piece of software. I like Zone Alarm's (http://www.zonealarm.com) personal edition, which is free.

There are a number of places on the Internet where you can test the vulnerability of your system. Symantec, which makes Norton anti-virus software, has such a test you can do for free. The Symantec Security Check for Home Users (http://www.symantec.com/securitycheck) will test your susceptibility to threats. Give it a try. After all, the system you protect will not only be your own anymore.

Click here to return to top