It's That Time of Year Again-Viruses Everywhere!

By Jean Hall Dwyer

As I sit here at work I can hear one co-worker constantly coughing. Someone down the hall just sneezed loud enough to shake the building! Earlier this morning I heard someone in the hall complaining about being a little light-headed and having stiff shoulders. As for me, I feel great! I HAD my flu shot back in October and I'm still very careful about staying clear of anyone with the flu virus.

How about you? Did you prepare for the probability of being exposed to a virus this year? Got your flu shot? Taking preventive measures? Avoiding people with the flu and washing your hands before eating? Did you answer YES to all of these? GREAT!! I'm proud of you.

Now, I have a few more questions. Did you prepare for your COMPUTER to be exposed to a virus this year? Have you downloaded the latest virus protection software? Extension employees need to go to the CTU Reference Desk Web page, scroll down to the viruses section and select to download the supported product (http://www.aces.edu/ctu/compref). The rest of you will have to purchase a virus protection software package; there are many out there, and they are available both online or at your local computer store.

Why should you go to the bother and/or expense of getting a virus protection software package for YOUR computer? Well, if you ever get e-mail, download files from the Web, use a compact-disk (CD), or even share data files the old-fashion way [on a floppy], you too run the risk of "catching" a virus!

Your computer is affected by a virus in ways that are not much different from how you feel when you get a virus. With a virus you're not quite up to par and don't function very well, and neither will your computer. You might cough, sneeze, feel light-headed and have stiff muscles. Your computer will also have a variety of symptoms. There will be a change in file size and system resources, even though you may not notice it right away. Your computer might be sluggish, give error messages, suddenly have files that are corrupted, or even crash completely.

To protect yourself from the flu, you need to get a flu shot. To protect your computer from a virus, you need to get an anti-virus program. There are also some general rules to live by-never open an EXE, BAT, or COM file from any source unless you are sure it's not a virus; and, never open e-mail attachments without scanning them first.

Now that you know you're supposed to protect your computer from viruses, you might be interested in knowing a little more about computer viruses. Fore-warned is forearmed.

A computer virus is a program that spreads by creating copies of itself and attaching them to other files. They usually manage to do this without your knowledge or permission. Computer viruses are written to purposely damage computers or to just annoy computer users.

All viruses have an infection phase. Your computer can become infected during normal use. Any use of disks, networks, e-mail attachments, or CDs can infect your computer. Even new hardware or software can have a virus. Each time you access an infected file, the virus copies itself into another program without your knowledge. In a very short period of time your entire computer system and all your disks will be infected. Unless you have CD write capabilities, you cannot infect a CD. Don't forget though, the CD you put into your computer, can still infect you!

Some viruses also have the attack phase in which a trigger, such as a specific date or time, causes the virus to damage your computer or make it behave oddly. No matter what kind of virus you have, they all manage to take up space on your hard drive and use system resources.

There are four main locations for viruses: files, boot disk, macros, and the network. File viruses attach themselves to regular program files. Then they replace code, fill in open spaces in the code, or create companion files. Their most common targets are programs with an EXE extension. They can also infect files with COM, SYS, OBJ, and BAT extensions. Whenever another program is running, a file virus will replicate.

Boot viruses infect the system sector itself. Once the boot virus infects your boot sector or master boot record, any floppy disk you insert into your computer will become instantly infected, even if it is non-bootable or you have not even accessed anything on the disk. Even worse, your computer may not recognize that it even exists and therefore be unable to start! You may remember the Michelangelo virus of a few years ago--it was a boot virus.

Macro viruses can only infect data files that contain macros and are usually Microsoft (MS) Office files. MS Word, Excel, Access, and PowerPoint all have macros built into their programming. The very annoying Wazzu and W97M are examples of macro viruses.

Network viruses are separated into several segments that run on different parts of the network. They are also known as network worms [more information on worms shortly]. Network viruses use automated functions such as those on e-mail to spread. They also can use the macros of MS Office documents to spread.

Computer viruses avoid detection by using different methods. Examples of these methods are polymorphic, stealth, TSR, and anti anti-virus. The polymorphic virus changes all or part of its code each time it replicates, thereby avoiding detection by scanning software. Some polymorphic viruses have been written to change regular viruses into polymorphic ones!

A stealth virus covers its trail as it infects your computer. It has to be memory resident in order to work. It takes over the system function that reads files or system sectors. A stealth virus is best detected by booting from a disk that is known to be clean, that way the virus is not memory resident and an anti-virus program will be able to detect it.

TSR (Terminate and Stay Resident) is a memory resident virus. You cannot detect this virus running. And, by being in the memory, a TSR virus can do anything the operating system can do. Once something external occurs, the TSR will modify or damage the computer's software. All boot viruses, many files viruses, and some macro and network viruses all fall into this category.

Anti 'Anti-Virus' Viruses target anti-virus programs, they are also called retro viruses. They try to keep you from detecting them by corrupting your anti-virus software. They delete or change the anti-virus programs and data files. They don't run during the infection phase; this would alert you by making your anti-virus software not function.


Viruses, Trojans, and Worms Oh My!!!

Now, since you know a lot more about viruses than you did a few minutes ago, do you feel like learning just a little bit more? Let's start with the differences and similarities between a virus, a trojan, and a worm.

It doesn't really matter in the end whether it is called a virus, a trojan, or a worm, they all refer to programs that have been purposely written to harm computers, programs, and files. Worms are classified as a virus, yet have very distinguishing characteristics. Trojans are not the same as either a virus or a worm. To complicate matters even more, trojans can be carried into your computer via a virus or a worm!

You've already learned about viruses-they are self-replicating, most of them try to hide, they rely on humans to help them spread from computer to computer, and most can do damage to your computer. Worms really constitute a subsection of viruses. All of these following characteristics of worms are also true for viruses-they spread quickly, try to congest or shut down networks, use up system resources, there is no control over them after they have been released, and most are not immediately noticeable. One difference is that worms do not infect other programs, they infect other computers by way of network connections.
.
Trojans are neither a virus nor a worm, though they do share a few characteristics-they use up system resources, occur without the user's knowledge or permission, the programmer can't control them once they are released, and they aren't readily noticeable. Trojans are different-they will always damage your computer is some way, they cannot self-replicate, and they always appear to be something useful.

Let's end with a quick discussion on hoaxes. We've all gotten them-dire warnings about devastating new viruses that you should forward to ALL your friends; pleas for assistance for children in trouble; or messages promising free money. These hoaxes do nothing but take your time and tie up system resources. DO NOT play into them. If an Extension employee is worried about a warning, just forward it to CTU. They will check on the validity of the message. The rest of you can consult an anti-virus site.

Follow this advice and you too can enjoy a season of healthy computing!!!


Return to Metro News...