What
is a Computer Virus?
A computer virus is a program that
has the ability to make copies of itself, and spread to other files. Viruses
can attach themselves to many types of files and programs, and spread as
files that are copied and sent from one computer to another. Just like
biological viruses, computer viruses spread quickly and can be difficult
to disinfect. All viruses are created deliberately, they are not accidents
or just pranks, but malicious.
In addition to copying itself, many
computer viruses deliver a "payload." While some virus payloads merely
display messages or images, others can destroy files, reformat your hard
drive, or send unintended email messages. Even if a virus doesn't contain
a damage routine, it can still cause trouble by wasting storage space and
memory. Some viruses are poorly written, and may cause a computer to stop
or damage files. Many viruses make the computer's memory unstable or cause
programs to run improperly.
More than 30,000 have been identified
and hundreds of new ones are created almost weekly.
Are
Some Viruses Hoaxes?
Often there are messages passed
around by e-mail "warning" of impending viruses that are being passed.
Sometimes the internet community does a good job of warning about such
things. More often than not, these are hoaxes and bogus reports. One web
site does a great job in keeping up with these hoaxes. It is called Vmyths.com,
short for Virus Myths. Of course, it is always good to check with your
virus software web page or the alt.comp.virus newsgroup to be up to date.
Does
!000 or other 'email fixes' really work?"
In a word, NO! Nothing takes the
place of a good virus program that is KEPT UP TO DATE. Click
here for more info on this "hoax."
What
Kind of Files Can Spread a Virus?
Viruses can infect any type of
file that contains executable code. Originally, these were just "program
files" which were, and still are, directly executed by the computer such
as files with .COM or .EXE extensions in Windows/DOS. Today, many other
file types can contain executable code such as word processing and spreadsheet
documents that use macros, which are simple embedded programs.
Other viruses infect executable
code in the boot sector of floppy disks or in system areas of hard drives.
And it's possible for HTML documents to spread viruses or carry other forms
of malicious code through JavaScript or other similar types of script.
Since virus code must be executed,
files that are recognized by the computer as pure data files are generally
safe. These include graphics and sound files such as .gif, .jpg, .mp3,
or .wav files as well as plain text in .txt files. Just opening a text
file or viewing picture files won't infect your computer with a virus.
The virus code has to be in a form that the computer will actually try
to execute.
How
do Viruses Spread?
Many years ago, most viruses spread
mainly through floppy disks. Infection happened when users swapped files
or borrowed diskettes from friends, school, or work. Among PCs on a network,
viruses can spread very quickly when users share an infected file. More
recently, the Internet has introduced new and more efficient ways to distribute
viruses. With the ubiquity of email in both businesses and homes, viruses
are spreading faster than ever. Viruses attached to email messages can
infect an entire network in a matter of minutes, costing companies millions
of dollars in damaged data, lost productivity, and clean-up expenses.
What
do Viruses do to Computers?
Viruses run on your computer just
like software programs. Their actions depend on the programming written
by the virus writer. Some viruses are deliberately designed to cause damage
by deleting certain types of files, or even reformatting a hard drive and
destroying all data. Others interfere with your computer's operations in
various ways. Many viruses only spread themselves, but these are still
harmful, since they may damage files or cause problems in the process of
spreading. Viruses also take up space in your computer's memory and reduce
its performance.
Viruses, however, can not damage
hardware hardware like your hard drive. It can damage your BIOS (input/output)
system. They won't burn out your CPU or cause a meltdown in your hard drive.
Warnings about viruses that will physically destroy your computer are hoaxes,
not legitimate virus warnings.
What
are the Symptoms of Virus Infection?
They vary widely. Some viruses
announce themselves openly; displaying a message, flashing graphics, or
even playing music. Others cause severe damage or carry out other actions
that quickly attract attention such as sending out a large number of email
messages. However, some viruses are designed to remain hidden. In certain
cases, these viruses cause strange things to happen to a computer - like
a slowdown in operations, decrease in memory, or a disk drive LED lighting
up for no apparent reason. You should also watch for files that change
in size or disappear.
However, legitimate software programs
or hardware glitches can also cause many of these effects, so don't immediately
jump to the conclusion that your computer is infected just because unusual
things happen.
How
Can I Avoid Virus Infections?
Install antivirus software from
a well-known, reputable company such as Trend Micro's PC-cillin 2000. Use
it as recommended and be sure to update it regularly! PC-cillin will remind
you of the need to update; it will even perform the update for you -- if
you let it. New viruses come out every day, so if your software is out
of date it may not protect you.
Scan all new programs or files that
may contain executable code before you open or run them, no matter where
they come from. Although rare, there have been cases where retail software
floppy disks and CD-ROMs sold in stores have spread viruses.
If you receive a message with an
attached file from an unknown source, simply delete it. If you receive
an attached file from a friend or acquaintance unexpectedly, verify that
it is genuine before opening it. Remember, the Melissa and ILOVEYOU viruses
mailed themselves to addresses in the user's address book, so they often
appeared to come from friends or associates.
Be extremely careful about downloading
files and documents from unknown or "dubious" sources such as newsgroups
or Web/ftp sites that you do not know well. Never open executable files
unexpectedly received as either attachments in email messages or during
an online chat session.
Maintain high security settings
on your operating system and Internet applications. For example, if your
email program automatically executes JavaScript or if Word does not warn
you about macros embedded in documents that you open, you should increase
your program's security level.
Perform regular backups in case
a virus or trojan erases or corrupts files on your hard drive. This will
also protect you from disk failure. In either of these cases, a recent
backup may be the only way to recover lost data. If you cannot backup your
entire system, at least backup files that you can't afford to lose or that
would be difficult to replace like: documents, bookmark files, address
books and important E-mail etc.
Are
pictures safe?
Usually, pictures are safe from
virus but even that's not always true. Somes malicious code is passed around
with a file extension of .shs or .shb (which are scrap files) which Windows
doesn't show. If you have a file which appears as something.jpg in Windows
Explorer but the actual file name is something.jpg.shs which is executeable
and will probably be malicious. One safe way to check out new files of
this kind is to Open them in your picture image viewer application whatever
it may be. If they display normally as pictures,they're probably ok.
What
can you do to Protect Against Viruses?
There are many things you can do
to protect against viruses. At the top of the list is using a powerful
antivirus product such as Trend Micro's PC-cillin 2000 for home users.
(this is one of many programs but a very good one) Corporate users can
learn how viruses infiltrate their networks by viewing our interactive
"Trend Enterprise Solution" diagram. For further suggestions see the International
Computer Security Association's Web site. (There are many sites like this
which you can find on the "Tools and Links" page.)
What might
be the Most Important way to Protect Yourself?
Update, Update, Update. If you
have an anti-virus programs, don't be lulled into a false sense of security
by thinking it will work without updates. Most companies extend update
privileges and you should do it weekly! That is the only way you can be
sure you have the most recent protection against the newest viruses.
Virus Pattern
A "virus pattern" (also known as
a "virus signature"), is the digital fingerprint that identifies a file
as being infected with a computer virus. When an antivirus company receives
a new virus, they take a binary pattern of the file and add it to a database
called the virus pattern file. During scanning, the binary code inside
the virus pattern file is compared to the code of the files on your computer,
and if there is a match, the file is deemed to be infected with a virus.
All input to a computer is converted
into binary numbers, made up of the digits "0" and "1." When programs tell
a computer what to do, the instructions are in machine language, expressed
in binary code.
How
is a Virus Pattern Created?
A virus pattern is a short piece
of binary code that is used to identify a virus-infected file. These are
generated according to the specific file format and means of virus infection.
When any Windows file is infected, we carefully follow the process that
Windows uses to handle this file type until we locate the virus' entry
point. Once its "hidden" place is discovered, a virus pattern for the scanning
program will be generated from this part of the file.
Antivirus companies like Trend Micro
have teams of specialized antivirus engineers who collect the virus patterns
of all newly detected viruses. However, with the number of viruses growing
so rapidly, finding every unique virus pattern becomes a difficult job.
An incomplete virus pattern could incorrectly identify normal, i.e., non-infected,
files as being virus-infected. When a new virus pattern is isolated, it
is rigorously tested by scanning many types of files to ensure that it
does not cause false alarms. Only after the testing is successful will
the virus pattern be complete.
Scan Engine
The scan engine is the heart of
any antivirus software, and the true measure of its quality. It is the
part of the program that scans your files and detects viruses.
No matter how attractive an antivirus
program's user interface, its ease of use, or its function set, it is the
scan engine that determines how good the software is at catching viruses.
When an antivirus program scans a disk drive or directory, it sends the
files one-by-one to the scan engine for comparison with the virus pattern
file. A superior scan engine will perform this check quickly, while using
relatively little system resources.
Hackers,
Crackers, and Virus Writers
Virus writers may or may not be
hackers, but very few hackers are virus writers. Some members of both groups
may be crackers, but most of them aren't. Here's a definition of the terminology:
Hackers
A slang term for a computer enthusiast.
According to the Jargon File compiled by long-time hacker and open source
guru Eric Raymond, a hacker "is a person who enjoys exploring the details
of programmable systems and how to stretch their capabilities, as opposed
to most users, who prefer to learn only the minimum necessary." Among professional
programmers, the term hacker implies an amateur or a programmer who lacks
formal training. Depending on how it is used, the term can be either complimentary
or derogatory, although it is developing an increasingly derogatory connotation.
The pejorative sense of hacker is becoming more common because the mass
media uses the term to refer to individuals who gain unauthorized access
to computer systems for the purpose of stealing and corrupting data. Hackers,
themselves, maintain that the proper term for such individuals is cracker.
It should be noted that many people
who call themselves hackers have a strong interest in network security.
"Ethical hackers" break into networks to test their skills. Often they'll
hack in, poke around a bit, and leave without causing damage.
Crackers
Crackers, on the other hand, break
into networks to deface Web pages, corrupt data, and similar acts of vandalism.
Hackers hate crackers, even though the public tends to lump them together.
Virus Writers
Finally, there are virus writers.
Instead of using network technology to gain access and information, they
focus on writing programs that can replicate and spread throughout a single
network or across the Internet. They usually transmit viruses through email
or Web downloads.
Bundled Anti Virus Programs
Anti
virus software that comes bundled with your computer will only protect
to the date that it was loaded onto your computer. That means it is current
to BEFORE you received your computer. You will need to subscribe and update
whatever that software may be. You can do this online and THEN, you can
set it to automatically remind you to update. It will not do it on its
own. Better yet, why not pick a day and always update then. At least you'll
be doing it on a weekly basis then.
ISP Protection?
Your isp
"might" have some anti-virus software in place but don't trust that. Take
the responsibility to keep track of this on your own. Buy and update your
own protection.
A
great site that combines most security concerns, products and comparisons
can be found by here clicking
here.
(these FAQ's can be found at Trend-Micro's
antivirus web page. Trend-Micro is a leader in anti-virus software.)