eBlue, Sacra Blue Online Magazine
Jun 2003 — Issue 251
eBlue articles
SPCUG Logo
Feature
Article

by Lee Reynolds



From Boca Bits, Feb 2003, Boca Raton Computer Society

Fixing Windows

VIRUSES, WORMS AND TROJANS
E-mail viruses and trojans are a cause of a great many of the problems that develop with Windows systems. In fact, if your Windows machine starts suddenly misbehaving in any way, one of the things you should do at once is see that your antivirus data is up-to-date and run a complete scan. If you don’t have an antivirus program, you definitely should get one. If you would rather not pay the money to get a good antivirus product such as Symantec’s Norton Antivirus, which is almost always given top honors in the reviews I’ve read in such places as PC World and PC Magazine, then by all means download the free AVG product at GriSoft.

If you find yourself in the unenviable position of not having an effective antivirus program (even if you have one, there are some especially devious virus varieties out there that specifically disable the most well known antivirus programs!), then, if you can get online to the internet, you might be able to do a free online scan at Housecall.

Let’s talk a bit about the various kinds of malicious software that can affect your computer, how you get them, how they wreak their havoc, and how you can protect yourself.

First of all, computer viruses are distinct from worms and Trojans, even though they are often lumped together under the heading of viruses.

A virus is usually a small amount of software that buries itself inside another application, and which runs when that application is run. Besides bringing about whatever problem it is designed to cause, it also is written so that it is capable of reproducing itself inside other programs and disk drive boot sectors. The earliest viruses were transmitted when people unknowingly exchanged infected floppy disks. Today, the most common source of infection is through attachments to e-mail messages. Today’s e-mail viruses replicate themselves by automatically e-mailing a copy of themselves to perhaps dozens of people in the victim’s e-mail Address Book or Contact List.

Worms are like viruses in their characteristic replication of themselves, but they operate across computer networks by taking advantage of security holes in the system’s software. An example, is the W97M/Melissa.A that came into being in late March 1999. If you have kept yourself aware of the numerous patches to programs such as Internet Explorer, Outlook Express, Windows Media Player and others that Microsoft has had to keep issuing because of these security holes, then you know about this problem. Of course, Microsoft is not the only software provider subject to these problems (I recently read about security holes discovered in Adobe’s free Acrobat Reader plug-in and Macromedia’s Shockwave plug-in, for example); it is probably the main source because Microsoft’s software plays such a major role in the operation of computers using any version of the Windows OS.

Trojan horses (or Trojans, for short) are programs that usually masquerade as other useful or entertaining programs, but hide within themselves the code to do some sort of damage when you run them, like perhaps erase your hard drive! Trojans do not replicate themselves automatically.

There are many, many possible problems that can be introduced by viruses, worms, and Trojans. Just a few of the possibilities I’ve seen:

  • Disable use of Regedit or Notepad when started.
  • Record AOL username and password for sending back to Trojan sender.
  • Modify registry values pertaining to how executable files are run.
  • Abort startup with message "Type the name of the Command Interpreter."
  • Cause an error in KERNEL32.DLL when Outlook Express is used to try and send a message with an attachment.
  • Modify your default home page in Internet Explorer.
  • Display "Driver memory error" message at startup.
  • Render antivirus programs unusable.
  • Substitute offensive messages for whatever you try to type.
  • Make it impossible to connect to antivirus vendor’s web site.
  • Continue to exhaust system free memory while the virus is resident.
  • Fill up hard disks with emails to send out.
  • Connect to an IRC channel and send out personal data from the computer.
  • Cause Windows or programs to start slowly.
  • Randomly corrupt disk writes while the virus is active in memory.
  • Cause various Windows error messages when you try to run an executable.
  • Remove all icons from the Desktop.
  • Cause an error message "Windows cannot be shut down due to security settings."
  • Overwrite or delete files.
  • Disconnect mapped network drives.
  • Erase CMOS or a flash BIOS.
  • Cause Desktop icons to appear to run away from the mouse cursor.
Today’s virus creators are getting very sophisticated in their trickery. One trick is to have the ability to load their code into memory so that they can keep running in the background as long as the computer is turned on. This is why virus scanners always begin by checking for the presence of viral code in memory. Another trick is to infect what is called the boot sector of your hard drive. Since the boot sector contains operating system code that always runs when the computer loads, it is guaranteed that the virus can immediately load into memory and start running. These boot sector viruses can also infect the boot sector of any floppy disk that is inserted in the machine. Another trick is what is known as a stealth virus; stealth boot viruses intercept attempts to read the boot sector (where they reside) and return copies of the original boot sector so it is seen as it was prior to infection.

There are some "viruses" or "trojans" which have been hoaxes. For example, many people were fooled by a hoax which came out not long ago that claimed that a program called SULFNBK.EXE was a dangerous trojan and that you should search your hard drive for it and delete it if found. As it happens, this program is present in the Windows\ Command directory of anyone who uses Windows, and it is a perfectly harmless part of the OS which manages long file names. You can read about other virus hoaxes at McAfee’s Hoax page.

How can you protect yourself from this type of damaging software? The first rule is: get yourself a virus scanner and update frequently the virus signature data files that the manufacturer makes available to keep abreast of new viruses as they appear on the scene. The second rule is: when you download programs from the internet, do a virus scan of it before you install or run the program. The third rule is: never access an e-mail attachment – particularly an executable type such as one with the file type extension of EXE, COM, or VBS – without scanning it first.

Here are a few other sources of information on the internet about viruses which you may find useful: F-Secure Virus News and Symantec Security Response. Symantec has news on the antivirus front, you can download the latest data for the Norton AntiVirus program, and consult a virus encyclopedia, among other things. Also check out How Computer Viruses Work at HowStuffWorks.com.

eBlue articles
This page prepared by:

Brian Smither

Copyright © 2003 Sacramento PC Users Group, Inc. All rights reserved.
Read our disclaimer and copyright page for more information.