HOME Calendar Join / Renew PC Alamode About Us HELP Sponsors
Reviews Columns Features Theme Issues   Archives Other  


 Preventive Maintenance

More virus talk!
June 2000

Russell James is Operations Manager at BJ Associates of San Antonio. They are an authorized service center for Toshiba and Sony systems. They are the laptop specialist and also handle system builds and parts for desktops. They can take care of any IBM compatible hardware or software problem that you have.


Last month I gave you a few examples of the many types of viruses that are are part of the 50,000 plus that we know of. Let’s start this month off by refocusing on one of my pet peeves. By now you all must realize that I think that virus protection is one of the most important software additions that you need to make to any computer system that you use. It is not only important to have a good virus scanner but also to make sure that it is updated on a regular basis. If you don’t think you need it for you then you should get it to help to keep the rest of us a little safer. Let me give you an example of what I mean. 

Mcafee puts out regular updates for its Viruscan software based on the volume and severity of new viruses that come out. I don’t keep all of the updates and I cannot remember that far back anyway. The four that I still have are dated April 19, April 27, May 3 and May 10. Most of you heard about the new virus that was discovered on May 4. It was call the Loveletter.vbs virus. The vbs stands for the extension on the end of the file that you have to click on to get infected. It shows up as an email from someone you correspond with the following format.

Subject "ILOVEYOU" Message "kindly check the attached LOVELETTER coming from me." Attachment "LOVE-LETTER-FOR-YOU.TXT.vbs"

After you click on the file, the virus starts its havoc. There are a number of things that it does including infecting and then renaming about 12 different types of files that it finds on you computer. This will give you a number of different chances to reinfect yourself just in case you get lucky and delete one of the original virus files. If it is left alone it will cause you and everyone you email through Outlook a lot of grief. 

This brings up a question that I cannot find an answer for in my mind. If you don’t know where something came from, why do you need to click on it. With all that is out there how do you dare click on it? The virus, when activated will send itself to everyone in your Outlook address book. Did everyone understand that? Even if you know the person that sent the file to you, it is possible that they do not know that they sent it to you. The virus propagates itself without your knowledge. This is how it is able to spread so quickly. Then you have all of the copycat virus writers that will take something like this and change it a little bit so they can feel important also. This multiplies the threat to an enormous level. Now you don’t only have to be on the lookout for an email that says ILOVEYOU in the subject line. You also have to be wary of the email that claims to be from the makers of Norton Antivirus.

Mcafee posted a file named extra.dat to help combat the virus on the fourth. As of the sixth, they had put out two additional dat files to try to curb the ever-increasing number of variants that came out almost immediately. As of the sixth there were at least 7 different viruses that were variants of the original. As of the tenth, there were about 22 variants. They all use the same general idea and they all require that you click on a file to get infected. What the virus writers have done is to change things like the subject line to try to catch you off guard. I did a search for vbs on the Mcafee virus library and there are 56 viruses that have vbs in the name. This is not something new that has just come up. These types of viruses have been around for at least a year. We all need to check to make sure that the HTA and VBS extensions are included in the list of files that are being scanned. 

In the Mcafee program you can check this by right clicking on the shield in the system tray. This is the group of program icons that are next to the clock. Pull the mouse up to Properties and then to System Scan. Left click on System Scan and this will bring up the properties for Mcafee System Scan. Now click on the Extensions button under What to Scan. Click on the Add button and type VBS in the box. Click on OK and the extension will be added to the Program File list. Start over to add the HTA extension to the list. These are a couple of extensions that I have found that are not included in the default program file list on all of the versions. Click on the OK button and you are finished with this little project.

This brings us to another very important point. I would bet that there is a very large percentage of you that don’t have a clue about what a file extension is. Then there is the problem of not being able to see them. Microsoft, in their infinite wisdom, decided with Windows 95 that we did not need to see the extensions. This means that you will only see the part of the name of the file that the author of the virus wants you to. The virus will rename a file from picture.jpg to picture.jpg.vbs.  With the registered file extensions hidden, this will change the look of the file name from picture to picture.jpg. You have heard on the news about the Loveletter.VBS virus but you cannot see the VBS extension. You just think that file is a picture.

Let’s all take a moment to change this. 
Open up Windows Explorer. For those of you with Windows 98 click on View and then Folder Options. Now click on the View tab. Look down the list for the box that shows "Hide file extensions for known file types". Take the check mark out of the box so that all the file extensions will be visible to you. Click on OK and the changes will be saved. Now you will be able to see all of the extensions in Windows Explorer as well as Outlook or any other program. Then when someone tells you to be careful not to click on anything with a VBS extension, you will have a fighting chance.

Another area of concern should be your Internet browser. With Internet Explorer, Microsoft has created what it called Security Zones. These can be found under Tools, Internet Options, Security. All versions of Outlook except Outlook 97 use these settings to decide how to interact with the active content that is found on the web today. Most of you should be using the Restricted Zone mainly because of the many different types of viruses that are using Script ActiveX controls and Active Scripting to spread their wares. These items should be changed on all levels to disable or prompt. This will then give you the choice of whether to allow these files to run on your computer. If you are prompted that an ActiveX control needs to run then you will have the choice to accept or decline before the program has the chance to ruin your system. If you make the wrong choice then at least you were asked. Use some common sense and think about what it is that is trying to run. Is it something that is necessary or is it just junk? Is it something that you asked for or is it something that just showed up. Treat all of these intrusions into your computer space like a knock on your front door at three am. Ask yourself why this file is trying to load onto your computer.

I doubt if we will ever get to the time when virus protection will become obsolete. The problem with virus software is that it can usually only scan for something that the companies have seen before. It is very hard to write software to protect us from something that hasn’t been created yet. As soon as there is a new technology, the hackers will find a way to use it against us. The only thing that we can do is try to keep our virus software as current as possible. Keep informed about what is happening with your computer and Internet software. Make the trip to www.windowsupdate.com and download the updates. These updates are written because someone has usually found a flaw in the software. Use the tools that you have to give yourself the best chance to survive. 

We are but little fish in this big Ocean called the Internet. Some of the biggest companies around have been hit with this latest flurry of viruses. Mcafee and Norton can give the end users all the advance warning and all the tools to protect themselves, but it is the end user that is at the front line. He is the one that has the most important job in the fight. If you follow the instructions that you are given then hopefully you won’t become a casualty.


Copyright© 1996-2008
Alamo PC Organization, Inc.
San Antonio, TX USA