This document discusses the varieties of viruses infecting the Internet and what you can do to disinfect your computer or avoid being infected. If you want to quickly know what viruses are currently active on the Internet or in the SIUC environment, we provide the following links:
The Computer Support Center Announcements page. Late-breaking news with the potential to impact the entire campus is announced on this page. If we're aware of a virus "going around" the SIUC campus, it will be announced on this page.
The Virus Information Center. This page is maintained by McAfee Associates, Inc., one of the leading commercial vendors of antivirus software.
The U.S. Department of Energy Computer Incident Advisory Capability page. The CIAC provides computer security services to employees and contractors of the United States Department of Energy. They're a reliable souce of late-breaking virus news.
Virus Types:
A computer virus is a program designed to infiltrate and disrupt your computer's operation. They're a fact of life on the Internet, and they're here to stay. In 1996 viruses cost the typical company $8100 in lost time and productivity. Several thousand viruses now roam the 'Net, ranging from A&A to ZZ.429. An exact count is impossible because some viruses mutate to alternate forms that detection programs can't recognize. If you think of a virus as an annoying bug that will infect someone else, you're only making yourself vulnerable to loss of irreplaceable data and several days of workstation downtime.
There are several varieties of these electronic pests.
A computer worm is a self-contained program that is able to spread copies of itself, usually over a network.
A Trojan Horse is a program that is supposedly useful but actually hides in your computer until it's triggered--such as by the day of the year--and does whatever damage it's designed for. It can't spread like a virus or worm.
A mail bomb is an e-mail message that, despite its normal appearance, bombards your mailbox with hundreds or thousands of copies of the same message.
Some of these bugs are merely annoying; others don't even exist (the "Good Times" hoax); and others wreak catastrophic, irreversible destruction on your hard drive. One virus scanner itself is reported to do more harm than the viruses it scans for! Since you don't know what's coming at you next, it would be wise to expect the worst.
Why They're Serious:
There are very good reasons to expect the worst. We're talking a very high level of cunning here, state-of-the-art electronic terrorism, from talented individuals who have chosen to direct their skills into random, malicious destruction. The Computer Support Center has prepared this page to make you aware of just how sophisticated and dangerous the newer viruses have become.
Virus creators' basic strategy is to increase the damage their programs do by concealing their activity until the damage is done. They do this through a combination of the following tactics:
Polymorphism is one of the more chilling characteristics of the newer viruses. This type of virus can change its internal structure or its encryption techniques. Polymorphic techniques change the digital "signature" of a virus each time it infects another computer. Antiviral signature-scanning software may not detect it.
Multipartite viruses infect Master Boot Records (MBRs), boot sectors, and files. The boot sector is a disk drive's Achilles heel. All disks and diskettes are vulnerable to this type of virus because they all have a boot sector. The Hare.7610 virus, for example, infects not only your hard drive but any floppy diskette you put in your computer.
Memory Resident viruses stay in active memory while other programs are running. You don't know they're there, of course, while they infect whatever software they have been targeted for.
Stealthy viruses redirect system pointers and conceal increased file sizes so they can remain undetected.
What You Can Do:
We post virus news of potential impact on the SIUC campus to our Announcements page. A wealth of global information about viruses is also available on the Internet. For example, a basic search on virus turns up about 100,000 "hits" on web pages and 10,000 hits in Usenet newsgroups. Three of these pages, which are commercial sites, are especially useful.
The first of these is the Data Fellows' F-PROT site. The F-PROT product family includes several tools that will help protect your information against viruses, including the new Word-specific macro viruses. Versions of F-PROF downloadable from this site include a limited free version.
The second is Symantec, one of the leading virus protection software creators. You can browse their web page, which is usually kept very current. They also have a virus alert page and a virus info database available.
A third commercial site, McAfee Associates, Inc., is also a good beginning point for the latest information on computer viruses. McAfee specializes in virus-related software. Their site offers, among many other features:
An anonymous-FTP page, which allows downloading of Virus Scan v2.2.9 (released January 1996).
We especially recommend that you visit their virus information library. This library includes lists of what McAfee considers the Top Ten Hot Viruses on the Internet and comprehensive lists of Viruses by Type and Viruses by Name. Both Symantec and McAfee are commercial sites, of course; we aren't endorsing their products, we're simply describing what they offer and providing links for your convenience.
Other Sources of Information:
Virus FAQ. This is a large, extensive page of frequently asked questions about viruses. It's maintained at the University of Wisconsin-Madison. There's an extraordinary amount of information on this page, and it's strongly recommended browsing for anyone wishing to know more about viruses.
ZDNet Download Help. A commercial site. Choose "What about computer viruses?" This page explains how the Ziff-Davis Publishing Company checks its files for viruses before downloading them.
Computer Virus Myths. A commercial site. This page is aimed at deflating the hysteria associated with Internet computer viruses.
NH&A Anti-Virus. This is another commercial site. It specializes in antivirus software, especially for the corporate world, and includes lots of useful information.
Virus Hoaxes. This page, which is maintained by the U.S. Department of Energy's Computer Incident Advisory Capability, describes some of the virus hoaxes circulating on the Internet (Irina, Good Times, Deeyenda, Ghost, and more). They also provide a home page.