[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Dummies guide to viruses
- To: "permaculture" <permaculture@franklin.oit.unc.edu>
- Subject: Dummies guide to viruses
- From: Mitra <mitra_lists@earth.path.net>
- Date: Wed, 23 May 2001 09:53:37 +1000
- In-reply-to: <LYRIS-100849-42753-2001.05.21-10.20.45--mitra_lists#earth.path.net@franklin.oit.unc.edu>
- Newsgroups: permaculture
- References: <LYRIS-107658-42582-2001.05.20-06.23.22--ralf.riedel#usm.ed u@franklin.oit.unc.edu>
I'm a techie, on all these non-techie lists, I guess its time to write
something useful to repay all the good advice I've received ...
Here are some simple steps you can take. These are for any of the modern
Windows environments configured in the default way. In order to spread
Viruses need to target your typical dumb user, who hasn't taken these
steps, so if you take them you'll be protected against 99.9% of viruses.
You could probably get away with either buying Virus software (#1) or
taking all the remaining steps (#2..#6) but I really recommend doing the
lot. I've done all these things, and as a result have never been infected,
although I see probably one virus a week in email. None of the steps below
affect my ability to get work done, for example by stopping things that
there are good reasons to want to do.
1: Get a good virus protection software that updates itself regularly -
e.g. Norton Antivirus www.symantec.com or McAfee www.mcafee.com, PAY FOR
THE SUBSCRIPTION (about $10 or $20 per year), believe me its worth the
money compared to rebuilding a trashed system.
2: Open My Computer -> C:/ then choose View -> Folder Options -> View, and
make sure that there is NO check mark by "Hide file extensions for known
file types", this will make sure that you can see the type on files before
opening them.
3: Set the correct options in the programs most commonly used with Macros
Open Microsoft Word
- if its Word2000 go to Tools -> Macros -> Security and set to High - there
is almost never a reason why a document will contain Macros for a good reason.
- if its earlier versions of Word its something like Options ->
General and make sure it has "Enable Macro Virus protection" turned on.
Do the same thing in Microsoft Excel, and if you have it Microsoft Power Point
There is probably something similar in Outlook - I don't use it, if you
know how it works let me know and I'll update this file.
4: ONLY open something where you know the type cannot hold viruses,
specifically, where the name is .gif, .jpg, .swf (flash/ shockwave)
.txt and (if you've taken the precautions above) *.doc and *.xls , .html
is probably OK meaning that its as safe as a web page, although people keep
finding vulnerabilities there.
In particular look out for tricky things that are something like
xxxx.jpg.vbs which is a Visual Basic virus pretending to be a JPG, its
the letters after the last period that count.
Just because it comes from someone you trust does NOT make it safe. Once
your friends machine is infected the virus can pretend to be her.
In particular do NOT EVER OPEN ANYTHING ENDING IN .EXE .VBS or .SCR these
are really commonly used for viruses. There have been programs sent around
as one of these which trashed systems but just looked like something fun.
5: Do NOT pass on virus warnings UNLESS they are dated, and have Links to
the news story or a web page giving more information AND you have checked
that link to check it makes sense. Any other Virus warning is itself a
virus, passed along from dumb email user to dumb email user.
6: Update your operating system frequently, open Internet Explorer - go to
Tools -> Windows Update and choose Product Updates, in particular install
anything labelled a critical update or that talks about security - this is
USUALLY easy.
Just in case you are interested I've attached a file listing of unsafe file
extensions taken from McAfee. Note just how many there are, also note how
it is a .TXT file and so cannot contain a virus, so its safe to open (if
you trust me :-) This is why its better to have
Hope this is helpful, if you know what you are doing, and have suggestions
for me to add to this please email me privately - mitra@earth.path.net
- Mitra
VirusScan software initially looks for viruses only in files that are susceptible to infection. It uses a list of file name extensions to keep track of vulnerable files. This list appears in the Program Extensions dialog box, and is something you can edit to suit your own needs. In this list, ? symbols represent wildcards—
VirusScan software substitutes any character for the ? so that it scans more than one file type with similar extensions. For example, the software will use the .XL? wildcard to look for viruses in Microsoft Excel spreadsheet (.XLS) and template (.XLT) files.
Note: McAfee recommends that you scan your system thoroughly during your first scan operation, or periodically thereafter, without limiting the scope of the scan operation to these file types. This ensures that your system starts in a virus-free condition. You can then use this list of extensions to limit the scope of later scan operations.
Extension File Type File description
<BLANK> Any Files with no extension.
.??_ Compressed Windows compressed files.
.ARC Archive LH ARC files, older version.
.ARJ Archive Robert Jung .ARJ compressed archive files.
.ASP Macro/script Microsoft Active Server Pages files. These files contain script commands for use with Internet Information Server.
.BAT Program DOS batch files.
.CAB Compressed Windows Compressed Application Binary or “cabinet” files.
.CDR Macro Corel Draw document files. Later versions of Corel Draw include a scripting language that can generate macro viruses.
.CLA Program Java class files (truncated from .CLASS).
.COM Program Command/binary image files. These common files run as infectable executable programs. DOS and Windows system files frequently make use of this extension.
.CSC Script/macro Corel script files. Script files can include viruses or generate macro viruses.
.DL? Program Dynamic Link Library file; C++ dialog script files. Dynamic Link Library files are resource files linked to executable program files. Executable files can load viruses stored in them and run them as part of their native code.
.DOC Macro Microsoft Word document files. These files can contain Word Basic macros and, therefore, macro viruses.
.DOT Macro Microsoft Word document template files. These files can contain Word Basic macros and macro viruses.
.EXE Program Executable files. Most software uses this extension to identify files that start their command shell or program kernel.
.GMS Macro Corel Global Macro Storage files.
.GZ? Compressed UNIX GNU Gzip compressed files.
.HLP Macro Windows Help files. These files can contain executable Word Basic or other macro code.
.HT? Script/macro Hyper Text Markup Language and related files; Microsoft Hyper Text template files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ICE Compressed ICE compressed files.
.IM? Program Image files for creating disk images.
.INI Program Windows initialization files. Although these are generally text files, infected .INI files can cause mIRC clients to perform unwanted actions.
.JS? Script JavaScript source files. JavaScript files can contain virus code that acts directly on web browsers.
.LZH Compressed LHARC compressed files.
.MD? Macro Microsoft Access database, add-in, and related files. These files can contain infectable Visual Basic for Applications macros.
.MPP Macro Microsoft Project files. These files can contain infectable Visual Basic for Applications macros.
.MPT Macro Microsoft Project template files. These files can contain infectable Visual Basic for Applications macros.
.MSG Macro Microsoft Mail, Exchange and Outlook message files. These files can contain script commands that can introduce virus infections.
.MSO Macro Microsoft Office 2000 files.
.OCX Program Microsoft Object Linking and Embedding custom controls. These files are similar to ActiveX controls and can function as harmful software in their own right.
.OLE Program Object Linking and Embedding object files. These files are similar to ActiveX controls. They are files created in one application to be embedded into files created by another application
.OV? Program Overlay files.
.POT Macro Microsoft PowerPoint template files. These files can contain infectable Visual Basic for Applications macros.
.PP? Macro Microsoft Powerpoint document and slide show files. These files can contain infectable Visual Basic for Applications macros.
.RAR Archive RAR compressed archives.
.RTF Macro Rich Text Format files. These files serve as a common text file format for many document files.
.SCR Program Windows screen saver files.
.SHS Program Windows shell script (scrap object) files. These files can introduce commands that cause unwanted behavior on the host computer.
.SMM Macro Lotus AmiPro spreadsheet files. These files include macro capabilities.
.SYS Program DOS or Windows system files and device drivers. These executable files frequently start along with or as part of program execution.
.TAR Archive UNIX tape archive files.
.VBS Script Visual Basic script files and VBScript files. VBScript is an implementation of Microsoft’s Visual Basic programming language. It powers special features on many web pages, and can directly manipulate many functions inside Microsoft Outlook and other software.
.VS? Macro Visio drawing and related files. Later Visio versions include infectable scripting extensions.
.VXD Program Windows virtual device drivers. These are executable files that often reside in memory.
.WBK Macro Microsoft Word backup files.
.WPD Macro Corel WordPerfect document files.
.XL? Macro Microsoft Excel worksheet, add-in, toolbar, chart, dialog box, backup, macro, workspace, Visual Basic module, and template files. These files can contain infectable Visual Basic for Applications macros.
.XML Script/macro Extensible Markup Language files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ZIP Archive WinZip and PKZip compressed archive files.
Copyright © 1995-2000 Networks Associates Technology, Inc. All Rights Reserved.