[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Dummies guide to viruses



I'm a techie, on all these non-techie lists, I guess its time to write 
something useful to repay all the good advice I've received ...

Here are some simple steps you can take. These are for any of the modern 
Windows environments configured in the default way. In order to spread 
Viruses need to target your typical dumb user, who hasn't taken these 
steps, so if you take them you'll be protected against 99.9% of viruses.

You could probably get away with either buying Virus software (#1) or 
taking all the remaining steps (#2..#6) but I really recommend doing the 
lot. I've done all these things, and as a result have never been infected, 
although I see probably one virus a week in email. None of the steps below 
affect my ability to get work done, for example by stopping things that 
there are good reasons to want to do.

1: Get a good virus protection software that updates itself regularly - 
e.g. Norton Antivirus www.symantec.com or McAfee www.mcafee.com, PAY FOR 
THE SUBSCRIPTION (about $10 or $20 per year), believe me its worth the 
money compared to rebuilding a trashed system.

2: Open My Computer -> C:/  then choose View -> Folder Options -> View, and 
make sure that there is NO check mark by "Hide file extensions for known 
file types", this will make sure  that you can see the type on files before 
opening them.

3: Set the correct options in the programs most commonly used with Macros
Open Microsoft Word
- if its Word2000 go to Tools -> Macros -> Security and set to High - there 
is almost never a reason why a document will contain Macros for a good reason.
- if its earlier versions of Word its something like Options -> 
General  and make sure it has "Enable Macro Virus protection" turned on.
Do the same thing in Microsoft Excel, and if you have it Microsoft Power Point
There is probably something similar in Outlook - I don't use it, if you 
know how it works let me know and I'll update this file.

4: ONLY open something where you know the type cannot hold viruses, 
specifically, where the name is  .gif, .jpg, .swf  (flash/ shockwave) 
.txt   and (if you've taken the precautions above) *.doc and *.xls , .html 
is probably OK meaning that its as safe as a web page, although people keep 
finding vulnerabilities there.
In particular look out for tricky things that are something like 
xxxx.jpg.vbs   which is a Visual Basic virus pretending to be a JPG, its 
the letters after the last period that count.
Just because it comes from someone you trust does NOT make it safe. Once 
your friends machine is infected the virus can pretend to be her.
In particular do NOT EVER OPEN ANYTHING ENDING IN .EXE .VBS or .SCR  these 
are really commonly used for viruses. There have been programs sent around 
as one of these which trashed systems but just looked like something fun.

5: Do NOT pass on virus warnings UNLESS they are dated, and have Links to 
the news story or a web page giving more information AND you have checked 
that link to check it makes sense. Any other Virus warning is itself a 
virus, passed along from dumb email user to dumb email user.

6: Update your operating system frequently, open Internet Explorer - go to 
Tools -> Windows Update and choose Product Updates, in particular install 
anything labelled a critical update or that talks about security - this is 
USUALLY easy.

Just in case you are interested I've attached a file listing of unsafe file 
extensions taken from McAfee. Note just how many there are, also note how 
it is a .TXT file and so cannot contain a virus, so its safe to open (if 
you trust me :-)  This is why its better to have

Hope this is helpful, if you know what you are doing, and have suggestions 
for me to add to this please email me privately - mitra@earth.path.net

- Mitra

VirusScan software initially looks for viruses only in files that are susceptible to infection. It uses a list of file name extensions to keep track of vulnerable files. This list appears in the Program Extensions dialog box, and is something you can edit to suit your own needs. In this list, ? symbols represent wildcards—
VirusScan software substitutes any character for the ? so that it scans more than one file type with similar extensions. For example, the software will use the .XL? wildcard to look for viruses in Microsoft Excel spreadsheet (.XLS) and template (.XLT) files. 

Note:	McAfee recommends that you scan your system thoroughly during your first scan operation, or periodically thereafter, without limiting the scope of the scan operation to these file types. This ensures that your system starts in a virus-free condition. You can then use this list of extensions to limit the scope of later scan operations.

Extension	File Type	File description
<BLANK>	Any	Files with no extension.
.??_	Compressed	Windows compressed files.
.ARC	Archive	LH ARC files, older version.
.ARJ	Archive	Robert Jung .ARJ compressed archive files.
.ASP	Macro/script	Microsoft Active Server Pages files. These files contain script commands for use with Internet Information Server.
.BAT	Program	DOS batch files.
.CAB	Compressed	Windows Compressed Application Binary or “cabinet” files.
.CDR	Macro	Corel Draw document files. Later versions of Corel Draw include a scripting language that can generate macro viruses.
.CLA	Program	Java class files (truncated from .CLASS).
.COM	Program	Command/binary image files. These common files run as infectable executable programs. DOS and Windows system files frequently make use of this extension.
.CSC	Script/macro	Corel script files. Script files can include viruses or generate macro viruses.
.DL?	Program	Dynamic Link Library file; C++ dialog script files. Dynamic Link Library files are resource files linked to executable program files. Executable files can load viruses stored in them and run them as part of their native code.
.DOC	Macro	Microsoft Word document files. These files can contain Word Basic macros and, therefore, macro viruses.
.DOT	Macro	Microsoft Word document template files. These files can contain Word Basic macros and macro viruses.
.EXE	Program	Executable files. Most software uses this extension to identify files that start their command shell or program kernel.
.GMS	Macro	Corel Global Macro Storage files.
.GZ?	Compressed	UNIX GNU Gzip compressed files.
.HLP	Macro	Windows Help files. These files can contain executable Word Basic or other macro code.
.HT?	Script/macro	Hyper Text Markup Language and related files; Microsoft Hyper Text template files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ICE	Compressed	ICE compressed files.
.IM?	Program	Image files for creating disk images.
.INI	Program	Windows initialization files. Although these are generally text files, infected .INI files can cause mIRC clients to perform unwanted actions. 
.JS?	Script	JavaScript source files. JavaScript files can contain virus code that acts directly on web browsers.
.LZH	Compressed	LHARC compressed files.
.MD?	Macro	Microsoft Access database, add-in, and related files. These files can contain infectable Visual Basic for Applications macros.
.MPP	Macro	Microsoft Project files. These files can contain infectable Visual Basic for Applications macros.
.MPT	Macro	Microsoft Project template files. These files can contain infectable Visual Basic for Applications macros.
.MSG	Macro	Microsoft Mail, Exchange and Outlook message files. These files can contain script commands that can introduce virus infections.
.MSO	Macro	Microsoft Office 2000 files.
.OCX	Program	Microsoft Object Linking and Embedding custom controls. These files are similar to ActiveX controls and can function as harmful software in their own right.
.OLE	Program	Object Linking and Embedding object files. These files are similar to ActiveX controls. They are files created in one application to be embedded into files created by another application
.OV?	Program	Overlay files.
.POT	Macro	Microsoft PowerPoint template files. These files can contain infectable Visual Basic for Applications macros.
.PP?	Macro	Microsoft Powerpoint document and slide show files. These files can contain infectable Visual Basic for Applications macros.
.RAR	Archive	RAR compressed archives.
.RTF	Macro	Rich Text Format files. These files serve as a common text file format for many document files.
.SCR	Program	Windows screen saver files.
.SHS	Program	Windows shell script (scrap object) files. These files can introduce commands that cause unwanted behavior on the host computer.
.SMM	Macro	Lotus AmiPro spreadsheet files. These files include macro capabilities.
.SYS	Program	DOS or Windows system files and device drivers. These executable files frequently start along with or as part of program execution.
.TAR	Archive	UNIX tape archive files.
.VBS	Script	Visual Basic script files and VBScript files. VBScript is an implementation of Microsoft’s Visual Basic programming language. It powers special features on many web pages, and can directly manipulate many functions inside Microsoft Outlook and other software.
.VS?	Macro	Visio drawing and related files. Later Visio versions include infectable scripting extensions.
.VXD	Program	Windows virtual device drivers. These are executable files that often reside in memory.
.WBK	Macro	Microsoft Word backup files.
.WPD	Macro	Corel WordPerfect document files.
.XL?	Macro	Microsoft Excel worksheet, add-in, toolbar, chart, dialog box, backup, macro, workspace, Visual Basic module, and template files. These files can contain infectable Visual Basic for Applications macros.
.XML	Script/macro	Extensible Markup Language files. Although they are nominally plain text, these files can contain powerful scripting functions that act through browser software.
.ZIP	Archive	WinZip and PKZip compressed archive files.

Copyright © 1995-2000 Networks Associates Technology, Inc. All Rights Reserved.