compeds logo-Home Page

Computer Education and Services

  "Love grows as a spark in one's heart, just as a seed grows to be a flower in the garden.  Both need to be nourished and cared for to become as beautiful as they are."*

 
 

Home
Up
General Windows Tips
Windows XP Tips
General Office Tips
Software Program Tips
Windows 7 Tips
Vista Tips
Virus Tips
Internet/Browser Tips
Hardware Tips

Virus Tips

Look for tips about viruses and anti-virus programs here.

Topics

What Is A Virus?
Virus Definition Files
Two or More Virus Scanners on One System
!000 Doesn't Work
Free On-line Virus Scanners
Swen...the New Mass Mailer Worm
Netsky.D Worm
Be Aware of Drive-by Downloads
Removing Malware
Viruses and Email Attachments
Check for Viruses First!
Shut Down Problem with Antivirus Program
Free Antivirus Program
Remove the MSBlast Worm From Your PC
Spoofed Return E-mail Addresses from "Support" Team
 

 

 

Removing Malware

As most of us know, spyware, adware, trojan viruses, and other nasties are on the rise.  Here is a site that not only helps with computer problems, but will also help you remove the goulies from your computer.  I must warn you that many solutions may require you to alter your Registry.  So make sure that you back up this all important part of your computer before you proceed.  The site is called PC Hell.

Back to Top

 

Be Aware of Drive-by Downloads

It's hard enough to keep viruses, worms, and Trojan horses from infecting your computer.  One of the latest threats is "drive-by" downloads.  All you need to do is visit an infected website, especially if you use Internet Explorer as your browser, to get infected.  The virus will install itself on your computer without your knowledge or permission.  All the anti-virus and anti-spyware programs in the world will not save you from infestation.

There is hope.  Internet Explorer can be configured  to stop "drive-bys".  Before you make changes, you may want to write down the original settings in case you want to change them back to the way they were. Here's how to configure IE:

bulletLaunch IE, click Internet Options from the Tools menu.
bulletClick the Security tab and click the Custom Level button.
bulletIn the dialog box, look below the ActiveX Controls And Plug-ins heading.
bulletSelect the Prompt radio button below Download Signed ActiveX Controls.
bulletSelect the Disable radio button below Download Unsigned ActiveX Controls.
bulletSelect the Disable radio button below Initialize And Script ActiveX Controls Not Marked As Safe.
bulletSelect the Prompt radio button below Run ActiveX Controls And Plug-ins.
bulletSelect the Prompt radio button below Script ActiveX Controls Marked Safe for Scripting.
bulletClick OK, confirm your change and exit Internet Options.

The only problem with these settings is that you will be presented with pesky dialog boxes whenever you reach legitimate, safe sites.

Back to Top

 

Spoofed Return E-mail Addresses from "Support" Team

Various viruses "spoof" return addresses; that is, they may pick at random an address in the address book of the infected computer and show it as the return address, so that you end up thinking the virus message is from someone you know.  

A recent variation represents itself as support@[name of your e- mail domain]. The message says "Dear user of [domain name] mailing system, Our anti-virus software has detected a large amount of viruses outgoing from your email account. You may use our free anti-virus tool to clean up your computer software. For further details, see the attached."  

It's signed "The [domain name] team" and includes a link to your domain's URL. It's easy to recognize this as a spoof if you host your own email server, but those who use an ISP's mail server could easily be fooled. 

A variation on this one that also spoofs your e-mail provider's address, claims your e-mail account is being disabled because of unauthorized access and instructs you to open an attached password protected .zip file. It provides the password in the body of the message. (The password protection prevents anti-virus software from examining the file). 

If you get a message like this, don't open the attachment and don't use the "anti-virus tool." Call your ISP or mail hosting service if in doubt about the legitimacy of any message purporting to be from them.

Back to Top

 

Netsky.D Worm

One of the most prolific worms this year is the Netsky.D variation, which uses an attachment in email that's a .pif (Program Information File) to replicate itself. Subject line varies; some of the most popular are "Re: Word file," "Re: Excel file," "Re: your details" and "Re: thanks!"

The worm deletes a number of important registry values and adds itself to Windows startup. For the download removal tool, see:

W32.Netsky@mm Removal Tool

Back to Top

 

Swen...the New Mass Mailer Worm

Symantec, maker of Norton Antivirus, has recently issued a warning about a new virus threat.  This is a mass-mailer worm known as W32.Swen.A@mm.  The virus comes to you as a so-called email attachment from Microsoft Support as an update.  Bottom line, Microsoft NEVER sends it's customers/clients attachments or updates through email!

The worm mainly affects those who use MS Outlook and Outlook Express.  Those systems with Internet Explorer 6.0 (mostly Windows XP) are not affected.  All other versions of Windows (Windows 95, 98, ME) can be affected.  If you have installed Internet Explorer 5.01 Service Pack, then you are protected.

To help protect your computer from this worm, perform the following:

bulletGo to Microsoft Support  or search for Bulletin MS01-020 and download the security update.
bulletGo to Symantec's Security Response site for removal instructions.

I urge you to make sure that you perform all critical updates for Windows and MS Internet Explorer.  You should also make sure that your virus program is up to date with the latest virus definitions.  This is for your own protection and those of others.

Back to Top

 

Remove the MSBlast Worm From Your PC

There's no need to take your infected PC to the shop. Here are steps you can take if your Windows 2000, NT 4.0, or XP computer has been hit with the W32.Blaster.Worm.

Before you start, you'll need to gather these elements:

Personal firewall software
Required attention span: 5-10 minutes

Follow these steps... 

bulletBreak your computer’s connection with the Internet. If you're on a dial-up connection, DSL, or a cable modem, turn off the modem.
bulletHold down Ctrl and Alt at the same time and press Delete with your other hand. Click Task Manager, then the Processes Tab.
bulletClick the Image Name column to organize the items alphabetically. Look for MSBlast. Mouse down to highlight it, then click End Process. Close the Task Manager.
bulletFrom Windows Explorer, search for the file MSBlast.exe on the C: drive. Delete any copies of MSBlast.exe that you find. 
bulletReboot your computer and reconnect to the Internet by turning on your modem again.

Download the RPC Interface Buffer Overrun Security Vulnerability Patch patch from Microsoft Windows Update. If that site is unavailable, get the file from another site, such as Download.com.  Good Luck!

Back to Top

 

Free On-line Virus Scanners

My last tip discussed using a free virus program called AVG provided by www.grisoft.com.  You can also go to the Internet and use free programs that will scan your computer for viruses.  Below are 3 sites that provide this service.

http://housecall.trendmicro.com
http://www.pandasoftware.com/activescan/com
http://www.ravantivirus.com/scan

Back to Top

 


Free Antivirus Program

I constantly remind folks about upgrading their antivirus programs.  There are over 60,000 bugs out there just waiting to wreck havoc on your computer.  Most antivirus programs cost and can be expensive on the pocketbook. 

Normally, I abstain from recommending a free program, however, due to the proliferation of viruses, I feel this one is worth a look.  AVG by Grisoft has proven itself to be an able virus detector.  I use it on 2 of my own systems.  The neat part about it is that it's FREE!  All you need to do is give them your name and email address.  This is so you can receive a code that unlocks the installation.  The program has even detected viruses other "paid-for" programs have missed.  You can schedule updates or manually update it yourself.  Very easy to use.

If you already have an out-of-date antivirus program on your system, find out the correct way to delete it and then install AVG.  Give those viruses a run for no money and try this program!

Back to Top

 

!000 Doesn't Work

I received an e-mail about how to stop viruses from spreading. Referring to a PC World article, the anonymous writer advised me to enter !000 as a contact in my Outlook or Outlook Express address book. Thereafter, !000 would appear as the first entry and prevent worms from e-mailing themselves to everyone in my address book. Is this true?

I hate to burst that bubble of hope, but the answer is no. Similar e-mail messages have been making the rounds for a couple of years, and the advice is bogus. Ignore it.

You're much better off getting an antivirus package and keeping it up-to-date. Visit Hoax Busters for details about this hoax, and go to "How to Spot Virus Hoaxes a Mile Off " for tips on how to identify virus hoaxes in general.

Back to Top

 

Shut Down Problem with Antivirus Program

If your computer will not shut, one of the problems could be your antivirus program.  Symptoms may be:

bullet

The floppy disk light may be on.

bullet

You may receive a "Windows Protection Error" message.

bullet

Your computer may stop responding while displaying the "Windows is shutting down" message.

This can happen if your antivirus program is set to scan your floppy drive when you shut down your computer.  To resolve this, contact your antivirus maker to see if they have a fix.  Meanwhile, you can set your program not to scan your floppy disk drive when you shut down your computer.  Consult your program's documentation on how to do this.

For additional shut down and other issues, view the Microsoft Knowledge Base article  Q315854.

Back to Top

 

Two or More Virus Scanners on One System

In today's electronic world, viruses, worms, and other nefarious programs are seemingly everywhere. Because of this, the anti-virus software industry is huge. It is true that you should have anti-virus software on your system.  However, many vendors incorrectly suggest that you should have more than one virus scanner on your system at once, so that if a virus 'slips' past the first, it will be caught by the second.

Not true. If you have a reputable anti-virus program, and are keeping it up to date, one is sufficient. Having multiple virus scanners on your system at once may be too taxing on your system and could cause performance problems or other unexpected results.

Back to Top

 

Check for Viruses First!

Do you download stuff from the Internet? These days, who doesn't? The problem is that some of the files downloaded may be worms, or have viruses attached to them. Before running ANY software downloaded from the Internet, no matter the source, run a virus checker against the downloaded files. A few extra seconds worth of work just might save you from several hours of recovery.

Back to Top

 

Virus Definition Files

If you are currently using a virus protection program, that's a good thing. However, if you don't keep your virus definition files up to date, you might as well not have a virus scanner at all.

Virus scanners work by looking for code that matches a worm, virus, or Trojan. After locating this signature, the anti-virus software loads the remedy for that particular virus. No two viruses are exactly the same, and many times their programs are very complex; some may even be polymorphs (programs that can change themselves).

Before doing anything else, download the latest version of software and virus definitions from your anti-virus software's manufacturer. It might cost you a little change, but it only takes one attack to kill a system -- a much more expensive prospect.

Back to Top

 

Viruses and Email Attachments

Virus programmers will often attempt to disguise their program as another file by naming it something like wacky.jpg.vbs. When you open the attachment in Windows, you see the 'wacky.jpg' but the .vbs extension (meaning Visual Basic Script), is omitted. Such a file extension could potentially be dangerous to your system, if it's a virus or a worm. (Note: If you ever see a file attachment that has an icon that looks like a light blue 'S', do NOT open it.) Watch for these file extensions and don't open any attachments bearing any of them: .js, .jse, .vbs, .scr, .shs, and .shb

The issue here is that Microsoft, in an attempt to make their products more friendly, has the default for double-clicking an email attachment as an 'OPEN' command. You can add a layer of security by changing this default to an 'EDIT' command. To do so:

1). Windows Me: Go to the Control Panel and select the Folder Options icon. Now, select the File Types tab and a small flashlight will appear. You may have to wait a moment. Now, when the files are displayed, find one with one of the extensions I listed above. Select it, and click the Advanced tab. Now, highlight Edit and press the Set Default button.

2). Windows 95/98: This is a bit more difficult. Go to an Explorer window and select View, then Folder Options. Click the Files tab and scroll through the file types. You will see the extensions in the small window at the bottom. When you find a file with one of the extensions I mentioned above, click Edit. Now select Edit from within the Actions list and click the Default button.

Back to Top

 

What Are Worms?

Technically, worms are not viruses. The term "worm" was derived from a book called "The Shockwave Rider" by John Brunner, in which the main character takes out the evil government's computer with a program called Tapeworm. Interestingly, original worm programs were designed to be helpful. Actually, the first destructive worm, Morris, was a good program that crashed, causing networks to crash along with it.

In general, a worm is a program that enters your computer in some fashion and then begins to perform a function. Keep in mind that worms do not require a host program to operate. Some of the more famous worms are programs such as the Morris worm, Anna Kournikova (not the tennis player but the worm named after her), Code Red I and II, and Annoying. Such worms wreak havoc among unsuspecting persons who inadvertently run the offending programs.


Unlike viruses, worms do not need any kind of user intervention or action to begin their nefarious activity. Once on a computer, a worm immediately begins its destructive task, and at the same time, looks for connections by which it can replicate and transmit itself to other host computers. In a contest between viruses and worms, worms win as potentially the more destructive of the two.

Back to Top

 

What Is A Virus?

Computer viruses make headlines! Frequently in the news is some new virus that's causing, or will soon cause, havoc on business computers, personal computers, and Web services. To combat the virus problem, the best weapons are knowledge and preparation, beginning with the definition of a virus.

Everyone knows how a biological virus operates: it can injure and potentially kill a host. A software virus will do the same thing. This kind of virus is a tiny program that causes your computer to perform in a manner you consider undesirable, and that then may attempt to replicate itself. The virus action may be as simple as displaying a text box that says, "John Doe is a big dumb jerk." Or it may be as destructive as the Melissa virus, which can tear down networks and ultimately shut down a business—at least temporarily. Some viruses, called retroviruses, actually attack virus-scanning software!

Keep in mind that a virus cannot run on its own. It must be attached to "host" software that runs legitimate software; while running the legit software, the host software becomes a host for the virus as well.

Back to Top

 

(Disclaimer:  Compeds lists these tips only as suggestions.  We will not be responsible for any damage or adverse changes to your system or software in their use or misuse.) 
 

Home ] Up ] General Windows Tips ] Windows XP Tips ] General Office Tips ] Software Program Tips ] Windows 7 Tips ] Vista Tips ] [ Virus Tips ] Internet/Browser Tips ] Hardware Tips ]Site Map ] Services ] Comped's Corner ] Glossary ] Feedback ] Tip of the Week ] Search ] Ray's Quotes ]

Home

Send mail to raymonde@msn.com with questions or comments about this web site or use our Feedback form.
Last modified: November 16, 2007

©1997-2004 Computer Education and Services
The material on this site is protected by U.S. Copyright Laws and cannot be used without the express written consent of the owner.