Monday, November 16, 2009

Myths & Pointers

This last section is intended simply to give you some pointers and dispel some myths about viruses. First, I have heard people say that if you have a virus in your master boot record, typing:
fdisk /mbr
will get rid of it. This method is very dangerous. This is because many master boot record viruses will scramble the hard disk's partition table. Thus, the virus is actually allowing you to access the hard disk. If you were to boot from a diskette you would not be able to do anything because the virus is not active to descramble the partition table. If you were to use "fdisk /mbr" you would be overwriting the virus with generic code. The virus would be gone, but your hard disk would still be scrambled. In a case like this, you need to restore the original master boot record and partition table.
Let's talk about the greatly-feared pkzip300 virus. Pkzip300 is not a virus. It does not replicate. Rather, it is a Trojan horse. This means that it is a program that is supposed to do one thing, but when executed it does something entirely different, usually destructive. I have seen statements to the effect of, "don't download or extract this file under any circumstances. It will format your hard disk and ruin your high-speed modem." Again, it's just a regular computer program. You could download it and decompress it and nothing, I repeat, nothing would happen! The only way this program could hurt you is if you physically executed it yourself.
And what about the Good News or Good Times virus? It's a big hoax!!! Every few months a wide-spread panic arises on the internet when the news of a horrific virus that is hidden in email is forwarded and reforwarded through cyberspace. The warning is basically the same every time. A seemingly reliable source, such as the FCC or IBM has issued a statement that if you were to download a message containing the subject line, "good news", or, "good times" your whole hard drive would be erased. The truth is that the concept of infecting your computer by reading the text of an email message is an impossibility, because no virus can hide itself in an email message. This is because messages are in text format, and there is no way to catch a virus or harm your system in any way by reading text. A binary program (a designation that includes Word documents and Excel spreadsheets) can not be hidden in a plain text message. Even if you received a text message containing a binary program encoded by NetSend, you are still safe. This is because when you type, "text" to produce the encoded program, the program is not executed. You still have to type the program's name to run it. Of course, if you receive a program like this you should scan it for viruses after decoding it, but before running it. The same rule applies to programs sent to you as attachments--scan them before running them. In short, if you receive an email message with no attachments, it does not contain a virus, no matter what the subject line reads. If it does contain an attachment, scan the attachment for viruses before running the program, opening the Word document in Word, or the Excel spreadsheet in Excel.
The main thing to remember when dealing with viruses is not to panic. Viruses do not have mystical powers. They are computer programs that have to conform to the constraints of all other programs. They can only do their dirty work if they are executed. I personally have about 5000 of them on my computer, (I downloaded them when I was testing antivirus software for my company), and not one of them has gotten loose and infected my system. That is because I simply did not execute any of them. Having a good antivirus strategy in place can prevent almost any type of attack before it happens. As long as you are virus-conscious, not virus-paranoid, you can prevent or recover from anything.

No comments:

Post a Comment