360 lines
18 KiB
Plaintext
360 lines
18 KiB
Plaintext
|
Reprinted from CompuMag, Vol. 1 (1989), Issues 3 and 4
|
|||
|
|
For subscription information call 1-805-273-0300
|
|||
|
|
|
|||
|
|
Virus Hysteria!
|
|||
|
|
|
|||
|
|
by Richard B. Levin
|
|||
|
|
|
|||
|
|
You're scared. Having heard how computer viruses leap
|
|||
|
|
from computer to computer, you've learned your system could
|
|||
|
|
be the next unwitting sufferer of a computer flu. After
|
|||
|
|
all, your friend has a friend whose cousin knows someone
|
|||
|
|
that witnessed a virus display "Arf! Arf! Gotcha'!" as it
|
|||
|
|
gobbled up data on an office PC. And your local BBSes are
|
|||
|
|
bubbling over with heated horror stories about bombs,
|
|||
|
|
Trojans and viruses, not to mention countless
|
|||
|
|
recommendations for anti-virus software products. It seems
|
|||
|
|
that every new day brings with it stories of impending
|
|||
|
|
computerized doom, created by evil geniuses with programming
|
|||
|
|
abilities far beyond those you or your associates could ever
|
|||
|
|
hope to achieve, much less do battle against.
|
|||
|
|
|
|||
|
|
Relax! Hysteria over computer viruses comes in waves.
|
|||
|
|
The hysteria is fueled, in large part, by the popular press'
|
|||
|
|
frenzied, poorly researched and consistently inaccurate
|
|||
|
|
reporting on the subject. Computer crime is not a new story
|
|||
|
|
and viruses are simply the latest plot twist. Vandals
|
|||
|
|
sending "time-bombs" and viruses into our nation's telephone
|
|||
|
|
network are akin to hackers breaking into corporate or
|
|||
|
|
government mainframe computers and scrambling data--the
|
|||
|
|
techniques they use for sowing destruction may differ, but
|
|||
|
|
their intent and results are the same. Before you hang up
|
|||
|
|
your joystick in disgust, however, realize that computer
|
|||
|
|
vandalism has been with us, in one form or another, since
|
|||
|
|
the first CRT was fired-up and will remain until the last
|
|||
|
|
disk drive grinds to a halt. In any public endeavor there
|
|||
|
|
will be an anti-social element; computing is no exception.
|
|||
|
|
In the interest of "safe computing," the question we must
|
|||
|
|
ask is "how do we protect ourselves from the ravages of the
|
|||
|
|
computer criminal and computer viruses?"
|
|||
|
|
|
|||
|
|
If you choose not to ignore the reality of computer
|
|||
|
|
viruses, there remains three ways to dispense with the
|
|||
|
|
problem: virus prevention software, virus detection
|
|||
|
|
software and safe-computing practices (which includes
|
|||
|
|
anti-virus software usage, among other things). As with
|
|||
|
|
other forms of crime prevention, virus prevention software
|
|||
|
|
products may provide an effective deterrent in some cases;
|
|||
|
|
they fail, however, when the criminal element is determined
|
|||
|
|
to perpetrate criminal acts. Most virus prevention software
|
|||
|
|
products have serious technical drawbacks users naturally
|
|||
|
|
overlook (we're not all computer scientists) and virus
|
|||
|
|
developers exploit. For example, not one of the anti-virus
|
|||
|
|
software programs on the market today can protect a system
|
|||
|
|
from a deadly disk "write" that bypasses DOS by directly
|
|||
|
|
manipulating the disk controller. Users of virus prevention
|
|||
|
|
products believe their computers are ImZ]<5D>Y<EFBFBD><59><EFBFBD><EFBFBD><EFBFBD><EFBFBD> in
|
|||
|
|
reality,`taey're sitting ducks, safeguarded only from the
|
|||
|
|
simplest of viruses.
|
|||
|
|
|
|||
|
|
Fact: it is physically impossible to prevent all
|
|||
|
|
manner of viruses from entering your system; no matter how
|
|||
|
|
many automobile alarms you may install, if the crooks want
|
|||
|
|
to steal the wheels badly enough, they will. This same line
|
|||
|
|
of reasoning remains true in the area of virus protection:
|
|||
|
|
if the virus developer is determined to breach your system,
|
|||
|
|
your system will be compromised. You can, however, detect
|
|||
|
|
viral infections almost immediately after they occur, which
|
|||
|
|
allows you to rapidly eradicate the invaders and prevent
|
|||
|
|
future infections. By employing the following "safe
|
|||
|
|
computing" measures (excerpted from the documentation that
|
|||
|
|
accompanies my CHECKUP virus detection system) and by
|
|||
|
|
installing a reliable virus DETECTION system, you are
|
|||
|
|
guaranteed a measure of security virus PREVENTION software
|
|||
|
|
can never provide:
|
|||
|
|
|
|||
|
|
* Run CHECKUP (or another reliable virus
|
|||
|
|
detection system) daily. CHECKUP provides a
|
|||
|
|
sanitary, clean floppy disk/batch file method
|
|||
|
|
that is capable of detecting any virus, past,
|
|||
|
|
present or future.
|
|||
|
|
|
|||
|
|
* Run major applications via DOS batch files
|
|||
|
|
and have CHECKUP (or another reliable virus
|
|||
|
|
detection system) perform a pre-run,
|
|||
|
|
last-minute ci<63>ck of programs about to run.
|
|||
|
|
|
|||
|
|
Using CHECKUP, for example: instead of
|
|||
|
|
typing the "WORD" command to run Microsoft
|
|||
|
|
Word, create a batch file named "WRD.BAT"
|
|||
|
|
that reads as follows:
|
|||
|
|
|
|||
|
|
CD \WORD
|
|||
|
|
|
|||
|
|
CHECKUP WORD.COM
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
CHECKUP WORD_DCA.EXE
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
CHECKUP MAKEPRD.EXE
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
CHECKUP MERGEPRD.EXE
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
CHECKUP MW.PGM
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
CHECKUP SPELL-AM.EXE
|
|||
|
|
IF ERRORLEVEL 1 GOTO EXIT
|
|||
|
|
|
|||
|
|
WORD
|
|||
|
|
|
|||
|
|
:EXIT
|
|||
|
|
|
|||
|
|
In the future, use the WRD command to invoke
|
|||
|
|
Microsoft Word. CHECKUP will examine all of
|
|||
|
|
Microsoft Word's executable files and will
|
|||
|
|
allow them to run if (and only if) they pass
|
|||
|
|
CHECKUP's scrutiny. Of course, unlike
|
|||
|
|
Microsoft Word, many applications have only
|
|||
|
|
one principal executable file to check,
|
|||
|
|
greatly simplifying implementation of pre-run
|
|||
|
|
checking through DOS batch files.
|
|||
|
|
|
|||
|
|
* Regularly check and log available disk space.
|
|||
|
|
Aggressive viruses decrease storage space as
|
|||
|
|
they spread throughout a system. This
|
|||
|
|
activity can be identified through rigorous
|
|||
|
|
monitoring.
|
|||
|
|
|
|||
|
|
The following commands, added to
|
|||
|
|
AUTOEXEC.BAT, will track disk usage:
|
|||
|
|
|
|||
|
|
CD \
|
|||
|
|
DIR >> DIR.LOG
|
|||
|
|
TYPE DIR.LOG > PRN
|
|||
|
|
|
|||
|
|
* Observe the time it takes for programs to
|
|||
|
|
load--infected files take longer. Programs
|
|||
|
|
exhibiting longer than normal load times
|
|||
|
|
might be infected (see next tip for related
|
|||
|
|
information).
|
|||
|
|
|
|||
|
|
* Scrutinize disk accesses whenever possible.
|
|||
|
|
Viruses can spend large amounts of time
|
|||
|
|
scanning directories and executable files as
|
|||
|
|
they search for new, uninfected host files.
|
|||
|
|
Programs conducting longer than normal disk
|
|||
|
|
I/O, especially during load-time, might be
|
|||
|
|
infected.
|
|||
|
|
|
|||
|
|
* Periodically re-install applications from
|
|||
|
|
their master disks. This overwrites
|
|||
|
|
application files in use and any viruses
|
|||
|
|
incubating within them.
|
|||
|
|
|
|||
|
|
* Once a week, use the SYS command to
|
|||
|
|
re-install the system files onto your boot
|
|||
|
|
disk(s). This eliminates viruses lurking in
|
|||
|
|
the boot sectors.
|
|||
|
|
|
|||
|
|
* Use the DOS "SHELL" command to rename and
|
|||
|
|
relocate COMMAND.COM to a directory other
|
|||
|
|
than the root of your boot disk. Then place
|
|||
|
|
a different copy of COMMAND.COM in the root
|
|||
|
|
directory. This may divert viruses into
|
|||
|
|
infecting the decoy copy instead of your
|
|||
|
|
actual command processor. Refer to your DOS
|
|||
|
|
reference manuals for information on the
|
|||
|
|
SHELL command.
|
|||
|
|
|
|||
|
|
* Boot from a certified clean floppy disk copy
|
|||
|
|
of your DOS master disks whenever possible.
|
|||
|
|
This insures your system is running under an
|
|||
|
|
uncorrupted operating system at all times.
|
|||
|
|
|
|||
|
|
* Change executable file attributes to
|
|||
|
|
read-only. Poorly engineered viruses may not
|
|||
|
|
be able to alter read-only files. Executable
|
|||
|
|
files are those ending in a .BAT, .COM or
|
|||
|
|
.EXE extension or loaded in CONFIG.SYS.
|
|||
|
|
|
|||
|
|
Many programs write to their master
|
|||
|
|
executable file when saving configuration
|
|||
|
|
information. If such a file has been
|
|||
|
|
converted to read-only, the read-only
|
|||
|
|
attribute must be removed before
|
|||
|
|
re-configuring and reset afterward.
|
|||
|
|
|
|||
|
|
There are many utilities that can reset file
|
|||
|
|
attributes, including ATTR.COM, available for
|
|||
|
|
downloading from the PC-Magazine Network on
|
|||
|
|
CompuServe. CompuServe users can "GO
|
|||
|
|
PCMAGNET" to download ATTR.COM. If you own
|
|||
|
|
the Norton Utilities, use Norton's FA.EXE to
|
|||
|
|
change attributes of COMMAND.COM to read-only
|
|||
|
|
using Norton's FA, enter:
|
|||
|
|
|
|||
|
|
FA COMMAND.COM /R+
|
|||
|
|
|
|||
|
|
Some versions of DOS provide an ATTRIB (or
|
|||
|
|
similar) command. Check your DOS reference
|
|||
|
|
manuals for more information on modifying
|
|||
|
|
file attributes.
|
|||
|
|
|
|||
|
|
* Use extreme caution when working with FAT and
|
|||
|
|
directory editors, directory sorters, disk
|
|||
|
|
optimizers, file movers, format-recovery
|
|||
|
|
systems, partition-related tools, un-erasers
|
|||
|
|
and other low-level DOS utilities. These
|
|||
|
|
programs manipulate critical data and one bug
|
|||
|
|
or errant keystroke can annihilate a disk.
|
|||
|
|
Additionally, DOS shells should be treated
|
|||
|
|
with care as they also handle critical disk
|
|||
|
|
information.
|
|||
|
|
|
|||
|
|
Safe bets for low-level disk management are
|
|||
|
|
the Norton Utilities, Advanced Edition, from
|
|||
|
|
Peter Norton Computing, Inc.; PC-Tools from
|
|||
|
|
Central Point Software and the Mace Utilities
|
|||
|
|
from Paul Mace Software. Among DOS shells,
|
|||
|
|
we recommend the Norton Commander, also from
|
|||
|
|
Peter Norton Computing, Inc. These programs
|
|||
|
|
are available at most computer retailers.
|
|||
|
|
|
|||
|
|
* Do not run files downloaded from public
|
|||
|
|
access BBSes (bulletin board systems) that do
|
|||
|
|
not validate users who upload. If the SysOp
|
|||
|
|
of a bulletin board did not contact you
|
|||
|
|
directly (by phone, mail or automatic
|
|||
|
|
callback), you can be certain that other
|
|||
|
|
users have not been validated. (SysOps: If
|
|||
|
|
validating users is a burden, a practical
|
|||
|
|
alternative is to validate them after they
|
|||
|
|
upload their first file.)
|
|||
|
|
|
|||
|
|
* Do not run files downloaded from public
|
|||
|
|
access BBSes where the SysOps do not test and
|
|||
|
|
approve all files.
|
|||
|
|
|
|||
|
|
* Do not run files provided by shareware/public
|
|||
|
|
domain disk distributors, including your
|
|||
|
|
local users group, where the disk librarians
|
|||
|
|
do not test and approve all files.
|
|||
|
|
|
|||
|
|
* Do not run self-extracting archives unless
|
|||
|
|
they have been tested. Self-extracting
|
|||
|
|
archives are a classic delivery method used
|
|||
|
|
by bomb developers.
|
|||
|
|
|
|||
|
|
* Beware of suspicious-looking files. A 128
|
|||
|
|
byte .COM file that un-archives without
|
|||
|
|
documentation and whose description reads
|
|||
|
|
"Great Word Processor" is suspect.
|
|||
|
|
|
|||
|
|
* Use a binary file-viewing utility (like the
|
|||
|
|
one included in the Norton Commander) to
|
|||
|
|
examine executable code. Look for suspicious
|
|||
|
|
comments and messages embedded in the code.
|
|||
|
|
|
|||
|
|
* Do not run programs unaccompanied by
|
|||
|
|
well-written documentation prepared by the
|
|||
|
|
program's author.
|
|||
|
|
|
|||
|
|
* Do not run programs that do not include the
|
|||
|
|
name, address and telephone number(s) of the
|
|||
|
|
author within the documentation or
|
|||
|
|
executable(s).
|
|||
|
|
|
|||
|
|
* Call program authors and verify the version
|
|||
|
|
number, time and date stamps, file sizes and
|
|||
|
|
archive contents of files you have received.
|
|||
|
|
!<21> Ask authors where you can get certified clean
|
|||
|
|
copies of their programs, then discard the
|
|||
|
|
copies you have and get the certified copies.
|
|||
|
|
|
|||
|
|
* Download shareware direct from the author's
|
|||
|
|
BBS. Most professional shareware authors
|
|||
|
|
provide support BBSes for their products.
|
|||
|
|
You are guaranteed uncorrupted programs when
|
|||
|
|
you download them directly from their
|
|||
|
|
authors.
|
|||
|
|
|
|||
|
|
* Do not use hacked or pirated software.
|
|||
|
|
Software pirates have the skill and the tools
|
|||
|
|
needed to create bombs and viruses. Many
|
|||
|
|
reported incidents of viral infections have
|
|||
|
|
been associated with software piracy. In
|
|||
|
|
fact, some of the deadliest Trojans have been
|
|||
|
|
modified copies of well-known applications.
|
|||
|
|
|
|||
|
|
* Back-up your system regularly! No system
|
|||
|
|
exists in a vacuum, nor is any anti-virus or
|
|||
|
|
anti-Trojan technique foolproof. Back-up on
|
|||
|
|
a daily, weekly and monthly basis. When
|
|||
|
|
disaster strikes, users who have regularly
|
|||
|
|
backed-up their systems will have the last
|
|||
|
|
laugh (and their data)!
|
|||
|
|
|
|||
|
|
If you are not using a virus detection system or you
|
|||
|
|
are using a less-than-perfect virus detection system, how
|
|||
|
|
can you tell if a virus has landed on your system and begun
|
|||
|
|
eating away at your precious data? The following
|
|||
|
|
guidelines, also excerpted from CHECKUP's documentation,
|
|||
|
|
will help you identify the viral warning signs:
|
|||
|
|
|
|||
|
|
1. Computer operations seem sluggish.
|
|||
|
|
|
|||
|
|
2. Programs take longer to load.
|
|||
|
|
|
|||
|
|
3. Programs access multiple disk drives when
|
|||
|
|
loading where they didn't before.
|
|||
|
|
|
|||
|
|
4. Programs conduct disk accesses at unusual
|
|||
|
|
times or with increased frequency.
|
|||
|
|
|
|||
|
|
5. Available disk space decreases rapidly.
|
|||
|
|
|
|||
|
|
6. The number of bad disk sectors steadily
|
|||
|
|
increases.
|
|||
|
|
|
|||
|
|
7. Memory maps reveal new TSR programs of
|
|||
|
|
unknown origin.
|
|||
|
|
|
|||
|
|
8. Normally well-behaved programs act abnormally
|
|||
|
|
or crash without reason.
|
|||
|
|
|
|||
|
|
9. Programs encounter errors where they didn't
|
|||
|
|
before.
|
|||
|
|
|
|||
|
|
10. Programs generate undocumented messages.
|
|||
|
|
|
|||
|
|
11. Files mysteriously disappear.
|
|||
|
|
|
|||
|
|
12. Names, extensions, dates, attributes or data
|
|||
|
|
changes on files that have not been modified
|
|||
|
|
by users.
|
|||
|
|
|
|||
|
|
13. Data files or directories of unknown origin
|
|||
|
|
appear.
|
|||
|
|
|
|||
|
|
14. CHECKUP (or another reliable virus detection
|
|||
|
|
system) detects changes to static objects
|
|||
|
|
(files). Changes detected to dynamic objects
|
|||
|
|
are not an indication of viral alterations.
|
|||
|
|
|
|||
|
|
Rest assured that neither you nor anyone you know will
|
|||
|
|
suffer a major data loss from a viral attack if
|
|||
|
|
safe-computing measures are implemented religiously. When
|
|||
|
|
and if a viral infection is discovered, turn your computer
|
|||
|
|
off and contact a good viral diagnostician for eradication
|
|||
|
|
advice. Do not use your computer or any floppy disks
|
|||
|
|
associated with your computer until your system has been
|
|||
|
|
thoroughly cleansed. Above all, however, enjoy computing
|
|||
|
|
and the thousands of quality public domain and shareware
|
|||
|
|
programs at your disposal. Take comfort in the knowledge
|
|||
|
|
that safe-computing techniques, employed properly, will
|
|||
|
|
serve to protect your data from harm.
|
|||
|
|
|