What is the difference between viruses, worms, and Trojans?
· It must execute itself. It will often place its own code in the path of execution of another program.
· It must replicate itself. For example, it may replace other executable files with a copy of the virus infected file. Viruses can infect desktop computers and network servers alike.
Some viruses are programmed to
damage the computer by damaging programs, deleting files, or reformatting the
hard disk. Others are not designed to do any damage, but simply to replicate
themselves and make their presence known by presenting text, video, and audio
messages. Even these benign viruses can create problems for the computer user.
They typically take up computer memory used by legitimate programs. As a result,
they often cause erratic behavior and can result in system crashes. In addition,
many viruses are bug-ridden, and these bugs may lead to system crashes and data
· File infector viruses: File infector viruses infect program files. These viruses normally infect executable code, such as .com and .exe files. The can infect other files when an infected program is run from floppy, hard drive, or from the network. Many of these viruses are memory resident. After memory becomes infected, any noninfected executable that runs becomes infected. Examples of known file infector viruses include Jerusalem and Cascade.
· Boot sector viruses: Boot sector viruses infect the system area of a disk--that is, the boot record on floppy disks and hard disks. All floppy disks and hard disks (including disks containing only data) contain a small program in the boot record that is run when the computer starts up. Boot sector viruses attach themselves to this part of the disk and activate when the user attempts to start up from the infected disk. These viruses are always memory resident in nature. Most were written for DOS, but, all PCs, regardless of the operating system, are potential targets of this type of virus. All that is required to become infected is to attempt to start up your computer with an infected floppy disk Thereafter, while the virus remains in memory, all floppy disks that are not write protected will become infected when the floppy disk is accessed. Examples of boot sector viruses are Form, Disk Killer, Michelangelo, and Stoned.
· Master boot record viruses: Master boot record viruses are memory resident viruses that infect disks in the same manner as boot sector viruses. The difference between these two virus types is where the viral code is located. Master boot record infectors normally save a legitimate copy of the master boot record in an different location. Windows NT computers that become infected by either boot sector viruses or master boot sector viruses will not boot. This is due to the difference in how the operating system accesses its boot information, as compared to Windows 95/98. If your Windows NT systems is formatted with FAT partitions you can usually remove the virus by booting to DOS and using antivirus software. If the boot partition is NTFS, the system must be recovered by using the three Windows NT Setup disks. Examples of master boot record infectors are NYB, AntiExe, and Unashamed.
· Multi-partite viruses: Multi-partite (also known as polypartite) viruses infect both boot records and program files. These are particularly difficult to repair. If the boot area is cleaned, but the files are not, the boot area will be reinfected. The same holds true for cleaning infected files. If the virus is not removed from the boot area, any files that you have cleaned will be reinfected. Examples of multi-partite viruses include One_Half, Emperor, Anthrax and Tequilla.
· Macro viruses: These types of viruses infect data files. They are the most common and have cost corporations the most money and time trying to repair. With the advent of Visual Basic in Microsoft's Office 97, a macro virus can be written that not only infects data files, but also can infect other files as well. Macro viruses infect Microsoft Office Word, Excel, PowerPoint and Access files. Newer strains are now turning up in other programs as well. All of these viruses use another program's internal programming language, which was created to allow users to automate certain tasks within that program. Because of the ease with which these viruses can be created, there are now thousands of them in circulation. Examples of macro viruses include W97M.Melissa, WM.NiceDay and W97M.Groov.
· If you receive an email titled [email virus hoax name here], do not open it!
· Delete it immediately!
· It contains the [hoax name] virus.
· It will delete everything on your hard drive and [extreme and improbable danger specified here].
· This virus was announced today by [reputable organization name here].
· Forward this warning to everyone you know!
Most virus hoax warnings do not
deviate far from this pattern. If you are unsure if a virus warning is
legitimate or a hoax, additional information is available at:
· Hardware problems. There are no viruses that can physically damage computer hardware, such as chips, boards, and monitors.
· The computer beeps at startup with no screen display. This is usually caused by a hardware problem during the boot process. Consult your computer documentation for the meaning of the beep codes.
· The computer does not register 640 K of conventional memory. This can be a sign of a virus, but it is not conclusive. Some hardware drivers such as those for the monitor or SCSI card can use some of this memory. Consult with your computer manufacturer or hardware vendor to determine if this is the case.
· You have two antivirus programs installed and one of them reports a virus. While this could be a virus, it can also be caused by one antivirus program detect the other program's signatures in memory. For additional information, see Should you run more than one antivirus program at the same time?
· You are using Microsoft Word and Word warns you that a document contains a macro. This does not mean that the macro is a virus.
· You are not able to open a particular document. This is not necessarily an indication of a virus. Try opening another document or a backup of the document in question. If other documents open correctly, the document may be damaged.
· The label on a hard drive has changed. Every disk is allowed to have a label. You can assign a label to a disk by using the DOS Label command from within Windows.
· When running ScanDisk, NAV Auto-Protect reports virus-like activity. The following are two possible solutions:
· Disable Auto-Protect
1. Start NAV, and temporarily disable Auto-Protect
2. Run ScanDisk and let it fix the errors.
3. Re-enable Auto-Protect.
· Change a ScanDisk option
1. Start ScanDisk and Choose to run a thorough scan.
2. Click Options.
3. Uncheck "Do not perform write testing."
4. Run ScanDisk again.
· Do not leave a floppy disk in the floppy disk drive when you shut down or restart the computer.
· Write-protect your floppy disks after you have finished writing to them.
· Be suspicious of email attachments from unknown sources.
· Verify that attachments have been sent by the author of the email. Newer viruses can send email messages that appear to be from people you know.
· Do not set your email program to "auto-run" attachments.
· Obtain all Microsoft security updates.
· Back up your data frequently. Keep the (write protected) media in a safe place--preferably in a different location than your computer.
You can contact Basic Computer Solutions, Inc. at:
Website Hosted by
BCSWeb.Net ( A Basic
Computer Solutions Company)