Fighting viruses a never-ending battle

Web Extras: Marketplace, Bridal, Headlines by Email, Postcards

Fighting viruses a never-ending battle

Thursday, May 11, 2000

By David Radin

Q: If corporate computing people know so much about what they're doing, why did so many companies get hurt by the recent "Love Bug"?

A: The battle against computer viruses and other terrorist attacks on our systems is an ongoing battle. In every skirmish, the corporate Information Technology (IT) professionals find out about a threat, take action to prevent or cure the problem, then wait for the next threat to arrive. As soon as a threat becomes evident, likely, or in some cases even remotely possible, IT people take their next steps; but it's often after the problem has already taken hold. The recent computer worm

Ask Your Questions
Have a question for David Radin? Contact him at his Web site

known as the "I Love You" virus spread so fast that much of the world was infected within a day of the first appearance of the worm. Unfortunately, that was much too fast for corporate IT managers -- or individual users -- to react. I spoke to dozens of companies that were infected the first day, many of them with thousands of employees. Since it takes time for that many employees to be properly warned, many IT people decided to simply shut down their mail servers while the problems were being handled -- a very smart move because it contained the problem by decreasing its spread. This particular worm made the problem especially difficult to contain because it set itself up to reinfect under certain conditions.

The "I Love You" virus used a technique that came to public attention last year when the Melissa virus stole 50 e-mail addresses from the address books of the infected computer and self-mailed infectious messages to those addresses. The more recent attack, though, stole the entire address book -- not just 50 names -- making it spread more quickly. Plus, it infected files that could be accessed by others on corporate networks, such access infecting whichever computer accesses the infected file.

Taking Precautions

While lots of people were affected by the "I Love You" virus, many escaped unscathed, probably because they used certain tactics to protect themselves from viruses.

First, make sure that your system is loaded with anti-virus software, such as Norton Anti-virus or McAfee ViruScan. Then update it often (at least monthly) with new virus definition files. If you hear of a contagious virus going around, immediately update your virus definition file. This is a very important step because if you downloaded a new virus definition file on the Wednesday before "I Love You" hit, you would not have been protected; but you would have been if you downloaded it the following Saturday. Most anti-virus software comes with a six-month or 1 year free subscription to virus definition updates.

As soon as you install your anti-virus software, update the virus definition file, then scan for viruses. Set up your anti-virus software to automatically scan periodically (let's say weekly), and enable its auto-protect feature. If your anti-virus software protects e-mail, make sure that you set up every e-mail account to be protected; and whenever you add a new e-mail account, include it in your anti-virus protection options. You can optionally set up your anti-virus software to update the virus definition file and/or scan for viruses automatically on a set schedule.

Even if you have anti-virus software, you can take additional precautions -- most of which need only common sense. Most importantly, do not open attachments that you were not expecting -- even if they come from a friend. Viruses and worms often spread via e-mail attachments, and many of them disguise themselves as friendly messages when they steal your address from your friend's address book. If you see an attachment from a friend that you had not expected to receive, ask your friend whether he actually intended to send it to you. Otherwise, delete it.

Patrick Martin, director of product management for Symantec's Anti-Virus Research Center, tells me it is not a bad idea to set up your e-mail software with a rule to automatically delete e-mail with certain types of attachments or those that meet the characteristics of known virus spreading messages. (I have posted instructions at www.InsiderRadio.com on how to set up such a rule in Outlook Express.) While your anti-virus software should catch most virus- spreading messages, this may help catch the few that get through. Plus, one of my listeners recently reminded me that you should frequently empty your recycle bin to make sure that you don't inadvertently set off a virus-carrying file that you had previously attempted to delete.

David Radin is host of the nationally syndicated radio show Internet Insider, a local version of which is aired on KDKA AM 1020 on Saturdays at noon. You can ask him a computer or Internet question by following the instructions at www.post-gazette.com/interact, where you can also find an archive of his previous Q&A columns.