On The Net - Computing News

with Chris Goh

Viruses: Part III - Killing them

If you've been infected by a virus, killing it - depending on the strain - is not easy.

To simplify things, I've categorised the four main types of viruses - Boot Sector Viruses, Operating System Viruses, Application Specific Viruses and Java Viruses. Some fall into all four categories.

A Boot Sector Virus (BSV) is created by people who know their stuff. They're less of an issue in recent years because later versions of Windows have better memory protection. A BSV strikes your hard drive at the lowest level, so propagation happens even before you launch windows. Formatting your hard drive will not necessarily clean it. You need partitioning software and to perform a Master Boot Reset, so it's better left to an expert. Anti-virus software offers varying degrees of success, they will detect current variants but may not be able to kill them. Generally for peace of mind, most packages wipe the machine clean and do the reset. Boot Sector Viruses tend not to affect documents so backup all your documents, and go ahead and reformat your drive. You are more likely to catch these viruses if you have an earlier version of Windows.

Operating System Viruses are one of the most potent forms and the latest example, LoveSan, exploits faults in Microsoft Windows 95/98/2000/XP. The main attacks include making your PC unable to load, using your PC to attack others and/or allow people to remotely control it. If you're infected with this type of virus your only real hope is to try killing the virus using either a boot disk (mentioned later) or loading Windows in Safe Mode.

To load Windows in Safe Mode, press F8 on the keyboard as the machine is booting just before the Windows logo comes up. Safe Mode disables any third party services and drivers when windows boots. For the virus, this is like denying it food to propagate. This is the best and most effective mode in which to run your Virus scanner if you are infected. If you haven't loaded an anti-virus program, this is also the safest mode to load it whilst you are infected. This should also be the first step you take if you're attempting to kill a virus. Make sure that you don't load any other programs.

Application Specific Viruses use bugs and flaws in a program to execute a virus. Often they are called Macro Viruses because they use extended code in an application to propagate themselves. The majority target Word, Outlook and Internet Explorer (Even on the Mac!). Melissa and Love Bug were classic examples of successful application viruses. They tend to repetitively execute small routines in an attempt to bring down services and make your computer unable to respond. Though they vary, the majority attempt to propagate by sending instances of themselves through your email program. The simplest way of checking if you have such a virus is to look at your sent items (preferably offline if you can) and see whether any emails have been sent that you didn't initiate, and if there are many with the same subject line.

Whilst these infections can be cleaned up relatively simply by your anti-virus package, it is often safer to reboot in safe mode before doing so. They usually don't damage your operating system, but your documents may be deleted or corrupted if they are infected.

Another strain of Application viruses target ICQ and P2P software. These are online chat programs and software/music sharing type programs. You download what you think is a self-extracting file with music or pictures and suddenly everything slows down. Avoid whenever possible self-extracting files. If you are downloading music, make sure you don't open it in the P2P or chat software but attempt to open it in the program it was intended for, eg your MP3 player. If your music player can't open the file, it may be any of the viruses mentioned here.

Java Viruses are devious programs that assist adult sites to increase their hits and also transfer information about you to others. They often send you popup ads and can also expose your hard drive's contents to others. The majority are not true viruses, but unsolicited code, which is loaded onto your machine when you surf the web. I mentioned how to avoid them last week, and only an appropriate virus killer can really kill them adequately. There are other free software packages that can kill them, but once you're infected, often the only thing you can do is uninstall all your web browsers, delete your internet cache and re-install. Even that is not guaranteed to work in Windows XP or 2000 because Microsoft has made the Internet Explorer so integral a part of the operating system. There is more scope here in the future to do more damage, so beware.

Virus killing tools

Like a fire extinguisher, you should always have certain things handy if and when a fire/virus breaks out. Here is a quick list and explanation.

Recovery Disk:

This is the main reason that many people buy brand name computers (Dell, Compaq, etc). A recovery disk is supplied by the vendor to enable your computer to be restored to its original factory software. If you have added new hardware since you first bought your computer, make sure you have the driver software for each item of hardware to restore your computer to full usability. Recovery disks tend to wipe your whole machine clean, so back up all your files before using one.

Drivers:

If you have upgraded your machine, make sure that you keep all your drivers, for instance, your Video Card, Sound Card and Printer software. If your vendor says it's on your machine, make sure you get the original disks or CD because you never know when you will need them.

Boot Disk for Windows:

Allows you to start your computer again from either a CDROM (if your computer supports it) or floppy disk. You can format a disk so it is a system disk, but if you need more information contact me.

Your Original Windows Disks or CDs:

This goes without saying. All your Windows Disks and Software applications should come with your machine when you purchase it. Keep these handy always.

Website of an Antivirus Vendor:

Always keep this handy in your bookmarks because you may need to download software from either your PC or a friend's (if yours has become inoperable!)

Backup device: Preferably a USB Memory Stick or CD-Rewritable/ Second Hard Drive:

This is the one most forgotten. You should have backups of your data, especially your documents. If you don't and you get a virus you need to act fast. On all latest PC's they have things call USB slots and USB memory sticks are the quickest way of quickly saving documents etc on another media (make sure you check for infections).

Like any medication see your doctor if pain persists. The above suggestions are by no means comprehensive but can help you act quickly, and sometimes first aid can save you a lot of money later. I have tried to simplify what is a growing and difficult area in computing. Even anti-virus vendors admit they are struggling to react to the ever-increasing number of strains.

• Next week, clever hoaxes and easy ways to spot and deal with them.