Skip to Content.
Sympa Menu

permaculture - Dummies guide to viruses

permaculture@lists.ibiblio.org

Subject: permaculture

List archive

Chronological Thread  
  • From: Mitra <mitra_lists@earth.path.net>
  • To: "permaculture" <permaculture@franklin.oit.unc.edu>
  • Subject: Dummies guide to viruses
  • Date: Wed, 23 May 2001 09:53:37 +1000

I'm a techie, on all these non-techie lists, I guess its time to write something useful to repay all the good advice I've received ...

Here are some simple steps you can take. These are for any of the modern Windows environments configured in the default way. In order to spread Viruses need to target your typical dumb user, who hasn't taken these steps, so if you take them you'll be protected against 99.9% of viruses.

You could probably get away with either buying Virus software (#1) or taking all the remaining steps (#2..#6) but I really recommend doing the lot. I've done all these things, and as a result have never been infected, although I see probably one virus a week in email. None of the steps below affect my ability to get work done, for example by stopping things that there are good reasons to want to do.

1: Get a good virus protection software that updates itself regularly - e.g. Norton Antivirus www.symantec.com or McAfee www.mcafee.com, PAY FOR THE SUBSCRIPTION (about $10 or $20 per year), believe me its worth the money compared to rebuilding a trashed system.

2: Open My Computer -> C:/ then choose View -> Folder Options -> View, and make sure that there is NO check mark by "Hide file extensions for known file types", this will make sure that you can see the type on files before opening them.

3: Set the correct options in the programs most commonly used with Macros
Open Microsoft Word
- if its Word2000 go to Tools -> Macros -> Security and set to High - there is almost never a reason why a document will contain Macros for a good reason.
- if its earlier versions of Word its something like Options -> General and make sure it has "Enable Macro Virus protection" turned on.
Do the same thing in Microsoft Excel, and if you have it Microsoft Power Point
There is probably something similar in Outlook - I don't use it, if you know how it works let me know and I'll update this file.

4: ONLY open something where you know the type cannot hold viruses, specifically, where the name is .gif, .jpg, .swf (flash/ shockwave) .txt and (if you've taken the precautions above) *.doc and *.xls , .html is probably OK meaning that its as safe as a web page, although people keep finding vulnerabilities there.
In particular look out for tricky things that are something like xxxx.jpg.vbs which is a Visual Basic virus pretending to be a JPG, its the letters after the last period that count.
Just because it comes from someone you trust does NOT make it safe. Once your friends machine is infected the virus can pretend to be her.
In particular do NOT EVER OPEN ANYTHING ENDING IN .EXE .VBS or .SCR these are really commonly used for viruses. There have been programs sent around as one of these which trashed systems but just looked like something fun.

5: Do NOT pass on virus warnings UNLESS they are dated, and have Links to the news story or a web page giving more information AND you have checked that link to check it makes sense. Any other Virus warning is itself a virus, passed along from dumb email user to dumb email user.

6: Update your operating system frequently, open Internet Explorer - go to Tools -> Windows Update and choose Product Updates, in particular install anything labelled a critical update or that talks about security - this is USUALLY easy.

Just in case you are interested I've attached a file listing of unsafe file extensions taken from McAfee. Note just how many there are, also note how it is a .TXT file and so cannot contain a virus, so its safe to open (if you trust me :-) This is why its better to have

Hope this is helpful, if you know what you are doing, and have suggestions for me to add to this please email me privately - mitra@earth.path.net

- Mitra
VirusScan software initially looks for viruses only in files that are
susceptible to infection. It uses a list of file name extensions to keep
track of vulnerable files. This list appears in the Program Extensions dialog
box, and is something you can edit to suit your own needs. In this list, ?
symbols represent wildcards—
VirusScan software substitutes any character for the ? so that it scans more
than one file type with similar extensions. For example, the software will
use the .XL? wildcard to look for viruses in Microsoft Excel spreadsheet
(.XLS) and template (.XLT) files.

Note: McAfee recommends that you scan your system thoroughly during your
first scan operation, or periodically thereafter, without limiting the scope
of the scan operation to these file types. This ensures that your system
starts in a virus-free condition. You can then use this list of extensions to
limit the scope of later scan operations.

Extension File Type File description
<BLANK> Any Files with no extension.
.??_ Compressed Windows compressed files.
.ARC Archive LH ARC files, older version.
.ARJ Archive Robert Jung .ARJ compressed archive files.
.ASP Macro/script Microsoft Active Server Pages files. These files
contain script commands for use with Internet Information Server.
.BAT Program DOS batch files.
.CAB Compressed Windows Compressed Application Binary or “cabinet”
files.
.CDR Macro Corel Draw document files. Later versions of Corel Draw
include a scripting language that can generate macro viruses.
.CLA Program Java class files (truncated from .CLASS).
.COM Program Command/binary image files. These common files run as
infectable executable programs. DOS and Windows system files frequently make
use of this extension.
.CSC Script/macro Corel script files. Script files can include viruses
or generate macro viruses.
.DL? Program Dynamic Link Library file; C++ dialog script files. Dynamic
Link Library files are resource files linked to executable program files.
Executable files can load viruses stored in them and run them as part of
their native code.
.DOC Macro Microsoft Word document files. These files can contain Word
Basic macros and, therefore, macro viruses.
.DOT Macro Microsoft Word document template files. These files can
contain Word Basic macros and macro viruses.
.EXE Program Executable files. Most software uses this extension to
identify files that start their command shell or program kernel.
.GMS Macro Corel Global Macro Storage files.
.GZ? Compressed UNIX GNU Gzip compressed files.
.HLP Macro Windows Help files. These files can contain executable Word
Basic or other macro code.
.HT? Script/macro Hyper Text Markup Language and related files;
Microsoft Hyper Text template files. Although they are nominally plain text,
these files can contain powerful scripting functions that act through browser
software.
.ICE Compressed ICE compressed files.
.IM? Program Image files for creating disk images.
.INI Program Windows initialization files. Although these are generally
text files, infected .INI files can cause mIRC clients to perform unwanted
actions.
.JS? Script JavaScript source files. JavaScript files can contain virus
code that acts directly on web browsers.
.LZH Compressed LHARC compressed files.
.MD? Macro Microsoft Access database, add-in, and related files. These
files can contain infectable Visual Basic for Applications macros.
.MPP Macro Microsoft Project files. These files can contain infectable
Visual Basic for Applications macros.
.MPT Macro Microsoft Project template files. These files can contain
infectable Visual Basic for Applications macros.
.MSG Macro Microsoft Mail, Exchange and Outlook message files. These
files can contain script commands that can introduce virus infections.
.MSO Macro Microsoft Office 2000 files.
.OCX Program Microsoft Object Linking and Embedding custom controls. These
files are similar to ActiveX controls and can function as harmful software in
their own right.
.OLE Program Object Linking and Embedding object files. These files are
similar to ActiveX controls. They are files created in one application to be
embedded into files created by another application
.OV? Program Overlay files.
.POT Macro Microsoft PowerPoint template files. These files can contain
infectable Visual Basic for Applications macros.
.PP? Macro Microsoft Powerpoint document and slide show files. These
files can contain infectable Visual Basic for Applications macros.
.RAR Archive RAR compressed archives.
.RTF Macro Rich Text Format files. These files serve as a common text
file format for many document files.
.SCR Program Windows screen saver files.
.SHS Program Windows shell script (scrap object) files. These files can
introduce commands that cause unwanted behavior on the host computer.
.SMM Macro Lotus AmiPro spreadsheet files. These files include macro
capabilities.
.SYS Program DOS or Windows system files and device drivers. These
executable files frequently start along with or as part of program execution.
.TAR Archive UNIX tape archive files.
.VBS Script Visual Basic script files and VBScript files. VBScript is an
implementation of Microsoft’s Visual Basic programming language. It powers
special features on many web pages, and can directly manipulate many
functions inside Microsoft Outlook and other software.
.VS? Macro Visio drawing and related files. Later Visio versions include
infectable scripting extensions.
.VXD Program Windows virtual device drivers. These are executable files
that often reside in memory.
.WBK Macro Microsoft Word backup files.
.WPD Macro Corel WordPerfect document files.
.XL? Macro Microsoft Excel worksheet, add-in, toolbar, chart, dialog
box, backup, macro, workspace, Visual Basic module, and template files. These
files can contain infectable Visual Basic for Applications macros.
.XML Script/macro Extensible Markup Language files. Although they are
nominally plain text, these files can contain powerful scripting functions
that act through browser software.
.ZIP Archive WinZip and PKZip compressed archive files.

Copyright © 1995-2000 Networks Associates Technology, Inc. All Rights
Reserved.


Archive powered by MHonArc 2.6.24.

Top of Page