ICCM '96 Session Notes

"Computer Viruses Roundtable"

Greg Slade - Computer Aided Ministry Society.

The bad news is, if you think you're immune from computer viruses, you're probably already infected without knowing it. The good news is, if you're afraid that a computer virus will bring your system crashing down in flames, you may already be infected without even noticing it.

Viruses are only one of many threats to the data on your computer. In the business world, the rule of thumb is that the data in your computer -- in terms of the cost in labour to re-enter it, if you can find it at all -- is 25 times the cost of the hardware itself. Many things besides viruses can affect your data, from human error to cosmic rays to blackouts to theft to fire to earthquake to nuclear strikes, so the most important thing you can learn in computing is to backup your data.

I should say, though, that computers are only tools. Where completely losing every computer resource would put a company out of business, it should only slow a ministry down. All I really need to preach a sermon is a Bible.

Basically, whether we are talking about computer viruses or biological viruses, the definition of a virus is:
an entity which makes use of the resources of the host to replicate itself without informed operator consent.
Viruses are related to "Trojan Horse" programs, which were designed to do damage to your data, while claiming to be something useful. Probably the most famous example of that is the program which claimed to be a new version 3.0 release of PKZIP. (The current version of PKZIP is 2.04g.) But not all viruses are intended to cause harm. Some are intended to be harmless jokes, and some were even intended be be "good", like the "MacMag" virus which flashed a message of "World Peace" on the screen, and then deleted itself. But even a virus which was intended to be benign can cause harm on your system due to a combination of factors which the virus author did not anticipate. The majority of viruses were intended to be benign, and are the electronic equivalent of spray painting grafitti on the wall of your house. Virus authors are neither monsters nor mental giants, just people who have a moral blind spot when it comes to making changes to other peoples' computers without their permission.

One of the persistent myths about viruses is that as long as you stick to commercial software, but every major operating system (with the possible exceptions of Pick and CP/M) has had at least one major software vendor which has been infected without their knowledge, and sent out infected disks to users, so you need to check every disk you stick into your machine, no matter where or who you got it from.

In essence, computer viruses are a case of applied human psychology: if you get a disk or a program from a trustworthy source, then it must be okay, right? But the whole point is, people pass on viruses because they don't know they have them.

Anti-Virus software comes in various forms:

• Memory resident activity monitors
  These check all activity on the machine and request the user to confirm an action where something happens which viruses normally do (eg change an executable, direct writes to disk).
• Signature scanners
  These look for the characteristic identification of known viruses, eg "Stoned" has "Legalize Marijauna" embedded in the code. They scan memory and hard disk, but can only find those viruses which they know about. They may also identify files as being infected when they just happen to contain the signature of a known virus.
• Heuristic scanners
  These look at all the programs on your system and try and work out what it is trying to do. Anything it thinks is questionable will be reported to the user. Typical activity in one class of virus is to modify itself, so programs whch are self-modifying will be reported.
• Change detection software
  This will create a signature for each file, based on size, checksum, CRC, or some other test (or combination of tests) for each program file on the system, and reports any changes when the system is next checked. Note: You must run this kind of program regularly for it to detect any changes which might have been made to your system by viruses.
• Boot sector checker
  This checks your boot sector as the machine boots up, before the operating system even loads, and will intercept and deny all attempts to write to your boot sector. In the DOS/Win world, Integrity Master is a good example.

Recommendations:

• Make backups and keep a copy offsite. One church had their computer and data disks stolen, and it took six volunteers six months to replace the data, and some of it never was recovered.
• Always write protect a floppy disk before using them in your computer -- your system may be infected without your knowledge, and infect that floppy the moment you read it.
• Get good anti-viral software before you have a problem, and use it. I have seen users who had zipped up copies of F-PROT on their machines, and thought it was protecting them. The best software in the world can't help you if it's not running.

  DOS/Win: If you have MS-DOS 6.0 or later, you already have Microsoft AntiVirus. Go ahead and use that, but in addition, pick up one of F-PROT, McAfee, or ThunderByte. If you have Novell DOS 7.0, use Search & Destroy, which comes bundled with it, and add one of F-PROT, McAfee, or ThunderByte.

  MAC: Gatekeeper, Disinfectant, and Symantec Anti-Virus together should give you pretty good protection.

  Up until last year, about 60% of virus infection were caused by the "Stoned" virus or descendants like "Michaelangelo." Nowadays, about 70% of infections in the commercial world are caused by Macro viruses. So a good signature scanner will protect you from the vast majority of the problems you will face today.

  Use at least two different virus virus packages. (Note that Microsoft AntiVirus is licenced from Norton, so running MSAV and then NAV is more like running the same package twice than like running two different packages. Also note that the activity montior in Microsoft AntiVirus can be disabled by a virus without your knowledge with only 7 bytes of code so do not rely on it. It is still better than nothing, but get something else to supplement it.)

• Put aside any infected disks, and mark them clearly. Then give them to a reputable virus expert for analysis. (For example, roberts@decus.ca)
• Do not leave floppies in your machine. A boot sector virus can load even from a "blank" floppy, and then infect your hard disk when you boot. If you accidentally boot your machine with a floppy in the drive, remove the floppy, power off your machine, wait until the hard drive spins down, and then power up again.
• Once you are infected you need to get one of the anti virus packages with a disinfecting module. You then need to check each system, and each floppy in your system. Good and regular backups are essential. People are generally more threat to data than viruses.

Call 1-800-SPRINGER to reach Springer-Verlag, and ask for the Second Edition of Robert Slade's Guide to Computer Viruses which includes a chapter on what do to if you get infected, and has a diskette with anti-virus software in the back of the book. I strongly recommend this book.

Where to find antivirus software:

http://www.coast.net/cgi-bin/coast/dwn?msdos/virus/ ftp://mirror.apple.com/mirrors/Info-Mac/_Anti-Virus/

Presented by Greg Slade, Computer Aided Ministry Society.

Back to ICCM '96 Program