|
Archive-name: computer-virus/mini-faq
Posting-Frequency: Every 7 days See reader questions & answers on this topic! - Help others by sharing your knowledge
-----BEGIN PGP SIGNED MESSAGE-----
ALT.COMP.VIRUS Mini-FAQ (version 1.2)
Last updated August 23, 1999
Maintained by George Wenzel <gwenzel@telusplanet.net>
Messages asking for help posted to alt.comp.virus are more likely to
receive a useful response if they conform to accepted standards of
civility. The news group news.announce.newusers includes information
on good newsgroup etiquette.
Don't reformat, low-level format, or use FDISK in an effort to remove
a virus. Using DOS utilities to remove viruses is not necessary.
Especially do not use FDISK unless you know EXACTLY what you're doing;
you could lose access to your hard drive. It is always preferable,
if at all possible, to use an anti-virus product to remove a virus. If
anything, it's safer.
Please, don't just ask "I've got a virus, can anyone help me?"
When asking for help, the more relevant information you give,
the more help can be returned. It helps to:
* Run more than one anti-virus program. Anti-virus programs do false
alarm once in a while (some more than others).
* When reporting the output of anti-virus programs, please list them
(name and version number), and say what each one said about the
possible virus. Posting the exact output can be helpful.
* Please consider the possibility that whatever you are seeing might
not be a virus. Many system problems are not virus related.
* Note that you cannot catch a virus simply by reading certain e-mail
or newsgroup messages. For a virus to spread, infected code must be
run.
Basic answers to common questions:
1) The following "viruses" are in fact hoaxes (warnings about viruses
that do not, or cannot, exist):
* "Good Times"
* "Deeyenda Maddick"
* "Irina"
* "Penpal Greetings"
* "Join the Crew"
* "Returned or Unable to Deliver"
* "NaughtyRobot".
* "It takes guts to say Jesus"
* "Win a Holiday"
As a general rule, any "Virus Warning" that you receive unexpectedly in
your e-mailbox that asks you to pass the message along (similar to a chain
letter) is highly likely to be a hoax. Information about these hoaxes
and more can be found at the Computer Virus Myths Website:
http://www.kumite.com/myths/
2) Many people have asked why alt.comp.virus is decidedly anti-virus
in nature. Because of the large proportion of anti-virus producers and
end users in the group, viruses are considered to be poor use of computer
resources, and the open distribution of them to be irresponsible.
Binaries are not welcome in UseNet discussion newsgroups. Alt.comp.virus
is a discussion newsgroup, so the posting of binaries is often met
with opposition and complaints to ISPs. Alt.comp.virus exists for the
discussion of computer viruses, not their distribution.
The majority of a.c.v. readers do not want virus source code or binaries
to be posted in this newsgroup. Should you post such material, you should
be aware that some of those readers will complain to your ISP about it.
For your own sake, check your ISP's policies regarding posting such material
to newsgroups before risking your account.
3) There is no such thing as the "best" anti-virus software. Everybody
has different criteria for quality, and different products excel in
different areas. It is more important to get a reasonably good anti-virus
product and to use it often than it is to worry about having the absolute
best anti-virus product. For maximum protection, it is generally
recommended that more than one kind of anti-virus program be used.
Scanners are generally used as a front line defense, but they must be
updated regularly. Generic anti-virus programs can be of use since they do
not need updating as often, and they can catch new viruses that a scanner
might miss.
Independent comparative reviews can be found at the following sites:
_Virus Bulletin_ http://www.virusbtn.com/
_Secure Computing_ http://www.westcoast.com/
University of Tampere http://www.uta.fi/laitokset/virus/
University of Hamburg ftp://ftp.informatik.uni-hamburg.de/pub/virus/
and http://agn-www.informatik.uni-hamburg.de/vtc/naveng.htm
4) Before claiming that a "good" virus exists or could exist, it would
be wise to read Vesselin Bontchev's paper "Are 'Good' Computer Viruses
Still A Bad Idea", available at:
ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/viruses/
5) There are no viruses which damage hardware by modifying how the
mechanical parts run or their electro-magnetic characteristics. There
*are* reported instances of specific hardware being damaged by the
misuse of specific software. No known viruses damage hardware,
and despite many suggestions to the contrary, it is unlikely that
one will ever exist.
That said, there is a virus (CIH) which corrupts a system BIOS, which
is not hardware damage, but is as difficult to fix. With a corrupt BIOS,
it is not possible for the system to start; the BIOS chip would need to
be returned to the factory to get re-programmed. Hardware write
protection of the BIOS should be used whenever possible, as should current
anti-virus software.
6) Testing your anti-virus program with a real virus is not generally
a good idea. Most reputable anti-virus packages will now trigger an
alert if they scan a file beginning with the following text:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
To make this file, copy the above text string into a text file using
the DOS edit program or Windows Notepad, and save it with a .com extension.
Virtually all Windows anti-virus programs and commercial Macintosh
anti-virus programs can recognise this test file. Running the file
displays the text "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!". Most people
in the anti-virus community consider "virus simulators" unnecessary
and unsuitable for testing proper installation of anti-virus products.
7) There are answers to other frequently asked questions and more
details in the other virus FAQ's. They are available at various sites,
but most of them are available at:
http://www.sherpasoft.com/acvFAQ/
and
http://www.faqs.org/faqs/computer-virus/
8) Before you ask about what a specific virus does, try:
http://www.drsolomon.com/vircen/enc/
http://www.datafellows.com/v-descs/
http://www.avpve.com/
http://vil.mcafee.com/villib/alpha.asp
These sites have reasonably-comprehensive virus databases. Be aware,
though, that there are many thousands of viruses and descriptions are only
available for the more common ones. Also, keep in mind that different
anti-virus products may use different names for the same virus. Project
VGREP is a virus name cross-referencing service which allows you to find
out what name is being used for a virus by different anti-virus products.
Project VGREP is available at http://www.virusbtn.com/VGrep/
Disclaimer:
The authors accept no responsibility for errors or omissions, or for
any ill effects resulting from the use of any information contained in
this document.
Copyright Notice:
We made this information freely available, and maintain it. Please
don't abuse our work by using it for profit without getting permission from
the FAQ maintainer.
Copyright (c) 1999
Contributors:
Bruce Burrell, Graham Cluley, David Harley, Gerard Mannig, A. Padgett
Peterson, Robert Slade, Dr. Alan Solomon, and Pierre Vandevenne.
Special thanks to those out there that thought this work was worth
something, and decided to send the maintainer a thank-you.
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.1 for non-commercial use <http://www.pgp.com>
Comment: PGP Key ID 0xDCC35C75 available on Keyservers
iQCVAwUBN8IYhrcpzG7cw1x1AQElxgQAkwQdMsIyzTOMOEXCX2WTgkxKx12TAZnz
h/3Ma3O96Pla7yJo6W2N6n6OgrwZxmBFZ0CWaY9gnjNL+AU+m9K5shPaLm0j9zcC
G394eudklIWy37349wxvGq+JB/kbcL6TFLCCjKtrDIK+syGPQ71iyqlkAwAy6ROD
cI87IkIyGd0=
=Nlvt
-----END PGP SIGNATURE-----
User Contributions:
[ Usenet FAQs | Web FAQs | Documents | RFC Index ]
Send corrections/additions to the FAQ Maintainer: George Wenzel <gwenzel@telusplanet.net>
Last Update March 27 2014 @ 02:11 PM
|
Comment about this article, ask questions, or add new information about this topic: