TCS - So, Your Computer Has a Virus? What Now?

So, Your Computer Has a Virus? What Now?

by Ira Wilsker
Golden Triangle PC Club
From the October 2002 issue of the I/O Port Newsletter

With the recent proliferation of computer viruses infecting more computers than ever before, cleaning computers of viruses has become a more common activity. As with any virus, biological or digital, prevention is the best defense. Many times in this column, I have preached about the importance of having antivirus software installed, properly configured, and frequently updated. I have been on my soapbox warning computer users to “practice safe hex” when opening email, using floppy discs, installing software, and visiting websites. I have pleaded to the users of Microsoft products, especially Outlook and Outlook Express, to frequently use the “Windows Update” feature, integral with all recent versions of Windows, to download and install the “critical updates” that Microsoft frequently releases. These patches contain updates intended to close some of the many security holes found in Microsoft software. In this column a few weeks ago, I recommended to readers that they should strongly consider using email software other than the virus targeted Outlook and Outlook Express. Also, in several recent columns, I emphasized the utter importance of keeping current backups of all critical software and files, repeating the ubiquitous three most important words in computing, “backup, backup, and backup”. If, despite following the above rules, your computer were to become infected with a virus, worm, or trojan, there still may be hope of restoring your computer to its prior condition.

Reiterating the message above, as computer viruses become more virulent, and often carry deadlier payloads than many of their predecessors, as well as propagate themselves at geometric speeds and frequency, the best defense is still good antivirus software, installed, properly configured, and updated very frequently. Almost all antivirus software has the capability to create a bootable rescue or emergency disc. Virtually every antivirus title I have installed on computers over the past several years offers the user the chance to create a rescue disc at the time of installation. Many products also periodically remind the user to create an updated rescue disc. These warnings should not be ignored, as a bootable antivirus recovery disc is often the only quick and easy way to recover from many types of viruses, such as the very common boot sector viruses. If you do not have a bootable antivirus disc, create one now! Not later; now! On most antivirus software, the creation of the rescue disc is listed under “tools” or “options” on the menu bar. While most antivirus software automates the process, it still takes the user to insert the floppy into the drive so the software can create the rescue disc. One warning; be sure to move the little tab on the disc to write protect it, so viruses on a hard drive cannot infect the floppy. By booting off of the rescue disc, cleaning utilities can be run, often making the computer at least bootable from the hard drive, and allowing Windows to load.

Just as the antivirus software itself needs very frequent, if not daily, updating in order to provide maximum protection, rescue discs also need to be recreated or updated periodically, to include the latest appropriate data or virus signature file information. Some software publishers, such as McAfee, offer online rescue updates to their software users. McAfee’s EMDATS.ZIP or EMSCAN.ZIP files, available on the same web page as their DAT file updates, contain the critical files necessary to detect and kill boot sector viruses that may prevent a computer from booting off of the hard drive. Norton, and other publishers, offers similar utilities. An updated rescue or emergency disc may make it quick and easy to get some infected computers back in service.

If infected, but still capable of getting online, the free online virus scans are an excellent way of removing most computer viruses. As has been written here several times before, housecall.antivirus.com and www.pandasoftware.com web sites both offer an excellent and free online scan. While Panda requires that only recent versions of Internet Explorer be used to run the scan, the housecall site allows either recent version of Internet Explorer or Netscape to be used. Please remember that while the online scans may be very good at removing existing viruses, they offer no continuing protection against future infections, and should not be relied on to protect from anything.

If the virus infection can be positively identified, then one of the many free virus-specific utilities available may be able to kill the infection. Companies such as Symantec, publisher of Norton Antivirus, have a variety of free “virus removal tools” available on their website at www.symantec.com/downloads. Similar free tools are available from Panda’s “Repair Utilities” link at www.pandasoftware.com. Most of these utilities are designed to be run from a bootable floppy, and not from within Windows.

Many of the most nefarious viruses literally destroy critical files. While some destroy data files, the most common targets are critical system files, which, if destroyed, render the computer unusable until restored. Contrary to popular belief, it is not always necessary to reformat the hard drive, destroying both the good and bad files. If the virus infection can be removed using the free standing utilities or a rescue disc, then damaged system files can be restored from either the operating system CD, the computer manufacturer’s recovery CD, or the backup set that should have been created before disaster struck. Destroyed data files are a different story, as their only hope of recovery is from the often-mentioned backup set.

All too many of us know the grief and hardship created by computer viruses. What is especially sad is the economic damage done to businesses by these high-tech vandals. One recent report states that domestic businesses spent an estimated $12 billion repairing virus damage last year, and that many critical but unrecoverable data files were lost. Imagine what cost and hardship may have been avoided if antivirus software had been properly installed and updated, and if current backups had been available.



For more information on the Tulsa Computer Society click here



Tulsa Computer Society 10/02/2002
Don Singleton, President