Computer Tips for Beginner

E-mail Viruses

Viruses that spread through e-mail have a common method of spreading. This page will discuss how common e-mail viruses currently spread.

The Virus Lifecycle

Viruses begin their life when someone releases them on the internet. They begin to spread. At this early stage of their lifecycle, no one is aware of their presence. As the virus becomes more widely spread, someone will recognize an abnormal problem with their system and investigate. Eventually a computer expert will conclude that a virus exists and notify companies that write anti virus software. The companies will research the virus and come out with an update to their database of viruses that includes information about the new virus and has information about how to recognize it. They may also release a tool that can be used to automatically remove that virus from computer systems.

Therefore the cycle is:

Release - The virus is released.

Recognition - Someone recognizes the virus.

Virus recognition database update - Antivirus programs will now recognize the virus.

Antiivirus update and removal tools

The time between step one and step three above can be significant. During this time you are vulnerable to getting the virus because your anti-virus software will not recognize it as a virus. This is why you should be careful about the e-mail attachments that you open, even if you are actively running anti-virus software.

How Viruses Work

When a victim of a virus double clicks on an infected attachment, the virus will run.

The virus will modify the victim's system so it will always be active when the system is turned on.

The virus will scan the victim's address book in their e-mail client program such as Outlook or Outlook Express.

In the past, viruses would then mail themselves to addresses found in the victim's address book. But today many viruses choose random recipients and senders from the victim's address book. This means that although the e-mail is sent from the victim's machine, the e-mail sender address is faked to appear as though someone else in the victim's address book sent the message.

What to Do

Always run anti-virus software and be sure it gets updated at least twice per week.

If you get a virus in an e-mail attachment and you are sure it is a virus, delete the e-mail message.

If you get an attachment from someone you know, consider whether there is enough personal information in the e-mail which a virus program would not know. If you are not sure your acquaintance sent the e-mail call them and be sure before opening the attachment. Do not count on your anti-virus software being able to stop you from getting infected if you open the e-mail attachment. Remember, viruses are not recognized right away by your anti-virus software and you could get a new unrecognized virus before your virus definition updates are released.

If you get an e-mail saying a message you sent was undeliverable and you did not send the message, consider whether your system is behaving abnormally. You probably do not have a virus, but if you are not sure, use your anti-virus software to perform a system scan for viruses and remove any viruses found using the procedure in the section about "Removing Viruses", then delete the e-mail.

If you get an e-mail saying a message you sent contained a virus, consider whether your system is behaving abnormally. You probably do not have a virus, but if you are not sure, use your anti-virus software to perform a system scan for viruses and remove any viruses found using the procedure in the section about "Removing Viruses", then delete the e-mail.

Example

Below is shown an e-mail from a virus as an example of how a virus writer will try to fool computer users.

From: staff@yourorganization.org [mailto:staff@yourorganization.org]  
Sent: Wednesday, March 03, 2004 4:41 AM  
To: usertofool@yourorganization.org  
Subject: Important notify about your e-mail account.    

Dear user of e-mail server "Yourorganization.org",    

Our antivirus software has detected a large  ammount of viruses outgoing  
from your email account, you may use our free anti-virus tool to  clean  up  
your computer software.    

For further  details see the attach.    

For security reasons attached file  is password protected. The password is  "22352".    

Cheers,     
The Yourorganization.org  team                   http://www.yourorganization.org

Of course there is an attachment. In this case the virus sent a zipped file (.zip) and instructed the user how to open it. It was encrypted in a zipped file so the anti-virus scanner could not detect it!

The Internet Email System

The email system that is currently used on the internet was not designed to curb the abuses presented by viruses and SPAM as they are occurring today. The email system today allows:

Anyone can set the "From" field in the email to any value they want. This means that you can send an email message and make it look like the President of the United States sent the message. There are ways to tell that this is not the case, but on the surface it will appear like the President of the United States sent the message. This is called faking the sending address.

If an email cannot be delivered, the email standard provides for the sender to receive a notification indicating that the message could not be delivered. Some email servers are also set up to notify the sender when a virus is found in an email they sent.

There are several things that the email system in use today does not provide for:

The system does not provide for positive identification of the sender.

There is no method to prevent a sender from sending unwanted emails.

Email Problems

Given the above conditions, several problems can occur.

If the sending address of the email is faked, any messages indicating the message could not be delivered will go to the person who appears to have sent the email rather than the person who actually sent it. This can cause people to receive non deliverable notifications for emails that they did not send which can be very confusing.

If a virus sends an email with a faked sender address, a mail server may detect the virus in the message and send a reply to the faked address notifying someone that they sent an email with a virus in it when in fact they did not. This can cause confusion and waste administrators time since users may call administrators and want their systems checked for viruses when they are not acutally infected with a virus. This is why administrators of mail servers should turn off notifications to addresses that appear to have sent a virus.

Someone can fake the sender of an email and send embarrassing or annoying messages and possibly jeopardize the reputation of the party they are sending the email as. They can make it appear as though a reputable party is sending smut on the internet. I do not know if there are any laws against this, but there should be. This would be called fraud along with some possible other charges such as libel and slander. There are ways to tell that the sender did not actually send the email but this could still unjustly hurt someone's reputation.

Recipients of virus or SPAM emails are unwilling recipients. These emails tie up their time and computer resources. When someone pays for a connection to the internet, and this connection is used to send them unwanted emails, this is the same as a denial of service attack and is essentially stealing. Everyone who connects to the internet has the right to use their connection haw they want and not how someone else wants. I will talk more about this in the section about SPAM.

Securing Your System

There are several measures which you can take to secure your system. The first and most important is to become informed about how your system works and what the threats are. Reading this guide and acting on the tips contained here is a good start.

Personal firewall - If you are not behind a corporate firewall, purchase and install a personal firewall on your computer. This will help protect your system from many vulnerabilities that some worms will try to exploit.

Updates - Perform system updates often. You can go to the Windows Update site to download updates for your system. Another way to get updates if your system is running Windows 2000 or Windows XP is to configure your system to download automatic updates. This can be done by opening your control panel (Click on "Start", then select "Settings", and click on "Control Panel". To configure updates double click the "Automatic Updates" icon and choose one of three configurations.

Use anti-virus software with regular updates. Be sure to run anti-virus software and download updates at least twice per week. There are many brands of anti-virus software which may be purchased at your local computer, office supply store, or on the internet. I will not be recommending any name brands in this tutorial.

Be aware of how viruses spread and don't open attachments unless you are SURE they are legitimate. Call the sender if necessary to be sure they sent the email. Be sure your system settings are set so you can recognize potential virus files that may have multiple extensions such as filename.txt.exe. If the extension ends in .exe, .com, or .bat don't double click on it or run it unless you are SURE it is from a legitimate source.

Avoid installing bad applications. As mentioned in the section about application programs, some computer programs may come with spyware or adware. Avoiding these can be important in both securing your system and keeping your system performance from being degraded. Keep in mind that adware programs may download and install other programs from the internet. A personal firewall is one defense against this happening because it will normally notify you when a program accesses the internet.