Virus Hunters

Virus Hunters<@VM>Inoculate your computer system with one of these antivirus products and some common sense

Computer attacks have became increasingly devious over the years, but antivirus software is wise to their wily ways


It has been 12 years since the first real Internet virus scare. On Nov. 2, 1988, Cornell University graduate student Robert Morris unleashed a 'worm' program that used e-mail protocols to propagate itself across the Internet.
It was a sophisticated program, written in c, and its primary effect was to slow Internet e-mail to a crawl.

The Morris worm was a mere sneeze compared with what the latest crop of malicious programs has done to computer systems worldwide in the last two years.

First, there was Melissa. Then in May, a computer student at a vocational school in the Philippines unleashed a worm of his own. This time, the program was written in Visual Basic Script, disguised as an e-mail attachment, a love letter.

And it did a lot more than just slow down Internet message delivery. It destroyed data on infected systems and brought countless corporate mail systems to their knees. Because of a lack of laws criminalizing computer vandalism, the suspected author of the Love Bug was never prosecuted. A series of copycat viruses, essentially modifications of the original ILOVEYOU worm code, continued to attack computer systems throughout the rest of the spring and summer.

With the world increasingly linked by the Internet, and with tools making software development less difficult, the potential threats to computer security have grown exponentially over the last few years. And recently, the number of incidents of politically motivated Internet attacks has increased dramatically.

Diagnose the problem

There are two widely used methods of detecting malicious programs. One is recognizing a known virus' signature, or code pattern. The other is identifying malicious behavior by a program and isolating it.

Signature-based scanning uses pattern recognition software to identify malicious code or files infected with a virus. The software examines the binary structure of a file and checks it against a database of the patterns of known threats. When the scan results in a match, the software can identify the problem file and isolate, repair or delete it.

The Lowdown

  • What is it? A virus hunter, more commonly referred to as antivirus software, detects and either removes or isolates a virus, or piece of malicious code.

  • How does it work? Most antivirus programs work one of two ways, either
    by scanning for the signatures or code patterns
    of known viruses, or by scanning for suspicious behavior.

  • Why do you need it? If your system receives information from any source other than your own keyboard'whether via e-mail, the Internet, dial-up connections, floppy disks or any other source'it is vulnerable to attack. Antivirus software is essential to ensuring that you protect your data.
  • When might you not need it? If it's 1960 and you have a closed, mainframe, stovepipe system, you're probably safe. Otherwise, see above.

  • Ballpark price? Prices vary depending on such factors as the type of product and number of users, but most average between $20 and $70 per user.

  • Must-know info? You are never finished protecting your system from attack. Once you have selected and installed your antivirus software, you should be sure to update the software at least every few weeks. Some vendors provide automatic updates, others make Web downloads available.

  • Signature scans work extremely well with known viruses but often can be easily circumvented by new threats. These programs are heavily dependent on frequent and timely updates from the software's manufacturer.

    Fortunately, most software packages that use signature scans support automated downloads from the Internet of updates to their databases. But in some cases, the software must be restarted after the updates are downloaded'not always an acceptable option if the protected system is a server.

    Symantec Corp. deals with this issue in its Norton AntiVirus Corporate Edition 7.5 by separating the scanning engine from the rest of the software architecture, allowing new definitions and software updates to be loaded without a restart.

    Behavior-based, or heuristic, scanning is a bit more complex. Rather than looking for specific known viruses or malicious applications, it watches for suspicious activity by a program, intercepting any application code that performs actions that could be damaging to the operating system. This can offer a high level of protection, but it can also be intrusive to system users.

    Also, some heuristic scans still depend on signature files to identify virus-like behavior with a specific threat, so they might not act against new threats that behave in ways the scans don't expect. This happened with ILOVEYOU, which many antivirus products did not immediately perceive to be a threat because it was a script-based attack and ran within a trusted application'Microsoft Outlook.

    On the defense

    Also essential to defending against viruses is the matter of where to catch them. Most virus protection programs traditionally have run on the desktop computer. This approach was fine when the main point of entry of viruses was through infected floppy disks, and it still offers a great deal of protection to individual users. But more layers of defense are required for an Internet-connected network.

    The first line of defense for most networks is at the entrance'the firewall or Internet mail gateway. Some firewall products can screen for malicious code in Simple Mail Transfer Protocol message packets before letting them on the network, preventing infection of systems from the outside.

    Firewall packet screening can be effective against already identified threats, as it is almost always dependent on pattern recognition. It also works well in blocking viruses and other threats coming in over nonmail protocols like File Transfer Protocol and Hypertext Transfer Protocol.

    It's all in the content

    Another type of interceptor, usually running on the mail relay server or on a groupware server, is a content filter. It can check for specific attachment types and quarantine them, preventing them from being delivered.

    Trend Micro's InterScan, for example, provides behavioral analysis and signature checking for not just SMTP but FTP and HTTP as well, to block both viruses and malicious Java and ActiveX Web components in Web pages before they even get on the network.

    Another effective point of defense is the organizational mail or groupware server; protecting this point can prevent infected files from entering from outside the organization or being propagated internally if brought in through other means.

    Some antivirus products integrate directly with groupware products such as Lotus Domino and Microsoft Exchange, screening attachments to mail messages.

    With large client installations, reporting is an essential part of catching attacks early. Reporting can help set up protection against new threats before they spread. Some products, such as Symantec's Norton and Network Associates' McAfee, offer a central console from which administrators can control how the product is deployed and check activity logs and other reports from client systems.

    But just as important as any virus protection product is applying rigorous administrative policies to networks and teaching users to apply a little common sense.

    By now, users should know the danger of opening an unknown file type. But every day, it seems another user double-clicks on yet another version of a script virus and launches yet another barrage.

    User education is very important to ensuring that the threat from viruses, malicious code and other attacks on system security are maintained at a level that can be managed by the safeguards put in place.

    Kevin Jonah is a network manager and free-lance technology writer in Maryland.

    CompanyProductType of productDetection methodPlatformsUpdate serviceChecks e-mail attachments before launchDetects script files in e-mailWarning before launching scriptsDeployment toolsPrice
    GFI Fax & Voice USA
    Cary, N.C.
    MailEssentials for Exchange/SMTPE-mail security, content gateway that removes all types of e-mail threats before they are delivered to usersContent screeningNT, Win 2000AutomaticYesYesQuarantines script files and inline scriptsDeployed at mail server$275 up for 10 users; government discounts available
    InDefense Inc.
    Santa Cruz, Calif.
    Achilles' ShieldBehavior-based intrustion detectionAnalyzes any unknown code, alerts users of intrusive tendencies, can certify good known codeNT, Win9x, Win 2000Not required; upgrades availableYesYesYesNetwork administration program with log-in scripting$29 per user, $1,500 for 100 users; $2,500 for 1,000 users
    Network Associates, Inc.
    Santa Clara, Calif.
    McAfee Active Virus DefenseScans for viruses at Internet gateway, groupware server, file server, desktop PC and PDAScans for known viruses by signature and by heuristic analysis of the codeNT 4.0, Win9x, Win 2000, WinCE, Palm OS, NetWare, Unix, Linux, Microsoft Exchange, MS-DOS Lotus DominoAutomatic, with options for scheduling and for selecting download locationsYes; also checks them before they reach recipientYes, at the Internet gateway e-mail serverNoThrough McAfee ePolicy Orchestrator, or through software deployment tools such as Microsoft SMS$70 up per seat for 2-year license; PC and PDA $105 up per seat for perpetual license; both prices 50-100 users; discounts for larger volumes
    Roxio Inc.
    Milpitas, Calif.
    GoBack Enterprise Edition 2.23A system-undo software package; does not screen for viruses, but can return a system to pre-virus stateNoNT, Win9x, Win 2000, Win MeUpdates on Web siteNoN/ANoNetwork installation$63 for 1 user; $265 for 5; $487 for 10; $2,095 for 50 $3,832 for 100 $14,995 for 1,000
    Sophos Inc.
    Wakefield, Mass.
    Sophos Anti-Virus (OS-based)SWEEP provides on-demand and scheduled virus checking of files on file servers or workstations; InterCheck provides local on-access virus-checking on workstations and server-based on-access virus-checking for networked workstations; Sophos Anti-Virus Interface allows third-party software developers to integrate their firewalls, gateways and similar applicationsScans for known viruses by signature, using file scanning and pattern recognitionFor servers: NT, Win 2000, NetWare, OS/2,Unix, OpenVMS; For clients: Win9x, NT,Win 2000, OS/2, Mac OS, MS-DOS Windows 3.1YesYesNoWill not let a known malicious script runVia central installation on network and provided admin tool$1,495 for 50 users
    Sybari Software Inc.
    East Northport, N.Y.
    Antigen for Exchange; Antigen for Lotus NotesMail server virus protection provides mail attachment filtering and content checkingContent screeningNT and Win 2000 with Exchange Server 5.0 and up; NT, AIX and Solaris with Lotus NotesAutomatic or on-demandYesYesYes, will quarantine scriptsNone (through mail server)$4,995 for 250 users with a two-year license
    Symantec Corp.
    Cupertino, Calif.
    Norton AntiVirus Corporate Edition 7.5Desktop and server virus detection and prevention; allows administrators to centrally deploy to clients; provides centralized event loggingScans for known viruses by signature, using file scanning and pattern recognitionMS-DOS, Win 3.x, Win9x, NT, Win 2000, NetWareScheduled and on-demandOn Notes, Outlook, cc:MailYesNoThrough management console or HTTP intranet deploymentBased on site licensing requirements
    Trend Micro Inc.
    Cupertino, Calif.
    Interscan Virus WallInternet gateway; stops viruses and other malicious code in SMTP, HTTP and FTP traffic before it gets to servers and users; optional eManager adds spam blocking, content filtering, and e-mail schedulingScans for malicious activity using signature pattern matching or behavioral analysisNT, Solaris, Linux, HP-UXScheduled or on-demand updates via the Internet or regular mailYesYesNoManaged through browser or Windows-based management console$725 up for 25 users
    Scan Mail for Exchange; ScanMail for LotusNotesScanMail for Exchange detects and cleans viruses from inbound and outbound e-mail on the Exchange server in real time and provides manual and scheduled scans of the information store database; ScanMail for LotusNotes detects and removes viruses hidden in Notes mail, shared databases and during Notes replicationScans for malicious activity using signature pattern matching or behavior analysisNT 4.0 and Win 2000 for Exchange; NT, Solaris, OS/390, AIX and OS/2 for NotesScheduled or on-demand via the Internet or regular mailYesYesNoManaged through browser or Windows-based management console$600 up for 25 users

    Stay Connected

    Sign up for our newsletter.

    I agree to this site's Privacy Policy.