Trojans | Viruses | Sharing | Web Sites | Windows Update | MS Office

If your computer uses Windows Update (WU) (for example, Windows ME and XP), don't trust it. According to Russ Cooper, "Surgeon General" of TruSecure Corporation (http://www.truesecure.com), "Windows Update is a dog and shouldn't be used, by anyone, at any time, for any reason."

…a Microsoft customer said a patch he installed via WU removed without warning several previous hot foxes he had installed. As a result, one of his systems was successfully attacked by the Nimda virus, for which he once had a patch. "It got Nimda again because the roll-up uninstalled the previous patches," said John McGuire, a staff engineer and security expert at Strictly Business Computer Systems, Inc., a consulting and engineering company in Huntington, West Virginia.

-- "Security tool leaves holes," Dennis Fisher, Eweek, April 22, 2002.

Windows Update also is slow to contact your computer with urgent security fixes. For example, on March 28, 2002Microsoft came up with a "critical update" to Internet Explorer. This was needed to block malicious web page email attachments that could install Trojans merely by viewing them.

According to the hacker at GreyMagic Software (http://security.greymagic.com/adv/gm002-ie/) who discovered this problem, "All this happens in less than 2 seconds, there is hardly anything the user can do to prevent this chain reaction…."

The Greymagic hacker publicized how to write viruses that take advantage of this problem on March 22, 2002. On March 28, Microsoft released a Critical Update that would block this kind of virus. However, Microsoft Update did not contact one of the author's test computers to fix the problem until April 16, 2002. That meant 25 days of virus danger.

To keep Windows Update from wrecking your computer, first, just say no to any Windows Update prompts that come unannounced to your computer. Instead, check http://windowsupdate.microsoft.com%20/every few days. This web site will scan your system to see what you have installed and give you a list of suggested updates. Look for items listed as "critical updates." To be safe, only download those. If it is designated critical, but called a "rollup," watch out. A rollup combines so many fixes that, as in the case of John McGuire, it may break some of your older fixes. If you have been installing Critical Updates all along, you won't need a rollup.

If you follow this procedure, you will only be vulnerable to the latest worms and viruses for the shortest possible time.

If you are serious, really serious, about avoiding viruses – don’t use either Outlook or Outlook Express. There are free email programs that worms and viruses can’t attack as easily. You can get Eudora for Windows or Mac OS from http://www.eudora.com/. Pegasus (http://www.pmail.com/) has versions for Windows and DOS. Both of these are free.

Some web page viruses can attack Eudora. To fix this, click Tools -> Options -> Viewing Mail, and uncheck both "Use Microsoft's viewer" and "Allow executables in HTML content."

Linux users have a choice of many free email programs. These range from the ancient Elm and Pine to newcomers with pretty graphical interfaces such as Kmail.

The most important thing to remember is that no matter what email program or operating system you use, beware the "click of death."

How do you know whether it is OK to click on an attachment? Sometimes a little knowledge is a dangerous thing. For example, a file ending in ".txt" can’t run a program. Someone who knows this may click on an apparent text file without thinking. That’s how "Life Stages" trapped many power users.

This virus hides in an email attachment called LIFE_STAGES.TXT.SHS (An SHS file is a Microsoft Scrap Object program.) If your computer hides commonly known file extensions, the "SHS" part will be hidden. So the attachment will look like "LIFE_STAGES.TXT." Joe Power User sees this and thinks it’s a harmless text file. Clicking opens a file in notepad. Joe thinks, yup, just what I thought, a harmless text file. While Joe is chuckling over the text of "Life Stages," the virus installation program does its dirty work.

Virus writers work hard at making the content of their attachments so enticing that people can’t resist the click. Wonder why so many people couldn’t resist the LIFE_STAGES virus? It sounds like a nifty joke – and it is. If you open its attachment in Notepad (not by clicking on the attachment!), you will see:

The male stages of life:

Age. Seduction lines.

17 My parents are away for the weekend.

25 My girlfriend is away for the weekend.

35 My fiancee is away for the weekend.

48 My wife is away for the weekend.

66 My second wife is dead.

Age. Favorite sport.

17 Sex.

25 Sex.

35 Sex.

48 Sex.

66 Napping.

Age. Definition of a successful date.

17 Tongue.

25 Breakfast.

35 She didn't set back my therapy.

48 I didn't have to meet her kids.

66 Got home alive.

The female stages of life:

Age. Favorite fantasy.

17 Tall, dark and handsome.

25 Tall, dark and handsome with money.

35 Tall, dark and handsome with money and a brain.

48 A man with hair.

66 A man.

Age. Ideal date.

17 He offers to pay.

25 He pays.

35 He cooks breakfast next morning.

48 He cooks breakfast next morning for the kids.

65 He can chew his breakfast.