How to Spot an E-Mail Virus

By Terry Hawthorne

Have you received any e-mails recently asking for your advice regarding an issue described in an attachment to the e-mail? If you have, please don't open that attachment. It contains a computer virus.

The virus is the W32.Sircam.Worm@mm, or Sircam for short. Sircam is a good example of how clever and malicious virus-writers have become. Sircam spreads by sending mass e-mails from infected computers. Because the virus gathers e-mail addresses from the infected computer's inbox and address book, infected e-mails appear to come from people you know or with whom you have exchanged e-mail in the past. Sircam appends its virus code to a file selected at random from the infected computer's hard drive. Most other e-mail viruses carry the virus in an attachment with a specific name. Sircam's author has cleverly exploited what hackers call social engineering: non-technical methods of gaining the trust of an unsuspecting computer user. In this case, users receive e-mails from people they probably know, containing attachments with legitimate-sounding names, with a message asking for the recipient's advice. Many users open those attachments, thereby infecting their own computers and starting another round of Sircam e-mails.

What Do I Do If I Get the Sircam Virus?

If you have the Sircam virus on the computer you use at school, fill out a work order for the Information Technology Department to remove it. Please note that Windows 2000 computers cannot be infected by this virus. If you have Sircam on your home computer, you can download a removal tool from http://www.sarc.com/avcenter/venc/data/w32.sircam.worm@mm.html.

Hoax Viruses: More Social Engineering

Have you ever received an e-mail warning you of a dangerous new computer virus for which there is no known fix? A virus just announced by IBM, or AOL, or Microsoft? A virus that affects both Macintosh and Windows computers? A virus that will erase all of the files on your computer, destroy your hard drive, erase all of your CD's, and send nasty e-mails to your boss and spouse? The e-mail usually concludes by urging you to forward it to everyone you know.

These are hoaxes. They are not computer viruses; they are "social engineering" viruses. (Social engineering is a hacking term for using non-technical methods of getting information or manipulating other computer users.)

The downside of these hoaxes is that they generate lots of unnecessary e-mail, which consumes our network bandwidth and results in slower Internet access. When you get an e-mail similar to the one I described above, please throw it away.

There is one other type of hoax you should be aware of. This is one that describes a virus that supposedly leaves a dangerous file on your computer. The hoax writer tells you where to look and, sure enough, the file is there. The file is there because it is a legitimate program. If you delete it, as the hoax instructs, your computer won't function properly. Here is an example of one of these hoaxes. This one started out as a joke about America Online users. Apparently a lot of folks took it seriously and sent it to all of their acquaintances.

You can view a list of hoaxes at www.symantec.com/avcenter/hoax.html.

Here's what else Sircam does:

It will delete all of the files on the hard drive on some computers.
It will slow the performance of some computers by filling up the hard drive with random data.
It may release confidential information to unauthorized persons. When it begins its mass e-mailing, Sircam selects a document at random from your hard drive. I know of one instance in which someone received a confidential legal document transmitted from a lawyer's computer.

Here are some tips on avoiding Sircam and its relatives:

Be very suspicious of any e-mail that consists of a generic subject and message, along with a request to view its attachment. By generic, I mean a message that does not contain enough specific information to enable you to identify the sender and the subject of the message. Here is an example of a generic message:

"Hi! How are you? I send you this file in order to have your advice See you later. Thanks"

The document attached to this message contained the Sircam virus. Note, too, that whoever composed this message has not quite mastered English grammar and punctuation. That is a common characteristic of the messages that accompany e-mail viruses. Some viruses have been tracked to former Soviet states, where English is not the virus author's native language.
Don't depend on your anti-virus program to catch every virus. Anti-virus programs have to be updated as new viruses are discovered. Most people do not have very recent updates of their virus definitions, and some viruses become fairly widespread even before the anti-virus vendors release an update that can identify them.
Confirm e-mail attachments before you open them. By confirm, I mean contact the sender to verify that he or she actually sent you an e-mail attachment.
Anticipate the next escalation in this war between virus authors and the rest of us upstanding Internet citizens. For example, if I were a virus author, I would anticipate that computer users are going to become very wary of opening unexpected attachments. Therefore, I would create a virus that sends two e-mails. The first one would announce that the recipient is going to receive another e-mail with an attachment. The reason for sending the first e-mail is to assure the recipient that the attachment contained in the second e-mail is a legitimate file and not a virus, which, of course, it will be.
Be aware that software, screensavers, images, and other files you download from Internet sites can contain viruses, spyware (software that tracks and reports your Internet browsing habits), DOS agents and other Trojan horses. (A DOS agent is a program that a hacker can use to launch a denial of service attach against a Web site. A Trojan horse is software that enables an attacker to remotely access and control your computer.) You should never download or install any files from the Internet on a school computer. The School Board's Information Technology Department is responsible for installing software.

The Age of Internet Innocence is over.

Terry Hawthorne is the Technology Coordinator for the Smyth County School Board.