Virus and Worm protection tips |
1. Recognizing when your computer is port scanning....
Many viruses today reveal themselves because they employ a method called 'port scanning'. This means that they use the infected computer to open a connection to random addresses on the internet, and start looking for open ports. This is easily detected with a command called 'netstat'. Normally, surfing the internet will result in your computer making a handful, lets say less than 10, connections to whatever systems you happen to be browsing to. When you have a virus like Blaster, or Welchi A, you will notice many more connections. Try it. Windows users need to click 'Start' / Run / and then type 'command' and press enter. This will get you a dos box. Type 'netstat' (without the ' marks), and press enter. A healthy system may look like this: Active Connections Proto Local Address Foreign Address State TCP compname:1940 baym-cs136.msgr.hotmail.com:1863 ESTABLISHED TCP compname:1946 cs70.msg.sc5.yahoo.com:5050 ESTABLISHED TCP compname:3349 cbc.ca:http ESTABLISHED TCP compname:3350 a209-249-123-101.deploy.akamaitechnologies.com:http ESTABLISHED You don't have to track down the reason for each and every connection. The thing to look for would be the volume of connections. If that list showed 20 different connections, and, like the example, you're only browsing cbc.ca, running Yahoo Messenger and MSN Messenger, then something nasty is probably happening to your computer. |
2. Identifying the worm.
Keeping an updated virus / worm definition list is certainly recommended. However, doing only this does not seem a bullet proof method, considering the number of people who *do* do this, and yet still seem to get hit. This is because many worms aren't actually programs, but simply take advantage of already existing programs and services in Windows to do their thing. There are a number of free utilities available on the internet. Symantec provides free worm/virus removal tools, but these are only effective if you know what worm/virus you want to remove. To identify virus and worm infections, you can: Run a free scan at Trend Micro Housecall for Home Networks Download a free (for home use) virus scanner at http://www.f-prot.com |
|