CyberWatch Column


Malicious Software


Professor of Computer Information Systems

Norwich University, Northfield, VT

This is another in a continuing series devoted to how ordinary people can protect themselves when using the Internet.

As this course is being written, there are over 55,000 distinct forms of malicious program code circulating in cyberspace.  Most of these harmful programs are limited to anti-virus laboratories and to the computers of virus hobbyists — people who derive a perverted pleasure from playing with dangerous toys.

Viruses are self-reproducing programs that insert parts of themselves into various forms of executable code — i.e., instructions that can tell a computer what to do.  There are several forms of executable code that have been used for viruses:

Today, there are virus-creation kits that allow untrained kids to create virus variants that can cause havoc to individuals and organizations.  Writing (or modifying) viruses seems to appeal to children because it is so easy to cause trouble for many people at once – it’s one of the few ways a child can feel really powerful in the world of adults.  It is important to discuss these problems with children from the earliest ages so that they can get used to the idea that writing viruses is just as bad an idea as, say, arson.  Writing and distributing viruses may be prosecuted under a number of computer crime laws, including the 1987 Computer Fraud and Abuse Act (18 USC 1087).

Use antivirus software on all your computers.

  • Keep your virus strings up to date (e.g., at least twice-monthly updates of your antivirus software).
  • Don't download or use software that purports to help you break the law or cheat people and businesses – these programs are especially prone to viruses or Trojan code.
  • Don't download or use stolen software (i.e., software copies without permission or in violation of license restrictions).
  • Don't execute software that anyone sends you through e-mail even if you know and like the person who sent it to you.  Just because they're nice people doesn't mean they are qualified to inspect programs for safety.
  • Before sending someone an attachment (e.g., a picture or any other kind of file) by e-mail, let your recipient know what to expect via a preliminary message; if you don't know the person personally, send an e-mail requesting permission to send the attachment.
  • Never open attachments you have received without warning, regardless of who sent them or what the subject line or text say.  Be especially suspicious of generic subjects such as "FYI" without details or "You'll like this."  If you are really curious about the attachment, phone or e-mail the supposed sender to find out whether it is legitimate. 
  • Don't forward programs, even reliable programs, to anyone; instead, tell your friends where to download useful programs from a trustworthy source (e.g., a legitimate Web site).
  • Before sending anyone an MS-Word document as an attachment, save the document as an RTF file instead of as the usual DOC file.  RTF files don't include document macros and therefore cannot carry macro-viruses.
  • Disable automatic execution of macros in MS-Word using the TOOLS | MACROS | SECURITY menu and select the HIGH option (which restricts macro execution to digitally-signed macros from trusted sources — none, by default).
  • Use the patches offered by Microsoft to shut off automatic execution of attachments in Outlook and Outlook Express.
  • 18 USC 1030:  Computer Fraud and Abuse Act of 1987 < >

  • Computer Virus FAQ for New Users (1999) < >
  • F-Secure Virus Database search < >
  • IBM Antivirus Research < >
  • ICSA Labs Virus Alerts < >
  • Online VGrep Search < >
  • Top Ten Viruses (Trend Micro) < >
  • Virus Bulletin < >
  • Virus Primer (Trend Micro) < >
  • “What makes Johnny (and Janey) write viruses?” (2001) by Kim Zetter <  >
  • WildList Organization < >
  • Word Macro Virus FAQ from Michigan State University < >
  • << end of article >>


    In recent weeks, readers may have heard a great deal on the news about the Sircam and CodeRed worms. 

    Sircam is a very widespread and dangerous worm that infects MS-Windows systems.  It infects a system when a user opens (double-clicks) an infected attachment.  The e-mail message carrying the worm usually has text that reads something like “Hi how are you?” in the first line, includes a semi-random selection from a list of phrases such as “I wanted your opinion on this” and is followed by a last line reading “See you later.  Thanks.”  The subject line of the e-mail message is random characters usually taken from the name of the attached infected file.  Once it infects a system, Sircam will attach itself to any document and convert it into an executable file and then mail itself to everyone in the victim’s e-mail address book.  The documents are randomly chosen, but there have been cases in which confidential or embarrassing information has been mailed out to thousands of recipients.  Sircam cannot infect Macintosh computers.  Always delete any attachment that you are not expecting to receive and, if necessary, contact the sender to determine why you have been sent a file without a preliminary request for permission to do so.   For technical details of the Sircam worm, see < >.

    The CodeRed worms (there are now several) are limited to Web servers (not ordinary PCs) using MS-Windows NT or Windows 2000 running the MS-IIS (Internet Information Server) package.  In addition to defacing Web sites, the initial version of the worm tried to launch a flood of spurious traffic at the White House Web site from the 20th to the 27th of July; luckily, a programming decision allowed the White House to avoid attack.  The newer versions of the worm are more insidious:  they cause no obvious damage to the infected system’s Web site and they open an unauthorized access path (a “back door”) into the infected system so that criminal hackers can gain control of the systems.  At this point, the CodeRed worms are spreading ferociously because there are still MS-IIS installations that have not installed the repairs (“patches”) that prevent infection.  For technical information about CodeRed worms, see the alerts from the Computer Emergency Response Team Coordination Center (CERT-CC) at < > and < >.

    << end of sidebar >>