IT Security Topic — Worms and Viruses

To prevent a pandemic, health experts encourage everyone to immunize themselves against things like the flu, measles and the mumps. Our computers spread infection in much the same way we do but need protection from things like worms, viruses and Trojan horses.

You’re immunized. Is your computer?

Protecting ourselves against the flu usually involves getting a shot before the start of flu season but protecting our computers against infection involves using antivirus software, regularly updating your software and applying patches, installing a firewall, and generally being vigilant about opening suspicious e-mail attachments or web sites.

According to the Symantec website, a computer virus is a small program written to alter the way a computer operates, without the permission or knowledge of the user. A virus must meet two criteria:

• It must execute itself. It will often place its own code in the path of execution of another program.
• It must replicate itself. For example, it may replace other executable files with a copy of the virus-infected file. Viruses can infect desktop computers and network servers alike.

Some viruses are programmed to damage the computer by damaging programs, deleting files, or reformatting the hard disk. Others are not designed to do any damage, but simply to replicate themselves and make their presence known by presenting text, video, and audio messages. Even these benign viruses can create problems for the computer user. They typically take up computer memory used by legitimate programs. As a result, they often cause erratic behavior and can result in system crashes. In addition, many viruses are bug-ridden, and these bugs may lead to system crashes and data loss.

Worms are programs that replicate themselves from system to system without the use of a host file. This is in contrast to viruses, which require the spreading of an infected host file. Although worms generally exist inside of other files, often Word or Excel documents, there is a difference between how worms and viruses use the host file. Usually the worm will release a document that already has the “worm” macro inside the document. The entire document will travel from computer to computer, so the entire document should be considered the worm. W32.Mydoom.AX@mm is an example of a worm.

Trojan horses are impostors--files that claim to be something desirable but, in fact, are malicious. A very important distinction between Trojan horse programs and true viruses is that they do not replicate themselves. Trojans contain malicious code that when triggered cause loss, or even theft, of data. For a Trojan horse to spread, you must invite these programs onto your computers--for example, by opening an e-mail attachment or downloading and running a file from the Internet. The PWSteal.Trojan is a Trojan.

It only takes one infected computer to bring a virus, worm, or Trojan horse onto an entire network, like the university, thus endangering the safety of all other computers and computer users on that network. Every computer that connects to the campus network has the ability to affect the service levels on the entire network. We must be diligent in maintaining our computers against viruses, worms, and Trojan horses.

Learn More

• Tips and tricks
• Five steps to help avoid instant message viruses

Get Help

IT Service Center
303-735-4357 (5-HELP)
security@colorado.edu