Patching Windows Systems

Applying the latest patches to your Windows 2000 Operating system to prevent viruses and worms

This procedure will help you determine the patched state of your system, detect and remove any viruses and apply updates. This procedure is written for Windows 2000 users. The patches are also available for Windows XP and Windows NT but instructions are not provided for those systems here although the procedures should be similar excluding the application of the service pack. If you have a system that has not been patched within the last few weeks or are not sure and do not know if you have a virus, and do not have current anti-virus software on your system follow all the steps below. Checking for and removing viruses can be skipped for users who are sure they do not have a virus. Skipping the firewall installation can be done if you already have a personal firewall or are behind a corporate firewall. For more information please read our Home Security article at http://www.comptechdoc.org/docs/ctdp/homesec/

Back up your Data

1. Back up your data to another computer, tape, CD-ROM, or at least to another partition on your hard drive. If you store data like most people, it is stored in MyDocuments. Always back up your data on a regular basis.

Install a firewall to help secure the system

2. Install a personal firewall. I use Norton Personal firewall from Symantec, but zonealarm personal firewall has a good reputation and is free for individuals and non profit organizations. It is available at http://www.zonelabs.com/ Please do not violate license laws when using this product. Since antivirus software is also an essential requirement to have a reasonably secure computer a nice convenient package is Norton's Internet security package from Symantec which can be found in many stores. It comes with both antivirus software and a personal firewall. The commercial version of ZoneAlarm's personal firewall also is very well recommended.
3. Configure your firewall before connecting to the internet. Most users should at this point read their documentation or run the provided firewall tutorial. You may get alerts while configuring or in one case I got an alert indicating that a specific program wanted to act as a server on the internet. Before answering the question I used another computer and went to http://www.google.com/ and looked up the name of the program the alert had specified. At this point I realized the computer had a virus. If you are told by the alert that a program wants to act as a server the likely answer to this question should be no, but it is best to look up the program name on Google to be sure.

Check for and remove viruses

4. Install antivirus software on your computer. I use Norton or Symantec Anti-virus software but use the one of your choice. It is wise to read product reviews.
5. Connect to the internet and get your latest virus definitions from your antivirus software manufacturer.
6. Run a full virus scan on your system but configure it to only find viruses. It is best at this point to not attempt to quarantine or delete infected files. This is because the virus may modify some system files and if these files are deleted or quarantined you may not be able to reboot your system after removing the virus. At this point you only want to identify any viruses, trojans or worms on your system.
7. At this point do not worry about connecting to the internet even if you have some viruses since your firewall will help protect you. Once you have identified viruses on your system, go to your virus manufacturers website and look up the information about each virus and print it out. Download any virus removal tool for each virus that they may provide. Use the virus removal tool where possible to remove the virus. If no tool is available, follow the manual virus removal procedures that they provide. You may be able to delete or quaranteen files identified in your scan by right clicking on the files and selecting either delete or quarantine.

Update your system

8. Right click the "My Computer" icon on your desktop and select properties.
9. If under the General tab it does not state that your system is service pack 3 or above, download the service pack from http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/default.asp Once downloaded click on the downloaded file and follow the steps provided in the install package, then reboot your system.
10. Review the critical updates at http://www.microsoft.com/windows2000/downloads/critical/default.asp and install them. Windows 2000 also has an autoupdate utility which can be configured from the control panel which will help get these but you must be careful to only select useful security and critical updates since the auto update facility will not always choose updates best for you.
11. Update your Internet Explorer browser to version 6 or above by using the site at http://www.microsoft.com/windows/ie/downloads/critical/ie6sp1/download.asp You will need to reboot after applying this latest version of Internet Explorer.
12. If you are using Microsoft Office, read the article "Preventing Viruses in Microsoft Office® Products" at http://www.comptechdoc.org/docs/ctdp/Officeupdates/ and apply the Microsoft Office updates as instructed in that article.
13. Download and install any critical or security updates for current threats as you are aware of them or check every couple of weeks on the Microsoft site for new updates.

Source By : http://www.comptechdoc.org/

Removing Viruses

By : No Name

Removing viruses can be risky to your operating system and may cause you to need to re-install your operating system. If you do not feel comfortable with the instructions in this section, you should get a computer professional to do the job. For more information read Applying the latest patches to your Windows 2000 Operating system to prevent viruses and worms. It contains information about how to remove viruses along with other useful information.

Virus Removal Procedure

1. Be sure you have good backups of your data along with an emergency boot disk for your system.
2. Determine what viruses you have on your system.
   - Install a virus scanning program if you do not have one already installed. Use the product of your choice. It is wise to read product reviews.
   - Be sure your virus definitions are up to date. Connect to the internet and download the latest virus definitions from the company that created your anti-virus software.
   - Configure your virus scanner not to remove any viruses but only detect them. You do not want to remove the virus(es) immediately since some viruses may infect files that your system requires to run. If these files cannot be cleaned by the anti-virus program, they may be deleted or quaranteened. If this happens you may not be able to run your system again.
   - Scan for viruses but do not remove them. Note: Some viruses will stop your virus scanner from operating. If this is the case you will probably need the help of a computer professional. If you have a virus that stops your virus scanner then you will need to either share the drive across a network and scan it from another computer or remove your hard drive and place it into another computer as a second hard drive, then scan your hard drive.
3. Learn about the viruses you have and how to remove them. - Go to the web site of the organization that created your anti-virus software. The Symantec security response site is a good site to find information about specific viruses and they provide virus removal tools.
4. Remove the viruses.
   - Many viruses have a removal tool which can be used to remove the virus. If there is a removal tool, download it and use it to remove the virus.
   - If there is no removal tool, you will need to follow the manual removal instructions. You may need to manually delete virus files and edit your system registry. The removal instructions will tell you how to do this, but some people may not feel comfortable doing this without the help of a computer professional.
   - If the manual instructions indicate that you should let your virus scanner remove the virus, then remove all viruses that you can with virus removal tools then run the virus scanner with it configured to remove all viruses.

Source By : http://www.comptechdoc.org

E-Mail Virus Spreading

By : No Name

This article briefly explains how email viruses are spread and shows how it causes some people to receive one of:

• Non-delivery notices for e-mail that you did not send.
• A notice that an e-mail you supposedly sent contained a virus.

Just because you received an e-mail like this does not mean that you have a virus. The best thing to do is simply delete the e-mail unless your system is performing strangely or erratically in which case you should scan for and remove any viruses. See the page about removing viruses at http://www.comptechdoc.org/basic/basictut/removevirus.html for more information.

How people that are not infected receive these types of messages is explained below in this description of how viruses spread. The below picture shows how a virus begins to spread.

In the lower left corner of the above picture the process of what happens when the virus is sent from the infected computer is shown. It is as follows:

1. The virus infected computer sends the virus to the intended recipient.
2. The e-mail server that the recipient is connecting to (or another server) may do one of the following:
   - It may recognize that the e-mail contains a virus. If inproperly configured, the e-mail server will then notify the faked sender of the e-mail, not the real sender, that they sent a message with a virus.
   - It may not recognize that the e-mail contains a virus but may try to deliver the e-mail and find that the address of the recipient does not exist.
3. The e-mail server may notify the faked recipient that their e-mail could not be delivered or the e-mail they sent contained a virus.
   - If in the above step the e-mail server did not recognize a virus in the e-mail and the e-mail address of the intended recipient does not exist, the faked sender is notified that the recipient address of the e-mail that they sent was invalid and the e-mail they sent could not be delivered (in spite of the fact that the faked sender never sent an e-mail to that recipient and usually they will not even know the person)
   - If the e-mail server found a virus in the message, the faked sender may be notified that they sent an e-mail containing a virus.
4. The e-mail may be delivered to the recipient depending on whether the e-mail server recoginzed the virus in the e-mail and whether it was configured to delete any e-mail that contains a virus.

The person whose sending e-mail address was faked by the virus above will therefore receive notifications that e-mails that they never send contained a virus or an e-mail that they sent (but actually never sent) was undeliverable.

My recomendation to e-mail server administrators is not to notify senders of e-mails that any messages they send do not contain viruses since most viruses today fake the sender of the e-mail. This will cut down on the confusion added by these messages.

Source By : http://www.comptechdoc.org/