1. Topics to be covered Removal Procedures Removal Procedures How Virus Infects How Virus Infects Virus and it’s types Virus and it’s types Precautions Frequently Asked Questions Frequently Asked Questions Do’s and Don’ts Do’s and Don’ts When Virus Attack When Virus Attack Exit Click to select the topic

2. Virus and it’s types A computer virus is a program written with mischievous or malicious intent. A virus is a potentially destructive software that spreads from file to file, via email or from disk to diskA computer virus is a program written with mischievous or malicious intent. A virus is a potentially destructive software that spreads from file to file, via email or from disk to disk It usuallyIt usually 1. reproduce itself so that it spreads. 2. does mischievous jobs like displaying a silly message on startup to causing serious damage like formatting your hard disk leading to data loss.. Types of Virus: : Infects Boot sector of Disk.The common one is POLYBOOT.B.Boot Virus: Infects Boot sector of Disk.The common one is POLYBOOT.B. Infects executable files and other files in Hard disk /Floppy Disk.File Virus : Infects executable files and other files in Hard disk /Floppy Disk. Infects MS Word, MS Excel Files. They attach themselves to Word and Excel documents and propagate very readily when such files are passed around from machine to machine.Macro Virus: Infects MS Word, MS Excel Files. They attach themselves to Word and Excel documents and propagate very readily when such files are passed around from machine to machine. It propagates by attaching itself to e-mail messages you send out (or in some cases by sending e-mail messages to addresses taken from your address book). This virus are not triggered simply by reading a e-mail message; the virus is triggered when you open (usually by clicking on it) the attachment which arrives with the message or when Auto Preview mode is selected..E-mail Virus:It propagates by attaching itself to e-mail messages you send out (or in some cases by sending e-mail messages to addresses taken from your address book). This virus are not triggered simply by reading a e-mail message; the virus is triggered when you open (usually by clicking on it) the attachment which arrives with the message or when Auto Preview mode is selected.. A worm is a self-reproducing program which usually do not infect other programs as other virus, but instead creates replicas of itself, which create even more copies thus blocking email traffic, hard disk space etc.Worms :A worm is a self-reproducing program which usually do not infect other programs as other virus, but instead creates replicas of itself, which create even more copies thus blocking email traffic, hard disk space etc. Menu

3. How Virus Infects How Boot Virus Infects: User brings a infected floppy or CD which contains a Boot virus If good antivirus is not loaded and updated, as soon as the floppy is inserted, virus infects the HDD The PC will stop Booting How File Virus infects: User brings a infected floppy or CD which contains a File virus If good antivirus is not loaded and updated, as soon as the floppy is inserted, virus infects all the executable files and working files. The Program stops responding or PC will hang.  The virus always search for a media to infect and spread itself from system to system.The computer user should always be aware of the media they are using to protect their system against virus attack. Good antivirus software with regular updated could prevent attack from virus. Menu

4. Removal Procedures  Please ensure you have the following ready to remove virus from your system: system:  A Bootable floppy.  Anti-Virus Rescue Disk with latest updates.  Follow the procedure to remove virus from your system: Boot your PC with a non-infected DOS Bootable Disk.Boot your PC with a non-infected DOS Bootable Disk. Insert the Anti-Virus Rescue Disk and run the anti-virus program.Insert the Anti-Virus Rescue Disk and run the anti-virus program. Make a note of the files which are clean failed.Make a note of the files which are clean failed. Once the scan is over. Manually delete all clean failed files.Once the scan is over. Manually delete all clean failed files. Re-boot your PC and re-scan your system to confirm the removal of virus.Re-boot your PC and re-scan your system to confirm the removal of virus.  Prepare Yourself Always make sure that the Bootable Floppy is virus free.Always make sure that the Bootable Floppy is virus free. Always keep updating patterns in your rescue disk so that it can detect the latest virus and clean them form your system.Always keep updating patterns in your rescue disk so that it can detect the latest virus and clean them form your system. Always write protect your Bootable as well as Anti-Virus Rescue Disk to avoid virus infection while cleaning.Always write protect your Bootable as well as Anti-Virus Rescue Disk to avoid virus infection while cleaning. Menu

5. When Virus Attack  When a File virus affects : Your PC might start behaving abnormally.Your PC might start behaving abnormally. All infected MS excel files might display 0 bytes.All infected MS excel files might display 0 bytes. Your PC might stop responding.Your PC might stop responding. Your windows system files might get corrupted by the virus.Your windows system files might get corrupted by the virus. You might get low memory error while executing any application.You might get low memory error while executing any application. Your application file size might abnormally increase.Your application file size might abnormally increase.  When a Boot Virus affects: You PC might stop booting. You PC might stop booting. Operating system might give unexpected errors. Operating system might give unexpected errors. In rare cases the virus might disable the presence of your Hard disk. In rare cases the virus might disable the presence of your Hard disk. Even the virus could format your system Hard Disk Drive. Even the virus could format your system Hard Disk Drive. Sometimes unknowingly virus copies itself to all floppies inserted in System. Sometimes unknowingly virus copies itself to all floppies inserted in System. Virus have the capability to damage the system areas of Hard disk drive. Virus have the capability to damage the system areas of Hard disk drive. Sometimes virus displays some peculiar messages. Sometimes virus displays some peculiar messages. The whole system operation gets affected. The whole system operation gets affected. Menu

6. Precautions  There is no way that guarantee 100% protection as new virus comes up everyday. However, the potential damage can be minimized by taking the following precautions: Maintaining a clean boot disk: Regularly check and update the floppies with up- to-date antivirus software and make sure it is (and stays) write-protected. Boot from it and make 1-2 copies.Maintaining a clean boot disk: Regularly check and update the floppies with up- to-date antivirus software and make sure it is (and stays) write-protected. Boot from it and make 1-2 copies. Use anti-virus software and regularly update the same with new patterns.Make sure that in configuration online/real time scanning is enabled.Use anti-virus software and regularly update the same with new patterns.Make sure that in configuration online/real time scanning is enabled. If you use a shareware/freeware package, make sure it is from a reputable source and you have hard copy of the documentation. Read the pros & cons before installing.If you use a shareware/freeware package, make sure it is from a reputable source and you have hard copy of the documentation. Read the pros & cons before installing. You need a proper Win95 32-bit antivirus package for full protection if your Operating system is Windows 95 & above.You need a proper Win95 32-bit antivirus package for full protection if your Operating system is Windows 95 & above. Menu

7.  Check all new systems and all floppy disks when they're brought in (from any source) with a good virus-scanning program. Once formatted, keep floppies write-disabled except when you need to write a file to them; then write-disable them again; scan again pre-formatted diskettes before use.  Acquire software from reputable sources.  Make sure your data is backed up regularly  Before restoring disconnect the system from network, restore archive data and scan the data with a reputable antivirus software.  Disable “Boot from floppy” from BIOS. Enable the same when you require it.  Some CMOS comes with special anti-virus settings. These are not a replace ment to ordinary virus packages but typically they write-protect your hard disk's boot sector and partition sector (MBR). This can sometime protect you against writing to boot sector. Also they sometimes give false alarm when you upgrade your operating system  Some CMOS comes with special anti-virus settings. These are not a replace ment to ordinary virus packages but typically they write-protect your hard disk's boot sector and partition sector (MBR). This can sometime protect you against writing to boot sector. Also they sometimes give false alarm when you upgrade your operating system. Precautions Menu

8. Frequently Asked Questions Menu Q.I have a virus problem - what do I do? A. Do not attempt to continue to work with an infected system. If you have the means of checking machines for infection, you should do so and take appropriate steps if an infection is found. Q. Do I need to worry about virus protection? A. Yes, New computer viruses continue to circulate and to present a real danger to individuals' computer systems and files. It is vital that every user take steps to protect themselves and their systems. Q. How do viruses spread? A. A PC is infected with a boot sector virus (or partition sector virus) if it is (re- )booted, usually by accident, from an infected floppy disk in drive A. A file virus infects other files when the program to which it is attached is run, and so can spread across a network (often very quickly). A multipartite virus infects boot sectors and files. Often, an infected file is used to infect the boot sector: thus, this is one case where a boot sector infector could spread across a network.

9. Frequently Asked Questions Menu Q. What is a boot sector? A.The boot sector is the first sector on a floppy disk. On a hard disk it is the first sector of a partition. It contains information about the disk or partition, such as the number of sectors, plus a small program. Even a non- bootable floppy disk has executable code in its boot sector. This displays the "not bootable" message when the computer attempts to boot from the disk. Q.Are there anti-virus packages which checks zipped/archived files? A. More and more anti-virus programs are scanning within zipped, packed, or archived files like.zip,.arz. The specific archive formats supported will vary from product to product - check with the makers of the product for details A. More and more anti-virus programs are scanning within zipped, packed, or archived files like.zip,.arz. The specific archive formats supported will vary from product to product - check with the makers of the product for details. QHow do I know I have a Virus? Q. How do I know I have a Virus? A. A computer virus can cause unusual screen displays, or messages - but most don't.One usually reliable indicator of a virus infection is a change in the byte size of executable (.com/.exe) files, a change in their content, or a change in their file date/time in the Directory listing. Q. What should be on a (clean) boot disk? A. A boot floppy is one which contains the basic operating system, so that if the hard disk becomes inaccessible, you can still boot the machine to attempt some repairs A. A boot floppy is one which contains the basic operating system, so that if the hard disk becomes inaccessible, you can still boot the machine to attempt some repairs.

10. Do’s and Don’ts Menu Do check your floppy for virus infection before using it in your system. Do check your floppy for virus infection before using it in your system. Do Scan your full Hard disk drive once in a week for virus. Do Scan your full Hard disk drive once in a week for virus. Do contact your local IBM-Helpdesk if your Anti Virus failed to clean a infected Do contact your local IBM-Helpdesk if your Anti Virus failed to clean a infected file. file. Maintain regular backups of all important files on your computer. Maintain regular backups of all important files on your computer. Ensure that you have up-to-date virus protection software on your. system system. Don't accept and use unsolicited floppy disks or CDs Don't accept and use unsolicited floppy disks or CDs. Don't run programs or open Word/Excel documents whose origin you don't know. Don't run programs or open Word/Excel documents whose origin you don't know. Do not send/forward mails which contains the request "Please send this e-mail to as Do not send/forward mails which contains the request "Please send this e-mail to as many people as possible". many people as possible". Do not use two anti virus software in your PC. Do not use two anti virus software in your PC. Do not open any mail which comes from an unknown source. Do not open any mail which comes from an unknown source. Do not forward or reply to any mail message which suspects of having Do not forward or reply to any mail message which suspects of having virus. virus. When you receive a virus warning not coming from ITS/IBM always check it with them and leave them to circulate if appropriate. When you receive a virus warning not coming from ITS/IBM always check it with them and leave them to circulate if appropriate.