Anti-Virus Protection and Configuration of Norton Anti-Virus for the Macintosh
| Discussion | Definitions | Configuration of NAVM |
The Macintosh operating system has historically been lucky to have had very few real threats. This is not a reason to not employee anti-virus software and maintain it correctly. There are threats based on Applescripts, Microsoft Office macro viruses, etc, which are still real threats.
What is a virus?
A computer virus is a small program written to alter the way a computer operates,
without the permission or knowledge of the user. A virus must meet two criteria:
* It must execute itself. It will often place its own code in the path of execution
of another program.
* It must replicate itself. For example, it may replace other executable files
with a copy of the virus infected file. Viruses can infect desktop computers
and network servers alike.
Some viruses are programmed to damage the computer by damaging programs, deleting
files, or reformatting the hard disk. Others are not designed to do any damage,
but simply to replicate themselves and make their presence known by presenting
text, video, and audio messages. Even these benign viruses can create problems
for the computer user. They typically take up computer memory used by legitimate
programs. As a result, they often cause erratic behavior and can result in system
crashes. In addition, many viruses are bug-ridden, and these bugs may lead to
system crashes and data loss.
There are five recognized
types of viruses:
1. File infector viruses: File infector viruses infect program files. These
viruses normally infect executable code, such as .com and .exe files. The
can infect
other files when an infected program is run from floppy, hard drive, or from
the network. Many of these viruses are memory resident. After memory becomes
infected, any non-infected executable that runs becomes infected. Examples
of
known file infector viruses include Jerusalem and Cascade.
2. Boot sector viruses: Boot sector viruses infect the system area of a disk--that is, the boot record on floppy disks and hard disks. All floppy disks and hard disks (including disks containing only data) contain a small program in the boot record that is run when the computer starts up. Boot sector viruses attach themselves to this part of the disk and activate when the user attempts to start up from the infected disk. These viruses are always memory resident in nature. Most were written for DOS, but, all PCs, regardless of the operating system, are potential targets of this type of virus. All that is required to become infected is to attempt to start up your computer with an infected floppy disk Thereafter, while the virus remains in memory, all floppy disks that are not write protected will become infected when the floppy disk is accessed. Examples of boot sector viruses are Form, Disk Killer, Michelangelo, and Stoned.
3. Master boot record viruses: Master boot record viruses are memory resident viruses that infect disks in the same manner as boot sector viruses. The difference between these two virus types is where the viral code is located. Master boot record infectors normally save a legitimate copy of the master boot record in an different location. Windows NT computers that become infected by either boot sector viruses or master boot sector viruses will not boot. This is due to the difference in how the operating system accesses its boot information, as compared to Windows 95/98. If your Windows NT systems is formatted with FAT partitions you can usually remove the virus by booting to DOS and using antivirus software. If the boot partition is NTFS, the system must be recovered by using the three Windows NT Setup disks. Examples of master boot record infectors are NYB, AntiExe, and Unashamed.
4. Multi-partite viruses: Multi-partite (also known as polypartite) viruses infect both boot records and program files. These are particularly difficult to repair. If the boot area is cleaned, but the files are not, the boot area will be re-infected. The same holds true for cleaning infected files. If the virus is not removed from the boot area, any files that you have cleaned will be re-infected. Examples of multi-partite viruses include One_Half, Emperor, Anthrax and Tequilla.
5. Macro viruses: These types of viruses infect data files. They are the most common and have cost corporations the most money and time trying to repair. With the advent of Visual Basic in Microsoft's Office 97, a macro virus can be written that not only infects data files, but also can infect other files as well. Macro viruses infect Microsoft Office Word, Excel, PowerPoint and Access files. Newer strains are now turning up in other programs as well. All of these viruses use another program's internal programming language, which was created to allow users to automate certain tasks within that program. Because of the ease with which these viruses can be created, there are now thousands of them in circulation. Examples of macro viruses include W97M.Melissa, WM.NiceDay and W97M.Groov.What is a Trojan horse?
What is a Trojan horse?
Trojan Horses are impostors--files
that claim to be something desirable but, in fact, are malicious. A very
important distinction between Trojan
horse
programs and true viruses is that they do not replicate themselves.
Trojans contain
malicious code that when triggered cause loss, or even theft, of
data. For a Trojan horse
to spread, you must, invite these programs onto your computers--for
example, by opening an email attachment or downloading and running
a file from
the Internet. The PWSteal.Trojan is a Trojan.
What is a worm?
Worms are programs that replicate themselves from system to system without
the use of a host file. This is in contrast to viruses, which requires the
spreading
of an infected host file. Although worms generally exist inside of other files,
often Word or Excel documents, there is a difference between how worms and viruses
use the host file. Usually the worm will release a document that already has
the "worm" macro inside the document. The entire document will travel
from computer to computer, so the entire document should be considered the worm.
PrettyPark.Worm is a particularly prevalent example.
What is a virus hoax?
Virus hoaxes are messages, almost always sent by email, that amount to
little more than chain letters. Some of the common phrases used in
these hoaxes are:
* If you receive an email titled [email virus hoax name here], do not open
it!
* Delete it immediately!
* It contains the [hoax name] virus.
* It will delete everything on your hard drive and [extreme and improbable
danger specified here].
* This virus was announced today by [reputable organization name here].
* Forward this warning to everyone you know!Most virus hoax warnings do not
deviate far from this pattern. If you are unsure if a virus warning is legitimate
or
a hoax, additional information is available at:
http://www.symantec.com/avcenter/hoax.html
Configuration of Norton Anti-Virus for the Macintosh
Expedition Outfitters only recommends Norton Anti Virus (whether for Windows or Macintosh). So, this configure describes the default configuration for Norton Anti-Virus for the Macintosh version 9.0 (NAVM 9.0). Once installed, the default configuration will correctly protect your computer. The only thing that is somewhat a nuisance is the Scan Disks When Mounted, which for a CD or a network mounted directory, this is painfully slow. Unless your computing environment warrants it due to exposure to outside media, you can disable this feature. Go to System Preferences, to the Norton Auto-Protect Control Panel. Simply disable the feature.
The most important thing you will need to do is insure that your installation continues to update itself and provide appropriate protection. Select a minimum of a weekly update of All Products is the correct configuration. This will include the Norton Anti-Virus application, the LiveUpdate application and the regularly updated virus definitions. This is accomplished by launching the LiveUpdate application. Then, select Scheduler and create an update profile. NOTE - Windows Users must set the updates and scanes for "Daily".
 |
  |