VIRUS HUNTERS

First, there was Melissa. Then in May, a computer student at a vocational school in the Philippines unleashed a worm of his own. This time, the program was written in Visual Basic Script, disguised as an e-mail attachment, a love letter.And it did a lot more than just slow down Internet message delivery. It destroyed data on infected systems and brought countless corporate mail systems to their knees. Because of a lack of laws criminalizing computer vandalism, the suspected author of the 'Love Bug' was never prosecuted. A series of copycat viruses, essentially modifications of the original ILOVEYOU worm code, continued to attack computer systems throughout the rest of the spring and summer.More recently, Microsoft Corp.'s corporate network was breached through the use of another malicious e-mail attachment'a Trojan horse that transmitted user passwords to an e-mail account in Russia. As a result, Microsoft's source code for several of its products, including Windows, might have been compromised.With the world increasingly linked by the Internet, and with tools making software development less difficult, the potential threats to computer security have grown exponentially over the last few years. And recently, the number of incidents of politically motivated Internet attacks has increased dramatically. There are two widely used methods of detecting malicious programs. One is recognizing a known virus' signature, or code pattern. The other is identifying malicious behavior by a program and isolating it.Signature-based scanning uses pattern recognition software to identify malicious code or files infected with a virus. The software examines the binary structure of a file and checks it against a database of the patterns of known threats. When the scan results in a match, the software can identify the problem file and isolate, repair or delete it.Signature scans work extremely well with known viruses but often can be easily circumvented by new threats. These programs are heavily dependent on frequent and timely updates from the software's manufacturer.Fortunately, most software packages that use signature scans support automated downloads from the Internet of updates to their databases. But in some cases, the software must be restarted after the updates are downloaded'not always an acceptable option if the protected system is a server.Symantec Corp. deals with this issue in its Norton AntiVirus Corporate Edition 7.5 by separating the scanning engine from the rest of the software architecture, allowing new definitions and software updates to be loaded without a restart.Behavior-based, or heuristic, scanning is a bit more complex. Rather than looking for specific known viruses or malicious applications, it watches for suspicious activity by a program, intercepting any application code that performs actions that could be damaging to the operating system. This can offer a high level of protection, but it can also be intrusive to system users'particularly software developers or system administrators who create or run applications that the antivirus software might identify as high-risk behavior.Also, some heuristic scans still depend on signature files to identify virus-like behavior with a specific threat, so they might not act against new threats that behave in ways the scans don't expect. This happened with ILOVEYOU, which many antivirus products did not immediately perceive to be a threat because it was a script-based attack and ran within a trusted application'Microsoft Outlook.InDefense's Achilles' Shield is based entirely on behavior-based detection. It records a snapshot of a clean system at the time of installation and monitors all future changes to the system. When it detects what it classifies as a 'viral' change to the system, it halts the process responsible.GoBack, a product from Adaptec Inc. spin-off Roxio Inc., uses a similar method. GoBack is not specifically an antivirus program'instead, it lets users roll back a system configuration on any corrupted or damaged system to a previous working configuration. Although this doesn't prevent the system from wreaking havoc on other computers before the problem is detected, it does let administrators essentially hit an undo button on damaged systems once a problem is discovered.Some antivirus packages, such as Network Associates Inc.'s McAfee Active Virus Defense, use a combination of techniques. McAfee combines signature scanning with behavioral analysis of code through heuristics.Also essential to defending against viruses is the matter of where to catch them. Most virus protection programs traditionally have run on the desktop computer. This approach was fine when the main point of entry of viruses was through infected floppy disks, and it still offers a great deal of protection to individual users. But more layers of defense are required for an Internet-connected network.The first line of defense for most networks is at the entrance'the firewall or Internet mail gateway. Some firewall products can screen for malicious code in Simple Mail Transfer Protocol message packets before letting them on the network, preventing infection of systems from the outside.Firewall packet screening can be effective against already identified threats, as it is almost always dependent on pattern recognition. It also works well in blocking viruses and other threats coming in over nonmail protocols like File Transfer Protocol and Hypertext Transfer Protocol.Another type of interceptor, usually running on the mail relay server or on a groupware server, is a content filter. It can check for specific attachment types and quarantine them, preventing them from being delivered.Trend Micro's InterScan, for example, provides behavioral analysis and signature checking for not just SMTP but FTP and HTTP as well, to block both viruses and malicious Java and ActiveX Web components in Web pages before they even get on the network. An optional module will even screen for spam.Another effective point of defense is the organizational mail or groupware server; protecting this point can prevent infected files from entering from outside the organization or being propagated internally if brought in through other means.Some antivirus products integrate directly with groupware products such as Lotus Domino and Microsoft Exchange, screening attachments to mail messages'and, in the case of Domino, files attached to Notes databases. Sybari Software Inc.'s Antigen for Exchange and Antigen for Lotus Notes products actually wrap other companies' virus protection engines'Norman Data Defense, McAfee, Sophos'to run on the groupware server. Some of these products, such as GFI Fax & Voice USA's MailEssentials do full-blown content scanning and protect against specific attachment types, such as vbs scripts.With large client installations, reporting is an essential part of catching attacks early. Reporting can help set up protection against new threats before they spread. Some products, such as Symantec's Norton and Network Associates' McAfee, offer a central console from which administrators can control how the product is deployed and check activity logs and other reports from client systems.But just as important as any virus protection product is applying rigorous administrative policies to networks and teaching users a little common sense.By now, users should know the danger of opening an unknown file type. But every day, it seems another user double-clicks on yet another version of a script virus and launches yet another barrage. User education is key to ensuring that the threat from viruses, malicious code and other attacks on system security are maintained at a level that can be managed by the safeguards put in place.XXXSPLITXXX-