A number of anti-virus vendors, including Trend Micro and Computer Associates, have warned of a virus with a new approach. It is known variously as QAZ.TROJAN or QAZ.WORM, and was officially re named to W32.HLLW.Qaz.A in September. The virus enters via unprotected shared drives and replaces the Notepad.Exe application (there have been occasions where Notepad was not the victim). The virus then provides a backdoor to outside intruders, in effect giving them remote control over the computer that has been infected.

According to Simon Perry, vice president of security solutions at Computer Associates, "While CA's InoculateIT (based on a product acquired from Cheyenne) has provided protection against Qaz.Trojan since August, the Microsoft attack un derscores the requirement for users to ensure that virus signatures are maintained to avoid critical data being hijacked." (A Microsoft spokesman issued a press release on October 27 stating that "no source code was compromised" during the virus attack.)

Note that the drive does not have to be "mapped" to any other machines, the virus will spread to any machine it finds where the windows directory is shared.

Interestingly, once the machine is infected, the virus attempts to send the infected computer's IP address to an e-mail address in China. You never know where these viruses will come from, Bulgaria used to be a very popular germination site.

This event simply underscores the importance of eternal vigilance on the part of system administrators and PC users. Education may prove to be the key, since many people do not know that:

• Anti-virus software virus identification strings do not update themselves. Thus, the machine is susceptible to newer variants of the original virus ("QAZ" already has at least four variants ). The cure for this problem is that most current anti-virus software will automatically either dial in to the vendor or connect via the Internet and update the strings on a scheduled basis. Unfortunately, this is often defeated because users don't have a persistent Internet connection, or turn off the machine during the period during which it is scheduled to update.
  
• Many users turn off the anti-virus software because they believe it slows down their machine. This can be resolved by settings in the anti-virus software as to what file extensions should be examined during the scan. We will not list all the permutat ions here, but at the least, data files should only be scanned monthly (.TXT, .WRI, etc.).

#  a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z