Virusi si jambo gumu: How Viruses Trick You Part 1 of 3

A flash drive in Tanzania may seem complicated with all of the viruses that can get onto them and cause every kind of problem. The problems with them that Tz computer users see every day all have pretty basic explanations, especially when they are still on the flash drive. In the next three virus tips I will explain:

1. the idea of a virus (this tip),
2. the way that most common USB Flash virus spread on to Windows XP
3. and their common hiding places.

Virus: Work is Work; Don't hate my work, it doesn't help me. Us: Take your panga somewhere else

In one sense, computer viruses are like biological viruses. Viruses have two goals:

1. To spread their instructions to other computer, and
2. To do something else

Any one virus does not want to completely break your computer with these goals. If it breaks your computer then it can’t spread from your computer to new computers and it is a weak virus. The “do sometime else” includes making our computers run slowly, do strange things, and sometimes stop working altogether. Usually after many viruses have arrived, they start interfering with each-other to make your computer very slow or crash.

Though viruses seem almost as dangerous and flexible as their biological viruses, they are written by people to spread a message, steal information, use your computer’s speed, or generally hurt Microsoft. As far as we know, no one writes viruses to deprive African school children of the opportunity to use computers but in our world, this is most often the effect.

We need to think about how viruses spread to help protect our computers from the first virus.

• In Tanzania, the common way to spread a virus is through a USB flash drive when the user runs a virus program on it by double clicking on the main drive or fake items.
• A few years ago in the rest of the world, email was the most common way to spread viruses. Here in TZ though, if you have a Yahoo email account, it already scans all your messages.
• An important and often forgotten way viruses can come is when you download new software ovyoovyo without knowing that the person or website it is coming from is trustworthy. You should be very careful when you install internet software when it isn’t from a big company like Microsoft or Yahoo. The bad software is a like fake Chinese TVs or pasi–it looks almost right on the outside but inside it doesn’t work and might start a fire.

A virus usually cannot enter the computer through music or video. It needs to be free to give specific bad instructions to the central processing unit (CPU). Running programs talk to the CPU directly but playing music & video does not. This means that viruses can pretend to be music but that real music rarely has a virus inside. Also, clicking on a real folder cannot start a virus but clicking on a program with a picture (icon) that looks like a folder can be very bad. Viruses are computer tricks-Vinakudanganya kuwezesha kazi yake. The worst trick is one most Tz users don’t even see. They click fake movies and fake folders and dirty drives without seeing the virus.

Hata usipokuwa na virus scanner, If your Windows XP computer is updated to Service Pack 2 or 3 and you are careful , then there is no reason you should get any viruses. Your computer is not giving you viruses, you are being tricked to double click and run the virus program. If people on your computer never double click or right click your USB flash drive in My Computer, then you will never get viruses. Instead, you should find, click on the Folders button at the top and then left click once on your flash drive on the left side of the window as pictured.

Screen shot showing the dangerous place to double click in My Computer. If you have an completely updated virus scanner you can worry less about this, otherwise be careful.

Why? Read the next tip on Autorun & Autoplay in Windows XP in this series on Viruses coming soon!

Some portions of this posting were written in collaboration with Aron, an A-Level teacher at Bihawana Secondary School.

Controlling Computer Viruses in Windows

Red bugs devouring a Baobao fruit

Viruses are a huge problem in Tanzania and most of Africa. Computers in Africa have many more viruses compared to the rest of the world. Parts of the problem may be that here virusi software siyo halisi and isn’t updated reliably because of the slow internet here.

In my experience, most Virus scanner companies are late to recognise viruses that come from East African countries so even if you have updates you are not always protected. Remember, the people that treat computer viruses and add them to the database are generally working in St. Petersburg, New York, or Israel; not Nairobi, Dar or Capetown.

Still, the first best way to deal with viruses is to keep your software up to date. No matter which software you use, it must be updated as often as you are bringing new viruses to the computer. This can be every week or every month. It depends on your computer. There are many virus scanners at FileHippo–some are Trial Versions but in order to get updates, you usually have to go into the software.

If you know where to find them, you can download offline files for the updates to use from your USB Flash Drives. Some versions of McAfee have programs to update with a file that you can download here (sdat). Some other company’s update files (Norton, Avast) can be found listed near the bottom of this page.

When I get stuck with those tool in Normal mode, the best way I have found to deal with viruses in Tanzania is to use Safe Mode (F8 while starting Windows), my normal Virus Scanner and the Sysinternals Suite from Microsoft. The main two programs I use from the Suite are autoruns.exe and procexp.exe. The package of tools is updated about once every two months to see more secret virus hiding places in Windows.  Remember: your normal virus scanner will always work best from Safe Mode. If it does not work in normal mode (“failed to remove”), then you should try in Safe Mode.

Here are some rough instructions:

• Turn on computer.
• right away, press F8 repeatedly in the first screen to get the option of Safe Mode
• Choose Safe Mode with Networking
• Safe Mode is a special mode where the programs that normally come when you start the computer do not come.
• If Safe mode gives a blue screen or restarts immediately then you have a very kali virus and you need to try to clean it from normal mode. You probably won’t be able to fix Safe Mode without reinstalling Windows.
• Press Yes to enter safe mode when it asks.
• Update your virus scanner from file that you downloaded if you could not update before. You can probably not install a new virus scanner in safe mode.
• Start the virus scanner from the start menu (On-Demand scan for C: drive)
• Start a scan.
• If you cannot find anything, Copy Autoruns.exe to the computer, newer version will work best to find new viruses hiding places (optional)
• On the virus scanner, when it has finished make sure all the viruses confirm “Deleted” status as action taken.

• If that has not worked, Unzip and open Autoruns.exe, wait for it to load.
• After it loads enable both Options->Verify Code Signatures and Options->Hide Microsoft & Windows Entries.
• Press refresh.

• Look through the list of items that will start. You can temporarily disable things that look suspicious with the checkbox or right click and delete permanently. Be a little bit careful about mouse and keyboard items.
• Reboot.

Next topic in viruses: How to make all hidden files from Viruses on Flash Drives appear.

Karibuni wakufunzi wote!

"nakukabidhi mwenge"

Welcome TTC Tutors to the new Blog for ICT Departments at Teachers Colleges’ around Tanzania. I am a USA Peace Corps volunteer who has been working at Mpwapwa TTC since 2007. Over the next two months I would like to share many things we use at Mpwapwa TTC to make our lives easier at our ICT department. I always enjoy visiting wakufunzi wa taifa to share these tips. I have already visited 6 of the 33 colleges from Butimba to Vikindu, but I think it is difficult to visit more. I want to be free to focus on new projects in Mpwapwa before I finish my contract at the end of the year. Instead of visiting you, I’ll be offering the tips here. For the first month, every three days I will post a new entry, some of the topics I will be talking about are in the list below.

I will assume that your college is working with the Solaris system the Wakute Project put together in December 2008 with a new user management website (if that link doesn’t give an error, you are ready!). I’m also pretty sure that you have many Windows XP computers around your ICT center so I will have tips for those too. More resources are available at the Wakufunzi Google Group but these will be openly available for easy access and better organization.

I will try to include good instructions so that you can use the tips to improve your work at your TTCs. If you ever have questions I’m always happy to answer via email or text. I am on Zain at 0782516598, yahoo IM at thadk, and skype at thadknull.

Some things that I already plan to cover:

• Ideas on viruses and how they’re spread in East Africa, how you can control them.
• Three ways to show the hidden files on your USB flash and why viruses hide them. Even when viruses delete the files instead of hiding them there are good programs to try to recover your files (if you haven’t used the flash again)!
• How to access free video Solaris training materials at your TTC.
• Why is the internet slow today?
• How to set up a proxy server with Ubuntu to filter
• How to enable printing and the difficulties
• What should you include in a resources folder for your students?
• My bookmarks keep getting erased! How can I have my bookmarks anywhere duniani?
• Using Windows & WinSCP to download files like a flash from Solaris: tips and tricks with screenshots
• How to add sections to word processing documents so that roman numeral page numbering (i,ii,iii) and normal numbering can be in the same document in OpenOffice and Word.
• “Cloning” a lab of Windows or Ubuntu desktops with CloneZilla so you can install Windows once and refresh dirty computers in 20 minutes to an “image” that is saved on your Solaris Server or flash drive.
• What is fiber, when is it coming to my TTC and why does it matter for TZ?
• The importance of power protection in Tanzania, problems already seen at TTCs (save your comments!) and what to buy for your computer to prevent it from dying.

Nashukuru sana, urudi tena tafadhali!
thadk