Prescription for computer-virus attacks
By Dana Dratch • Bankrate.com

If your computer has been acting a little strange lately, perhaps it's coming down with something.

A new computer virus seems to pop up every week. And the malicious programming comes with a high price tag, calculated in both customer and employee frustration as well as in actual dollars lost.

How's a small business, especially a home-based operation with no technical staff, to cope? In most cases, the infrastructure exists to help you get your machinery running again. But in some instances, you're going to have to pay professionals to repair and protect your company data.

Symptoms, diagnosis, isolation
The biggest challenge often is figuring out that your machinery is infected. Many times, users don't even know. But there are symptoms that indicate a potential problem.

Be on the lookout for the three Cs: crashing more than usual, corrupted files, and complaints from e-mail contacts that they are receiving infected messages you didn't send.

Once you're sure your equipment has a virus, identifying it is fairly easy. A handful of companies make anti-virus software, such as McAfee and Symantec. Many of them provide on their Web sites a diagnostic program, often for free, that can tell you which virus your machine contracted.

Next, disconnect from any kind of network. While some viruses are simply nuisances, others can destroy your business information and that of attached machines. Depending on which variety of pest you have, you also may need to disconnect from the Internet to prevent further damage. Then call anyone you, or any of your network users, may have infected. They're probably going to find out eventually, so it pays to be proactive and responsible.

And resist the temptation to transfer files from the contaminated computer to another one. By removing any data from the infected system, you risk transferring the virus to the new equipment.

Get, or update, software
Now to the cleanup. Anti-virus manufacturers share information readily, and many Web sites post step-by-step instructions on how to eliminate whatever is bugging your computer. Of course, it will cost you to actually rid your machine of the virus.

If you have access to an uninfected computer, use it to facilitate your fix. Otherwise, head to the nearest office supply store to buy a repair program.

Where the virus exploits a specific software's design, check that maker's Internet site, too. The manufacturer usually will post a fix or "patch" that you can download and install to correct the situation and prevent future problems.

Was outdated virus software the reason the bug slipped into your system? Update your version from the product's Web site and run it. Depending on the virus, you may have to go into the computer and change or delete files after you run the upgrade. If you're not comfortable with computers or confident that you understand what you're doing, this is the time to call a professional.

When to call in the cavalry
Because there is no one-size-fits-all solution to virus eradication, the complexity of your computer system also affects whether you'll need expert advice. Differences in software, hardware, networks, user choices, and the hundreds of viruses on the loose mean that what works perfectly for your company may not work for another. In fact, two computers on the same network can catch the same virus, with one losing data and the other coming through unscathed.

As a business owner, you have to make a tactical decision: At what point do you call in the experts?

Some things to consider:

• How many computers do you have? Are they leashed together in a network?
• How vital is your data? If you lose access to the computers for a few days, will profits dry up?
• How confidential is the information on your computers? Do you deal with customer credit card numbers or personal medical histories?
• How dangerous is the virus you are dealing with? Will it just replicate in an attempt to fill your hard drive or could it start spewing out confidential or compromising information?

If you call an expert, it will cost you $75 to $200 an hour depending on where you live, and you'll likely pay a two-hour minimum, says Michael Erbschloe, vice president of research with Computer Economics Inc., a computer research firm in Carlsbad, Calif. How long the job will take depends largely on how many computers you have, what you do with them and the infecting virus.

But the news is not all bad. In some cases, even deleted files can be restored, says Chris Wysopal, director of research and development for @stake Inc., a digital security consulting company based in Cambridge, Mass. If you have lost vital data, it's probably worth the money to pay a pro.

Special concerns: Web sites and e-commerce
Computer professionals also may be necessary if your company has a Web site or depends on e-commerce. In these instances, computers are more vulnerable to viruses and such operations demand a secure system.

If you host your own site, make sure your Webmaster understands the need for security and how to set it up and use it. Be sure that person understands what data is vulnerable, where in the system it could be compromised, and how to protect it. Ask your tech about anti-virus software, firewalls and security.

Firewalls are a must to block future infections. They are a particularly good idea for anyone who has a DSL or cable modem connection, since the machines are connected to the Internet all of the time and are more vulnerable to attack. Home-based businesses that connect via cable modem need a firewall apart from the one offered by the service provider.

Lawrence Rogers, senior member of the technical staff of CERT Coordination Center, part of the Software Engineering Institute at Pittsburgh's Carnegie Mellon University, likens it to the old party-line telephones. Since cable modems operate with a broadcast signal, someone who knows what they are doing could read your e-mail or tour the Web sites you've been visiting, he says. When Rogers discovered some suspicious activity on his own cable-modem system, he alerted the provider and installed personal firewalls on all his computers. Problem solved.

If someone else hosts your Web site, find out if the service has a firewall, what is allowed in and what isn't. Also check the host's virus protection software and the frequency of scans.

Generally, the price of anti-virus vigilance is not that high. A sole proprietor can pick up a firewall program, along with anti-virus software programs, for less than $50 each. Some manufacturers even sell the protective programs as a package.

Compared to what a virus could cost your company, either in down time, professional fixes or lost customers, the investment, says Rogers, "is a pretty good insurance policy."

Dana Dratch is a freelance writer based in Georgia.

-- Updated: Aug. 25, 2003