A relatively minor enhancement to Windows 2000 could prevent most viruses from infecting users' PCs a software expert said this week.
Peter Morris, head of technology at software consultancy The Mandelbrot Set (TMS), said the Windows 2000 operating system could be adapted by Microsoft to prevent any unauthorised application from accessing users' hard discs, thus eliminating the threat of virus attacks.
The Love Bug used a Trojan horse to lure users into opening the infected e-mail message, which ran a Visual Basic script. Although a simple deception, Morris warned that users could easily be fooled into opening e-mail messages that contain seemingly innocuous attachments.
Illustrating the ease with which a virus writer could conceal a virus as a photograph e-mailed from a friend, Morris said, "I could send you a virus program in your e-mail which would appear in your in-box as an attachment with an icon depicting an image." Any user double-clicking on the icon would infect their PC with the virus.
As the Love Bug demonstrated, anti-virus software only offers protection once the virus has done some damage. However, if Windows 2000 was modified it could prevent any e-mail attachment from attempting to do something unauthorised before the anti-virus software detected the attack.
Morris said, "Users need the operating system to be proactive to prevent viruses from causing damage."
In response to the Love Bug virus Microsoft has developed a security patch for Outlook. The patch closes a security hole in Outlook exploited by virus writers by preventing e-mail attachments containing programs or scripts to run and alerting users when a program accesses their address book.
One of the main reasons the Love Bug was allowed to spread was because the Outlook e-mail software on users' PCs is capable of running Visual Basic scripts.
Bob Brace, vice-president at Nokia Internet Communications, said, "I can see no advantage for a user in having Visual Basic in e-mail software. This was a basic flaw in Outlook's design."
When features like scripting are disabled, viruses transmitted over e-mail are not be able to infect PCs.