Page 1 Viruses

Page 2 What Is a Virus A virus is basically a computer program that has been written to perform a specific set of tasks. Unfortunately, those tasks are often used to against us.

Page 3 What Is a Virus A virus may do any of the following: install itself on a computer in a way that makes it difficult to detect and remove replicate itself from the infected computer to other computers perform routine system file management processes such as file deletion and boot record modification copy information across a network link carry out its activities without any regard for the system or network resources it is utilizing.

Page 4 In the past, viruses were usually spread via floppy disks and computer modems. Today, most viruses are spread by USB memory sticks, CDs, DVDs, network shares, or . viruses are now the most common type of virus. What Is a Virus

Page 5 Types of Viruses There are three main types of viruses: A virus is malicious software which attaches to another program to execute a specific unwanted function on a computer. A worm executes arbitrary code and installs copies of itself in the memory of the infected computer, which then infects other hosts. A Trojan Horse is an application written to look like something else. When a Trojan Horse is downloaded and opened, it attacks the end user computer from within.

Page 6 Virusus Most viruses require end user activation and can lay dormant for an extended period and then activate at a specific time or date. Viruses can be harmless, such as those that display a picture on the screen, or they can be destructive, such as those that modify or delete files on the hard drive. Viruses can also be programmed to mutate to avoid detection.

Page 7 Worms are a particularly dangerous type of hostile code. They replicate themselves by independently exploiting vulnerabilities in networks. Whereas a virus requires a host program to run, worms can run by themselves. They do not require user participation and can spread very quickly over the network. Worms

Page 8 Worms are responsible for some of the most devastating attacks on the Internet. The SQL Slammer Worm of January 2003 slowed global Internet traffic as a result of Denial of Service. Over 250,000 hosts were affected within 30 minutes of its release. A patch for this vulnerability was released in mid-2002, so the servers that were affected were those that did not have the update patch applied. Worms

Page 9 Most worm attacks have three major components: Enabling vulnerability - A worm installs itself using an exploit mechanism ( attachment, executable file, Trojan Horse) on a vulnerable system. Propagation mechanism - After gaining access to a device, the worm replicates itself and locates new targets. Payload - Any malicious code that results in some action. Most often this is used to create a backdoor to the infected host. Worms

Page 10 The term Trojan Horse originated from Greek mythology. Greek warriors offered the people of Troy (Trojans) a giant hollow horse as a gift. A Trojan Horse in the world of computing is malware that carries out malicious operations under the guise of a desired function. A Trojan Horse contains hidden, malicious code that exploits the privileges of the user that runs it. Trojan Horses

Page 11 The term Trojan Horse originated from Greek mythology. Greek warriors offered the people of Troy (Trojans) a giant hollow horse as a gift. A Trojan Horse in the world of computing is malware that carries out malicious operations under the guise of a desired function. A Trojan Horse contains hidden, malicious code that exploits the privileges of the user that runs it. Trojan Horses

Page 12 The Trojan Horse concept is flexible. It can cause immediate damage, provide remote access to the system (a back door), or perform actions as instructed remotely, such as "send me the password file once per week." Trojan Horses

Page 13 Trojan Horses are usually classified according to the damage that they cause: Remote-access Trojan Horse - enables unauthorized remote access Data sending Trojan Horse - provides the attacker with sensitive data such as passwords Destructive Trojan Horse - corrupts or deletes files Proxy Trojan Horse - user's computer functions as a proxy server FTP Trojan Horse -opens port 21 Security software disabler Trojan Horse - stops antivirus programs or firewalls from functioning Denial of Service Trojan Horse - slows or halts network activity Trojan Horses

Page 14 The primary means of mitigating virus and Trojan Horse attacks is antivirus software. Antivirus software helps prevent hosts from getting infected and spreading malicious code. It requires much more time to clean up infected computers than it does to maintain up-to-date antivirus software and antivirus definitions on the same machines. Antiviruses

Page 15 Antivirus software is the most widely deployed security product on the market today. Several antivirus software companies, such as Symantec, Computer Associates, McAfee, and Trend Micro, have been in the business of detecting and eliminating viruses for more than a decade. Antivirus products have update automation options so that new virus definitions and new software updates can be downloaded automatically or on demand. Antiviruses

Page 16 How does antivirus software work? The three basic ways in which anti-virus software works are: 1.scans for viruses 2.removes viruses 3.offers limited protection against the installation of new viruses. The Antivirus ability to do these tasks depends on how up-to-date it is. Antiviruses

Page 17 A scan checks if software has not been altered by a virus. It will also check the computer’s RAM, hard disk drive (HDD) boot sector and each file on the drive. The anti-virus program will scan for patterns of bits, called signatures, which are known to match the program code of a virus. These ‘bit patterns’ are stored in a database called a Virus Definition File. Scanning for viruses

Page 18 Some anti-virus software will check for viruses passively. This means that when a file or document is accessed, the anti-virus program will automatically scan it. Scanning for viruses

Page 19 Methods for removing viruses vary greatly. Many virus programs come equipped with procedures to remove common viruses from the system. The type of actions required to remove a virus is different for each version of a virus. The most common methods of virus removal are: 1.Removal by the anti-virus program that detected it 2.Removal by a software utility from the anti- virus software support site 3.Manual removal following a written procedure. Removing viruses

Page 20 If you cannot remove a virus using the software the first place you should go is the company's website to check if a removal method has been found. If a virus has completely destroyed files on your computer and you can’t remove it the best action is to restore a backup or format your hard drive. Removing viruses