Computer Networks I Antivirus explained By: Daniel Josefsson Daniel Josefsson Kristoffer Wallin Kristoffer Wallin om>om>
Content History Malicious logic TrojansWormsViruses
Content, continued AntivirusScanningDictionaryHeuristicsSandboxingRemovalToday
History “I’M THE CREEPER : CATCH ME IF YOU CAN” Berndt Fix Beginning of 90’s Peter Tippett Virus distribution
Trojans Definition: A program with an overt (documented or known) effect and a covert (undocumented or unexpected) effect Payloads Remote Accessing Data Destruction Downloader Server Trojan(Proxy, FTP, IRC, , HTTP/HTTPS, etc.) Security software disabler Denial-of-service attack (DoS)
Worms Definition: A program that copies itself from one computer to another NetworkPayload
Viruses Definition: A program that inserts itself into one or more files and then performs some (possibly null) action InfectionVirus-Worms
Dictionary Requires frequently updated dictionary EncryptionPolymorphic
Heuristics Behavior Emulate files False positives
Sandboxing Emulate OS Performance issues
Removal Attempt to remove the malicious code Quarantine the file Delete the malicious file Might fail
Today Best detection rates by June 2008 (1) G DATA 2008 version % F-Secure 2008 version % TrustPort version % Detection of new viruses Whitelisting (1)