1. Computer Viruses and Worms

2. WHAT IS VIRUS? Computer viruses are small software programs that are designed to spread from one computer to another and to interfere with computer operation. A virus might corrupt or delete data on your computer, use your e- mail program to spread itself to other computers, or even erase everything on your hard disk. Viruses are most easily spread by attachments in e-mail messages or instant messaging messages. That is why it is essential that you never open e-mail attachments unless you know who it's from and you are expecting it. Viruses can be disguised as attachments of funny images, greeting cards, or audio and video files. Viruses also spread through downloads on the Internet. They can be hidden in illicit software or other files or programs you might download. To help avoid viruses, it's essential that you keep your computer current with the latest updates and antivirus tools, stay informed about recent threats, and that you follow a few basic rules when you surf the Internet, download files, and open attachments. Once a virus is on your computer, its type or the method it used to get there is not as important as removing it and preventing further infection

3. Definition of Virus A virus is a small piece of software that piggybacks on real programs in order to get executed Once it ’ s running, it spreads by inserting copies of itself into other executable code or documents

4. General information about computer virus Different Malware Types. Malware is a general name for all programs that are harmful; viruses, Trojan, worms and all other similar programs. Viruses A computer virus is a program, a block of executable code, which attach itself to, overwrite or otherwise replace another program in order to reproduce itself without a knowledge of a PC user. There are a couple of different types of computer viruses: boot sector viruses, parasitic viruses, multi-partite viruses, companion viruses, link viruses and macro viruses. These classifications take into account the different ways in which the virus can infect different parts of a system. The manner in which each of these types operates has one thing in common: any virus has to be executed in order to operate. Most viruses are pretty harmless. The user might not even notice the virus for years. Sometimes viruses might cause random damage to data files and over a long period they might destroy files and disks. Even benign viruses cause damage by occupying disk space and main memory, by using up CPU processing time. There is also the time and expense wasted in detecting and removing viruses.

5. What do viruses do? Once an attacker manages to exploit a weakness, they can run any code they want on the victim’s machine. Attack codes vary in what they try to do. Have you ever suffered a computer attack? What happened to your machine? How hard was it to recover?

6. What a computer virus do? A virus tries to take control of computer system it has infected at the first opportunity availible.it makes copies of itself and also try to carry harmful task written in its program. This process can happen so quickly that the user is not even aware of the presence of a virus in his/her computer.

7. Types of computer Virus. There are three types of computer virus  Boot virus  Program virus  Micro virus

8. Types of Infection VIRUSES E-MAIL VIRUSES WORMS TROJAN HORSES

9. Viruses A virus is a small piece of software that piggybacks on real programs. 2 main characteristics of viruses  It must execute itself.  It must replicate itself.

10. Virus Virus might attach itself to a program such as spreadsheet. Each time the spreadsheet program runs, the virus runs too and replicate itself.

11. Top 5 Sources of Computer Virus Attack  The most potent and vulnerable threat of computer users is virus attacks. Virus attacks hampers important work involved with data and documents. It is imperative for every computer user to be aware about the software and programs that can help to protect the personal computers from attacks. One must take every possible measure in order to keep the computer systems free from virus attacks. The top sources of virus attacks are highlighted below:  Downloadable Programs  Cracked Software  Email Attachments  Internet  Booting From CD

12. – File infector virus Infect program files – Boot sector virus Infect the system area of a disk – Master boot record virus infect disks in the same manner as boot sector viruses. The difference between these two virus types is where the viral code is located. – Multi-partite virus infect both boot records and program files – Macro virus infect data files. Examples: Microsoft Office Word, Excel, PowerPoint and Access files Types of Viruses

13. Boot Sector Viruses Traditional Virus Infects the boot sector on floppy disks and hard disks By putting its code in the boot sector, a virus can guarantee it gets executed Load itself into memory immediately, and it is able to run whenever the computer is on

14. Boot virus: Boot viruses infects the boot records of hard disk and floppy disks. Generally these are considered more dangerous than program viruses.

15. Decline of traditional viruses Reasons: – Huge size of today’s programs storing on a compact disk – Operating systems now protect the boot sector

16. Macro Viruses These viruses infects data files. For example, Microsoft word document and template files are susceptible to macro virus attacks they spread rapidly as infected documents are shared on networks or downloaded from internet sites.

17. Program Virus These viruses infect program files, which have extensions such as.COM,.EXE.,SYS.,DLL,.OVL, or.SCR. program files are attractive targets for computer virus because they are widely used and have relativity, simple formats to which viruses can attach themselves.

18. Video https://www.youtube.com/watch?v=afzkoB_lY Nk https://www.youtube.com/watch?v=afzkoB_lY Nk https://www.youtube.com/watch?v=lbXWO_C zQR0 https://www.youtube.com/watch?v=lbXWO_C zQR0

19. What does malware do? Some attackers just want to see if they can make an attack succeed. – The malware they write may simply displaying something to the user or announce its presence in another way. Other attackers want to do damage to others without trying to benefit directly. – The malware they write might delete files or otherwise corrupt the system.

20. What does malware do? (continued) Still others try to write malware that steals information from the victim. – The malware they write might search for credit card numbers or other personal information and send it back to the attacker. – Spyware might watch for victim’s passwords or otherwise spy on their online activity.

21. Trojan A Trojan Horse is a program that does something else that the user thought it would do. It is mostly done to someone on purpose. The Trojan Horses are usually masked so that they look interesting, for example a saxophone.Wav file that interests a person collecting sound samples of instruments. A Trojan Horse differs from a destructive virus in that it doesn't reproduce. There has been a password trojan out in AOL land (the American On Line). Password30 and Pasword50 which some people thought were wav. files, but they were disguised and people did not know that they had the trojan in their systems until they tried to change their passwords. According to an administrator of AOL, the Trojan steals passwords and sends an E-mail to the hackers fake name and then the hacker has your account in his hands.

22. Worms Worm - is a self-replicating program, similar to a computer virus. A virus attaches itself to, and becomes part of, another executable program; however, a worm is self-contained and does not need to be part of another program to propagate itself.

23. Worms… Worms – is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well. They are often designed to exploit the file transmission capabilities found on many computers.

24. Worm A worm is a program which spreads usually over network connections. Unlike a virus which attach itself to a host program, worms always need a host program to spread. In practice, worms are not normally associated with one person computer systems. They are mostly found in multi-user systems such as Unix environments. A classic example of a worm is Robert Morris Internet-worm 1988.

25. History of Worms The first worm to attract wide attention, the Morris worm, was written by Robert Tappan Morris, who at the time was a graduate student at Cornell University. It was released on November 2, 1988 Morris himself was convicted under the US Computer Crime and Abuse Act and received three years probation, community service and a fine in excess of $10,000.

26. Videos https://www.youtube.com/watch?v=y8a3 QoTg4VQ https://www.youtube.com/watch?v=y8a3 QoTg4VQ Removing Viruses https://www.youtube.com/watch?v=yy- lapv-nqM https://www.youtube.com/watch?v=yy- lapv-nqM

27. Other types of virus Bacteria, also known as rabbits, are programs that do not directly damage the system. Instead they replicate themselves until they monopolize CPU, memory or disk space. This constitutes a denial of service attack.

28. A bomb is actually a type of Trojan horse that can be used to release a virus or bacteria. Bombs work by causing an unauthorized action at a specified date, time or when a particular condition occurs. There are two types of bombs; logic and time. Logic bombs are set to go off when a particular event occurs. Time bombs go off at a specified time, date or after a set amount of time elapses.

29. Salami cut away tiny pieces of data. They can be particularly dangerous as the damage they do is small and can be attributed to some truncation of the system. It is possible for a salami to do a great deal of damage before it is found.

30. Zombies Infected computers — mostly Windows machines — are now the major delivery method of spam. Zombies have been used extensively to send e-mail spam; between 50% to 80% of all spam worldwide is now sent by zombie computers

31. Kaspersky ANTIVIRUS Kaspersky is product of Kaspersky lab, A Russian computer security company, Co-founded by Natalya Kaspersky antivirus, do the following things Invites virus scan by opening the Kaspersky antivirus window.

32. Money flow Pay per click

33. Typical things that some current Personal Computer (PC) viruses do Display a message

34. Typical things that some current Personal Computer (PC) viruses do Erase files Scramble data on a hard disk Cause erratic screen behavior Halt the PC Many viruses do nothing obvious at all except spread! Display a message Display a message

35. Distributed Denial of Service A denial-of-service attack is an attack that causes a loss of service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system.

36. How it works? The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users. Victim's IP address. Victim's port number. Attacking packet size. Attacking interpacket delay. Duration of attack. MyDoom – SCO Group

37. DDoS

38. MyDoom 26 January 2004: The Mydoom virus is first identified around 8am. Computer security companies report that Mydoom is responsible for approximately one in ten e-mail messages at this time. Slows overall internet performance by approximately ten percent and average web page load times by approximately fifty percent

39. MyDoom… 27 January: SCO Group offers a US $250,000 reward for information leading to the arrest of the worm's creator. 1 February: An estimated one million computers around the world infected with Mydoom begin the virus's massive distributed denial of service attack— the largest such attack to date. 2 February: The SCO Group moves its site to www.thescogroup.com.

40. Executable Viruses Traditional Viruses pieces of code attached to a legitimate program run when the legitimate program gets executed loads itself into memory and looks around to see if it can find any other programs on the disk

41. Videos https://www.youtube.com/watch?v=pFBYjmh Mo6E https://www.youtube.com/watch?v=pFBYjmh Mo6E https://www.youtube.com/watch?v=jC6Q1uC nbMo https://www.youtube.com/watch?v=jC6Q1uC nbMo

42. E-mail Viruses Moves around in e-mail messages Replicates itself by automatically mailing itself to dozens of people in the victim ’ s e-mail address book Example: Melissa virus, ILOVEYOU virus

43. Melissa virus March 1999 the Melissa virus was the fastest-spreading virus ever seen Someone created the virus as a Word document uploaded to an Internet newsgroupInternet newsgroup People who downloaded the document and opened it would trigger the virus The virus would then send the document in an e-mail message to the first 50 people in the person's address book

44. Melissa virus Took advantage of the programming language built into Microsoft Word called VBA (Visual Basic for Applications)

45. I Love You Virus (May,2000) Contained a piece of code as an attachment. Double Click on the attachment triggered the code. Sent copies of itself to everyone in the victim’s address book Started corrupting files on the victim’s machine.

46. Code Red (Worm) Code Red made huge headlines in 2001 It slowed down internet traffic when it began to replicate itself. Each copy of the worm scanned the internet for Windows NT or Windows 2000 that don’t have security patch installed. Each time it found an unsecured server, the worm copied itself to that server.

47. Code Red Worm Designed to do three things  Replicate itself for the first 20 days of each month.  Replace web pages on infected servers with a page that declares “Hacked by Chinese”  Launch a concreted attack on the White House Web server

48. Symptoms of Infection Programs take longer to load than normal. Computer’s hard drive constantly runs out of free space. The floppy disk drive or hard drive runs when you are not using it. New files keep appearing on the system and you don’t know where it come frm.

49. Symptoms of Infection Cont.. Strange sounds or beeping noises come from the computer. Strange graphics are displayed on your computer monitor. Unable to access the hard drive when booting from the floppy drive. Program sizes keep changing.

50. Protection TO protect yourself you need to be “Proactive” about Security issues. Being reactive won’t solve anything; Specially at crunch time and deadlines!! In matter of fact it can make the problem much more complex to solve, and the situation much worse, resulting in a complete Nightmare!! Best Measures are the preventative ones.

51. Protection Measures You need to basically to do four steps to keep your computer and your data secure: 1. Get the latest Anti-Virus Software. 2. Make sure you have the latest security patches and hot fixes using Windows Update. 3. Use a Host-Based Firewall. 4. BACKUP your Important Files.

52. Malware The most general name for a malicious computer program is malware. You may have heard computer programs called software. The word malware comes from MALicious softWARE.

53. How does malware invade your computer? You have probably heard of some ways that malware can invade your computer. What are they? – Through email attachments – By clicking on a web link when surfing the web – By downloading a program that claims to be a game or cool picture – Others?

54. Front Door Attacks What do many of these attacks (through email, web browsing or downloads) have in common? – They all require the actions of a legitimate user. They can be considered “front door” attacks because a user is tricked into opening the door for the attack through their action.

55. Understanding Front Door Attacks The key to understanding front door attacks is that when you run a program it runs with *all* your rights and privileges. – If you can delete one file, any program you run can delete all your files. – If you can send one email, any program you run could send thousands of spam emails. This includes any program you run even accidentally by opening an email attachment or clicking on web link.

56. Back Door Attacks Not all attacks require action by a legitimate user. “Back door” attacks target vulnerabilities in server software that is running on your computer. Server software is software that listens for requests that arrive over the network and attempts to satisfy these requests. – A web server is an example of server software.

57. Are you running any servers? Most home computer users think they are not running any server software. However you would be surprised. For example, most default installations of Windows run a number of network services by default.

58. How can you check? At a Windows command prompt, type the command “netstat –an”. It will display a list of server software that is listening for requests over the network.

60. Things to Notice In the List The server listening on port 135 was attacked by the Blaster worm. The server listening on port 435 was attacked by the Sasser and Korgo worms.

61. Server Software Server software is designed to provide useful features. – For example, server software allows you to mount files from other computers or share printers between computers etc. So how then can server software be used to attack a computer?

62. Legitimate vs Illegitimate Requests Basically server software receives a request over the network, examines the request and decides if it can satisfy the request – Legitimate requests do not cause an attack. – Most illegitimate requests do not cause attacks either because the server simply answers that it does not understand or cannot satisfy a request.

63. Carefully crafted, devious requests To attack server software, authors of malware do not just send any old illegitimate request. They send very carefully crafted illegitimate requests that exploit a weakness or flaw in the server software.

64. What is an example of such a weakness? (part 1) When programmers write server software, they write it to listen for requests that come in over the network. They might assume that no request will ever be longer than 1000 letters long. This might be a perfectly valid assumption for all reasonable requests, but an attacker might send a request that is 100,000 letters long.

65. What is an example of such a weakness? (part 2) If the server only left room for 1000 letters, then the rest of the letters may get copied over the legitimate program instructions. Thus, the request sent by the attacker takes the place of the legitimate program instructions and the server starts to execute the attackers code instead.

66. Buffer Overflow Attacks This type of attack is called a “buffer overflow attack” because it overflows the buffer of space left for a request with too many characters. Such an attack could be prevented if the server always checked for requests that are too long. – Sometimes programmers neglect to do that and this is what produces the weakness or flaw that is exploited by the attacker. – If you are learning to program, you should know that you can prevent many viruses by following good programming practices.

67. Buffer Overflow Attacks Aren’t Easy The attacker must – Know how long of a request to send – Send precisely the right data that can be interpreted as instructions by the server – Find a machine running a server with that weakness. If the attacker sends the wrong data, the server might crash instead of running the attackers instructions.

68. Exploiting a weakness If an attacker crafts an attack that works on their local machine then chances are that it will work on many other machines. Attackers tend to target the most common computing platform – Windows – so that their attacks will impact the most machines.

69. What does malware do? (continued) Still others write malware that uses the victim’s computer for their own purposes. – Use it to store files (often illegal) and make them available to others – shifting liability away from the attackers. – Use it to attack other computers – making it harder to trace the attack to its real source.

70. Self-replicating Regardless of its other goals, a large percentage of malware tries to spread itself automatically. Malware programs may try to spread by – Sending out email with infected attachments. – Send out carefully-requests back door attack packets.

71. Consequences of Attacks If you have ever been attacked by a computer virus, you know the damage it can cause – Your computer can begin to run very slowly and constantly pop-up annoying messages that make it difficult to do anything productive. – Having the virus removed by a technician can be expensive and time-consuming. – The virus itself may destroy irreplaceable files like family pictures or videos. Even if the virus itself does not cause data loss, often the process of removing the virus can require reinstalling the operating system and all the programs. – Your credit card or other private information can be stolen.

72. World-wide damage estimates Computer viruses cause a huge amount of damage worldwide. – Damages from just one virus (The I Love You Virus) are estimated at $10 billion dollars. It is also estimated that 45 million people worldwide were affected. Costs come from restoring damaged systems, replacing lost information, steps taken to prevent attacks and steps taken to prepare to recover from attacks.

73. Case Jason, a 16 year old honor student, wrote a computer virus that causes 4 billion dollars of damage and impacted countless home and business computers. The authorities traced the virus to him. Jason says that he is very sorry and didn’t mean for it to get so out of hand. He said he was just fooling around to see if he could do it.

74. Discussion How would you feel if you were a friend of Jason’s? How would you feel if you had lost your entire MP3 collection or a book report you had worked on for 3 weeks? What type of punishment would recommend in this case?

75. Blackhat vs Whitehat Blackhat computer hackers look for flaws in software to exploit them or break into computer for malicious purposes. Whitehat computer hackers look for flaws in software to fix them or attempt to break into computers to audit their security.

76. What do whitehat hackers do? Analyze server software for flaws that could be exploited and recommend fixes. Analyze new viruses or malware to characterize what they are doing and to build patches. Audit the overall security of computer systems.

77. Defenses Even if you are not whitehat hacker there is a lot you can do to defend your computer against attack Defending against front door attacks means being careful about what programs you run and what attachments and links you open Defending against back door attacks means knowing what services are running on your machine and keeping them patched

78. Defending against front door attacks 1) Be careful opening email attachments even from friends. 2) Be careful clicking on web links found on less reputable web sites. 3) Beware of free downloads that seem too good to be true. 4) Use a good virus scanner and keep your virus signatures up- to-date. 5) Consider using less popular email readers and web browser software.( Attackers target the most popular software.) There are excellent and free open source options.

79. Defending against back door attacks 1) Use netstat to see what services are running. 2) Periodically check to see if any new services have been started. 3) Keep your server software patched and up- to-date. 4) Consider shutting down any services you do not need.

80. Prepare to recover from an attack No matter how careful you are it is still wise to prepare to recover from an attack if one does occur. – 1) Back up your personal data such as digital pictures, letter and papers you’ve written, your address book, etc. – 2) Keep track of the software you’ve installed on your computer including where you got it and any activation keys you paid for.

81. HOW DO I REMOVE A COMPUTER VIRUS? If your computer is infected with a virus, you'll want to remove it as quickly as possible. A fast way to check for viruses is to use an online scanner, such as the Microsoft Safety Scanner. The scanner is a free online service that helps you identify and remove viruses, clean up your hard disk, and generally improve your computer's performance. If you're not sure whether your computer has a virus, see How can I tell if my computer has a virus? to check for some telltale signs. To try a different online scanner, follow the links to other companies that provide them on the Windows Security software providers webpage. To run the Microsoft Safety Scanner 1.Go to the Microsoft Safety Scanner webpage to download the scanner. 2.Click Download Now, and then follow the instructions on the screen. If you can't connect to the Internet If you can't get to the Microsoft Safety Scanner online, try restarting your computer in safe mode with networking enabled. To restart in Safe Mode with networking enabled 1.Restart your computer. 2.When you see the computer manufacturer's logo, press and hold the F8 key. 3.On the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking, and then press Enter. 4.Log on to your computer with a user account that has administrator rights. 5.Follow the steps above to run the Microsoft Safety Scanner

82. Prevention Updates Anti-Viruses More secure operating systems e.g. UNIX

83. Best antivirus software.  Norton antivirus.  MacAfee virus scan  Kaspersky antivirus

84. Norton antivirus Norton antivirus is a product of Symantec corporation. Founded in 1982. Notion check the following program Boot record s Programs(at the time you used them) All local hard drives, Files download from internet, Usb(when in use)

85. MacAfee virus scan MacAfee, Inc. is an antivirus software and computer security company headquartered in Santa Clara, California. It markets McAfee Virus Scan and related security products and services, including the Intercept, and Found stone brands....

86. CONCLUSION There are lots of viruses in the world and new viruses are coming up every day. There are new anti-virus programs and techniques developed too. It is good to be aware of viruses and other malware and it is cheaper to protect you environment from them rather then being sorry. There might be a virus in your computer if it starts acting differently. There is no reason to panic if the computer virus is found. It is good to be a little suspicious of malware when you surf in the Internet and download files. Some files that look interesting might hide a malware. A computer virus is a program that reproduces itself and its mission is to spread out. Most viruses are harmless and some viruses might cause random damage to data files. A trojan horse is not a virus because it doesn't reproduce. The trojan horses are usually masked so that they look interesting. There are trojan horses that steal passwords and formats hard disks. Knowing the different kinds of attacks and the goals of attackers can help you understand how better to defend yourself.

87. Conclusion Be aware of the new infections out there. Take precaution measures. Always backup your data. Keep up-to-date on new Anti virus software. Simply avoid programs from unknown sources.