2.  Application software consists of programs designed to make users more productive and/or assist with personal tasks.  Growth of internet simplified the spread of malware  Most personal computer are being or have been infected by some malware  Most people think they are safe under the protection of anti-virus software  Malware, short for malicious software or malicious-logic program, consists of programs designed to disrupt computer operation, gather sensitive information, gain unauthorized access to, or even control computer systems remotely. › Virus  Disruption › Trojan  Gather information, gain unauthorized access › Rootkit  Hide other malware so that they are hard to detect even using anti-virus software. 2

3.  Computer virus: A program that can replicate itself, conceal itself and deliver the payload. › The payload: destructive event or prank  Some virus has the functionality of mutation. 3

4.  How it Spreads 4

5.  Execution phases › Infection  Replication  Concealment  Setting up Trigger › Delivery  Deliver the actual activity which may harm the infected computer or just display a prank 5

6.  Replication › Hide in one legal file  Macro(a way to create a shortcut for a task)  In macro language of document file: for example, word  Executable file  Change the instructions of an legal executable file  Master boot record  Load itself whenever the computer starts › Once the infected file is executed or opened, the virus copy itself and attach the copies to other legal files in the computer. 6

7.  Replication 7

8.  Concealment › Hide in fake code sections › Polymorphic virus: Can mutate by changing its own code. 8

9.  Setting up trigger › Purpose of virus  Display a prank  Disrupt your hard disk  Cause irregular screen behavior  Disable certain functionalities  And more….  May do nothing but copying themselves and kept spreading 9

10.  Setting up trigger › According to the purpose, the virus will be configured to activate under certain conditions.  Logic Bomb: Activate when virus detects certain condition  Example: If user is logging on, then display a message saying that the users are infected.(prank virus)  Time Bomb: Activate when it is certain time and date.  Example: If it is year 2012, then display a message saying that the doom day is coming. › A time bomb is also a logic bomb 10

11.  Execution phases › Infection  Replication  Concealment  Setting up Trigger › Delivery  Deliver the actual activity (in the payload) which may harm the infected computer or just display a prank. 11

12.  Worm › Resides in active memory and replicates itself over the network to infect machines  Trojan horses › disguise themselves as legal application, however providing unauthorized access or sensitive information to malicious remote users  Rootkit › is a program that easily can hide and allow someone to take full control of your computer from remote location, often for nefarious purposes. 12

13.  Comparisons 13 MalwareSoftware levelReplicationConceal existence Conceal behavior Deliver payload Infect local files Infect et network VirusApplicationYes NoYes No TrojanApplicationNoYes No WormsApplicationYesYes/NoNoYesNoYes RootkitOperating System NoYes No

14.  Tips › Install latest updates of your operating systems  Why updates are important. › Install a reputable anti-virus program › Update your anti-virus definitions frequently.  How does anti-virus applications work › Install personal firewalls program. › Be careful while visiting a web page that you are not familiar with, reading an email from unknown address or inserting usb flash drive into your computer. 14

15.  Symptoms of malware attacks 15  Computer can’t boot up properly  Screen sometimes freezes  System frequently crashes  Abnormal hard disk activities  Computer runs slower than usual

16.  Solution 16  Run a fun disk scan using your anti-virus applications  If nothing was found  Look up the running processes  Ctrl-alt-delete open task manager  Regular process should have a regular name. (afege10x98.exe is obviously a suspicious process)  Look up the registry. (Don’t try if you are not familiar with it)

17.  Smalltalk: › Why anti-virus sometimes doesn’t work  Anti-virus application provides:  Specialists who are responsible for discovering new malware  For found malware, give it a signature and identify the characteristics of the code it will inject into the infected files.  These signature- characteristics pairs will be stored in the definitions of the anti-virus application.  Users download the definitions to their local machines and go over the files to see if any of them contains the characteristics  Problem: It can only detect known malware, but most of the spreading malware kept unknown! 17

18.  Protecting your computer requires 18

19.  References http://www.securelist.com/en/descriptions/ Email-Worm.Win32.Magistr.a http://techblog.avira.com/2008/12/19/clea ning-polymorphous-infected-files/en/