1. Copyright © 2007 Heathkit Company, Inc. All Rights Reserved PC Fundamentals Presentation 25 – Virus Detection and Prevention

2. 2 Objectives At the end of this presentation, you will be able to:

3. 3 Define virus, parasitic virus, worms, Trojan horses, bombs and macro virus and explain their differences and similarities. Identify several ways in which viruses are spread. Explain ways to prevent viruses. Explain methods of detecting and eliminating viruses.

4. 4 What is a Virus?

5. 5 A Virus is... An intentionally destructive computer program.

6. 6 A Virus is... Human generated versus machine generated.

7. 7 A Virus is... Somebody’s illness they intentionally give to you and hope you pass it on.

8. 8 Targets of a Computer Virus Hard disk drive Floppy disks CMOS

9. 9 How a Virus Spreads Infected Floppy Disk Virus Virus Virus Floppy Disks Virus Hard Disk Drive

10. 10 How a Virus Spreads Hard Disk Drive Virus Virus Virus Floppy Disks Virus From Network, BBS, or Internet

11. 11 Where Computer Viruses Hide Executable files (Parasitic Virus) The hard or floppy disk DOS Boot Record (Boot Sector Virus) Hard disk partition record continued...

12. 12 Where Computer Viruses Hide Added to the end of a legitimate program. In unused memory areas a program reserves for itself. In an empty disk sector. In memory as a fake TSR.

13. 13 Parasitic Viruses Attach themselves to executable programs and do their dirty work when that program is run.

14. 14 Boot Sector Viruses Loaded into memory when the computer boots from a drive (usually a hard disk drive) with an infected disk.

15. 15 Common Virus Types Worms Trojan Horses Bombs Macro

16. 16 The Worm Worm Worm Worm

17. 17 The Trojan Horse

18. 18 The Trojan Horse TNT

19. 19 The BOMB January 1, 2010 Monday, August 5 10 Minutes after this presentation starts Friday the 13th

20. 20 TNT Worm Worm Trojan Horse Bomb January 1, 2000 Monday, August 5 10 Minutes after this presentation starts

21. 21 Macro Virus Probably the most common virus today.

22. 22 Macro Virus Open a document with a Macro virus attached and you’ve got it.

23. 23 Macro Virus Often found in Word and Excel documents.

24. 24 Macro Virus Written in the application’s macro language.

25. 25 Macro Virus Easy to spread to another user.

26. 26 Macro Virus Often transferred over the internet.

27. 27

28. 28 The Checksum Binary Code Hexadecimal Value Binary Code Hexadecimal Value 1100 0110 0010 0100 C 6 2 4 0011 1001 0101 0001 3 9 5 1 0100 0010 1010 0101 4 2 A 5 0001 0111 1000 1101 1 7 8 D The Checksum 1 4 9 A 7 The Checksum 1 4 9 A 7

29. 29 Searching for Character Strings Some types of antivirus scanners find viruses by searching for character codes it knows are found in certain viruses.

30. 30 Polymorphic Viruses These viruses can change their appearance to trick virus scanners that search for character strings.

31. 31 Stealth Virus Virus Infected Boot Record Copy of Original Boot Record

32. 32 Preventing Viruses Preparing for the Virus Attack that will Strike Sooner or Later

33. 33 Virus Protection is a Tradeoff Time Investment AbsoluteNone Safety Try to be here

34. 34 Regular Backups are More Important than any Virus Protection Procedures Backup 11Jan09

35. 35 Use Software Only From Reputable Sources... Don’t use pirated software. Don’t borrow software. Don’t loan software. Make sure you have the original software distribution disks - floppies, CD-ROM, etc.

36. 36 Use a Virus Scanner Regularly Get the latest virus definitions from WWW. Educate users in using virus scanning software. Scan diagnostic and boot disks regularly. Get the latest virus definitions from WWW. Educate users in using virus scanning software. Scan diagnostic and boot disks regularly.

37. 37 Have an Emergency Virus Scanner Disk Bootable Virus Scanner Emergency Disk

38. 38 Have a Quarantine Machine for Disk Testing Scan disks on quarantine machine. Load the disk contents onto quarantine machine HDD and scan. Cold boot quarantine computer from your EBD and check hard disk.

39. 39 The Big Question ? Is it Worth all the Time and Trouble?

40. 40 If you get a virus... Ignore messages saying “Do not turn this computer off or the data will be destroyed”. Cold boot from the EBD, run scanner and clean infected files. Scan any recently used floppies.

41. 41 If you get a virus... Reboot using your emergency disk. Use your virus scanner to find and remove the virus. Re-partition, format, and reload software if scanner can’t remove virus.

42. Copyright © 2007 Heathkit Company, Inc. All Rights Reserved PC Fundamentals End