Computer Viruses

1. Computer Viruses Philip and Luke

2. What is a Computer Virus? • "A parasitic program written intentionally to enter a computer without the users permission or knowledge. The word parasite is used because a virus attaches to files or boot sectors and replicates itself, thus continuing to spread. Though some virus's do little but replicate others can cause serious damage or effect program and system performance. A virus should never be assumed harmless and left on a system." -Symantec • Thus, a computer virus is a computer program written by a person who designed it to spread to as many computers as possible.

3. Brain In Pakistan Basit Farooq Alvi and Amjad Farooq Alvi ran a computer store called Brain computer services. They soon discovered that a floppy disk contained computer instructions that were executed when the computer was first turned on. Basit and Amjad used this knowledge for their own purposes and created computer instructions that would change the label of floppy disks in the computer to (C) Brain. The instructions would make a copy of themselves onto other floppy disks that were inserted into the floppy-disk drive. Brain did nothing other than change a floppy’s label and copy itself to other floppies, but that was sufficient to cause trouble. People continued to do what they had been doing for a few years: exchanging computer programs and files using the only available means – circulating them on floppy disks. At first, no one noticed that some of these floppies had a stowaway on board. In 1987, users at the University of Delaware began noticing that the labels on some of the floppies were mysteriously being changed to (C) Brain. The Brain virus had made its way from central Asia to North America – and doubtless, to the other countries of the world.

4. Progression in Early Viruses Soon after Brain, other viruses appeared, such as Jerusalem, Miami, Alameda, Cascade and Lehigh. These viruses were small sets of computer instructions that covertly implanted themselves somewhere on a floppy disk and could copy themselves from disk to disk. But unlike Brain, some of these viruses were more harmful. The Jerusalem virus would delete any program that a person ran on any Friday the 13th. It was named Jerusalem because it was first detected at Hebrew University in Israel and was thought to have originated there. The Alameda virus would copy itself when the computer used pressed Ctrl+Alt+Del (the sequence used in those days to restart the computer). Some descendents (known as “variants”) of Alameda virus on newer PC’s with hard drives would erase the contents of the hard drive after the virus had been activated a set number of times. The Cascade virus has disrupting, but also humorous effects. When the virus was activated, the characters on-screen would “fall”, pilling in a heap at the bottom of the screen. The results looked funny to just about anybody but the victim.

5. How Viruses Have Evolved With Time Viruses are more sophisticated since they started gaining wide recognition in the 1980s. When Norton AntiVirus and other tools were successful at detecting and removing viruses from computers, the struggle was on: The people who wrote viruses knew they had to stay one step ahead; they developed ways to make their viruses more difficult to detect.

6. How Early Viruses Spread from Computer to Computer • In the md-to-late 1980s, data was most often transferred from computer to computer by using floppy disks and so-called bulleting board systems (BBSs), managed online locations that were the forerunners of today's websites. • In the past viruses spread relatively quickly as few people had antivirus protection.

7. Why do People Write Viruses? There is an entire ‘community’ of virus writers, hackers, crackers, and others who compete and try to outdo one another to gain status and respect amongst themselves. This is the main reason people write viruses. To prove how this is true hackers gather at conventions such as the annual Defcon in Las Vegas and have contests to award their viruses. They also publish some magazines, like 2600 Magazine and Phrack. Another reason people write viruses is out of pride and try and outdo their own limits as programmers.

8. The Origins of Antivirus Tools • In 1991, Symantec released the first version of Norton Antivirus. Programs like Norton are designed to find and eliminate viruses from a computer, usually with three goals in mind: • Make the virus stop doing harm to the computer it has infected. • Stop the spread of the virus. • Limit any further harm the virus can do. Early antivirus programs had a database that contained information about each virus. The database would contain some of that were found in each virus. Then, as the antivirus program scanned files on the computer, it would simply compare the information in the scanned files with the information about each known virus. When there was a match, the antivirus program would have found a virus. The database would have contained signatures for several dozen viruses and this would have been updated every few months. There was no “real-time” detection, only scans were available to detect viruses that were already on the computer.

9. Trojan Horses, Worms, Spam and Hoaxes • Viruses are not the only bad things that can happen to you and your computer. • Worms: These are like viruses in that they spread from computer to computer, with the aim to wreck everything they touch. But unlike viruses, which attach themselves to another file or program in order to be transported, a worm has its own “propulsion system” built right in. Worms spread amazingly fast through the Internet by scanning for computers that have particular vulnerabilities. • Trojan Horses: These are destructive programs that disguise themselves as a normal beneficial program. These have to be opened by the user to function and when functioning a Trojan horse can have destructive characteristics; such as deleting files or corrupting directories. • Spam: • Phishing Spam: These are attempts to trick us into giving private information to official-looking Websites. • Hostile Web Sites: Sometimes harmless-looking sites actually attempt to alter our Web browsers and plant viruses or spyware in our computers • Hoaxes: These are schemes designed to prey on our trusting nature, either by scaring us with fake virus warnings or tricking us into sending money, information or e-mail access to black hats.

10. Types of Viruses • To date there are three primary types of viruses that exist today: • File-infector viruses - which attach themselves to program files. • Boot-sector viruses - which install themselves in a hard drive’s or floppy’s boot sector • Macro viruses - which go into Microsoft Word and Excel documents.

11. File Infector • As one of the most popular types of viruses, a file-infector virus arrives embedded or attached to a computer program file – a file with an .EXE extension in its name. When the program runs, the virus instructions are activated along with the original program. The virus carries out the instructions in its code – it could delete or damage files on your computer, attempt to implant itself within other program files on your computer, or do anything else that its creator dreamed up to cause havoc. • The presence of a file-infector virus can be detected in two major ways: • The size of a file may have suspiciously increased. If a program file is too big, a virus may account for the extra size. At this point, you need to know two things: • What size the file(s) should be when fresh from the software maker. • Whether the virus is a cavity seeker – a dangerous type that hides itself in the unused space in a computer program. • The signature of a known virus turns up in an antivirus scan. The signature – a known, characteristic pattern that “fingerprints” a particular virus – is a give away that a virus is embedded within a program file – provided your antivirus software knows what to look for.

12. Stealth Viruses • To stay one step ahead of antivirus programs, virus writers began to incorporate some advanced techniques in their viruses in order to avoid detection: These include: • Encryption: The virus can attempt to scramble its code to avoid detection. Some viruses can rescramble themselves differently each time they’re scanned for, so the encrypted code cannot form a part of the virus signature. • Cavity-Seeking: Because an infected file betrays the presence of a virus by being bigger than it should be, some viruses are designed to find – and fit into – leftover space in the files they infected. The idea is to avoid changing the file size, making the virus a little harder to detect. The approach is typical of virus writers who known how antivirus programs work.

13. Boot Sector While less common today, boot-sector viruses were once the mainstay of computer viruses. A boot-sector occupies the portion (sector) of a floppy disk or hard drive that the computer first consults when it boots up. The boot sector provides instructions that tell the computer how to start up; the virus tells the computer to load itself during that start up.

14. Macro During the late 1990s and early 2000, macro viruses were the most prevalent viruses. Unlike other virus types, macro viruses are not specific to an operating system and spread with ease via email attachments, floppy disks, Web downloads, file transfers, and cooperative applications. Popular applications that support macros (such as Microsoft Word and Microsoft Excel) are the most common platforms for this type of virus.  These viruses are written in Visual Basic and are relatively easy to create. Macro viruses infect at different points during a file's use, for example, when it is opened, saved, closed, or deleted.

15. How Viruses Spread A virus can be successful only if it has a way to spread from computer to computer. Otherwise, the virus remains only on the computer where it originated.

16. Floppies and CD-ROMs Floppy disks and, later, CD-ROMs and other removable media, were one of the earliest routes for viruses to make the jump from computer to computer. In the 1980s, floppy disks were the primary means for copying data – and viruses – from computer to computer and from person to person. Typically, files that were already infected with viruses were copied to the removable media and ended up on one or more other computers. File-infector viruses were then activated when the new victim ran the program on the floppy disk or CD. After it’s activated, the virus on the new computer carried out tasks, whatever they were, usually resulting in the virus being implanted in other files on the new victim's computer. The cycle continued when the new victim, probably unaware that he had a virus, in transferred the virus to new victims when he or she put files on floppy disks or CDs for transfer to other people.

17. E-mail The rise in popularity of e-mail in the mid-1990s has provided viruses with new routes to infect computers. E-mail, and the development of standard means for sending and receiving computer files using attachments, gives viruses a fast track for spreading from computer to computer. If the virus is to succeed in its mission, usually it has to entice the recipient of the e-mail message to which it’s attached. The come-on is usually with some variation on a familiar theme (open me – it’s important…). Only when someone opens it can the virus activate and spread. A virus in an e-mail message works like a Trojan horse: The message and its attachment is actually something else. Viruses that arrive via e-mail are usually spread to other computers the same way. As a rule, after an e-mail-borne virus is activated, it tries to find your e-mail program’s personal address book feature. If the virus finds the address book, it grabs all the addresses and sends copies of itself to some or all of them. Often the mail message sent tom those recipients will resemble the same one that arrived in your mailbox, but some viruses have a range of subject lines and messages to pick from. Some recent viruses don’t even require the opening of an attachment. Using a hostile version of HTML code the e-mail is automatically opened when the e-mail is received. This can happen when using particular versions of Outlook as they allow an e-mail preview resulting in a security vulnerability in the software.

18. Instant Messages Instant messages or IM, is a relatively new phenomenon that lets people communicate in real time over the internet. IM has similarities to e-mail – you can exchange text messages conveniently with friends. Although they are far simpler then e-mail programs, IM programs have had their share of flaws – some of which were originally intended as useful features. For example, IM includes file-transfer capabilities; you can send a file – a document, picture, program file or a virus – to another person. This is another way a virus can spread. In fact, some viruses and Trojan horses have been written specifically with IM in mind. They try to exploit any available flaws in your IM program so they can send themselves on to the nest recipient, all without your knowledge or consent.

19. Document Types A macro virus in Microsoft Word or Excel document has the same capabilities as a virus. It goes back to an attempt (in the late 1990s) to make those documents more useful. People started sending documents to each other in high numbers. This open wide opportunities to virus writers

20. Websites Vulnerabilities in Microsoft Internet Explorer have lead to a situation where a cleverly-programmed Websites can actually transfer a malicious program from the Website to your computer without your consent or your knowledge. Most of the time these malicious programs are contained within ActiveX Controls. There are security settings within Internet Explorer that let you control whether you permit Websites to send Active X Controls to your computer or not. Nowadays, the default security settings are tighter than they used to be, buts its still possible for Websites to download nasty Active X Controls with embedded viruses to your computer without your knowing it. One more problem with these malicious Active X Controls centers around exploiting vulnerabilities in Internet Explorer. These flaws can be exploited by creating special coding in the Active X Control that can fool Internet Explorer into trusting the Active X Control when it shouldn’t be.

21. Newsgroups Newsgroups are a high area of were viruses are distributed. Newsgroups are like mailboxes where people can deposit articles for everyone else to read. Newsgroup articles rapidly propagate through all the world’s newsgroups servers so anybody rereading news anywhere can read the articles posted there. Submitting a news article, called posting, is very much like writing an e-mail message. Reading a newsgroup article is similar to reading a mail message. A person intent on harming others can plant viruses and Trojan horses in newsgroups as easily as he or she can in e-mail messages. Then, as people throughout the world read articles from the newsgroup, many may fall victim to the virus. When a person reads an article, the attachment in the article can be opened just as an attachment in an e-mail message. Also, if the news article contains a link to a hostile Website, then the malicious code in the Website can do as much damage to the victim as though they received the link through e-mail.

22. Pirated Software • Pirated software is software being distributed illegally, denying the original software maker from the income derived by selling it. • Sometimes viruses can make their way onto pirated software and for a variety of reasons, including: • Poor Quality Control: Often, the distribution of pirated software occurs in sub-standard conditions where viruses may slip in unnoticed. • Deliberate Insertion of Viruses: Perhaps the trafficker of pirated software deliberately plants viruses in the software they distribute as a way of inflicting harm on those who purchase the software.