3. PC Viruses
How they got the name
q Computer viruses are called viruses
because they share some of the traits
of biological viruses.
• A computer virus passes from computer
to computer like a biological virus passes
from person to person.
4. PC Viruses
How they got the name
q A biological virus is not living.
• It’s a fragment of DNA inside a protective
jacket. Unlike a cell, a virus has no way
to do anything or to reproduce by itself --
it is not alive.
q Computer viruses also can not
reproduce by themselves
5. PC Viruses
How they got the name
q A biological virus inject itself into a
cell
• And uses the cell's existing machinery to
reproduce itself
q A computer virus “piggybacks” on top
of a program or document
• And “reproduces (gets executed)
• Once running, it’s able to infect other
programs or documents
7. PC Viruses
What they are
q A virus is a small piece of software
(code) that piggybacks on real
programs, like Excel, that have
“embedded executable languages”
• Macro languages -- Visual Basic, etc.
• Each time the program runs the virus
runs, too
• and it has the chance to reproduce (by
attaching to other programs) or wreak havoc.
8. PC Viruses
What they are
q E-mail viruses
• An e-mail virus moves around in
attachments to e-mail messages, and
usually replicates itself by automatically
mailing itself to dozens of people in the
victim's e-mail address book.
9. PC Viruses
What they are
q Dave Parry, TPC User explains
• Most e-mails are sent as plain ASCII text,
which cannot run programs.
• Word and Excel files can carry viruses
because they have a macro language.
• The files as such are quite harmless if they
have no macros.
• One way to cleanse WinWord DOC files is
to save them as RTF, which is text only
and no macros.
10. PC Viruses
What they are
q TPC October Meeting participants
respond:
• email that uses HTML coding can carry
viruses embedded in the HTML coding of
the message.
• Users have a choice to use HTML coding
or not
• the suggestion from the floor was to turn it off
11. PC Viruses
What they are
q Trojan Horse
• A Trojan horse is a computer program
• The program claims to do one thing
(it may claim to be a game)
but instead does damage when you run it
(it may erase your hard disk)
• Trojan horses have no way to replicate
automatically.
12. PC Viruses
What they are
q Worms
• A worm is a small piece of software that
uses computer networks and security
holes to replicate itself.
• A copy of the worm scans the network for
another machine that has a specific security
hole.
• It copies itself to the new machine and starts
replicating from there
13. PC Viruses
What they are
q Worms and Trojan horses are actually
more common today than viruses.
• Antivirus programs offer protection
against all viruses, worms, and Trojans
• refer to all of these types of malware as
viruses.
15. PC Viruses
How they spread
q A virus runs first when a legitimate
program is executed.
• The virus loads itself into memory and
looks to see if it can find any other
programs on the disk.
• If it can find one, it modifies it to add the
virus's code to the new program.
• Then the virus launches the "real program."
16. PC Viruses
How they spread
q The user has no way to know that the
virus ever ran.
• Unfortunately, the virus has now
reproduced itself, so two programs are
infected.
• The next time either of those programs
gets executed, they infect other
programs, and the cycle continues.
17. PC Viruses
How they spread
q When the infected program
• is distributed by
• floppy disk
• uploaded to a bulletin board
• zipped and delivered as an executable
• then other programs get infected
q This is how viruses spread
18. PC Viruses
How they spread
q Virus Attacks
• Some sort of trigger will activate the
attack phase, and the virus will then "do
something”
• Anything from printing a silly message on
the screen to erasing all of your data.
• The trigger might be a specific date, or the
number of times the virus has been replicated,
or something similar.
19. PC Viruses
How they spread
q Virus creator’s tricks
• load viruses into memory so they ran in
the background
• infect the boot sector on floppy disks and
hard disks
21. PC Viruses
How to prevent them
q Run a secure operating system like
UNIX or Windows NT
• security features keep viruses away
q Buy virus protection software
q Avoid programs from unknown
sources (like the Internet)
q Stick with commercial software
purchased on CDs
22. PC Viruses
How to prevent them
q With E-mail viruses
• defense is personal discipline
• Never double-click on an attachment that
contains an executable program
• Attachments that come in as
• Word files (.DOC), spreadsheets (.XLS), images (.GIF
and .JPG), etc., are data files
• and they can do no damage
• excepting the macro virus problem in Word and
Excel documents mentioned above
23. PC Viruses
How to prevent them
q With E-mail viruses
• defense is personal discipline
• Never double-click on an attachment that
contains an executable program
• A file with an extension like .EXE, .COM or
.VBS is an executable
• and an executable can do all sorts of damage
• once run, you have given it permission to do
anything on your machine.
• Never run executables from e-mail.
24. PC Viruses
How to prevent them
q Don’t victimize yourself
• learn where to find legitimate
information on hoaxes, myths etc.
• do not forward warnings if you haven’t
personally checked them out!
q vmyths.com/index.cfm
q http//antivirus.about.com
q www3.ca.com/virusinfo/
25. PC Viruses
How to prevent them
q Some rules of thumb:
• if you merely find JDBGMGR.EXE on your
computer, then it's probably not infected;
q But. . .
• if you receive JDBGMGR.EXE as an email
attachment, then it probably is infected.
26. PC Viruses
How to prevent them
q TPC Member Jim Tittsler reports:
• “...there have been problems with buffer
overflows where downloading a message
with carefully crafted Date: header was
enough to execute code.
• No attachment, no preview or "opening"
required, since the attack begins when the
client retrieves the Date: header of the
message from the server.
• http://www.iss.net/security_center/static/4953.php
27. PC Viruses
How to prevent them
Don’t fall for the
q "False Authority Syndrome”
• Most people who claim to speak with
authority about computer viruses have
little or no genuine expertise.
• The person feels competent to discuss
viruses because of
• his job title,
• because of expertise in another computer field,
• simply because he knows how to use a computer
28. PC Viruses
How to prevent them
q E-mail is clearly the predominant
vulnerability point for viruses
• Current viruses are spread via security
holes in Microsoft Outlook and Outlook
Express
• Free patches are available from Microsoft
to address these problems
• many people are reluctant to apply them.
29. PC Viruses
How to prevent them
q First, update your system with
Windows Update and Office Update
• or, buy a Mac
q Buy virus protection software
• eTrust EZ Anti Virus
• (TPC NG’s Tom Young from Osaka recommends it)
• http://www2.my-etrust.com/products/Antivirus
30. PC Viruses
How to prevent them
q What’s the best one to buy?
• The WildList International:
• As each package offers slightly different
features, only the individual or corporate
administrator can decide which package
would best suit the need.
• There are a number of papers written on how
to choose the best personal antivirus
software.
31. PC Viruses
How to prevent them
q What’s the best one to buy?
• The WildList International:
• We encourage you to arm yourself with as
much knowledge as possible prior to making a
final purchasing decision.
• This includes being familiar with
• the affiliation of the authors of such papers and
• any affiliations between testers and software
developers.
• (see False Authority Syndrome)
32. PC Viruses
How to prevent them
Product Editor's Member's
(rated by PC Magazine) Rating Rating
Norton Anti Virus 2002 5 3
McAfee Security Suite No rating No rating
Trend PC-Cillin 2002 3 4
Panda Antivirus Platinum 6.0 4 No rating
Norman Virus Control 5.2 3 No rating
McAfee Virus Scan 6.0 3 4
Kaspersky Anti-Virus Personal 3 No rating
F-Secured Anti-Virus Pesonal Edition 3 No rating
ETrust EX Armor Suite 3 No rating
34. PC Viruses
How to spot a hoax
q "Thoughts travel faster in a vacuum."
• Think about it. By removing the actual
thinking process, thoughts can travel
uninhibited and thus exceed all logical
bounds.
• In addition, such thoughts often tend to
become hyperdriven (adj. driven by hype).
35. PC Viruses
How to spot a hoax
q Rule of thumb: If you receive a virus
alert message, don't believe it.
• There are warnings usually in ALL CAPS
about reading or downloading an e-mail
message
• Also look for the multiplication of exclamation
marks.
• Salvation by immediate deletion is also
nearly universal.
36. PC Viruses
How to spot a hoax
q For some reason the word "miscreant"
is a common catchphrase in hoaxes.
q Hoax viruses always seem to wield
the powers of a vengeful binary god.
• Such godlike viruses can often do nasty
things to your system that are beyond the
abilities of software, mere mortals, or
even most hardware technicians.
37. PC Viruses
How to spot a hoax
q (it says) forward this mail to anyone
you care about.
• Here it is. This is the replication engine.
This is what gives the virus the pesky
lifelike ability to multiply. This is also a
dead giveaway that it is a hoax.
38. PC Viruses
How to spot a hoax
q The Authoritative Source Syndrome
• "Whoa! The FCC. This must be real."
• This aspect of cited authority is meant to lend
credibility to the hoax.
• The truth is, however, that according to the FCC
they have never, and will never, send out virus
warnings.
39. PC Viruses
How to spot a hoax
q Superlative abilities of the virus:
• unparalleled in its destructive capability
• this virus is "highly intelligent”
• Odd. All the viruses seen (at IBM Research)
are extremely dumb.
• “most destructive”
• “most polymorphic”
• “stealthiest” virus.
40. PC Viruses
How to spot a hoax
q The language is crafted to sound
technical.
q It uses computer jargon
• It tends to lend credibility to the hoax.
• Do you believe that a CPU can be
melted down by "an nth-complexity
infinite binary loop”?
42. PC Viruses Bonus Pack!
TPC Users comment
q Recent virus unleashed!
• W32/Bugbear@MM
• found on McAfee’s site
• reported by TPC Member Sam Julien
43. PC Viruses Bonus Pack!
TPC Users comment
q Andrew Hayes writes:
• “Store your original program installation
CD's and license information in a safe
place (A safe place is not next to you PC)
• Keep backups of your data or any
downloaded software
• (after it has been thoroughly scanned)
• Run AV software 24/7
44. PC Viruses Bonus Pack!
TPC Users comment
q Andrew Hayes writes:
• Don't open email attachments unless
you're 110% certain they are safe,
• if you're not expecting something from a
friend, confirm with them before opening it.
• (He’s) seen a few infected systems, from
a relatively benign Word Macro virus to
one that trashed the HDD (so that) a low-
level format was need to get it working
again.
45. PC Viruses Bonus Pack!
TPC Users comment
q Andrew Hayes writes:
• “I also saw one that blew the mobo by
setting registers to a certain combination
that caused an overload in part of the
circuit, but I'm sure those sort are very
rare now.
• Modern motherboards don't have those
types of defects, do they?”
46. PC Viruses Bonus Pack!
TPC Users comment
q David Parry (uses)
• Virus Buster from Leprechaun Software
• Updates are available very soon after a new
virus appears
• e-mailed notification of new viruses and also
news of hoaxes.
• (He) gave up on McAfee after paying for upgrades
and getting the runaround when (he couldn’t) log in
to download the goodies.
• He goes on to say that the Australian Gov’t
uses Leprechaun antivirus software
47. PC Viruses Bonus Pack!
TPC Users comment
q CR Lipton has interesting comments
• about security on the Trend Micro site
• “Apparently, if this morning's CNet News is to be believed, one of the
things you should NOT do is to scurry down to the Trend Micro
website and buy anything from them.
• According to the story, their shopping pages have a little glichette
that causes it to pop up with the previous buyer's name, address, and
credit card information already filled in for you.
• If anyone wants to, they can then charge their purchase to your credit
card while getting the product delivered to themselves.
• And, even better, your credit card info continues to be displayed until
the next honest person erases yours and types in theirs.
49. PC Viruses
Resources
q www.tokyopc.org/ Chit Chat Newsgroup -- Chit Chat “Personal Computer Virus Attacks”
q www.vmyths.com/ This site is NOT sponsored by antivirus companies – it lists virus
hoaxes
q www.symantec.com/avcenter/hoax.html Here’s another hoax site, from Symantec
q www.symantec.com/avcenter/ Symantec Security Advisory site
q www.howstuffworks.com/virus.htm How computer viruses work
q www.cert.org/other_sources/viruses.html Carnegie Mellon Software Engineering
Institute, CERT® Coordination Center Computer Virus Resources
q www.virusbtn.com/ Virus Bulletin Independent Anti Virus Advice
q www.ciac.llnl.gov/ciac/CIACVirusDatabase.html Although the Computer Incident
Advisory Capability site (associated with the DOE) is no longer being maintained, it has
loads of advice and information about PC and Mac viruses. Also links to other sites that
are being maintained.
q www.zdnet.com/products/stories/reviews/0,4161,2248291,00.html ZD Nets tells
you how to protect against computer viruses.
50. PC Viruses
Resources
q www.special.northernlight.com/compvirus/ Current news, Journal articles and
editorials; Virus Writers and Hackers; Journals, Portals and Reference; US
Government Resources; Web bugs; Malware, Spyware, Adware and Trojan Horses;
Diagnostics; Anti-Virus Solutions (over 30 of them!)
q www.research.ibm.com/antivirus/SciPapers/Wells/HOWTOSPOT/howtospot.htm
l Joe Wells seminar and funny paper on getting “in the know”
q www.jaring.nmhu.edu/virus.htm Computer viruses have been with us since the
late 1980s and continue to increase in number. The following list includes some of the
best sites on the Internet for describing computer viruses as well as links to many of
the top anti-virus software sites. From Wayne Summers at New Mexico Highlands
University.
q www3.ca.com/virusinfo/ More than I ever wanted to know about computer viruses.
The Virus Information Center serves as a rich, up-to-the-minute resource, containing
detailed information on viruses, worms, Trojans, and hoaxes, as well as valuable
documentation on the implementation of comprehensive antivirus protection. CA’s
eTrust Antivirus Research Centers monitor around-the-clock to defend against the
damaging effects a virus outbreak could cause.
51. PC Viruses
Resources
q www.sophos.com/virusinfo/whitepapers/videmys.html An introduction to
computer viruses written by Carole Theriault, carole.theriault@sophos.com, Sophos
Plc, Oxford, UK and first published in: October 1999
q www.cknow.com/vtutor/index.htm Computer Knowledge Virus Tutorial
q www.pcmag.com/article2/0,4149,6276,00.asp PC Magazine Personal Antivirus
Article
q www.wildlist.org/ The world's premier source of information on which viruses are
spreading In the Wild. But don't take our word for it. Read what PC Magazine,
MSNBC an others have to say about us
q www.research.ibm.com/antivirus/SciPapers.htm With scientific papers titled,
Where There’s Smoke, There’s Mirrors, how can you go wrong?
q http://vil.mcafee.com/dispVirus.asp?virus_k=99728McAfee detailed information
on latest virus released into the Wild.
With gratful appreciation to the How Stuff Works site for it’s description of viruses. http://www.howstuffworks.com/virus.htm
Obviously, the analogy between computer and biological viruses stretches things a bit, but there are enough similarities that the name sticks
Bulletin boards led to the precursor of the virus known as the Trojan horse. In the 80’s, people could dial up a bulletin board with a modem and download programs of all types. Games were extremely popular, and so were simple word processors, spreadsheets, etc. A Trojan horse is a program that sounds really cool when you read about it. So you download it. When you run the program, however, it does something uncool like erasing your disk. So you think you are getting a neat game but it wipes out your system. Trojan horses only hit a small number of people because they are discovered quickly. Either the bulletin board owner would erase the file from the system or people would send out messages to warn one another.
For example, the Code Red worm replicated itself over 250,000 times in approximately nine hours on July 19, 2001 Each copy of the worm scans the Internet for Windows NT or Windows 2000 servers that do not have the Microsoft security patch installed. Each time it finds an unsecured server, the worm copies itself to that server. The new copy then scans for other servers to infect. Depending on the number of unsecured servers, a worm could conceivably create hundreds of thousands of copies. The Code Red worm is designed to do three things: Replicate itself for the first 20 days of each month Replace Web pages on infected servers with a page that declares "Hacked by Chinese" Launch a concerted attack on the U.S. White House Web server in an attempt to overwhelm it The most common version of Code Red is a variation, typically referred to as a mutated strain, of the original Ida Code Red Read more about it at www.howstuffworks.com/virus3.htm
The spreading part is the infection phase of the virus. Viruses wouldn't be so violently despised if all they did was replicate themselves. Unfortunately, most viruses also have some sort of destructive attack phase where they do some damage.
As virus creators got more sophisticated, they learned new tricks. One important trick was the ability to load viruses into memory so they could keep running in the background as long as the computer remained on. This gave viruses a much more effective way to replicate themselves. Another trick was the ability to infect the boot sector on floppy disks and hard disks. The boot sector is a small program that is the first part of the operating system that the computer loads. The boot sector contains a tiny program that tells the computer how to load the rest of the operating system. By putting its code in the boot sector, a virus can guarantee it gets executed. It can load itself into memory immediately, and it is able to run whenever the computer is on. Boot sector viruses can infect the boot sector of any floppy disk inserted in the machine, and on college campuses where lots of people share machines they spread like wildfire. In general, both executable and boot sector viruses are not very threatening any more. The first reason for the decline has been the huge size of today's programs. Nearly every program you buy today comes on a compact disc. CD’s cannot be modified, and that makes viral infection of a CD impossible. Boot sector viruses have also declined because operating systems now protect the boot sector. Both boot sector viruses and executable viruses are still possible, but they are a lot harder now and they don't spread nearly as quickly as they once could. Call it "shrinking habitat," if you want to use a biological analogy. The environment of floppy disks, small programs and weak operating systems made these viruses possible in the 1980s, but that environmental niche has been largely eliminated by huge executables, unchangeable CDs and better operating system safeguards.
You can protect yourself against viruses with a few simple steps: If you are truly worried about traditional (as opposed to e-mail) viruses, you should be running a secure operating system like UNIX or Windows NT. You never hear about viruses on these operating systems because the security features keep viruses (and unwanted human visitors) away from your hard disk. If you are using an unsecured operating system, then buying virus protection software is a nice safeguard. If you simply avoid programs from unknown sources (like the Internet), and instead stick with commercial software purchased on CDs, you eliminate almost all of the risk from traditional viruses. If you insist on downloading programs then please, run them through an anti-virus screen with updated virus definitions. In addition, you should disable floppy disk booting -- most computers now allow you to do this, and that will eliminate the risk of a boot sector virus coming in from a floppy disk accidentally left in the drive. You should make sure that Macro Virus Protection is enabled in all Microsoft applications, and you should NEVER run macros in a document unless you know what they do. There is seldom a good reason to add macros to a document, so avoiding all macros is a great policy.
By following these simple steps, you can remain virus free.
nearly identical to the sulfnbk.exe mass hysteria of 2001. The JDBGMGR.EXE file is a legit Windows operating system file, just like sulfnbk.exe.
And of course, by the authority vested in me by the How Stuff Works site, and by the fact that they are talking about “his” job title and “his” expertise and “his” computer, I’m sure that I can not be included in this group! ;-)
I don’t think that many people are reluctant to apply them, I don’t think that they’ve been educated properly to understand the issues. They don’t know how to or don’t think it’s important to keep their system files current. It’s the “set it and forget it” syndrome.
For a site that does so much good, I think these are “weasel words”. It appears to me that the lawyers had a shot at the copy and have consequently taken out f the riendly, cheerful and helpful way that the rest of the site converses.
PC Magazine is more opinionated. This is the top nine in their list of virus protection products. The list is much longer, I encourage you to go to the site to review it. It doesn’t appear to be in any order that I can discern.
With thanks to Joe Wells, Senior Editor, antivirus online , January 10, 1997 http://www.research.ibm.com/antivirus/SciPapers/Wells/HOWTOSPOT/howtospot2.html
Date Discovered: 9/30/2002 Date Added: 9/30/2002 Origin: Malaysia Length: 50,688 bytes (UPXed) or 50,664 bytes Type: Virus SubType: E-mail worm DAT Required: 4226 This virus is written in MSVC and packed with UPX. It spreads via network shares and by emailing itself. It also contains a backdoor trojan component that contains keylogging functionality. Mass-mailing This worm emails itself to addresses found on the local system. The virus code contains email subject strings and attachment names. However, the majority of samples received contain information not present in the virus. Suggesting that there is a higher probability of the virus using words and filenames contained on the infected system. Possible message subject lines include the following (however, other random subject lines are also possible):