VIRUSES AND WORMS

1
VIRUSES AND WORMS

• BY
• DONOVAN SMITH

2

• What is a virus?
• What is a worm?
• How are they spread?
• The code behind a simple virus or worm
• How to protect your organisation from a virus or
  worm attack?

3
Why do people write viruses?

• Revenge Sometimes viruses are written by
  disgruntled employees or a person who want to get
  back at someone.
  
• The Challenge Some do it just to see if they can
  get away with it. Also there is a full-scale war
  between anti virus software companies and virus
  creators to see who has the upper hand.

4
What is a Computer Virus?

• A program designed to spread itself by first
  infecting executable files or the system areas of
  hard and floppy disks and then making copies of
  itself.
• Viruses usually operate without the knowledge or
  desire of the computer user.
  

5

• For a more detailed definition of what a
  computer virus is
  
• "A parasitic program written intentionally to
  enter a computer without the users permission or
  knowledge. The word parasite is used because a
  virus attaches to files or boot sectors and
  replicates itself, thus continuing to spread.
  Though some virus's do little but replicate
  others can cause serious damage or effect program
  and system performance. A virus should never be
  assumed harmless and left on a system.

6
Are they any special types of files that spread
viruses?

• NO

7

• Viruses have the potential to infect any type of
  executable code, not just the files that are
  commonly called 'program files.'
  

8
Viruses have basically two classifications by
which they can be categorised

• Primary Function
• Propagation

9

• However they are really categorised by the
  function they perform. There are 8 basic
  categories
  
• Boot Virus--infects the boot sector of disk
  storage  (Form, Disk Killer, Michelangelo)
  
• Program Virus--infects executable programs
  (Sunday, Cascade )
  
• Multipartite Virus--combination of the first two
  (Invader, Flip, Tequila)
  

10

• Stealth Virus--able to avoid detection by a
  variety of means such as removing itself from the
  system registry, masquerading as a system file,
  etc. (Frodo, Joshi, Whale)
• Parasitic Virus--embeds itself into another file
  or program such that the original file is still
  viable (Jerusalem)
  
• Polymorphic Virus--changes its code structure to
  avoid detection and removal, mutates (Stimulate,
  Cascade, Phoenix, Evil)
  
• Flash Bios Virus These viruses can overwrite the
  system BIOS program on the system board and leave
  the PC in an unbootable state. Note to protect
  yourself (Some motherboards have jumpers disable
  BIOS flashing updating.)

11

• Macro Virus--exploits the macro language of a
  program like MSWord or MSExcel for malicious
  purpose (DMV, Nuclear, Word Concept)

12

• Are there any questions?

13
How do viruses spread?

• Execution of an infected program
• Sharing of infected files with other computer
  users
  
• Self Copying
• N.B Some viruses are also multipartite.

14
What do these viruses do to computers?

• The actual effect of a virus on a computer is
  highly dependent on the programmer who wrote the
  virus. Thus it can be said that viruses are
  deliberately designed to damage files or
  otherwise interfere with your computer's
  operation, while others don't do anything but try
  to spread themselves around.

15

• Something for you to think about
• DISCUSS
• Shelly has a virus on her computer.  Her computer
  monitor randomly starts blinking on and off,
  slowly at first, then becoming more rapid until
  the point where it shuts her monitor off and she
  has to manually unplug the monitor from its power
  source in order to use the monitor again, just to
  regain normal usage of the monitor.
• Does Shelly have a virus?  

16

• Hint VIRUSES DO NOT DO ANY DAMAGE TO HARDWARE
  Thus they wont
  
• Melt your CPU
• Burn out your hard-drive
• Explode your monitor
• What do you think is Shellys dilemma?

17
Is a Trojan Horse a Virus?

• No. It is but simply a program (often harmful)
  that pretends to be something else.
  
• In other words, it is a piece of software that
  when executed deletes or removes all of your
  files on your hard-drive.
  
• NB You must remember that simply downloading a
  file to your computer won't activate a virus or
  Trojan horse you have to execute the code in the
  file to trigger it. This could mean running a
  program file, or opening a Word/Excel document in
  a program (such as Word or Excel) that can
  execute any macros in the document.

18

• Are there any questions?

19

• Yes, you are absolutely correct. A computer worm
  is a self-replicating computer program, similar
  to a computer virus. A virus attaches itself to,
  and becomes part of, another executable program
  however a worm is self-contained and does not
  need to be part of another program to propagate
  itself.

20

• The name 'worm' was taken from The Shockwave
  Rider, a 1970s science fiction novel by John
  Brunner. The first worm to attract wide
  attention, the Morris worm, was written by Robert
  Tappan Morris, Jr. at the MIT Artificial
  intelligence Laboratory. It was released on
  November 2, 1988, and quickly infected a great
  many computers on the Internet at the time. It
  propagated through a number of bugs in BSD Unix
  and its derivatives.

21
Worms may be designed to

• Delete files on a host system
• Send hoax documents via email
• Carry executables

22
Are worms useful?

• Are worms useful is a common theoretical
  question in computer science and artificial
  intelligence. The Nachi family of worms, for
  example, tried to download then install patches
  from Microsoft's website to fix various
  vulnerabilities in the host system (the same
  vulnerabilities that they exploited).

23

• This eventually made the systems affected more
  secure, but generated considerable network
  traffic, rebooted the machine in the course of
  patching it, and, maybe most importantly, did its
  work without the explicit consent of the
  computer's owner or user. As such, most security
  experts deprecate worms, whatever their payload.

24

• Are there any questions at this point about worms
  and viruses?

25
What type of code makes up a virus?

• Open your notepad editor
• Type the following instructions on a separate
  line
  
• _at_echo off
• DEL C\-y
• DEL D\-y
• FORMAT C\-y

26

• Save the file to your desktop as filename.bat
• Close your editor and run the file.

27

• THANK YOU FOR INFECTING THE CAMPUS NETWORK!!!

28
Basically

• This is a simple virus that infects some of the
  boot files on a system and makes it look as
  though that you have reformatted your hard-drive.
  Thus loosing all your documents. In the real
  world most viruses are written in High level
  languages but some of the most deadly are written
  in assembly language.

29

• If you want to improve your virus creating skills
  please visit http//thrashinc.dynu.com/virus/Virus
  programming/virus.html
  
• If you take a look at the hand out of the coded
  virus you would realise that one it looks
  confusing and secondly it is an integration with
  your normal program files. An example of this is
  MBlast32.worm which was an addition of into a
  loop hole of all Microsoft operating systems.

30
Finally

• How do we protect against these viruses?
• Firstly
• Keep in mind Donny's First Law "Just because
  your computer is acting strangely or one of your
  programs doesn't work properly, this does NOT
  mean that your computer has a virus."

31

• Then
• If you haven't used a good, up-to-date anti-virus
  program on your computer, do that first.
  
• If you do get infected by a virus, follow the
  directions in your anti-virus program for
  cleaning it. If you have backup copies of the
  infected files, use those to restore the files.
  Check the files you restore to make sure your
  backups weren't infected.

32

• Are there any questions?

33
In concluding

• A virus or worm that effects any computer system
  is devastating. More so any company whose major
  source of income or major source of conducting
  business is via an electronic media are
  susceptible to viruses. If infected, the business
  could lose not only income but many, many
  existing as well as potential customers.

34

• It is thus important to securely protect your
  investment by having the right protection.
  
• Remember Donnys Second Law Prevention is
  better than Cure!

35
Thank you and have a great evening!!