Tunisia IT

Understanding Computer Viruses 4 newbies September 30, 2006

Posted by tunisiait in English, IT articles.
add a comment

The last decade has been one of tremendous upheaval in the world of computers. As processing powers and networks have increased and so have the viruses.

They have become far more complex and difficult to detect. Everyday the world is confronted with new damaging viruses. With the opening up of information technology viruses are now finding it easier to spread themselves.

Today viruses spread through floppies, mobile disks, Cd , especially from Internet downloading and E-mails. So, in this short article we will speak about some aspects of this threat and other similar one’s as Trojan Horses in the windows operating system.

Viruses overview

Let’s look at this short definition of a computer virus, to have clear idea about it:

” It’s a computer program hidden within another seemingly innocuous program that produces copies of itself and inserts them into other programs and that performs a malicious action (as destroying data, sending personal data,…) “

So, viruses hadn’t complicated working mechanism, so what makes them spread easily? The response is that the main security problem come from operating systems holes, as for example the MS-Windows one’s, and desperately Linux OS based or Mac OS too .

Virus History

The Viruses History has very “tremendous” events, with viruses who make big companies loose many money or those make users hilarious, so it’s better to speak in this short article about the first known virus, and that was in 1981 where the first virus in the wild has appeared.

As described in Robert Slade’s history, the first virus predated the experimental work that defined current-day viruses. It was spread on Apple II floppy disks (which contained the operating system) and reputed to have spread from Texas A&M. The virus was named Elk Cloner and displayed a little funny rhyme on the screen:

It will get on all your disks

It will infiltrate your chips

Yes it’s Cloner!

It will stick to you like glue

It will modify ram too

Send in the Cloner !

Nowadays ,there are tenths viruses who appears every day in the world, and the total number of harmful one’s is estimated to be at least 90,000 !!

Let’s go into computer viruses details

As we said before a virus is a computer program which has the ability to make copies of itself, also it can be transferred from PC to PC via :

– Mobile Disk & Flash memory

– Floppy Disk

– Communications lines

– Networks (local networks, internet,…)

=> Any storage or communication medium, who allows reading/writing/transferring data

With the aid of these communications channels or carriers, viruses can spread between computers from:

– Desk to desk

– Office to office

– Company to company

– Country to country

– Continent to continent

– Earth to March (in next years )

-….

So you can find a virus in your Office applications ,games, multimedia players,…and generally activated when you execute a virus-corrupted application.

Now, let’s look at the viruses origin

Viruses fall into two general categories: “boot sector” and “file-infecting” viruses:

–Boot viruses dwell in the boot sector of the hard or floppy disk that carries them. These execute as your computer starts or whenever your computer reads information from an infected storage disk. Once they copy themselves into your computer’s memory, they can then spread to other disks or other computers over a network, each time leaving copies of themselves that can repeat the cycle.

–File-infecting viruses become active only when you execute the program that carries them or, in the case of macro and script viruses, when a program opens a data file that carries them. Typically, such viruses infect files with extensions such as .EXE, .COM, or .DLL, and non-executable files such as Microsoft Word .DOC files or Excel .XLS data and template files. A huge increase in the variety and scope of new viruses over the last few years, however, has expanded this list to cover nearly any type of file even some plain text files in certain circumstances. Once it executes, the file virus also loads itself into your computer’s memory, replicates, then attaches itself to other executable programs.

In recent years, the line between these two divisions has blurred considerably. Many viruses combine both file-infecting and boot sector-infecting features. These often use a variety of tricks and techniques to conceal themselves from anti-virus software. Newer virus types rely partly on unorthodox methods, including user psychology, to help them spread quickly and widely, while some have elements that classify them not as viruses, but under a more general heading of “malicious software” or “hostile code.”

Examples of the latter include software that anti-virus researchers classify as “worms” or Trojan horse programs. These agents, because they do not technically reproduce, are not viruses. But they can often have equally harmful effects and spread just as fast, if not faster, than “ordinary” computer viruses.One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.

Other agents have worm-like or Trojan-like characteristics, who are malicious programs and scripts as Java Scripts & Applets or ActiveX controls, when you download software from suspicious sites in the internet.

Where do they come from ?

People create viruses for a number of reasons:

-From idle curiosity

-To deliberate criminal intent.

-Nationalism & economical reasons (for example in 2001 a French guy make a virus who affected only the Windows2000 English Version)

-Stupidiy

-To show superiority

-…

The challenge from modern techniques used by viruses

The challenge for virus creators is finding subtle ways to disguise or hide their programs so that they can spread undetected. Therefore, virus authors have always been trying to fool the existing virus scanners. The techniques used by them include:

-Polymorphic nature: Most of the scanners detect viruses by a unique signature for each virus. To evade such style, new generation viruses keep on changing their code. This poly (many) morphic (forms) nature makes the virus identification a difficult task.

-Stealth methodology: For a normal computer user, one method to detect a virus is to look at file sizes. Since the file size increases after a virus attack, the user can suspect a virus in the file and take corrective measures. Recent viruses are smart enough to hide such information and furnish the ideal information when they are active in the memory.

-Anti-debug code: To make the study difficult for the anti-virus persons, many viruses employ anti-debug techniques. By using few techniques, the viruses change themselves the moment somebody tries to study them using debugging tools.

By using combinations of the above techniques, a virus can remain undetected and spread effectively.

How can you recognize a virus activity and avoid them ?

There are some very obvious ways. In many cases your computer starts behaving differently. This primarily happens because the virus often fiddles with the basic computer formats, directories etc.

It can:

-Format the hard disk

-Encrypt the hard disk data

-Corrupt file allocation table

-Change screen display

-Hang the system

-Lock keyboard & floppy drives and much more.

-Displaying annoying messages.

-Sending your personal data via Email or internet without your agreement.

With some care and the right computer protection, you can keep viruses at bay, but there are important idea that you must keep in mind all Anti Virus Software together can’t catch all the virus who exists in the world since there are very much one’s who appears every day but can stop the majority of them, so there are some basis things to do to avoid having a virus in your computer:

-It’s imperative that computers are fitted with comprehensive anti-virus software that is also easily upgradeable and has the information of the newer types of viruses afloat.

-Update your Anti-virus software as usually as you can.

–Perform a manual scan of your hard disk periodically.

–Scan all floppy disks before first use.

–Don’t open email messages and email attachments from people you don’t know. Verify that the “author” of the email has sent the attachments. Newer viruses can send email messages that appear to be from a person you know.

–Don’t download programs from suspicious sites, because many programs hide a virus inside them.

–Don’t go to suspicious sites because many virus are executed by displaying pages containing harmful java applet & scripts…so configure your browser not to execute such scripts when you access suspicious site.

What viruses don’t do

Viruses do not:

– Damage hardware, such as keyboards or monitors. Though you may experience strange behaviors such as screen distortion or characters not appearing when typed, a virus has merely affected the programs that control the display or keyboard.

– Damage your disks who are already physically damaged, but damage just what’s stored on them. Viruses can only infect files and corrupt data.

– Infect write-protected disks or text-based email messages.

– Eat your dog or cat

Conclusion

Users must keep in mind that not everything that goes wrong with a computer is caused by a computer virus or worm. Both hardware and software failure is still a leading cause of computer problems especially in the Intel/Windows platform. Never the flow of new computer viruses can be stopped ,it’s like ache it exists forever.

Written by SwiftY

–Critics & comments are welcome–

Mindography:
– General culture!

Netography:
– Internet Sites:

www.Astalavista.com

www.Webgurru.com

www.cknow.com
– Norton (www.Symantec.com) and McAffee (www.McAffee.com) Help section.

(This is an old article written by me at the end of 2001 and a little reviewed at the beginning of 2004,it’s information are still valid,but I must make something new and updated and more PROVersion 1.0 November 2001,Version 1.1 February 2004,Version 1.2 March 2006)

-LA VERSION Française saura disponible prochainement –

SwiftY