Music Beat Machine

By admin 　http://www.davidchristiannelson.com/live-music-visualizer-mac/

computer virus

brief intro to computer viruses

A computer virus is a computer program which can copy itself and infect a computer without permission or knowledge of the owner. The term 'virus' is also commonly, but erroneously used to refer to other types of malware, adware and spyware programs not have the reproductive abilities. A true virus can only spread from one computer to another (in one or other form of executable code) when the host is taken to the target computer, For example, because a user has sent it via a network or the Internet, or carried it on removable media, such as a floppy disk, CD, DVD or USB drive. Viruses can increase their chances of spreading to other computers by infecting files on a network file system or a file system that is accessed by another computer. The phrase "computer viruses" is sometimes used as a catch-all phrase to cover all forms of malware. Malware includes computer viruses, worms, trojan horses, most rootkits, spyware, adware, crimeware and other malicious and unwanted software), including true viruses. Viruses are sometimes confused with computer worms and Trojan horses that are technically different. A worm can exploit security holes to spread to other computers without needing to be transferred as part of a host and a Trojan horse is a program that appears harmless, but has a hidden agenda. Worms and Trojan horses, viruses can cause harm to either a computer system that hosts data, functional performance, or networking throughput, when they are done. Some viruses and other malware have symptoms noticeable to the computer user, but many are hidden. Most personal computers are now connected to the Internet and local networks facilitating the dissemination of malicious code. Today's viruses may also take advantage of network services such as Web, email, Instant Messaging and file sharing systems to spread.

history

Creeper virus was first detected on ARPANET, the forerunner of the Internet in the early 1970s.

Creeper was a experimental self-replicating program written by Bob Thomas of BBN in 1971. Creeper used ARPANET to infect DEC PDP-10 computers running Tenex operating system. Creeper gained access via the ARPANET and copied to the external system where the message "I'm the creeper, catch me if you can!" was viewed. The Reaper program was created to delete Creeper.

A program called "Rother J" was the first computer virus to appear "in nature" – that is, outside the single computer or lab where it was created. Written in 1981 by Richard Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread via floppy. This virus was created as a practical joke when Richard Skrenta was still in high school. It was injected in a game on a floppy. At its 50th use Elk Clones virus will be activated infects the computer and display a short poem beginning "Elk Clones: The program with a personality."

The first PC virus in the wild was a boot sector virus is transferred to (c) Brain

, Was created in 1986 by the Farooq Alvi Brothers, operating out of Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software, which they had written. However, analysts claimed that the Ashar virus, a variant of Brain, possibly predated it based on code in the virus

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and programs on diskettes. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector and ensure that they would be run when the user start the computer from the disk, usually unexpectedly. PCs of the era would try to boot first from a floppy if one had been left on the drive. Until disks fell out of use, this was the most successful infection strategy and boot sector viruses were the most common in the wild for many years.

Traditional computer viruses emerged in the 1980s because of the spread of personal computers and the resultant increase in BBS and modem use, and software sharing. Messageboard-driven software sharing contributed directly to the spread of Trojans and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBS's. Within the "pirate scene "of hobbyists trading illicit copies of retail software, merchants were in a hurry to get the latest programs easy targets for viruses.

Macro viruses have become common Since the mid-1990s. Most of these viruses are written in scripting languages for Microsoft programs such as Word and Excel, and across the entire Microsoft Office by infecting documents and worksheets. Since Word and Excel were also for Mac OS, most can also spread to Macintosh computers. Although most of these viruses have the ability to send infected e-mail, they virus that did took advantage of Microsoft Outlook COM interface. Some old versions of Microsoft Word macros to replicate themselves with additional blank lines. If two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, is shown as a "mating" of the two, and will likely be discovered as a virus unique from the "parents".

A virus can also send a URL link as an instant message to all contacts on an infected machine. If the recipient, thinking the link is from a friend (a reliable sources) follow the link to the website, the virus host on site may be able to infect this new computer and continue propagating material.

Cross-site scripting virus emerged recently, and was academically demonstrated in 2005. Since 2005 there have been several instances of cross-site scripting viruses in the wild, use websites such as My Space, Facebook and Yahoo.

Infection strategies

In order to replicate itself, a virus be allowed to execute code and write to memory. For this reason, many viruses attach themselves to executable files that can be part of legitimate programs. If a user tries to launch an infected program, the virus' code can be implemented simultaneously. Viruses can be divided into two types based on their behavior when they are done. Resident viruses immediately search for other hosts, which may be infected, infect these goals, and finally transfer control to the programming interfaces infected. Resident viruses do not search for hosts when they started. Instead, an alien virus loads itself into memory on execution and transfers control to that program. The virus remains active in the background and infects new hosts, when these files are available for other programs or the operating system itself.

Resident virus

Resident viruses can be perceived as consisting of a search module and a repeat module. locator module is responsible for finding new files to infect. For each new executable file the finder module meetings, it calls the replication module to infect that file. [11]

Resident virus

Resident viruses contain a replication module which is similar to that employed by resident virus. This module is not called by a finder module. The virus loads the replication module into memory when it is executed instead, ensuring that this module is executed each time the operating system is called to perform a particular operation. replication module can be called, for example, each time the operating system performs a file. In this case virus infects every suitable program that performed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file is accessed. This poses a special problem when you use anti-virus software as a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner not to notice that such a virus is present in memory virus can "piggy-back" on virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus can slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors On the other hand, is designed to infect hosts infrequently. Some slow infectors only infect such files when they are copied. Slow infectors are designed to avoid to be discovered by limiting their actions: they are less likely to slow a computer noticeably, and will very rarely trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach, however, not be very successful.

Vectors and hosts

Viruses have targeting different types of transmission media or hosts. This list is not exhaustive:

• Binary executable files (such as COM files and EXE files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux)
• Volume Boot Records of floppy disks and hard disk partitions
• The master boot record (MBR) of hard disk
• General-purpose script files (such as batch files in MS-DOS and Microsoft Windows, VBScript files, and shell script files on Unix-like platforms).
• Application-specific script files (such as Telix-scripts)
• System specific car script files (eg Autorun.inf file is necessary for Windows to automatically to run software stored on the USB Memory Storage Devices).
• Documents can contain macros (such as Microsoft Word documents, Excel spreadsheets, AmiPro documents and Microsoft Access database files)
• Cross-site scripting vulnerabilities in Web applications
• Arbitrary computer files. An exploit buffer overflow format string, race condition or other exploit bug in a program that reads the file can be used to trigger execution of code hidden in it. Most errors of this type can be more difficult to exploit in computer architectures with protection features such as an Execute Disable Bit and / or address space layout randomization.

PDFs, as HTML, may link to malicious code. [citation needed] PDFs can also be infected with malicious code.

In operating systems, using extensions to determine program funds (such as Microsoft Windows), the extensions can be hidden from the user by default. This makes it possible to create a file which is of a type other than it appears to the user. For example, an executable can be created named "Picture.png.exe" where the user sees only "picture.png" and suppose therefore, that this file is an image, and most likely is safe.

Another method to generate virus program from parts of the existing operating system files using of CRC16/CRC32 data. The original code can be quite small (dozens of bytes) and extract a fairly large virus. This is analogous to a biological "prion" on way it works, but is vulnerable to signature detection.

This attack is yet to be seen "in nature".

Methods to avoid detection

To avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially in MS-DOS platform make sure the "last modified" date of a host file stays the same when the file is infected with the virus. This approach is not fool anti-virus software but especially those who maintain and date Cyclic redundancy check on file changes.

Some viruses can infect files without increasing their sizes or damaging files. They achieve this by overwriting unused fields of executable files. These are called cavity viruses. For example, the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because these files have many empty gaps, the virus which was 1 KB in length, not add to the size of the file.

Some viruses try to avoid be discovered by killing the tasks associated with antivirus software before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defence a computer against viruses may demand that a filesystem migrate to detailed and explicit authorization for any type of file access.

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts in order to spread further. In some cases it may be a poor idea to infect a host program. For example, performs many anti-virus programs, an integrity check of their own code. Infect these programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses programmed not to infect programs that are known for being a part of the anti-virus software. Another type of host, virus sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or anti-virus professionals themselves, being infected by a virus. These files can be created for different reasons, all related to the detection of viruses:

• Anti-virus professionals can use bait files to take a sample of a virus (ie a copy of a program file that is infected with the virus). It is more practical to store and exchange a small infected bait file, than to exchange a large application program that has been infected by the virus.
• Anti-virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case the virus can be done to infect large numbers of fishing bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus.
• Some anti-virus software employs bait files that are accessed regularly. Once these files have changed, anti-virus software warns the user that a virus is probably active on the system.

Since bait files are used to detect viruses, or to make detection possible, a virus may benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or applications that contain certain patterns of 'garbage instructions'.

A related strategy to make baiting difficult is sparse infection. Sometimes it makes sparse infectors not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random to infect a file or not, or a virus can only infect host files on particular days of the week.

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software application to read the file and passing the request to the virus, rather for OS. The virus can then return an uninfected version of the file to the anti-virus software, so it seems that the file is "clean". Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a media that is known to be pure.

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete or (in some cases) "Pure" or "heal" the infected file. Some viruses of the techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a second variant of the virus.

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case the virus consists of a small decrypting module and an encrypted copy of the virus program. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decryption module, which (for example) attached to end. In this case, a virus scanner does not directly detect virus by signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. As these would be symmetric keys that are stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably is not required, since even change the code is such a rarity, it may be the reason for virus scanners to at least flag the file as suspicious.

An old, but compact, encryption involves XORing each byte in a virus with a constant so that the exclusive-or operation had only repeated for decryption. It is suspicious code that modifies itself, so the code to do the encryption / decryption can be a part of the signature in many virus definitions.

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In case of polymorphic viruses but this decryption module is also modified on each infection. A well written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See polymorphic code for technical details on how these engines operate [12].

Some viruses employ polymorphic code in a way that limits the mutation rate of the virus significantly. For example, a virus programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it harder for anti-virus professionals to obtain representative samples of virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely to detect virus scanner will be unreliable and that some instances of the virus may be able to avoid detection.

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique is said to be metamorphic. To enable metamorphism, a metamorphic engine is necessary. A metamorphic virus is usually very large and complex. For example, consisted W32/Simile over 14,000 lines of assembly language code, of which 90% is part of the metamorphic engine. [13] [14]

Vulnerability and countermeasures

The vulnerability of operating systems to viruses

Like the genetic diversity in a population reduces the chance of a single disease destroy a population, the many different software systems on a network similarly limits the destructive potential virus.

This was a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. Users of Microsoft software (Especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of the virus. Microsoft software is targeted by virus programmers because of their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated and non-integrated Microsoft applications (such as Microsoft Office) and applications with scripting languages with access to the file (for example Visual Basic Script (VBS), and applications with networking features) are also particularly vulnerable.

While Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system provides third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS's (and NTFS-aware applications on Windows NT-based platforms) only allow their users to run executable files in their own protected memory.

An Internet-based research revealed that there were cases where people like to press a certain button to download a virus. Security analyst Didier Stevens ran a half-year advertising campaign on Google AdWords, which said, "Is your PC virus-free? Get it infected here! ". The result was 409 clicks. [15] [16]

As of 2006 [update], there are relatively few security exploits targeting Mac OS X (with a Unix-based filesystem and kernel). [17] The number of viruses for older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple that there are only four known viruses, and independent sources indicate there are as many as 63 viruses. Virus vulnerability between Macs and Windows is a chief selling point, one that Apple uses in their Get a Mac commercials. [18] In January 2009, Symantec announced the discovery of a trojan that targets Macs. [19] This discovery does not get much coverage until April 2009. [19]

Windows and Unix have similar scripting abilities, but while Unix natural blocks normal users are allowed to make changes in the operating system environment, older copies of Windows such as Windows 95 and 98 no. In 1997, that "when a virus for Linux was released – known as Bliss" – leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows. [20] Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly (so it is a trojan) and it can only infect programs that the user has access to modify. Unlike Windows users, most Unix users do not log in as an administrator user except to install or configure software as a result, even if a user has run the virus may not harm their operating system. The Bliss virus never became widespread, and is still mainly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked. [21]

Role software

Because software is often designed with security features to prevent unauthorized use of system resources may Many viruses exploit software bugs in a system or program to spread. Software development strategies that produce large numbers of bugs will generally also produce potential holdings.

Anti-virus software and other preventive measures

Many users install anti-virus software can detect and eliminate known viruses after the computer downloads or run executable. There are two common methods that an anti-virus software uses to detect viruses. The first and by far the most common method of detection the virus is using a list of virus signature definitions. This works by examining the contents of your computer's memory (its RAM, and boot sectors) and files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus "signatures". The disadvantage of this detection method is that users are only protected from viruses that pre-date their last virus definition update. The second method is to use a heuristic algorithm to find viruses based on common behavior. This method has the ability to detect viruses, anti-virus security firms have yet to create a signature for.

Some anti-virus programs are able to scan opened files in addition to sent and received emails' on the fly "in a similar manner. This practice is known as" on-access scanning. "Anti-virus software changes not the underlying ability of the host software to transmit viruses. Users should update their software regularly to patch security holes. Anti-virus software also needs to be updated regularly to prevent the latest threats.

You can also minimize the damage done by viruses by making regular backups of data (and Operating Systems) in various media that are either kept unconnected to the system (most of the time), read-only or not accessible to other causes, such as the use of different file systems. This way, if the data is lost through a virus, it can start again using the backup (preferably recent).

If a backup session on optical media such as CD and DVD is closed, it becomes read-only and can no longer be affected by a virus (as long as a virus or are infected file was not copied to CD / DVD). Likewise, an OS on a bootable CD used to boot the computer if the installed operating systems become unusable. Backup on removable media must be carefully checked before restoration. The Gammima viruses, for example. Propagates via removable flash drives [22] [23]

Another method is to use different operating systems Systems on different file systems. A virus is not expected to affect both. Data backups can also be put on different file systems. For instance, Linux specific software to write to NTFS partitions, so if you do not install this software and uses a separate installation of MS Windows to make backup copies of an NTFS partition backup should remain safe from any Linux viruses (unless they are written specifically to provide this option). Likewise, MS Windows does not read the file as ext3, so if one normally uses MS Windows, backups can be made on an ext3 partition using a Linux installation.

Recovery methods

When a computer has been compromised by a virus, it is usually unsafe to continue to use the same computer without completely reinstalling the operating system. There are however a number recovery options that exist after a computer has a virus. These actions depend on the severity of the type of virus.

Virus removal

One possibility on Windows Me, Windows XP and Windows Vista is a tool called System Restore, which restores the registry and critical system files to a previous checkpoint. Often a virus will cause a system to hang, and a subsequent hard reboot will do a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to destroy or restore files also exist in previous restore points. [24] Some viruses, however, disable System Restore and other important tools like Task Manager and Command Prompt. An example of a virus that does this is CiaDoor.

Administrators have the ability to disable such tools from limited users for various reasons (for example, to reduce damage and spread of the virus). The virus modifies the registry to do the same, except when the administrator who controls the computer, it blocks all users from gaining access to tools. When an infected tool activates it gives the message "Task Manager has been disabled by your administrator." Even if the user tries to open the program administrator. [Citation missing]

Users who are running a Microsoft operating system can access Microsoft's website to run a free scan, provided they have their 20-digit registration number.

Operating system reinstallation

Reinstalling the operating system is another approach to virus removal. It is simply reformat OS partition and install OS from its original media, or imaging the partition with a clean backup image (Taken with Ghost or Acronis for example).

• This method has the advantages of being simple to do, is faster than running multiple anti-virus scanner, and is guaranteed to remove any malware. Down Sides include having to reinstall all other software, reconfigure, restore user preferences. User data can be backed up by booting off of a Live CD or putting the hard drive in another computer and boot from the second computer's operating system (although you should be aware not

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it can do so without any user intervention. Unlike a virus, it is not necessary to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only consuming bandwidth, whereas viruses almost always corrupt and devour files on a targeted computer

Payload

Many worms have been created, are only designed to spread, and not try to change the systems they pass through. But as the Morris worm and Mydoom showed network traffic and other unintended effects can often cause major disruption. A "payload" is code designed to do more than to spread the worm – it can delete files on a host system (eg ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via email. A very common payload for worms is to install a backdoor into the infected computer to allow the creation of a "zombie" computer under control of the worm author – Sobig and Mydoom are examples which created zombies. Networking of these machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or cloak their website address. [1] Spammers are therefore thought to be a source of funding for the creation of such worms, [2] [3] and worm writers have been caught selling lists of IP addresses of infected machines. [4] Other attempts to blackmail companies with threatened DoS attacks. [5]

Backdoors can be exploited by other malware, including worms. Examples include Doomjuice that spread better by using the backdoor opened by Mydoom, and at least one instance of malware take advantage of the rootkit and backdoor installed by Sony / BMG DRM software used by millions of music CDs before the end of 2005.

Worms with good intentions

From the very first research into worms at Xerox PARC there have been attempts to create useful worms. Nachi family of worms, for example, tried to download and install patches from Microsoft's website to fix vulnerabilities in the host system – By exploiting the same vulnerabilities. In practice, though it may have made these systems more secure it generated considerable network traffic, rebooted the machine during by duplicating it, and did his work without the consent of the computer owner or user.

Some worms such as XSS worms that have been written for research to determine the factors how worms spread, such as social activity and changes in user behavior, while other worms are little more than a fun, as one that sends the popular image macro of an owl with the phrase "O rly?" to a print queue in the infected computer.

Most security experts regard all worms as malware, whatever their payload or their authors intentions

Protecting against dangerous computer worms

Worms spread by exploiting vulnerabilities in operating systems. All suppliers provide regular security updates, and if these are installed in a machine so most of the worms are able to spread it. If a seller accepts a vulnerability, but has yet to release a security update to patch it, a zero day exploit is possible. But these are relatively rare.

Users may be wary of open unexpected e-mail, and should not run attached files or programs or visit Web sites that are linked to these emails. But as with the ILOVEYOU worm, with increased growth and efficiency of phishing attacks, it remains possible to trick the end user into running a malicious code.

Anti-virus and anti-spyware software are useful but they must be kept up to date with new pattern files at least every couple days. Using a firewall is also recommended.

In April-June 2008 issue of IEEE Transactions on Dependable and Secure Computing, computer scientists describe a potential new way to fight Internet worms. The researchers discovered how to contain the kind of worm that scans the Internet randomly, looking for vulnerable hosts to infect. They found that the key is that software to monitor the number of scans that machines on a network send out. When a machine starts sending out too many scans, it is a sign that it has been infected, so administrators to take it off line and check it for viruses

A Trojan horse, or trojan for short, is a term used to describe malware that appears to the user, to perform a desirable function but in fact facilitates unauthorized access to the user's computer system. The term comes from the Trojan horse story in Greek mythology. Trojan horses are not self-replicating, which differentiates them from viruses and worms. In addition, they require interaction with an attacker to fulfill their purpose. The attacker need not be the individual responsible to distribute the Trojan horse. It is possible for attackers to scan computers on a network using a port scanner, hoping to find one with a Trojan horse installed

The purpose of the Trojans

Trojans are designed to give an attacker remote access to a target computer system. When a Trojan horse has been installed on a target computer system, it is possible for an attacker to access it remotely and conduct operations. The type of operations, an attacker can perform is limited by users' on the target computer system and design of the Trojan horse itself.

Operations can be performed by an attacker on a target computer system comprises:

• Deleting files
• Modification of files
• Uploading files
• Downloading files
• Installing software (including other malware)
• Data Theft (such as passwords, security codes, credit card information)
• Using the machine as part of a botnet (eg to perform Distributed denial of service (DDoS) attacks)
• Keylogger
• View user's screen

An example of a Trojan horse attack is one that was reported in 1999:

This trojan horse was sent via e-mail. Reports suggest that it is well were distributed and that there were several versions. The email sent to distribute the Trojan horse pretending to be from Microsoft Corporation, offering a free upgrade to Microsoft Internet Explorer. The email did not originate Microsoft Corporation does not provide an upgrade to Microsoft Internet Explorer. The Trojan horse was an executable file named "ie0199.exe" and was given as an e-mail attachment. A version of the email containing the message:

As a user of Microsoft Internet Explorer, Microsoft Corporation you with this upgrade to your web browser. It will make some mistakes in your Internet Explorer. To install the upgrade, you can save the attachment (ie0199.exe) in some folder and run it.

When it is installed the Trojan horse reportedly modified system files and attempted to make contact with other external systems.

Installation

• Software download (eg A Trojan Horse is part of a program downloaded from file sharing networks)
• Websites containing executable content (eg, a Trojan horse in the form of an ActiveX control)
• Email attachments
• The application exploits (Flaws in a web browser, media player, messaging client or other software that can be exploited to allow installation of a Trojan horse)
• Social Engineering (eg, a hacker trick a user into installing a Trojan horse by communicate with them directly)

In addition, there have been reports of compilers, which even Trojans. In addition to compiling code to executable form also insert code in the output executable causing them to become Trojan horses. It is still distinct from self-replication, since the process is not automatic.

Removal

Antivirus software is designed to detect and remove Trojan horses, ideal to prevent them from ever being installed. It may be possible to remove a Trojan horse manual given a full understanding of how this particular Trojan horse works, but if it is possible that a Trojan horse has been used by an attacker access to a computer system would it's hard to know what the damage is done and what other problems have been introduced. In situations where safety of the computer system is critical, it is advisable to rebuild it from known good software

, Was created in 1986 by the Farooq Alvi Brothers, operating from Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software they had written. However, analysts claimed that the Ashar virus, a variant of Brain, possibly predated it based on code in the virus

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and applications on floppy disks. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector and ensure that they would be run when the user start the computer from the disk, usually unexpectedly. PCs of the era would try to boot first from a floppy if one had been left on the drive. Until disks fell out of use, this was the most successful infection strategy and boot sector viruses were the most common in the wild for many years.

Traditional computer viruses emerged in the 1980s because of the spread of personal computers and the resultant increase in BBS and modem use, and software sharing. Messageboard-driven software sharing contributed directly to the spread of trojans and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBS's. Within the "pirate scene" of hobbyists trading illicit copies of retail software, merchants were in a hurry to get the latest programs easy targets for virus.

Macro viruses have become common since the mid-1990s. Most of these viruses are written in scripting languages for Microsoft programs such as Word and Excel and across the entire Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also for Mac OS, most can also spread to Macintosh computers. Although most of these viruses have the ability to send infected e-mail, the virus that had used the Microsoft Outlook COM interface. Some old versions of Microsoft Word macros that allow copying themselves with extra blank lines. If two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, appears as a "mating" of the two, and is likely to be detected as a virus unique from the "parents".

A virus can also send a URL link as an instant message to all contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site can be able to infect this new computer and continue propagating material.

Cross-site scripting virus emerged recently, and was academically demonstrated in 2005. Since 2005 There has been several instances of cross-site scripting virus in nature, exploiting websites such as MySpace, Facebook and Yahoo.

Infection strategies

For to replicate itself, a virus be allowed to execute code and write to memory. For this reason, many viruses attach themselves to executable files that can be a part of legal programs. If a user tries to launch an infected program, the virus' code can be implemented simultaneously. Viruses can be divided into two types based on their behavior when they are done. Resident viruses immediately search for other hosts, which may be infected, infect these targets, and finally transfer control to the programming interfaces those infected. Resident viruses do not search for hosts when they started. Instead, a resident virus loads itself into memory on execution and transfers control to that program. The virus remains active in the background and infects new hosts when those files are available for other programs or the operating system itself.

Resident virus

Resident viruses can be perceived as consisting of a finder module and a repeat module. Locator module is responsible for finding new files to infect. For each new executable file the finder module meetings, it calls the replication module to infect that file. [11]

Resident virus

Resident viruses contain a replication module which is similar to that employed by the resident virus. This module is not called by a finder module. The virus loads the replication module into memory when it is executed instead, ensuring that this module is executed each time the operating system is called to perform a particular operation. replication module can be called, for example, each time the operating system performs a file. In this case the virus infects every suitable program that performed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file that is accessed. This poses a special problem when you use anti-virus software as a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner not to notice that such a virus is present in memory virus can "piggy-back" on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus can slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors, on the other hand, is designed to infect hosts infrequently. Some slow infectors, for example, only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: they are less likely to slow down a computer noticeably, and will very rarely trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach However, not being very successful.

Vectors and hosts

Viruses have targeted various types of transmission media or hosts. This list is not exhaustive:

• Binary executable files (such as COM files and EXE files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux)
• Volume Boot Records of floppy disks and hard disk partitions
• The master boot record (MBR) of hard disk
• General-purpose script files (such as batch files in MS-DOS and Microsoft Windows, VBScript files, and shell script files on Unix-like platforms).
• Application-specific script files (such as Telix-scripts)
• System specific car script files (eg Autorun.inf file is required for Windows to automatically run software stored on the USB Memory Storage Devices).
• Documents that can contain macros (such as Microsoft Word documents, Excel spreadsheets, AmiPro documents and Microsoft Access database files)
• Cross-site scripting vulnerabilities in Web applications
• Arbitrary computer files. An exploited buffer overflow, format string, race condition or other exploit bug in a program that reads the file can be used to trigger execution of code hidden in it. Most errors of this type may be more difficult to exploit in computer architectures with protection features such as an Execute Disable Bit and / or address space layout randomization.

PDFs as HTML, may link to malicious code. [Citation needed] PDFs can also be infected with malicious code.

In operating systems that use file extensions that provide program funds (such as Microsoft Windows), the extensions can be hidden from the user by default. This makes it possible to create a file that is of a type other than it appears to the user. For example, an executable can be created named "Picture.png.exe" where the user sees only "picture.png" and therefore assumes that this file is an image, and most likely is safe.

Another method to generate virus program from parts of the existing operating system files using CRC16/CRC32 data. The original code can be quite small (dozens of bytes) and extract a fairly large virus. This is analogous to a biological "prion" in the way it works, but is vulnerable to signature detection.

This attack has not yet been seen "in nature".

Methods to avoid detection

To avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially in MS-DOS platform, make sure the "last modified" date of a host file stays the same when the file is infected with virus. This approach is not fool anti-virus software, but especially those who maintain and date Cyclic redundancy check on file changes.

Some viruses can infect files without increasing their sizes or damaging files. They achieve this by overwriting unused areas of executable files. These are called cavity viruses. For example, the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because these files have many empty gaps, the virus which was 1 KB in length, not add to the size the file.

Some viruses try to avoid detection by killing the tasks associated with antivirus software before it can discover them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defence a computer against viruses may demand that a filesystem migrate to detail and express authorization for any type of file access.

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts spreading further. In some cases it may be a bad idea to infect a host program. For example, performs many anti-virus programs, an integrity check of their own code. Infect these programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses programmed not to infect programs that are known to be part of anti-virus software. Another type of host that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or anti-virus professionals themselves, of being infected with a virus. These files can be created for different reasons, all related to the detection of virus:

• Anti-virus professionals can use bait files to take a sample of a virus (ie a copy of a program file that is infected with the virus). It is more practical to store and exchange a small infected bait file, than to exchange a large application program that has been infected by the virus.
• Anti-virus professionals can use bait files to studying the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus made to infect a large number bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus.
• Some anti-virus software employs bait files that are entered regularly. Once these files have changed, anti-virus software warns the user that a virus is probably active on the system.

Since bait files used to detect viruses, or to make detection possible, a virus may benefit from not infecting them. Viruses typically do this by avoiding suspicious programs such as small program files or applications that contain certain patterns of 'garbage instructions'.

A related strategy to make baiting difficult is sparse infection. Sometimes sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software request to read the file and passing the request to the virus, instead of OS. The virus can then return an uninfected version of the file to the anti-virus software, so it seems the file is "clean". Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method for To avoid stealth is to boot from a media that is known to be clean.

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for known virus signatures. A signature is a characteristic byte-pattern that is part of a particular virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete or (in some cases) "Pure" or "heal" the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a second variant of the virus.

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case the virus consists of a small decrypting module and an encrypted copy of the virus program. If virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decryption module, which (for example) attached to end. In this case can a virus scanner does not directly detect the virus using signatures, but it can still detect decryption module, which still makes indirect detection of the virus possible. As these would be symmetric keys that are stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably is not required, since even change the code is such a rarity that it may be the reason for virus scanners to at least flag the file as suspicious.

An old, but compact encryption involves XORing each byte in a virus with a constant so that the exclusive-or operation had only repeated for decryption. It is suspicious code that modifies itself so the code to do the encryption / decryption may be part of the signature in many virus definitions.

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded of a decryption module. In case of polymorphic viruses, but this decryption module is also modified on each infection. A well written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See polymorphic code for technical detail on how these engines operate [12].

Some viruses employ polymorphic code in a way limits the mutation rate of virus significantly. For example, a virus programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it harder for anti-virus professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make more likely to detect the virus scanner will be unreliable and that some instances of the virus may be able to avoid detection.

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique is said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, consisted W32/Simile over 14,000 Lines Assembly language code, of which 90% is a proportion of metamorphic engine. [13] [14]

Vulnerability and countermeasures

The vulnerability of operating systems Virus

Like the genetic diversity within a population decreases the chance of a single disease destroy a population, the many different software systems on a network similarly limits the destructive potential of viruses.

This was a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. Users of Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of virus. Microsoft software is targeted by virus writers because of their desktop dominance, and is often criticized for including many errors and holes for virus writers to to exploit. Integrated and non-integrated Microsoft applications (such as Microsoft Office) and applications with scripting languages with access to the file (for example Visual Basic Script (VBS) and applications with networking features) are also vulnerable.

Although Windows is by far the most popular operating system for virus writers, some viruses is also available on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS's (and NTFS-aware applications on Windows NT-based platforms) only allow their users to run executable files in their own protected memory.

An Internet-based research revealed that there were cases where people like to press a certain button to download a virus. Security analyst Didier Stevens ran a half year advertising campaign on Google AdWords, which said "Is your PC virus-free? Get it infected here!". The result was 409 clicks. [15] [16]

Per 2006 [update], there are relatively few security exploits targeting Mac OS X (with a Unix-based filesystem and kernel). [17] The number of viruses for older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple that there are only four known viruses, and independent sources indicate there are as many as 63 viruses. Virus Vulnerability between Macs and Windows is a chief selling point, one that Apple uses in their Get a Mac commercials. [18] In January 2009, Symantec announced the discovery of a trojan that targets Macs. [19] This discovery does not get much coverage until April 2009. [19]

Windows and Unix have similar scripting abilities, but while Unix natural blocks normal users are allowed to make changes in the operating system environment, older copies of Windows such as Windows 95 and 98 no. In 1997, that "when a virus for Linux was released – known as Bliss "- leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows. [20] Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly (so it is a trojan) and it can only infect programs the user has access to modify. Unlike Windows users, most Unix users do not log in as an administrator user except to install or configure software as a result, even if a user has run the virus may not harm their operating system. Bliss virus never became widely used and is still mainly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked. [21]

Role software

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses exploit software bugs in a system or program to spread. Software development strategies that produce large numbers errors will generally also produce potential holdings.

Anti-virus software and other preventive measures

Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or run executable. There are two common methods that an anti-virus software uses to detect viruses. The first and by far the most common method of virus detection is using a list of virus signature definitions. This works by examining the contents of your computer's memory (its RAM and boot sectors) and files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus "signatures". The disadvantage of this detection method is that users are only protected from viruses that pre-date their last virus definition update. The second method is to use a heuristic algorithm to find viruses based on common behaviors. This method has the ability to detect viruses, anti-virus security firms have yet to create a signature for.

Some anti-virus programs are able to scan opened files in addition to sent and received emails' on the fly "in a similar manner. This practice is known as" on-access scan. "Anti-virus software does not change the underlying capability host software to transmit viruses. Users should update their software regularly to patch security holes. Anti-virus software also needs to be updated regularly to prevent the latest threats.

You can also minimize the damage done by viruses by making regular backup of data (and Operating Systems) on different media that are either kept unconnected to the system (most of the time), read-only or not accessible for other reasons such as using different file systems. This way, if the data is lost through a virus, you can start again using the backup (preferably recent).

If a backup session on optical media like CD and DVD is closed, it becomes read-only and can no longer be affected by a virus (as long as a virus or are infected file was not be copied to CD / DVD). Likewise, an OS on a bootable CD used to boot the computer if the installed Operating Systems become unusable. Backups on removable media must be carefully checked before restoration. The Gammima viruses, for example. Propagates via removable flash drives [22] [23]

Another method is to use different operating systems on different filesystems. A virus is not expected to affect both. Data backups can also be put on different file systems. For example, Linux requires specific software to write to NTFS partitions, so if you do not install this software and uses a separate installation of MS Windows to do backups on an NTFS partition backup should remain safe from any Linux viruses (unless they are written specifically to provide this option). Likewise, MS Windows not read ext3 file systems, so if one normally uses MS Windows, backups can be made on an ext3 partition using a Linux installation.

Recovery methods

When a computer has been compromised by a virus, it is usually unsafe to continue to use the same computer without completely reinstalling the operating system. There are however a number of recovery options that exist after a computer has a virus. These actions depend on the severity of the type of virus.

Virus removal

One possibility on Windows Me, Windows XP and Windows Vista is a tool called System Restore, which restores the registry and critical system files to a previous checkpoint. Often a virus will cause a system to hang, and a subsequent hard reboot will do a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to destroy or restore files also exist in previous restore points. [24] Some viruses, however, disable System Restore and other important tools like Task Manager and Command Prompt. An example of a virus that does this is CiaDoor.

Administrators have the ability to disable such tools from limited users for various reasons (for example, to reduce damage and spread of viruses). The virus modifies the registry to do the same, except when the administrator who controls the computer, it blocks all users from gaining access to tools. When an infected tool activates it gives the message "Task Manager has been disabled by your administrator." Even if the user tries to open the program is trustee. [citation needed]

Users who are running a Microsoft operating system can access Microsoft's website to run a free scan, provided they have their 20-digit number.

Operating system reinstallation

Reinstalling the operating system is a different approach for virus removal. It is simply reformat the OS partition and install OS from its original media, or imaging the partition with a clean backup image (Taken with Ghost or Acronis for example).

• This method has the advantages of being simple to do, is faster than running multiple anti-virus scanner, and is guaranteed to remove any malware. Down Sides include having to reinstall any other software, reconfigure, restore user preferences. User data can be backed up by booting off of a Live CD or putting hard drive in another computer and boot from the second computer's operating system (although you should be aware not

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it can do so without any user intervention. Unlike a virus, it is not necessary to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only consuming bandwidth, whereas viruses almost always corrupt and devour files on a targeted computer

Payload

Many worms have been created, are only designed to spread, and not try to change the systems they pass through. But as the Morris worm and Mydoom showed network traffic and other unintended effects can often cause major disruption. A "payload" is code designed to do more than to spread the worm – it can delete files on a host system (eg ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via email. A very common payload for worms is to install a backdoor into the infected computer to allow the creation of a "zombie" computer under control of the worm author – Sobig and Mydoom are examples which created zombies. Networking of these machines are often referred to as botnets and are very commonly used by spam senders for sending junk e-mail or to blur

About the Author

hi are you having problems with worms and viruses then read this article……….http://latestnewscomm.blogspot.com

The Chain Fleetwood Mac Unleashed The Hits Tour 03 06 2009 21

Searching for online music creator software programs can be difficult. The web is crowded with music making software packages that aresound303066_mixing_desk geared for a variety of ability levels. And there is a wide variety of price tags as well. In my quest to find the best music making software, I’ve researched many of these “make your own music” offerings. In reality I’ve found that most of them are simply not worth the money. However, I’ve recently found a music creator program that is certainly worth the investment cost. Click Here For A Sonic Producer Product Review

---