Virus and related threats

Viruses and related threats are malicious software programs or code designed to infect and compromise computer systems, networks, and devices. They are a major concern in computer security and can cause various types of damage, including data loss, system crashes, unauthorized access, and financial losses. Here are some common types of virus-related threats:

1. Computer Viruses: Computer viruses are self-replicating programs that attach themselves to other files or software programs. They spread by infecting files or by being transferred through various means, such as email attachments, file sharing, or infected websites. When an infected file or program is executed, the virus activates and can perform malicious actions, such as corrupting or deleting files, stealing information, or spreading further.
2. Worms: Worms are similar to viruses in that they self-replicate and spread, but they do not require a host file or program to propagate. Worms exploit vulnerabilities in computer systems or networks to spread rapidly. They can cause network congestion, consume system resources, and carry out malicious activities, such as unauthorized access, data theft, or launching distributed denial-of-service (DDoS) attacks.
3. Trojan Horses: Trojans are malicious programs disguised as legitimate software or files. They often masquerade as useful or harmless applications, enticing users to download or execute them. Once installed, Trojans can perform a variety of malicious activities, such as capturing keystrokes, stealing sensitive information, opening backdoors for remote access, or launching additional malware.
4. Ransomware: Ransomware is a type of malware that encrypts files or locks computer systems, preventing users from accessing their own data. Attackers then demand a ransom payment in exchange for restoring access or decrypting the files. Ransomware attacks can cause significant disruption to individuals and organizations, leading to data loss, financial losses, and reputational damage.
5. Spyware: Spyware is malicious software designed to collect information about a user’s activities without their knowledge or consent. It can track keystrokes, monitor web browsing habits, capture login credentials, and collect sensitive data. Spyware often operates silently in the background and can compromise user privacy and security.
6. Adware: Adware is software that displays unwanted advertisements or pop-up ads on a user’s computer. While not inherently malicious, adware can disrupt user experience, slow down system performance, and sometimes collect personal information without consent.
7. Botnets: Botnets are networks of compromised computers, often infected by worms or Trojans, controlled by a central command-and-control (C&C) server. Botnets can be used for various malicious activities, including sending spam emails, launching DDoS attacks, distributing malware, or participating in large-scale cyberattacks.

Protection against viruses and related threats involves implementing multiple layers of defense, including:

• Using reputable antivirus and anti-malware software.
• Keeping operating systems, applications, and security software up to date with the latest patches and updates.
• Exercising caution when opening email attachments or downloading files from untrusted sources.
• Regularly backing up important data and storing backups offline or in a secure location.
• Enabling firewalls and intrusion detection/prevention systems.
• Practicing safe web browsing habits and avoiding suspicious websites or clicking on untrusted links.
• Educating users about the risks of social engineering techniques, such as phishing emails or deceptive downloads.

Combining proactive measures with regular monitoring, incident response, and security awareness training can help mitigate the risks associated with viruses and related threats.

VIRUSES AND RELATED THREATS

Perhaps the most sophisticated types of threats to computer systems are presented by programs that exploit vulnerabilities in computing systems.

1. Malicious Programs

Malicious software can be divided into two categories:

those that need a host program, and those that are independent.

The former are essentially fragments of programs that cannot exist independently of some actual application program, utility, or system program. Viruses, logic bombs, and backdoors are examples. The latter are self-contained programs that can be scheduled and run by the operating system. Worms and zombie programs are examples.

2. The Nature of Viruses

A virus is a piece of software that can “infect” other programs by modifying them; the modification includes a copy of the virus program, which can then go on to infect other programs.

A virus can do anything that other programs do. The only difference is that it attaches itself to another program and executes secretly when the host program is run. Once a virus is executing, it can perform any function, such as erasing files and programs.

During its lifetime, a typical virus goes through the following four phases:

·        Dormant phase: The virus is idle. The virus will eventually be activated by some event,such as a date, the presence of another program or file, or the capacity of the disk exceeding some limit. Not all viruses have this stage.  

·        Propagation phase: The virus places an identical copy of itself into other programs orinto certain system areas on the disk. Each infected program will now contain a clone of the virus, which will itself enter a propagation phase.  

·        Triggering phase: The virus is activated to perform the function for which it wasintended. As with the dormant phase, the triggering phase can be caused by a variety of system events, including a count of the number of times that this copy of the virus has made copies of itself.  

·        Execution phase: The function is performed. The function may be harmless, such as amessage on the screen, or damaging, such as the destruction of programs and data files.  

3. Virus Structure

A virus can be prepended or postpended to an executable program, or it can be embedded in some other fashion. The key to its operation is that the infected program, when invoked, will first execute the virus code and then execute the original code of the program.

An infected program begins with the virus code and works as follows.

The first line of code is a jump to the main virus program. The second line is a special marker that is used by the virus to determine whether or not a potential victim program has already been infected with this virus.

When the program is invoked, control is immediately transferred to the main virus program. The virus program first seeks out uninfected executable files and infects them. Next, the virus may perform some action, usually detrimental to the system.

This action could be performed every time the program is invoked, or it could be a logic bomb that triggers only under certain conditions.

Finally, the virus transfers control to the original program. If the infection phase of the program is reasonably rapid, a user is unlikely to notice any difference between the execution of an infected and uninfected program.

A virus such as the one just described is easily detected because an infected version of a program is longer than the corresponding uninfected one. A way to thwart such a simple means of detecting a virus is to compress the executable file so that both the infected and uninfected versions are of identical length.. The key lines in this virus are numbered. We assume that program P₁ is infected with the virus CV. When this program is invoked, control passes to its virus, which performs the following steps:

 1. For each uninfected file P₂ that is found, the virus first compresses that file to produce P’₂, which is shorter than the original program by the size of the virus.

2.     A copy of the virus is prepended to the compressed program.

3.     The compressed version of the original infected program, P’₁, is uncompressed.

4.     The uncompressed original program is executed.

In this example, the virus does nothing other than propagate. As in the previous example, the virus may include a logic bomb.

4. Initial Infection

Once a virus has gained entry to a system by infecting a single program, it is in a position to infect some or all other executable files on that system when the infected program executes. Thus, viral infection can be completely prevented by preventing the virus from gaining entry in the first place. Unfortunately, prevention is extraordinarily difficult because a virus can be part of any program outside a system. Thus, unless one is content to take an absolutely bare piece of iron and write all one’s own system and application programs, one is vulnerable.

Books on Virus Related Threats