1. Computer Viruses Susan Rascati CS30 Section 11 George Washington University

2. What is a Virus? A virus is a self-reproducing program that can infect other programs by modifying them to include, a possibly evolved, copy of itself. A virus is a self-reproducing program that can infect other programs by modifying them to include, a possibly evolved, copy of itself.

3. What is meant by infection? A virus infects by inserting itself into the chain of command so that when one attempts to execute the original program the virus as well (or in more extreme cases, instead) is executed A virus infects by inserting itself into the chain of command so that when one attempts to execute the original program the virus as well (or in more extreme cases, instead) is executed

4. 3 Main Components INFECTION : The method in which the virus spreads INFECTION : The method in which the virus spreads PAYLOAD: What the virus does besides replication. PAYLOAD: What the virus does besides replication. TRIGGER: The routine that decides when the payload is delivered. TRIGGER: The routine that decides when the payload is delivered.

5. Mandatory Components Only the INFECTION mechanism is mandatory component of a virus Only the INFECTION mechanism is mandatory component of a virus

6. Viral Damage

7. Deliberate Damage Deliberate damage is what is inflicted by the virus payload Deliberate damage is what is inflicted by the virus payload Can range from completely benign results such as running the screen message “I WANT A COOKIE” to corrupting files and destroying a hard drive Can range from completely benign results such as running the screen message “I WANT A COOKIE” to corrupting files and destroying a hard drive

8. Accidental Damage Damage is caused when a virus attempts to attach itself to the system Damage is caused when a virus attempts to attach itself to the system The virus can accidentally corrupt areas and inadvertently inhibit a user from opening files or booting up the computer The virus can accidentally corrupt areas and inadvertently inhibit a user from opening files or booting up the computer Such actions are considered accidental because they are not the part of the payload mechanism Such actions are considered accidental because they are not the part of the payload mechanism

9. Incidental Damage All viruses, even benign ones, cause some loss of computer performance: Memory Memory Disk space Disk space Clock cycles Clock cycles

10. How to prevent a virus Avoid opening email attachment from senders you do not know Avoid opening email attachment from senders you do not know Be very particular about the type of freeware and software that you chose to use and download Be very particular about the type of freeware and software that you chose to use and download Use anti-virus software to scan ALL files and documents before they are opened on the hard drive Use anti-virus software to scan ALL files and documents before they are opened on the hard drive

11. Anti-Virus Software The greatest method of virus prevention is anti-virus software. It will scan your hard drive every time the computer is turned on. Ideally, these programs search for behaviors characteristic to viruses, isolate the infected files, and remove the virus from the software.

12. Update Anti-Virus Software In order to ensure complete protection, one must do more than simply buy and install such programs In order to ensure complete protection, one must do more than simply buy and install such programs While most software can identify the most common viruses, on average 3-5 new strains are discovered every day While most software can identify the most common viruses, on average 3-5 new strains are discovered every day

13. Update Anti-Virus Software Many anti-virus companies such as Symantec and McAfee maintain websites that contain the most up-to-date virus information Many anti-virus companies such as Symantec and McAfee maintain websites that contain the most up-to-date virus information The most recent virus information can be downloaded to your existing software allowing you to detect the new strains The most recent virus information can be downloaded to your existing software allowing you to detect the new strains These websites also offer instruction on how to remove certain viruses should your computer become infected These websites also offer instruction on how to remove certain viruses should your computer become infected

14. OH NO! I have a virus! If all prevention methods fail and your computer manages to get infected – don’t panic!

15. Is it even a Virus? It may look like a virus, but it might be a JOKE or a TROJAN HORSE It may look like a virus, but it might be a JOKE or a TROJAN HORSE The main difference: Viruses modify other files, jokes and Trojan horses exist in only one file and thus can be removed through the deletion of that file The main difference: Viruses modify other files, jokes and Trojan horses exist in only one file and thus can be removed through the deletion of that file

16. How to Tell Most likely it is a Virus if: 1. It reads as a common, older virus 2. Scanner finds it in file or boot sector today, it wasn’t found yesterday, and you have not updated your scanner files 3. Scanner finds two instances of the virus in the same computer

17. How to Tell Most likely it is NOT a virus if: 1. Your scanner only finds one infected file, and it is a file you use all the time 2. Scanner only identifies something as a “possible virus”

18. Virus vs. Hoax Don’t believe all that you read. Many emails you receive warning of deadly viruses are HOAXES; they describe phony viruses!

19. It is Probably a Hoax if it… Reports that it will cause horrific damage to the PC Reports that it will cause horrific damage to the PC Uses very technical language to which the user is most likely not familiar Uses very technical language to which the user is most likely not familiar Is written in very motive language, such as all capital letters to influence its power and urgency Is written in very motive language, such as all capital letters to influence its power and urgency Tells you that you MUST email it to as many people as possible in order to avoid an awful, viral fate! Tells you that you MUST email it to as many people as possible in order to avoid an awful, viral fate!

20. If it definitely is a virus Don’t panic, instead: Contain, Control, Kill Don’t panic, instead: Contain, Control, Kill First you want to prevent further spread of the virus. First you want to prevent further spread of the virus. Limit the use of the infected workstation Limit the use of the infected workstation Learn everything you can about the virus so that you are fully prepared for all that it might do to the PC Learn everything you can about the virus so that you are fully prepared for all that it might do to the PC

21. Kill the Virus Search for solutions, either on-line at subscriber anti-virus sites such as www.service.symantec.com Search for solutions, either on-line at subscriber anti-virus sites such as www.service.symantec.com www.service.symantec.com or public sites such as www.virusinformationcenter.com or public sites such as www.virusinformationcenter.com www.virusinformationcenter.com Follow the directions for virus extermination Follow the directions for virus extermination If you cannot alone exterminate the virus, call in the experts If you cannot alone exterminate the virus, call in the experts