Virus Infections By: Lindsay Bowser

Introduction b What is a “virus”? b Brief history of viruses b Different types of infections b How they spread b viruses Melissa VirusMelissa Virus ILOVEYOU VirusILOVEYOU Virus b What is a “worm”? Code RedCode Red b How to protect yourself

What is a “virus”? b A computer virus shares some of the same traits as a biological virus. b A computer virus must piggyback on top of some other program or document in order to be executed. b Once executed, it is then able to infect other programs or documents.

History of a virus b Traditional viruses were first widely seen in the late 1980’s. b The spread of personal computers was a large contributor. Prior to the 1980’s, home computers were nearly non-existent. b During the 1980’s, real computers started to spread to businesses and homes because of the popularity of the IBM PC (1982) and the Apple Macintosh (1984). b Another factor in the creation of viruses was the use of bulletin boards. Downloading games was popular.

History cont... b Bulletin boards led to the precursor of viruses known as the Trojan Horse. b When the Trojan Horse is downloaded, and you run it, it will wipe out your whole system. b Trojan Horses didn’t affect many people because they were discovered quickly.

Types of Infections b Viruses- small piece of software that piggybacks on real programs. Self- reproducing. b viruses- moves around an message and usually replicates itself by automatically mailing itself to dozens of people in the victim’s address book.

Infections cont... b Worms- small piece of software that uses computer networks and security holes to replicate itself. b Trojan Horses- simply a computer program that claims to do one thing, but instead does damage when you run it. They have no way to replicate automatically.

How they spread b Early viruses were pieces of code attached to a common program, such as a game. b The virus loads itself into memory and looks around to see if it can find any other viruses on the hard drive. b If it can find one, it adds to the virus’s code and then the virus launches the “real” program. b The user really has no idea that the virus even ran. b Unfortunately, the virus has now reproduced itself.

How they spread cont... b Now any time one of the programs gets executed, they infect more programs and the cycle continues. b If one of the infected programs is given to another person on a floppy disk or uploaded to a bulletin board, then the other programs get infected and this is how it spreads. b The spreading part is the infection phase of the virus. b The destructive part is the attack phase of the virus. Printing a silly messagePrinting a silly message Erasing all of your dataErasing all of your data

Viruses b The Melissa Virus (1999) spread in word documents sent via . b It was uploaded to an Internet newsgroup. b Anyone who downloaded the document and opened it would trigger the virus. b The virus would then send itself in an to the first 50 people in the person’s address book. b The message contained a friendly note with the person’s name so that the recipient would open the document thinking it was harmless.

viruses cont... b The virus would then create 50 new messages from the recipient’s machine and the cycle would continue. b The Melissa virus was one of the fastest- spreading viruses ever seen. b The ILOVEYOU virus (2000), was much simpler than the Melissa. It simply contained a piece of code as an attachment. b Once the attachment was double clicked, it allowed the code to execute. b It then sent copies of itself to everyone in the victim’s address book and then corrupted files on the machine.

What is a “worm”? b A worm is a computer program that has the ability to copy itself from machine to machine. b They usually move around and infect other machines through computer networks. b A worm usually exploits some sort of security hole in a piece of software or the operating system.

Code Red b Code Red (2001) was a worm that experts once thought this worm would clog the Internet so effectively that things would completely stop. b The Code Red worm slowed down internet traffic when it began to replicate itself. b Each copy of the worm scanned the Internet for Windows NT or Windows 2000 servers that do not have the Microsoft security patch installed. b Each time it found one, it copied itself to that server. b It then scanned for other servers to infect.

Code Red cont... b The Code Red worm was designed to do 3 things: Replicate itself for the first 20 days of each month.Replicate itself for the first 20 days of each month. Replace web pages on infected servers with a page that declares “Hacked by Chinese”.Replace web pages on infected servers with a page that declares “Hacked by Chinese”. Launch a concerted attack on the White House web server in an attempt to overwhelm it.Launch a concerted attack on the White House web server in an attempt to overwhelm it. b Upon successful infection, the worm would wait for the appointed hour and connect to the White House domain.

Code Red cont... b The attack would consist of the infected systems simultaneously sending 100 connections to port 80 of the White House domain. b The U.S. government changed the IP address of in order to prevent that particular attack and issued a general warning about the worm advising users of Windows NT and Windows 2000 to make sure they had the security patch installed.

How to protect yourself b Make sure you have the latest security patches installed on your machine. b Buy virus protection software such as Norton or McAfee. b Avoid programs from unknown sources. b Disable “Floppy Disk Booting”. b Make sure that “Macro Virus Protection” is enabled in all Microsoft applications.

Questions??

Works Cited b How Stuff Works b CNN g/10/23/virus.works.idg/ g/10/23/virus.works.idg/