Detected by, M.Nitin kumar ( ) Sagar kumar sahu ( )

 A biological virus is not living.  It’s a fragment of DNA inside a protective jacket. Unlike a cell, a virus has no way to do anything or to reproduce by itself -- it is not alive.  Computer viruses also can not reproduce by themselves  Virus : A true virus is capable of self replication on a machine. It may spread between files or disks, but the defining character is that it can recreate itself on it’s own with out traveling to a new host.

 The first virus was made by Farooq alvi brothers of pakistan.  The virus was named dubbed brain©.  It was a boot sector virus.  Due to the spreading of use of personal computers,virus started spreading from different systems.

A typical virus goes through following stages:  1. Dormant phase :these remian in dormant state i.e. they get activated by some event.  2. Propagation phase: The virus places an identical copy of itself into other programs or into certain system areas on the disk.  3. Triggering phase: The virus is activated to perform the function for which it was intended  4. Execution phase: The function may be harmless, such as a message on the screen, or damaging, such as the destruction of programs and data files.

Parasitic virus : It attaches itself to executable files and replicates, when the infected program is executed, by finding other executable files to infect.  Memory-resident virus : Lodges in main memory as part of a resident system program.  Boot sector virus : Infects a master boot record or boot record and spreads when a system is booted from the disk containing the virus.  Stealth virus : A form of virus explicitly designed to hide itself from detection by antivirus software.  Polymorphic virus: A virus that mutates with every infection, making detection by the “signature” of the virus impossible.

 1. Boot virus : The boot virus affects the booting process of the infected computer system thus causing slow start and shut down process.  2. DOS virus : This virus affects the disk operating system of the infected computer system.  3. Windows virus :Due to windows virus following problems are encountered in the infected computer system:. * Unusual entries in the Task Manager list * Unusual slowdown of system. * Increase in file size of infected files

4. Macro virus : Macro viruses take advantage of a feature found in office application, such as Microsoft Excel or Microsoft Word. This feature is the macro. 5. Script virus: These malicious scripts utilize scripting host execution capabilities of browsers and mail systems. These viruses are scripted in the web scripts. 6. Java virus: These virus codes are written in java programming language. These have the extension as (*.class).There are two types of java viruses: * Java Applet * Java Application 7. Palm virus: These viruses include the Trojans and download from internet to the computer systems.

A virus runs first when a legitimate program is executed. The virus loads itself into memory and looks to see if it can find any other programs on the disk. If it can find one, it modifies it to add the virus's code to the new program. Then the virus launches the "real program."The user has no way to know that the virus ever ran. Unfortunately, the virus has now reproduced itself, so two programs are infected. The next time either of those programs gets executed, they infect other programs, and the cycle continues

1. Don’t open files that you are not expecting 2. Suspect messages that appear more than once in your Inbox 3. Learn file extensions 4. Anti-virus installation Advanced Antivirus Techniques: 1. Generic Decryption Digital Immune System.

1.  Discovered on: September 18, 2001  is a new mass-mailing worm that utilizes to propagate itself. The threat arrives as readme.exe in an . It is a virus infecting both local files and files on remote network shares.  Type: Worm.  Nimda is the first worm to modify existing web sites to start offering infected files for download. Also it is the first worm to use normal end user machines to scan for vulnerable web sites.

2. Melissa:  Discovery Date: 3/26/1999  Origin: Newsgroup Posting  Length: varies depending on variant  Type: Macro/Worm  Subtype: Macro  Risk Assessment: High  Category: Companion.

3. Bubble boy :  Discovery Date: 11/8/1999  Origin: Argentina (?)  Type: Worm/Macro  Subtype: VbScript  Risk Assessment: Low  Category: Stealth/Companion.

4. Back Orifice:  Discovery Date: 10/15/1998  Origin: Pro-hacker Website  Length: 124,928  Type: Trojan  Subtype: Remote Access  Risk Assessment: Low  Category: Stealth.

RESOURCES:  1. how computer viruses work  2.  3.