信息处理技术 Technology of Information Processing 潘晟旻 Instructor: Pan Shengmin 潘晟旻 Computer Center. Kun Ming University of Science & Technology.

信息处理技术 CH11 Security

Virus Protection, and Backup Computer Viruses 计算机病毒

A program that attaches itself to a file, reproduces itself, and spreads to other files A virus can perform a trigger event: –Corrupt and/or destroy data –Display an irritating message Key characteristic is their ability to “lurk” in a computer for days or months quietly replicating themselves What is a computer virus?

File virus - a virus that attaches itself to an application program. Boot sector virus - infects the system files that your computer uses every time you turn it on. Macro virus - infects a set of instructions called a “macro” What is a computer virus?

Appears to perform one function while actually doing something else –Not a virus, but may carry a virus –Does not replicate itself Another type of Trojan horse looks like a log- in screen PictureNote Trojan – arrives as named picture.exe and then tries to steal login and e- mail passwords How is a Trojan horse different from a virus?

7 A program designed to enter a computer system through security holes –Usually through a network from computer to computer –Does not need to be attached to a document to reproduce Mass-mailing worms –Klez, Netsky, MyDoom, and Bagle –Spoofed addresses 地址欺骗 What’s a worm?

What are the symptoms of a malicious code attack? Network traffic jam Denial of Service Browser reconfiguration Delete and modify files Access confidential information Performance degradation Disable antivirus and firewall software

Antivirus software is a set of utility programs that looks for and eradicates viruses, Trojan horses, and worms Antivirus Software: How can I avoid viruses and worms?

Hackers have created viruses that can insert themselves into unused portions of a program To counterattack the work of hackers, antivirus software designers created software with a checksum - a number calculated by combining binary values of all bytes in a file –Compares checksum each time you run a program How does antivirus software work?

Checks for a virus signature –A unique series of bytes used to identify a known virus How does antivirus software work?

“All the time” Most antivirus software allows you to specify what to check and when to check it When should I use antivirus software?

New viruses and variations of old viruses are unleashed just about everyday Check Web site of antivirus software publisher for periodic updates Some software periodically reminds you to check for updates How often should I get an update?

Antivirus software is pretty reliable, but viruses try to get around detection –Multi-partite viruses –Polymorphic viruses –Stealth viruses Antivirus software is not 100% reliable, but protection is worth the risk How reliable is antivirus software?

Some viruses don’t really exists A virus hoax arrives as an message containing dire warnings about a supposedly new virus that is on the loose –Recommends a strategy –Recommends forwarding the –Says no one has a fix for it yet Many cases it is a fake Virus Hoaxes: What’s a virus hoax?

What’s a virus hoax?

Don’t panic You can ignore a virus hoax You can validate the hoax by going to a reliable Web site that lists hoaxes and viruses What should I do about virus hoaxes?

You should now be able to: –Create valid names for files and folders –Use file management features –Describe how a computer physically stores files –Explain viruses, boot sector viruses, macro viruses, Trojan horses, worms, and Denial of Service attacks –Describe how antivirus software is used –Understand backup and restore plans –Compare backup devices Conclusion