-
Notifications
You must be signed in to change notification settings - Fork 0
/
virus_info.html
280 lines (253 loc) · 21.2 KB
/
virus_info.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
<html>
<meta name=”robots” content=”noindex,nofollow”/>
<a href=index.html>Back to home</a>
<hr/>
source: CEH v. 12
<h1>Virus concepts</h1>
<h2>Viruses</h2>
<p>Computer viruses have the potential to wreak havoc on both business and personal computers. The lifetime of a virus depends
on the ability to reproduce itself. Therefore, attackers design every virus code such that the virus <b>replicates itself</b>
n times.</p>
<p>A computer virus is self-replicating and produces its code by attaching copies of itself to other executable code and
operates without knowledge of consent of the user. Like biological virus, a computer virus is contagious and can contaminate
other files; however infection of external machines is only possible with the assistance of computer users.</p>
<p>Some viruses affect computers as soon as their code is executed; other viruses remain dormant until a pre-determined
logical circumstance is met. Viruses infect a variety of files, such as overlay files (.ovl) and executable files
(.exe, .sys, .com or .bat). Viruses are transmitted through file downloads, infected disks/flash drives and email
attachments.</p>
<h2>Characteristics</h2>
<p><ol>
<ul>Infecting other files</ul>
<ul>Transforms itself</ul>
<ul>Encrypt itself</ul>
<ul>Alters data</ul>
<ul>Corrupts files and programs</ul>
<ul>Replicates itself</ul>
</ol></p>
<h2>Purpose of Creating Viruses</h2>
<p><ol>
<ul>Inflict damage on competitors</ul>
<ul>Realize financial benefits</ul>
<ul>Vandalize intellectual property</ul>
<ul>Play pranks</ul>
<ul>Conduct research</ul>
<ul>Engage in cyberterrorism</ul>
<ul>Distribute political messages</ul>
<ul>Damage network or computers</ul>
<ul>Gain remote access to the victim's computer</ul>
</ol></p>
<h2>Indications of Virus Attack</h2>
<p><ol>
<ul>Processes require more resources and time, resulting in degraded performance</ul>
<ul>Computer beeps with no display</ul>
<ul>Drive label changes and OS does not load</ul>
<ul>Constant antivirus alerts</ul>
<ul>Computer freezes frequently or encounters an error such as BSOD</ul>
<ul>Files and folders are missing</ul>
<ul>Suspicious hard drive activity</ul>
<ul>Browser window "freezes"</ul>
<ul>Lack of storage space</ul>
<ul>Unwanted advertisements and pop-up windows</ul>
</ol></p>
<h2>Stages of Virus Lifecycle</h2>
<p><ol>
<ul><b>Design</b>: development of virus code using programming languages or construction kits</ul>
<ul><b>Replication</b>: the virus replicates for a period within the target system and then spreads itself</ul>
<ul><b>Launch</b>: the virus is activated when the user performs specific actions such as running an infected program</ul>
<ul><b>Detection</b>: the virus is identified as a threat infecting target system</ul>
<ul><b>Incorporation</b>: antivirus software developers assimilate defenses against the virus</ul>
<ul><b>Execution of the damage routine</b>: users install antivirus updates and eliminate the virus threats</ul>
</ol></p>
<h1>Working of Viruses</h1>
<h2>Infection Phase</h2>
<p>Programs modified by a virus infection can enable virus functionalities to run on the system. The virus infects the target system after it is triggered and becomes active upon the
execution of infected programs, because the program code leads to the virus code. The two most important factors in the infection phase of a virus are:</p>
<p><b>Method of infection</b></p>
<p><b>Method of spreading</b></p>
<p><ol>
<ul>a virus loads itself into memory and checks for an executable on the disk</ul>
<ul>the virus appends malicious code to a legitimate program without the permission or knowledge of the user</ul>
<ul>the user is unaware of the replacement and launches the infected program</ul>
<ul>the execution of the infected program also infects other programs in the system</ul>
<ul>the above cycle continues until the user realizes that there is an anomaly in the system</ul>
</ol></p>
<p>Apparently, the user unknowingly triggers and executes the virus for it to function. Potential targets for virus infections are:</p>
<p><ol>
<ul>Source code</ul>
<ul>Batch files</ul>
<ul>Script files</ul>
</ol></p>
<p>Boot sector viruses execute their code before the target PC is booted.</p>
<p>Most popular methods by which a virus spreads are:</p>
<p><ol>
<ul><b>Infected files</b>: a virus can infect a variety of files</ul>
<ul><b>File-sharing services</b>: file servers</ul>
<ul><b>DVDs and other storage media</b>: infected storage media</ul>
<ul><b>Malicious attachments and downloads</b>: malicious attachment sent via email or downloaded from untrusted sources</ul>
</ol></p>
<h2>Attack Phase</h2>
<p><ol>
<ul>Delete files and alter the content of data files, slowing down the system</ul>
<ul>Perform tasks not related to applications, such as playing music and creating animations</ul>
<ul>Viruses execute upon triggering specific events</ul>
<ul>Some viruses execute and corrupt via built-in bug programs after being stored in the host's memory</ul>
<ul>The latest and most advanced viruses conceal their presence, attacking only after thoroughly spreading through the host</ul>
</ol></p>
<h2>How does a computer get infected by viruses</h2>
<p><ol>
<ul><b>Downloads</b>: viruses are incorporated in popular software programs</ul>
<ul><b>Email attachments</b></ul>
<ul><b>Pirated software</b>: cracked versions of commercial software</ul>
<ul><b>Failing to install security software</b>: new viruses</ul>
<ul><b>Updating software</b>: if patches are not regularly installed, virus might exploit vulnerabilities</ul>
<ul><b>Browser</b>: incorrectly configured browser could result in automatic running of scripts</ul>
<ul><b>Firewall</b>: disabling</ul>
<ul><b>Pop-ups</b>: when a user clicks any suspicious pop-up by mistake, a virus behind the pop-up can enter the system</ul>
<ul><b>Removable media</b>: virus-infected removable media (CD/DVD, USB drive, card reader)</ul>
<ul><b>Network access</b>: connecting to untrusted Wi-Fi network, leaving Bluetooth on, permitting file sharing program that is accessed openly</ul>
<ul><b>Backup and restore</b>: a backup of an infected file</ul>
<ul><b>Malicious online ads</b>: malvertising</ul>
<ul><b>Social media</b>: click on social media sites, including malicious links shared by contacts</ul>
</ol></p>
<h1>Types of viruses</h1>
<h2>System or Boot Sector Viruses</h2>
<p>Most common targets for a virus are the system sectors, which include the master boot record (MBR) and the DOS boot record system sectors. An OS executes code in these areas while booting.
Every disk has some sort of system sector. MBRs are most virus-prone zones because if the MBR is corrupted, all data will be lost. The DOS boot sector also executes during system booting. This
is a crucial point of attack for viruses. The system sector consists of only 512 bytes of disk space. Therefore, system sector viruses conceal their code in some other disk space. Primary carriers
of system or boot sector viruses are email attachments and removable media (USB drives). Such viruses reside in memory. Some sector viruses also spread through infected files; these are known as <b>multipartite viruses</b></p>
<p>A boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR. When the system boots, first, the virus code executes and then control passes
to the original MBR.</p>
<p>System sector viruses create the illusion that there is no virus on the system. One way to deal with this virus is to avoid the use of Windows OS and switch to Linux or Mac. Windows is prone to these attacks.
Another approach is to periodically perform antivirus checks.</p>
<h2>File Viruses</h2>
<p>File viruses infect files executed or interpreted in the system, such as COM, EXE, SYS, OVL, OBJ, PRG, MNU and BAT files. File viruses can be direct-action (non-resident) or memory-resident viruses.</p>
<p>File viruses insert their code into the original file and infect executable files. Such viruses are numerous, albeit rare. During program execution, the virus executes along with program files to infect more files.
File viruses hide their presence using stealth techniques to reside in a computer's memory in the same way as system sector viruses. If a user attempts to read the file, the virus intercepts the request and the
user gets back his original file. File viruses can infect many file types, as a wide variety of infection techniques exist.</p>
<h2>Multipartite Viruses</h2>
<p>A multipartite virus (multipart virus, hybrid virus) combines the approach of file infectors and boot record infectors and attempts to simultanously attack both the boot sector and the executable or program files.
When the virus infects the boot sector, it will, in turn affect the system files and vice versa. This type of virus re-infects a system repeatedly if it is not rooted out entirely from the target machine.</p>
<h2>Macro Viruses</h2>
<p>Macro viruses infects Microsoft Word or similar applications by automatically performing a sequence of actions after triggering an application. Most macro viruses are written using the macro language
Visual Basic for Applications (VBA), and they infect templates or convert infected documents into template files while maintaining their appearance of common document files. Macro viruses are somewhat less harmful
than other viruses. They usually spread via email. Pure data files do not allow the spreading of viruses, but sometimes, the average user easily overlooks the line between a data file and an executable file.
Virus writers can exploit universal programs with macro capacibility such as Microsoft Word, Excel, PowerPoint, Help files etc.</p>
<h2>Cluster Viruses</h2>
<p>Cluster viruses infect files without changing the file or planting additional files. They save the virus code to the hard drive and overwrite the pointer in the directory entry, directing the disk read pointer
to the virus code instead of the actual program. Only one copy of the virus exists on disk. A cluster virus, example Dir-2, first launches itself when any program starts on the computer system and control is then passed
to the actual program. If the victim boots from a clean usb drive and then runs a utility such as CHKDSK, the utility reports a serious problem with the cross-linked file on the disk. Such utilities usually offer
to correct the problem. If the offer is accepted, the virus infects all the executable files and results in the loss of original content or all files might appear to be of the same size.</p>
<h2>Stealth Viruses / Tunneling Viruses</h2>
<p>These viruses hide from antivirus programs by actively altering and corrupting the service call interrupts while running. A stealth virus hides from antivirus software by hiding the original size of the file or
temporarily placing a copy of itself in some other system drive, thus replacing the infected file with uninfected file that is stored on the hard drive. This virus also resides in memory. To avoid detection, these viruses
always take over system functions and use them to hide their presence. One of the carriers of stealth viruses is the rootkit. Installing a rootkit results in such a virus attack because a Trojan installs the rootkit
and is thus capable of hiding any malware.</p>
<h2>Virus Removal</h2>
<p><ol>
<ul>Always perform a cold boot (boot from write-protected CD or DVD)</ul>
<ul>Never use DOS commands such as CHKDSK / FDISK to fix the virus</ul>
<ul>Unse antivirus software</ul>
</ol></p>
<h2>Encryption Viruses</h2>
<p>Encryption viruses or cryptolocker viruses penetrate the target system via freeware, shareware, codecs, fake ads, torrents, email spam etc. This type of virus consits of an encrypted copy of the virus and
a decryption module. The decryption module remains constant, whereas the encryption makes use of different keys. An encryption key consists of a decryption module and an encrypted copy of the code, which enciphers
the virus. When the attacker injects the virus into the target machine, the decryptor will first execute and decrypt the virus body. Then, the virus body executes and replicates or becomes resident in the target
machine. The replication process is successfully accomplished using the encryptor. Each virus infected file uses a different key for encryption. These viruses employ XOR on each byte with a randomized key.
The decryption technique employed is "x", or each byte with a randomized key is generated and saved by the root virus. Encryption viruses block access to target machines or provide victims with limited access to
the system. They use encryption to hide from virus scanners. The virus scanner cannot detect the encryption virus using signatures, but it can detect the decryption module.</p>
<h2>Sparse Infector Viruses</h2>
<p>Viruses typically hide from antivirus programs. Sparse infector viruses infect less often and try to minimalize their probability of discovery. These viruses infect only occasionally upon satisfying
certain conditions or infect only those files whose lengths fall within a narrow range. Two approaches:</p>
<p><ol>
<ul>Replicates only occasionally (example: every tenth program executed or on a particular day of the week (wakeup call))</ul>
<ul>Determines which file to infect based on certain conditions (example: infects target files with a maximum size of 128kb)</ul>
</ol></p>
<h2>Polymorphic Viruses</h2>
<p>Such viruses infect a file with an encrypted copy of a polymorphic code already decoded by a decryption module. Polymorphic viruses modify their code for each replication to avoid detection. They accomplish this
by changing the encryption module and the instruction sequence. Polymorphic mechanisms use random number generators in their implementation. A polymorphic virus consits of three components:</p>
<p><ol>
<ul>encrypted virus code</ul>
<ul>decryptor routine</ul>
<ul>mutation engine</ul>
</ol></p>
<h2>Metamorphic Viruses</h2>
<p>Metamorphic viruses are programmed such that they rewrite themselves completely each time they infect a new executable file. Metamorphic code reprograms itself. </p>
<h2>Overwriting File or Cavity Viruses</h2>
<p>Some programs have empty spaces in them. Cavity viruses, also known as space fillers, overwrite a part of the host file with a constant (usually nulls), without increasing the length of the file while preserving its
functionality. Maintaining a constant file size when infecting allows the virus to avoid detection. Cavity viruses are rarely found due to unavailability of hosts and code complexity.</p>
<p>A new design of a Windows file, called the Portable Executable (PE) improves the loading speed of programs. However, it leaves a particular gap in the file while it is being executed, which can be used by the
cavity virus.</p>
<h2>Companion / Camouflage Viruses</h2>
<p>The companion virus stores itself with the same filename as the target program file. Companion viruses use DOS to run COM files before the execution of EXE file. The virus installs an identical COM file and
infects EXE files. DOS will execute COM, then EXE and then BAT files with the same root name, if they are all in the same directory.</p>
<h2>Shell Viruses</h2>
<p>Shell virus code forms a shell around the target host program's code, making itself the original program with the host code as its sub-routine. Nearly all boot program viruses are shell viruses.</p>
<h2>File Extension Viruses</h2>
<p>File extension viruses change the extensions of files (example BAD.TXT.VBS). If you have forgotten that extensions are turned off in Windows, you might think that this is a text file and open it.</p>
<p><ol>
<ul>Turn off 'Hide file extensions'</ul>
<ul>Scan all the files in the system using robust antivirus software</ul>
</ol></p>
<h2>FAT Viruses</h2>
<p>These viruses attack the File Allocation Table (FAT) and destroy the index, making it impossible to locate files. FAT viruses often manifest in the form of corrupted files, with users noting that files
are missing or inaccessible. The FAT architecture can also by changed (FAT32 -> FAT12)</p>
<h2>Logic Bomb Viruses</h2>
<p>A logic bomb is triggered by a response to an event, such as the launching of an application or when a specific date/time is reached, where it involves logic te execute the trigger. When a logical bomb
is programmed to execute on a specific date (example: Christmas) it is referred to as a <b>time bomb</b>.</p>
<h2>Web Scripting Viruses</h2>
<p>These viruses breaches the web browser security. This allows to inject client-side scripting into the web page. A typical version of web scripting viruses is DDoS. There are two types of web scripting viruses:</p>
<p><ol>
<ul>Non-persistent (attacks without your knowledge)</ul>
<ul>Persistent: cookies are directly stolen and the attacker can hijack the session</ul>
</ol></p>
<h2>E-mail Viruses</h2>
<p>Email viruses perform a wide variety of activities, from creating pop-ups to crashing systems or stealing personal data. </p>
<h2>Armored Viruses</h2>
<p>Armored viruses are viruses that are designed to confuse or trick deployed antivirus systems to prevent them from detecting the actual source of the infection. They trick antivirus programs by showing some
other location even though they are actually on the system itself. Basic techniques:</p>
<p><ol>
<ul>Anti-dissassembly: uses specially crafted code or data in a program to produce an incorrect program listing by dissassembly analysis tools</ul>
<ul>Anti-debugging: used to ensure the program is not running under the debugger</ul>
<ul>Anti-heuristics: prevent heuristic analysis and rely on the program's ability to protect itself from programmer and debugger intervention</ul>
<ul>Anti-emulation: avoid dynamic analysis by fingerprinting the emulated system environment</ul>
<ul>Anti-goat: use heuristic rules to detect possible goat files such as a virus that cannot infect a file if it is too small or if it contains a large amount of do-nothing instructions</ul>
</ol></p>
<h2>Add-on Viruses</h2>
<p>These viruses append their code to the host code without making any changes to the latter or relocate the host code to insert their code at the beginning.</p>
<h2>Intrusic Viruses</h2>
<p>Overwrite the host code completely or partly with the viral code</p>
<h2>Direct Action or Transcient Viruses</h2>
<p>Transfer all controls of the host code to where it resides in the memory. Transcient virus executes only upon the execution of its attached program and terminates upon the termination of its attached program.
At the time of execution the virus may spread to other programs. It operates only for a short while and goes direct to disk to search for programs to infect.</p>
<h2>Terminate and Stay Resident (TSR) Viruses</h2>
<p>These viruses remains permanently in the target machine's memory during an entire work session, even after the target hosts program is executed and terminated. If the TSR virus infects the system,
the user needs to reboot the system to remove the virus without a trace.</p>
<h1>Infect systems using a virus</h1>
<h2>Creating Virus</h2>
<p>A virus can be created in two ways:</p>
<p><ol>
<ul><b>Writing a simple virus program</b>:</ul>
<ul>create a batch file named game.bat with the following text:</ul>
<ul>@ echo off</ul>
<ul>for %%f in (*.bat) do copy %%f + game.bat</ul>
<ul>del c:\Windows\*.*"</ul>
<ul>Convert the game.bat batch file into game.com using the bat2com utility</ul>
<ul>send the game.com file as an email attachment to the victim</ul>
<ul>when game.com is executed by the victim, it copies itself to all the .bat files in the current directory on the target machine and deletes all the files in the Windows directory</ul>
</ol></p>
<p><ol>
<ul><b>Using Virus maker tools</b>:</ul>
<ul>DELmE's Batch Virus Generator</ul>
<ul>JPS Virus Maker</ul>
<ul>Bhavesh Virus Maker SKW</ul>
<ul>Deadly Virus Maker</ul>
<ul>SonicBat Batch Virus Maker</ul>
<ul>TeraBit Virus Maker</ul>
<ul>Andreinick05's Batch Virus Maker</ul>
</ol></p>
<h2>Propagating and deploying virus</h2>
<p>After creating viruses, attacker can adopt various virus propagation and deployment techniques to transfer the virus to the victim's machine.</p>
<p><ol>
<ul>Virus Hoaxes</ul>
<ul>Fake Antivirus (two thirds of all antivirus applications present in the Android Play Store are fake !)</ul>
</ol></p>