sign in sign up
<<
Home , ILOVEYOU, Klez, Nimda, Sobig

Bhaskar V.Patil et al, / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 2 (4) , 2011, 1789-1792 The Working and Problems of in Enterprise Areas Bhaskar V. Patil1, Dr. Milind. J. Joshi2 1Bharati Vidyapeeth University Yashwantrao Mohite institute of Management, Karad [M.S.], INDIA 2Shivaji University Kolhapur, Kolhapur [M.S.], INDIA

Abstract—Today’s enterprise networks are distributed to 2 INFORMATION ABOUT VIRUS different geographical locations and applications are more A computer virus is self replicating program containing centrally located, information represents the most important code that explicitly copies itself and that can infects other asset. With the growing number of data communication ser- program by modifying then or their environment [1]. vices, channels and available software applications, data are Harmful program code refers to any part of programme processed in large quantities and in a more efficient manner. code which adds any sort of functionality against the spe- This technological enhancement offers new flexible oppor- [2] tunities also measure security threats poses in the networks. cification. A virus is a program which is able to repli- These threats can external or Internal, external threats di- cate with little or no user intervention, and the replicated vided as hacking, virus attack, Trojans, worms etc. program(s) are able to replicate further. [4] Malicious soft- There are thousand and thousand of different viruses these ware or for short, are “programs intentionally days which improve every day. Although the wild spread of designed to perform some unauthorized - often harmful or new and strong viruses, it still infects and spread only with undesirable act." Malware is a generic term and is used to user’s permission. This research paper highlights history of describe many types of malicious software, such as virus- worst computer attack, type of computer virus with effect on es and worms. This is a typical structure of a computer computer & few examples of virus on their types, working of computer virus, and problem occur due to virus in comput- virus which contains three subroutines. The first subrou- ers. tine, infect-executable, is responsible for finding available executable files and infecting them by copying its code into them. The subroutine do-damage, also known as the Index Terms - Network, Virus, Security threats, Hacking, payload of the virus, is the code responsible for delivering Attack of Computer Virus, Major attacks & Life Cycle of the malicious part of the virus. The last subroutine, trig- Computer Virus ger-pulled checks if the desired conditions are met in or- der to deliver its payload. The structure of Computer Virus can be divided 1 INTRODUCTION in to four phases; [6] Today enterprise networks are distributed to different  Mark cans prevent re-infection attempts. geographical locations and applications are more centrally  Infection Mechanism causes spread to other files. located. Every company’s data is most valuable asset and  Trigger is conditions for delivering payload. must be treated as such. With the ever growing number of  Payload is the possible damage to infected comput- malicious threats; such as Viruses, Spyware and , ers. it has become mandatory to protect yourself against them. The most powerful way for communication and data 3 HISTORY OF COMPUTER VIRUS transfer is , because the speed of internet goes There are thousand and thousand of different viruses these increased day by day. People can transfer large amount of days which improve every day. However, there is much data within few minute from one location to another loca- software released every day to detect and avoid these vi- tion worldwide. ruses. Although the wild spread of new and strong virus- Computers are used extensively to process the es, it still infects and spread only with user’s permission. data and to provide information for decision making There are endless arguments about the "first" virus. There therefore it is necessary to control its use. Due to organi- were a number of malware attacks in the 1970s and some sational cost of data loss, cost of incorrect decision mak- count these among the virus attacks. The description of ing, and value of computer software hardware organisa- the malware, however, would indicate these were worms tions suffer a major loss therefore the integrity of data and and not viruses by general definition. Just to be complete, information must be maintained. There are thousand and however, the questionable entries from the 1970s are thousand of different viruses these days which improve included here with that Computer Knowledge considers every day. From these virus performance of computer virus history to start in 1981. And in year 1995 to 2000 goes slowly, entire disk will be crashed, programs are the total number of computer virus are created. And in modified and more. 2001 to 2010 them are increases up to 1221 number of

newly create computer virus.

1789 Bhaskar V.Patil et al, / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 2 (4) , 2011, 1789-1792

The new computer virus are created from year 2005 to TABLE 2: TYPES OF COMPUTER VIRUS year 2010 are shown in table 1. The table shows that for What It How Affects Example Of [7] Virus Type every month computer virus are created. Does Our PC Virus it interrupt all Randex, To live as a resi- of the opera- TABLE 1: YEAR WISE TOTAL NO OF VIRUS Resident CMJ, Meve, dent in the RAM tions ex- Viruses and memory ecuted by the MrKlunky system Infects executa- Destroys or Program or bles such as alters pro- Sunday and File Virus EXE, BIN, grams and Cascade COM, SYS) data. Destroys or Infects boot Boot sector alters pro- Disk Killer, sectors on hard Virus grams and Stone virus. and floppy disks data. Destroys or A hybrid of a Multipartite alters pro- Invader, Flip, program and Virus grams and and Tequila boot sector virus data. 700 Triggers on a Commonly DMV, Nu- Macro Virus command in affects Word clear, Word Microsoft Office & Excel Concept 600 107 Destroys or Uses various alters pro- Frodo, Joshi, Stealth Virus tactics to avoid 500 grams and Whale 110 detection. data. Year Involuntary, 400 2009 - 2010 Uses encryption 316 97 2008 - 2009 Destroys or Stimulate, 64 77 to foil detection, 128 2007 - 2008 Polymorphic alters pro- Cascade, 140 79 2006 - 2007 so that it appears 245 Virus grams and Phoenix, 300 179 2005 - 2006 differently in 2004-2005 data. Evil, Proud, 116 152 148 each infection. 197 Virus 101 143 162 200 130 spread only 67 57 If the recipient 63 112 74 with the 88 42 97 84 57 opens the e-mail Melissa, 62 40 opening of 36 50 100 70 35 20 Virus attachment, the ILOVEYOU, 6 22 23 36 31 95 29 the attach- 41 15 39 12 31 29 7 19 word macro is Love Bug 8 9 32 11 36 52 8 32 ment in the 42 61 69 68 55 12 31 44 activated then 9 24 19 14 21 21 email 0 JanFeb MarAprMay Jun JulAug Sep Oct NovDec It makes unnec- a computer essary alterations system is 7FaSSt, Elf CHART 1: YEAR WISE TOTAL NUMBER OF COMPUTER Spyware to your PC & causing it to Bowling VIRUS changes your slow down experience of it. It allows From the above chart 1 showing in year first and last four Programs that do other com- A2KM. month less number of computer viruses is created. In re- things that are puter users to Trojan Nitrogen , maining four month computer virus are created much not described in take control Horses 91Cast, their specifica- of your PC more as compare to first and last four month of every 8sec!Trojan year. tions. over the in- ternet negative effects 4 TYPES OF COMPUTER VIRUS It replicate Lovgate.F, on your system, themselves as Trile.C, Worms they are detected stand-alone .D, There are thousands of different kinds of viruses but they and eliminated programs Mapson. form distinct groups. They all operate differently and af- by antivirus fect our computers and the information contained on them It prevents It inserts a mali- FAT alloca- in different ways. From the Table [Table: 2 Types Of cious code into a Directory tion from Spam Laws, Computer Virus] shows that the different types of com- cluster and Virus being allo- DIR II virus puter virus, what it does, how a particular computer virus marks it as allo- cated in the cated in the FAT. are get affected with some example of commuter virus. future

1790 Bhaskar V.Patil et al, / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 2 (4) , 2011, 1789-1792

5 HISTORY OF WORST COMPUTER VIRUS ATTACKS E. The Virus Virus attacks are not shocking news anymore. But here is The Klez virus appeared in late 2001 and infected a vic- the list of the worst of those attacks which shocked many tim’s computer through an e-mail message. The virus at that time in history. The history of computer virus at- replicated itself and was sent itself to all the contacts in tack is as follow; the victim’s address book. The virus could disable virus- A. Melissa scanning software and could falsely act as a virus-removal Melissa was created by David L. Smith in 1999 and is tool. The modified version of this virus could take any based on a Microsoft Word macro. He intended to spread name from the contact list of the victim and can place that the virus through e-mail messages. The virus prompts the address in the “From” field. This technique is called recipient to open a document and by doing so the virus spoofing. By spoofing the e-mail appears to come from a gets activated. The activated virus replicates itself and source when it’s actually coming from somewhere else. will be transferred to 50 persons whose address is present Spoofing will prevent the user’s chance to block email in the recipient’s e-mail address book. from a suspected recipient. The increase in e-mail traffic due to the virus forced some F. SQL Slammer / Sapphire SQL companies to block e-mail programs until the virus attack Slammer / Sapphire virus caused a damage of affected was controlled. networks included Bank of America’s ATM service, Con- B. tinental Airlines etc. A few minutes after the infection of The MyDoom creates a in the OS of the vic- the first Internet server, the number of victims of the tim’s computer. The MyDoom virus had two triggers. Slammer virus doubled every few seconds. After Fifteen One of them began a denial of service (DoS) attack on minutes of the first attack, half of the servers that act as Feb. 1, 2004. In Feb. 12, 2004 the second trigger was in- the pillars of the Internet were affected by the virus. itiated which stopped the virus distributing itself. Later G. and that year, MyDoom virus outbreak occurred for a second The Sasser worm exploited vulnera- time, which targeted several search engine companies. bility. The infected system will look for other vulnerable The virus would send a search request to a search engine systems and instruct those systems to download the virus. and will use e-mail addresses obtained in the search re- A random scan of the IP addresses was done to find po- sults. Such a type of attack slowed down search engine tential victims. The virus made it difficult to shut down services and caused some website crash. the computer without turning OFF the system. C. ILOVEYOUILOVEYOU The Netsky virus spread through e-mail and Windows ILOVEYOU was a standalone program which was capa- networks. The virus causes a denial of service (DoS) at- ble of replicating itself. The virus initially traveled tack on the affected system. through the e-mail, same way as Melissa virus. The email H. Leap-A/Oompa-A had a subject which says that the message was a love let- Oompa-A, was one of the viruses which aimed at Mac ter from the secret admirer. Attachment with this e-mail systems. The viruses used the iChat instant messaging caused all the trouble. program for its propagation among vulnerable Mac com- The file LOVE-LETTER-FOR-YOU.TXT.vbs contained puters. the worm. As the name suggests Scripting The Leap-A virus was not able to cause much harm to was used for creating this virus. The copied itself several computers, but showed that even a Mac computer can be times and made victim’s several folders hidden, it added affected by malicious softwares. several new files to the victim’s computer registry keys I. and Code Red II and replaced several files with copies of itself. Code Red and Code Red II exploited D. vulnerability found in and Windows NT Nimda was spread through the Internet rapidly and be- machines. A buffer overflow problem was the vulnerabili- came one of the fastest propagating computer virus. The ty. Due to this if the OS receives more information than Nimda worms aimed on the Internet servers and its real its buffers handling capacity; the adjacent memory will be purpose was to slow down the Internet traffic. Nimda overwritten. The original worm initiated a distributed could travel through the Internet in multiple methods denial of service attack to the White House website. which included the email. The Nimda worm was able to That means all the infected computers with Code Red try create a backdoor into the victim’s OS. If the victim was to contact the Web servers at the same time, thereby over- logged in as the administrator for the machine, then the loading the machines. The infected machine no longer worm would provide the attacker the full control over the obeys the owner, allowing a remote user to control and system. access the machine. The Nimda virus caused several network systems to crash J. Storm Worm as the system’s resources were taken away by the worm. The Storm Worm got this particular name because of the The Nimda worm was one of the dreaded distributed de- fact that the e-mail messages which carry the virus carried nials of service (DDoS) attack virus. a subject “230 dead as storm batters Europe.” Some ver- sions of this Worm turn computers into bots or Zombies.

1791 Bhaskar V.Patil et al, / (IJCSIT) International Journal of Computer Science and Information Technologies, Vol. 2 (4) , 2011, 1789-1792

The infected computers become vulnerable to further at- problems occur due to the virus attacks which are given tack by the person behind the attack. bellow; A. Computer speed or performance has slowed 6 WORKING OF COMPUTER VIRUS B. Computer system freezes and blue screens of death C. The computer keeps on rebooting again and again Computer viruses have a life cycle that starts when they're D. An entire disk or drive is erased created and ends when they're completely eradicated. The E. Unknown files are added to a d following diagram [Diagram 1: Life Cycle] points are [9] F. Cause erratic screen behavior describes in each stage . G. Unexplained messages appear on the screen H. Many viruses do nothing obvious at all except spread! I. Your browser home page changed itself J. Application software seems to be changed K. Operating system software appears to be modified L. Unexplained printing problems occur

8 CONCLUSIONS A computer virus is software intentionally written to copy itself without the computer owner’s permission and then perform some other action on any system where it resides. Now a days, viruses are being written for almost every computing platform Anti-virus protection is, or should be, an integral part of any Information Systems operation, be it personal or professional. There are number of computer virus are created and these computer virus are affected in DIAGRAM 1: LIFE CYCLE OF COMPUTER VIRUS day today life. These viruses erase important data. before Stage I - Creation – The Computer viruses are created by finding the solution against the computer virus people misguided individuals who wish to cause widespread, must know the basic thing of computer virus like which random damage to computers. are the type of computer virus are created now a days, Stage II -Replication - Computer Viruses replicate by working of computer virus, problem occurs from comput- nature means it copies itself from one PC to anther PC. er virus. Stage III -Activation - Viruses that have damage routines will activate when certain conditions are met. Viruses ACKNOWLEDGMENTS without damage routines don't activate, instead causing The researchers are grateful to the authors, writers, and damage by stealing storage space. editors of the books and articles, which have been referred Stage IV -Discovery - This phase doesn't always come for preparing the presented research paper. after activation, but it usually does. Discovery normally It is the duty of researcher to remember their parents takes place at least a year before the virus might have be- whose blessings are always with them. come a threat to the computing community. Stages V -Assimilation - At this point, antivirus develop- REFERENCES ers modify their software so that it can detect the new [1] Dr. Solomon's Virus Encyclopedia, 1995, ISBN virus. This can take anywhere from one day to six 1897661002 months, depending on the developer and the virus type. [2] Dr. Klaus Brunnstein 1999, from Antivirus to Antimalware Stage VI -Eradication - If enough users install up-to-date Software and Beyond http://csrc.nist.gov/ nissc/1999/ proceed- virus protection software, any virus can be wiped out. So ing/ papers /p12.pdf [3] Paul Royal, Mitch Halpin, David Dagon, Robert Edmonds, and far no viruses have disappeared completely, but some Wenke Lee. PolyUnpack: Automating the Hidden-Code Extraction have long ceased to be a major threat. of Unpack-Executing Malware. In The 22th Annual Computer Se- curity Applications Conference (ACSAC 2006), Miami Beach, FL, The same or different developer develops a different December 2006. strain of a new virus and process begins afresh. [4] Rainer Link, Prof. Hannelore Frank, August, 2003, Server-based Virus-protection On Unix/Linux [5] Felix Uribe, Protecting your Personal Computer against Hackers 7 PROBLEMS OF COMPUTER VIRUS and Malicious Codes [6] K. Lai, D. Wren, T. Rowling, Consumer Antivirus Performance Many common computer problems are easy to fix but Benchmarks hard to diagnose. Once you figure out what is wrong with [7] The Wild List Organization International, www.wildlist.org the computer, a solution is easy to find. Most of the time, [8] Digg, Worst Computer Virus Attacks in History, September, 2009 it will either be a problem of: viruses, malware, spyware [9] Gaurav Sharma, A LOOK INTO COMPUTER VIRUSES or a computer running slow. There are some common

1792