Virus Protection for Windows by Roger A
Total Page:16
File Type:pdf, Size:1020Kb
Malicious Mobile Code: Virus Protection for Windows By Roger A. Grimes Publisher: O'Reilly Pub Date: August 2001 ISBN: 1-56592-682-X Table of Pages: 542 • Contents • Index • Reviews Reader • Reviews • Errata Copyright Preface About This Book Why Another Book on Viruses? What This Book Doesn't Cover Organization of the Book Conventions Used in This Book Software Covered in This Book Comments and Questions Acknowledgments Chapter 1. Introduction Section 1.1. The Hunt Section 1.2. What Is Malicious Mobile Code? Section 1.3. Malicious Code and the Law Section 1.4. Malicious Code-Writing Subculture Section 1.5. MMC Terminology Section 1.6. Summary Chapter 2. DOS Computer Viruses Section 2.1. Introduction Section 2.2. DOS Technologies Section 2.3. DOS Virus Technologies Section 2.4. Types of DOS Viruses Section 2.5. Virus Defense Mechanisms Section 2.6. Examples of DOS Viruses Section 2.7. Detecting a DOS-Based Computer Virus Section 2.8. Removing a DOS Virus Section 2.9. Protecting Yourself from Viruses Section 2.10. Risk Assessment -- Low Section 2.11. Summary Chapter 3. Windows Technologies Section 3.1. Windows Technologies Section 3.2. New Windows Versions Section 3.3. Summary Chapter 4. Viruses in a Windows World Section 4.1. DOS Viruses on Windows Platforms Section 4.2. Windows Viruses on Windows Platforms Section 4.3. Signs and Symptoms of Windows NT Virus Infections Section 4.4. Windows Virus Examples Section 4.5. Detecting a Windows Virus Section 4.6. Removing Viruses Section 4.7. Removing Infected Files Section 4.8. Preventing Viruses in Windows Section 4.9. Future Section 4.10. Risk Assessment -- Medium Section 4.11. Summary Chapter 5. Macro Viruses Section 5.1. Microsoft Office Version Numbers Section 5.2. What Is a Macro Virus? Section 5.3. Microsoft Word and Excel Macros Section 5.4. Working with Macros Section 5.5. Office 2000 Security Section 5.6. Macro Virus Technologies Section 5.7. Macro Virus Examples Section 5.8. Detecting Macro Viruses Section 5.9. Removing Macro Viruses and Repairing the Damage Section 5.10. Preventing Macro Viruses Section 5.11. Risk Assessment -- High Section 5.12. Summary Chapter 6. Trojans and Worms Section 6.1. The Threat Section 6.2. What Are Trojan Horses and Worms? Section 6.3. Signs and Symptoms Section 6.4. Types of Trojans Section 6.5. Trojan Technology Section 6.6. Becoming Familiar with Your PC Section 6.7. Trojan and Worm Examples Section 6.8. Detecting and Removing Trojansand Worms Section 6.9. Preventing Trojans and Worms Section 6.10. Risk Assessment -- High Section 6.11. Summary Chapter 7. Instant Messaging Attacks Section 7.1. Introduction to Instant Messaging Section 7.2. Types of Instant Messaging Section 7.3. Introduction to Internet Relay Chat Section 7.4. Hacking Instant Messaging Section 7.5. Examples of IRC Attacks Section 7.6. Detecting Malicious IM Section 7.7. Removing Malicious IM Section 7.8. Protecting Yourself from IM Attacks Section 7.9. Risk Assessment -- Medium Section 7.10. Summary Chapter 8. Internet Browser Technologies Section 8.1. Introduction Section 8.2. Browser Technologies Section 8.3. Web Languages Section 8.4. Other Browser Technologies Section 8.5. When to Worry About Browser Content Section 8.6. Summary Chapter 9. Internet Browser Attacks Section 9.1. Browser-Based Exploits Section 9.2. Examples of Attacks and Exploits Section 9.3. Detecting Internet Browser Attacks Section 9.4. Removing and Repairing the Damage Section 9.5. Preventing Internet Browser Attacks Section 9.6. Risk Assessment -- Medium Section 9.7. Summary Chapter 10. Malicious Java Applets Section 10.1. Java Section 10.2. Java Security Section 10.3. Java Exploits Section 10.4. Example Java Exploits Section 10.5. Detecting Malicious Java Applets Section 10.6. Removing Malicious Java Code Section 10.7. Protecting Yourself from Malicious Java Code Section 10.8. Risk Assessment -- Low Section 10.9. Summary Chapter 11. Malicious ActiveX Controls Section 11.1. ActiveX Section 11.2. ActiveX Security Section 11.3. ActiveX Security Criticisms Section 11.4. Malicious ActiveX Examples Section 11.5. Detecting Malicious ActiveX Controls Section 11.6. Removing and Preventing Malicious Active Controls Section 11.7. Risk Assessment -- Medium Section 11.8. Summary Chapter 12. Email Attacks Section 12.1. Introduction Section 12.2. Email Programs Section 12.3. Email Exploits Section 12.4. Detecting Email Attacks Section 12.5. Removing Infected Email Section 12.6. Preventing Email Attacks Section 12.7. Risk Assessment -- High Section 12.8. Summary Chapter 13. Hoax Viruses Section 13.1. The Mother of All Computer Viruses Section 13.2. Categories of Hoax Messages Section 13.3. Detection Section 13.4. Removing and Preventing Hoax Viruses Section 13.5. Risk Assessment -- Low Section 13.6. Summary Chapter 14. Defense Section 14.1. Defense Strategy Section 14.2. Malicious Mobile Code Defense Plan Section 14.3. Use a Good Antivirus Scanner Section 14.4. Antivirus Scanning Locations Section 14.5. The Best Steps Toward Securing Any Windows PC Section 14.6. Additional Defense Tools Section 14.7. Antivirus Product Review Section 14.8. Future Section 14.9. Summary Chapter 15. The Future Section 15.1. The Future of Computing Section 15.2. MMC Exploits Section 15.3. Real Defense Solutions Section 15.4. Summary Colophon Index Top Team-Fly Malicious Mobile Code: Virus Protection for Windows By Roger A. Grimes Table of Contents Copyright © 2001 O'Reilly & Associates, Inc. All rights reserved. Printed in the United States of America. Published by O'Reilly & Associates, Inc., 101 Morris Street, Sebastopol, CA 95472. Nutshell Handbook, the Nutshell Handbook logo, and the O'Reilly logo are registered trademarks of O'Reilly & Associates, Inc. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and O'Reilly & Associates, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps. The association between the image of a Trojan horse and the topic of malicious mobile code is a trademark of O'Reilly & Associates, Inc. While every precaution has been taken in the preparation of this book, the publisher assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein. Team-Fly Top Team-Fly Malicious Mobile Code: Virus Protection for Windows By Roger A. Grimes Table of Contents Preface Here are some sure things: you can't get a virus by simply reading an email. Malicious code can't harm hardware. A virus can't hide from a booted, write-protected diskette. Your computer can't get infected from a picture file. I have given this advice hundreds of times and could repeat it in my sleep. It was the mantra of every antivirus researcher. We had to repeat it to every inquiring emailer asking if today's computer virus hoax was something to be afraid of. There was only one problem. We were wrong! Well, we weren't wrong at the time. Then the Internet became everything. Computers advanced. New computer languages were created. Old languages were expanded. Writing programs became easier and so did writing malicious code to do bad things. Write it once today and spread it to 60 million computers tomorrow. Worms, like Melissa and I Love You, routinely shut down tens of thousands of networks in hours. The CIH virus erased the hard drives and corrupted the ROM BIOS chips of over ten thousand computers in a single day. You can unwittingly click on a hacker web site that later on records your credit card and bank account information when you log onto your bank's "secure" web site. Simply joining an instant messaging conversation can allow complete access to your home system. When browsing the Internet, your browser will automatically download and run programs. A rogue program can harm your system and all you did was surf the Web. Today, more than ever, malicious mobile code can hurt your system. There are over fifty thousand different computer viruses, Trojan horses, and malicious Internet programs. Hundreds of web sites and dozens of international hacker clubs are dedicated solely to silently invading your computer system. They have contests with prizes to see who can write the most wicked creation. There is a lot of collective personal effort directed toward destroying your privacy and data. If your job involves computers, malicious programs can be more than an inconvenience. This book will help you protect your Microsoft Windows system and networks. Team-Fly Top Team-Fly Malicious Mobile Code: Virus Protection for Windows By Roger A. Grimes Table of Contents Preface About This Book This book covers malicious mobile code attacks on Windows PCs, including: computer viruses, macro viruses, Trojan horse programs, worms, email exploits, Java and ActiveX exploits, instant messaging attacks, and Internet browser exploits. This book is written for intermediate and advanced level personal computer users and network administrators who are interested in protecting Windows-based computer assets against malicious mobile code. I am assuming you have an adequate understanding of PC mechanics, such as the concepts of booting, the difference between a program executable and a data file, and what the World Wide Web and the Internet are. Team-Fly Top Team-Fly Malicious Mobile Code: Virus Protection for Windows By Roger A. Grimes Table of Contents Preface Why Another Book on Viruses? Why write another book on viruses? First, I could not find a good information source covering all the new types of viruses and Trojans. There are dozens of antivirus computer books out on the market today, but most are centered around DOS viruses running on DOS-based computers.