DOCSLIB.ORG

VB January 2004, P.14

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
VB January 2004, P.14 JANUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Malware Distribution (type) TRENDS 2.00% Drawing the lines 1.50% script AND 1.00% binary macro 0.50% 0.00% FORECASTS ItW %growth (VirusBulletin) %growth ItW ch April May June July 3 NEWS Mar August January February October September Once again the 2003 (January~October) Number crunching time has come to ponder what might be in store for SAS – the SysAdmin Service? the coming year. Jamz Yaneza looks at malware data collected over the past year and attempts some 3 VIRUS PREVALENCE TABLE predictions for 2004. page 14 4 VIRUS ANALYSIS ALL-ROUNDER Who? What? Where? Swen? Swen has something for everyone, one might say. Peter Ferrie has the nitty gritty details of this 11 LETTERS all-action virus. page 4 11 CALL FOR PAPERS HARDWARE SOLUTIONS Recent reports of a ‘new’ anti-virus solution based 12 FEATURE on quick pattern matching of network traffic Hardware anti-virus solutions? without a significant reduction in network speed seem tantalising. However, Matthew Wagner has 14 OPINION reservations about such a hardware solution. The malware battle: page 12 reflections and forecasts 17 PRODUCT REVIEW Authentium Command AntiVirus for Windows Enterprise 4.90.2 In this month’s VB Spam Supplement ASRG founder Paul Judge explains the aims and objectives 20 END NOTES & NEWS of the ASRG, and Pete Sergeant looks at economic and legal solutions to spam. ISSN 0956-9979 COMMENT ‘Being online is between anti-virus, anti-spam and general security, but their basic functions have little in common. becoming a Anti-spam is part of a larger industry for regulating combination of information. This includes not only filtering unsolicited annoying and worrying emails, but also such tasks as moderating news groups, suppressing pop-ups and controlling web browsing. The experiences.’ focus of this industry is knowing (or learning) what John Ogness types of information a user wants and regulating H+BEDV Datentechnik GmbH incoming information accordingly. Many standalone products are available and a number of operating system and application developers have released products with DRAWING THE LINES these capabilities integrated. The security industry is responsible for collecting Anti-virus companies have earned the reputation of security reports, notifying the appropriate individual or protecting users against computer-related threats. Today, organization about any problems, and tracking their malicious code has many opportunities to compromise a resolution. Usually detailed information is made user’s computer. These range from active trickery, such available about the dangers of each problem, how it can as the use of email, shared files, or instant messengers, to be detected, and how it can be fixed. Operating system the use of ‘invisible’ tactics, such as taking advantage of and application developers often maintain this flaws in software. information for their products and in many cases offer To complicate the issue, the incidence of spam continues automatic updates to correct the problems. Prevention or to increase at an alarming rate – currently it is estimated handling of computer compromises is another aspect of to represent more than 60 per cent of all email. the security industry. Furthermore, software security holes are uncovered daily Anti-virus companies already have the advantage of a and, due to the increasing complexity of new software reputation for protecting users. But anti-virus companies technologies, they are often more dangerous and more should not abuse this advantage in order to increase difficult to fix than before. profits or mislead users by releasing their own products Being online is becoming a combination of annoying and with the anti-spam/security label. Just as other industries worrying experiences. So where do the users turn? They respect the skills and qualifications of anti-virus turn to the place to which they have always turned for organizations, so should the anti-virus industry respect computer protection: the anti-virus community. the skills and capabilities of the security and anti-spam organizations that already exist. Should anti-virus companies extend themselves in order to protect users against these non-virus-related dangers This is not to say that anti-virus companies may not and annoyances? Fighting spam and fixing security participate in these industries. Rather, anti-virus problems are nothing new – these industries have been in companies should use their role as widely-known existence for a decade, though it is only recently that defenders to help inform users about the other industries they have been in high demand. From a user’s and solutions. perspective there may not seem to be much difference There is a need to build positive relationships between the anti-virus, anti-spam, and security industries. This may require the establishment of standards and interfaces so that their various solutions can work Editor: Helen Martin together successfully. It is important that the three Technical Consultant: Matt Ham industries develop a professional cooperation to help Technical Editor: Morton Swimmer combat the very real and growing threats of today’s Consulting Editors: interconnected society. Nick FitzGerald, Independent consultant, NZ Must anti-virus organizations start providing their own Ian Whalley, IBM Research, USA security and anti-spam solutions? No, but if they do Richard Ford, Florida Institute of Technology, USA Edward Wilding, Data Genetics, UK develop their own solutions, it is important that they acknowledge the fact that they are newcomers to an existing industry, and make efforts to cooperate with rather than re-invent these industries. 2 JANUARY 2004 VIRUS BULLETIN www.virusbtn.com NEWS NUMBER CRUNCHING Last month saw a flurry of the traditional end-of-year Prevalence Table – November 2003 predictions for the security challenges in the year ahead, along with a number of reports estimating the cost of virus Virus Type Incidents Reports attacks to businesses in 2003. However, it is difficult (if not impossible) to truly quantify the ‘average’ cost of a virus Win32/Opaserv File 7492 27.62% attack with so many variables and subjective issues to be Win32/Mimail File 7050 25.99% considered. This fact was suitably illustrated by two recent Win32/Dumaru File 2156 7.95% news reports published just one week apart in Computer Win32/Sobig File 1534 5.65% Weekly (CW – see http://www.computerweekly.com/). First, CW reported that a single virus attack could cost Win32/Bugbear File 1437 5.30% your business £66,000 – a figure arrived at by analyst Win32/Sober File 1110 4.09% firm Datamonitor. The firm estimated an average cost to Win32/Dupator File 1109 4.09% businesses of £26,000 for the more ‘serious’ virus incidents, Win32/Swen File 1014 3.74% while 11 per cent of survey respondents said their companies had suffered greater than £66,000 losses from Win32/Gibe File 989 3.65% a single incident. Win32/Klez File 812 2.99% One week later, CW reported the results of a different Win32/Yaha File 756 2.79% survey, this time carried out by the Corporate IT Forum Win32/Funlove File 286 1.05% (Tif). The Tif survey indicated that the ‘true cost’ per virus Win95/Spaces File 190 0.70% attack to UK companies is an average of £122,000 – a Win32/Nachi File 167 0.62% figure nearly double that indicated by the Datamonitor findings (and more than four times greater than the £30,000 Win32/Fizzer File 99 0.36% per attack cost estimated by PricewaterhouseCoopers and Win32/Magistr File 87 0.32% the Department of Trade and Industry’s 2002 Information Redlof Script 73 0.27% Security Breaches Survey). Win32/Lovsan File 73 0.27% Confused? All we can recommend is that figures such as Win32/SirCam File 59 0.22% these be taken with a dose of salt. While VB recognises Win32/Holar File 43 0.16% the importance of bringing home the notion that virus attacks can and do cause significant losses and upheaval Win32/Deborm File 40 0.15% to businesses, it is unlikely that analysts will come up Win32/Nimda File 31 0.11% with a reliable formula for putting an accurate figure on Win32/Spybot File 30 0.11% those losses. Win32/Ganda File 29 0.11% Win32/Hybris File 25 0.09% SAS – THE SYSADMIN SERVICE? Win32/Sdbot File 25 0.09% A set of proposals for tackling computer crime has been Fortnight Script 24 0.09% published by UK Parliamentary lobby group EURIM and Win32/Kriz File 24 0.09% the Institute for Public Policy Research. Among other Win32/Lovgate File 24 0.09% proposals, the paper recommends the introduction of frameworks to facilitate co-operation between industry and Win32/Parite File 22 0.08% law enforcement. One of the ideas put forward is to bring in Win32/BadTrans File 20 0.07% members of the private sector to assist law enforcement Win32/Valla File 20 0.07% bodies in areas in which they lack the specialist skills Others 390 1.03% necessary to investigate computer crimes. Rather than simply assisting with investigations (as computer security Total 27,130 100% experts have done in the past), the paper proposes that specialists from the private sector would be granted an The Prevalence Table includes a total of 280 reports across expanded role and become (unpaid) special constables 74 further viruses. Readers are reminded that a complete listing is posted at http://www.virusbtn.com/Prevalence/. (without the power to arrest). The full paper can be read at http://www.eurim.org/. JANUARY 2004 3 VIRUS BULLETIN www.virusbtn.com VIRUS ANALYSIS WHO? WHAT? WHERE? SWEN? begins with ‘p’, ‘q’, ‘u’, or ‘i’ (regardless of case), the Peter Ferrie virus displays a prompt to Symantec Security Response, USA install a Microsoft Security Update.
Load more

Recommended publications
  • Computer Viruses, in Order to Detect Them
    Behaviour-based Virus Analysis and Detection PhD Thesis Sulaiman Amro Al amro This thesis is submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Software Technology Research Laboratory Faculty of Technology De Montfort University May 2013 DEDICATION To my beloved parents This thesis is dedicated to my Father who has been my supportive, motivated, inspired guide throughout my life, and who has spent every minute of his life teaching and guiding me and my brothers and sisters how to live and be successful. To my Mother for her support and endless love, daily prayers, and for her encouragement and everything she has sacrificed for us. To my Sisters and Brothers for their support, prayers and encouragements throughout my entire life. To my beloved Family, My Wife for her support and patience throughout my PhD, and my little boy Amro who has changed my life and relieves my tiredness and stress every single day. I | P a g e ABSTRACT Every day, the growing number of viruses causes major damage to computer systems, which many antivirus products have been developed to protect. Regrettably, existing antivirus products do not provide a full solution to the problems associated with viruses. One of the main reasons for this is that these products typically use signature-based detection, so that the rapid growth in the number of viruses means that many signatures have to be added to their signature databases each day. These signatures then have to be stored in the computer system, where they consume increasing memory space. Moreover, the large database will also affect the speed of searching for signatures, and, hence, affect the performance of the system.
    [Show full text]
  • Contents in This Issue
    NOVEMBER 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Virus Bulletin WHEN IRISH EYES ARE thanks the sponsors Is the boot on the other foot? SMILING of VB2005: A busy conference schedule, 3 NEWS combined with the famous warmth Microsoft assists Nigeria in fight against and hospitality of the Irish and a high-tech crime drop or two of the local ‘water’ were Errata – Windows 2003 Server a recipe for success for VB2005 in comparative review Dublin last month. page 14 3 VIRUS PREVALENCE TABLE LANGUAGE LOGGING 4 VIRUS ANALYSIS Using components of Windows multilingual Criss-cross support, it is possible to create a file that will capture keystrokes on a target system while using FEATURES the OS to protect that file from removal or deletion. Masaki Suenaga explains how an IME could be 6 IME as a possible keylogger used as a keylogger. 11 The false positive disaster: anti-virus vs. page 6 WinRar & co. THE TROUBLE WITH WINRAR 13 LETTERS Andreas Marx reports on his extensive false positive testing of anti-virus software. 14 CONFERENCE REPORT page 11 In Dublin’s fair city 16 PRODUCT REVIEW NOD32 for Windows NT/2000/XP/2003/x64 with centralized management This month: anti-spam news and events and 20 END NOTES & NEWS John Graham-Cumming looks at measuring and marketing spam filter accuracy. ISSN 0956-9979 COMMENT ‘It adds insult to the voices of those of us on the systems administrators’ side, which was equal in its representation on the panel.) injury when the So, putting aside the reporting of the subject, I’d like to major media outlets touch again on why accurate reporting is an issue for misrepresent the those of us on the administration side.
    [Show full text]
  • Contents in This Issue
    FEBRUARY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT A NEW TREND IN Are your networks secure? VIRUS WRITING? Following in the footsteps 3 NEWS of W32/Bugbear.A, VB2004 call for papers W32/Mimail.I and .J took Divine intervention the concern of identity theft Waiting, reflecting and removing to another level, producing a plausible-looking popup and web page and asking questions that are favoured security checks of many 3 VIRUS PREVALENCE TABLE banks. Stuart Taylor asks: is there a criminal element entering virus writing? 4 FEATURE page 11 Outbreak response times: putting AV to the test TESTING TIMES It’s not just a product’s ability to detect malware 7 TUTORIAL that is of vital importance to the user, but the speed Mission impossible: the Messenger with which the developer produces an update in and others outbreak situations. Andreas Marx puts AV response times to the test. 11 OPINION page 4 Misguided or malevolent? New trends in virus writing COMPARATIVE REVIEW Matt Ham lines up the AV products for 12 COMPARATIVE REVIEW Windows NT. page 12 Windows NT 4.0 20 END NOTES & NEWS This month: Anti-spam news and events, Habeas delivering the goods, ASRG summary. ISSN 0956-9979 COMMENT ‘Until now, most who are not located in the same office, who may be travelling on business or may be working from home. business use of Managers from any location can respond to instant instant messaging messages with quick decisions. Presence-awareness allows each user to see the online status and availability has been of the of other colleagues on the system.
    [Show full text]
  • Progress Made, Trends Observed a White Paper from the Microsoft Antimalware Team Msrwindows Malicious Software Removalt Tool
    Progress Made, Trends Observed A White Paper from the Microsoft Antimalware Team MSRWindows Malicious Software RemovalT Tool Matthew Braverman Program Manager Microsoft Antimalware Team Acknowledgements I would like to thank the following individuals for their contribution to this paper: Mike Chan, Brendan Foley, Jason Garms, Robert Hensing, Ziv Mador, Mady Marinescu, Michael Mitchell, Adam Overton, Matt Thomlinson, and Jeff Williams The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photo- copying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. Copyright © 2006 Microsoft Corporation. All rights reserved.
    [Show full text]
  • U Slucaju Da Vam Je Racunar Zarazen Virusom Mozete Koristiti Sledece Alate Za Njegovo Odstranjivanje ....Alati Su Poredjani Po Abecednom Redu
    U slucaju da vam je racunar zarazen virusom mozete koristiti sledece alate za njegovo odstranjivanje ....alati su poredjani po abecednom redu.... A AOL.Trojan.32512 Symantec http://www.symantec.com/avcenter/ven...dyremoval.html Apost.A Trend Micro http://www.trendmicro.com/ftp/products/tsc/tsc.zip Autoupder Symantec http://securityresponse.symantec.com...oval.tool.html Avril Sophos http://www.sophos.com/support/disinfection/avril.html Avron Kaspersky http://www.thunderstore.com/clean.htm B BadTrans Panda http://www.pandasoftware.es/library/...rans@mm_en.htm Bad Trans.b Symantec http://securityresponse.symantec.com...r/FixBadtr.exe Panda http://www.pandasoftware.es/library/W32BadtransB_en.htm Sophos http://www.sophos.com/support/disinf...badtransb.html Bagle.A@mm Panda http://www.pandasoftware.com/download/utilities Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=182 Symantec http://securityresponse.symantec.com...oval.tool.html Sophos http://www.sophos.com/support/disinfection/baglea.html AntiVir http://www.antivir.de/download/remov...%2BBedingungen F-Secure http://www.f-secure.com/v-descs/bagle.shtml Norman http://www.norman.com/virus_info/vir...es.shtml#bagle McAfee http://vil.nai.com/vil/stinger Bagle.B@mm Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=193 Panda http://www.pandasoftware.com/virus_i...?idvirus=44777 Symantec http://securityresponse.symantec.com...oval.tool.html McAfee http://vil.nai.com/vil/stinger Bagle.C@mm McAfee http://vil.nai.com/vil/stinger Bitdefender http://www.bitdefender.com/html/viru..._id=1&v_id=205
    [Show full text]
  • 4GT Tuning Switch (13GB), 146, 334–335 Active/Passive Cluster Model Compared with Active/Active, 349–350 a Defined, 336 a (Host) Records, 356 Activesync
    30323 99 pp. 539-570 r1ah.ps 2/19/04 11:15 AM Page 539 Index 4GT tuning switch (13GB), 146, 334–335 Active/Passive cluster model compared with Active/Active, 349–350 A defined, 336 A (Host) records, 356 ActiveSync. See Exchange ActiveSync Accept/Deny lists, 309–312, 320 ActiveX, S/MIME control, 286–287 Access control lists (ACLs), 295 ADC (Active Directory Connector), 29–31 Access control, information privacy, 294–295 components, 154–155 Access properties, SMTP virtual servers, connection agreements, 31 231–232 installing, 165 Accessibility requirements, e-mail systems, 6 name resolution and, 30–31 ACLs (access control lists), 295 overview, 29–30 Active Directory. See also Registry schema changes and, 86–87 compatibility issues, 63–64 service account restrictions, 30 domain functional levels, 63–64 setup permissions, 31 DOMAINPREP and, 29 ADC management snap-in, 165–166 DSAccess (Directory Service Access), ADC servers, upgrading, 184 475–476 ADC Tools Exchange 2000 integration with, 8–9 automating connection agreements, 166–167 Exchange 2003 deployment and, 26–27 launching, 165–166 forest functional levels, 64 log files, 156–157, 173 FORESTPREP and, 27–29 running, 155–156 InetOrgPerson object, 65 ADCObjectCheck, 133 LDAP and, 288–290 ADCUserCheck, 133 linked value replication, 64 AdditionalPoolThreadsPerProc, 474 preparing for Exchange Server 2003, 154 Address Rewrite (EXARCFG), 498–499 RSG integration with, 399–404 ADDROOTCERT.EXE (Add Root Certificate), Active Directory Account Cleanup 497–498 Wizard, 17 ADMIN.EXE (Exchange Server 5.5 Active Directory Connector. See ADC Administrator), 16 (Active Directory Connector) Administration. See also ESM (Exchange System Active Directory Services Interface (ADSI), Manager); QDGs (query-based distribution 111 groups) Active/Active cluster model components, 15–16 compared with Active/Passive, 349–350 improvements to, 92–93 defined, 336 productivity enhancements, 195–196 limitations of, 353 Administrative Groups containers, ESM, 211–212 539 30323 99 pp.
    [Show full text]
  • Contents in This Issue
    APRIL 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT 1 NEW WORM RECEIVED Outbreak detection from the trenches SymbOS/Commwarrior.A is the first worm to use MMS technology to spread on mobile phones. Will MMS 3 NEWS become the replication method of US anti-spyware bill approved choice among malware for mobile phones? Peter Ferrie and Frédéric IT security ‘more stressful than divorce’ Perriot fear that this might be the case. Anti-hype site going for a song page 4 WHAT’S UP DOC? 3 VIRUS PREVALENCE TABLE Static analysis is a critical component of anti-virus strategies, but obfuscation techniques make it 4 VIRUS ANALYSIS difficult to identify the calls made by malicious programs. Eric Uday Kumar, Aditya Kapoor and Paradise lost Arun Lakhotia present DOC, a tool for detecting obfuscated calls and returns in binaries. page 7 7 TECHNICAL FEATURE DOC – answering the hidden ‘call’ of a virus HATS OFF As Linux makes gradual headway in the operating system battleground, VB BOOK REVIEWS continues to see a rise in the number of 11 The art of defence products submitted for Linux 12 Dummies’ guide to viruses comparative reviews. This time there are 17. page 13 13 COMPARATIVE REVIEW Red Hat Linux 9 20 END NOTES & NEWS This month: anti-spam news & events; Bayesian Noise Reduction; ASRG summary. ISSN 0956-9979 COMMENT ‘Ironically it is the wait! The virus does not yet ‘exist’ for your customers because it is still only in Japan. Once it moves across the simplest malware borders it appears on the radar; detection kicks in and that takes 10 copies customers are protected.
    [Show full text]
  • Contents in This Issue
    MAY 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Survey responses by no. and % No of responses Percentage THE 40 37.1 35.48 Keeping pace in a war of worms 35 ELUSIVE 30 25 23 UNICORN 22 3 NEWS 20 15 The results of 11.29 10 9.68 7 NAI reverts to McAfee 6 6.45 Andrew Lee’s 5 4 0 malware naming Symantec vulnerabilities Researchers Vendors Corporate Indy Other survey indicate Call for papers: AVAR 2004 that the anti-virus industry’s UNICORN is as elusive as the shy mythical creature itself. 3 VIRUS PREVALENCE TABLE page 13 VIRUS ANALYSES CHIBA WITTY BLUES 4 Netsky: conflict starter? W32/Witty shows a number of similarities to 9 Chiba Witty blues W32/Slammer: it is short, its sending rate is limited only by available bandwidth, and it selects random target IP addresses. Unlike Slammer, however, FEATURES this worm features a very destructive payload. 11 Password-protected viruses Frédéric Perriot, Péter Ször and Peter Ferrie provide 13 Hunting the UNICORN the witty comments. page 9 17 PRODUCT REVIEW BitDefender for Samba Linux Fileservers 1.5.6-1 20 END NOTES & NEWS This month: anti-spam news and events; closing loopholes in the mail flow with MTA Mark and SPF; and a summary of the month’s posting to the ASRG mailing list. ISSN 0956-9979 COMMENT “When it comes to malware doing very little except being a nuisance through propagation techniques, their method of gaining access protection, overconfidence is our to computers in the first place is usually the tried and own worst enemy.” true strategy of social engineering.
    [Show full text]
  • Virus Bulletin March 2004
    MARCH 2004 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT ALL IN THE MIX Outsourcing: the future of anti-malware Take a little piece of W32/Mimail, a dash of social support? engineering, a pinch of W2K/Stream and share the code freely. Peter Ferrie describes the gaggle of 3 NEWS variants that make up the Dumaru family. Plans, acquisitions and royalty page 4 Gigabyte arrested DOOM AND GLOOM 3 VIRUS PREVALENCE TABLE When a daily sports paper compares a national soccer crisis with the spread of an Internet worm, you know that the worm has had an enormous VIRUS ANALYSES impact on everyday life. Gabor Szappanos tracks 4 How Dumaru? the rise of W32/Mydoom. 9 We’re all doomed page 9 14 FEATURE RESCUE ME Rescue me 2: disinfection with With new malware becoming increasingly complex bootable rescue media and a developing trend towards malware that prevents AV software from functioning, good rescue 16 CALL FOR PAPERS solutions have become vital. Andreas Marx looks at a range of end-user products. page 14 17 PRODUCT REVIEW Grisoft AVG 7.0 19 ERRATA 20 END NOTES & NEWS This month: John Graham-Cumming reports on different ways to say ‘Viagra’ and Pete Sergeant presents his monthly summary of postings to the ASRG mailing list. ISSN 0956-9979 COMMENT ‘The future of employee would have, they do not need access to ‘the keys to the kingdom’ if sample handling is configured corporate malware correctly. In the rare case that the consultant needs to support may visit a machine, non-disclosure agreements, and supervision by a member of staff will meet the trust very well lie in requirements of the client.
    [Show full text]
  • Network Security- Virus Attacks and Defence Using Antivirus Software Trupti Shah Research Scholar of JJT-University, Rajasthan, India
    ISSN : 2347 - 8446 (Online) International Journal of Advanced Research in ISSN : 2347 - 9817 (Print) Vol. 2, Issue 4 (O ct. - Dec. 2014) Computer Science & Technology (IJARCST 2014) Network Security- Virus Attacks and Defence using Antivirus Software Trupti Shah Research Scholar of JJT-University, Rajasthan, India Abstract Network security is important in every field of today’s world such as government offices, educational institutions, any business organization etc. So data security is the extreme critical factor in ensuring the safe transmission of information through the network. Threats to data privacy are powerful tools in the hands of attackers that could use the vulnerabilities of a network to corrupt, destroy and steal the sensitive information. There are many network security measures to protect the data from the hands of the attackers like antivirus software, firewalls, cryptography etc. In this paper an attempt has been made to study different viruses which can harm the computer. It outlines about antivirus software which can detect viruses; worms etc. and warn the user of their presence in computer and deactivate then clean up the computer of malicious software. Keywords Vulnerabilities, Threats, Network Security Measures, Antivirus Software, Firewalls and cryptography. I. Introduction II. Digital Threats Now-a-days, there are so many unethical practices in the form Virus (Vital Information Resource Under Siege): Computer of digital attacks which are causing problems in the field of viruses are the malicious programs having the ability to replicate Information Technology. These attacks are sometimes in the and execute themselves. They can attach themselves to the other form of malicious software which enter in the system by themself program, files or data stored in the system automatically without without the knowledge of the user and sometimes in the form of any instructions from the user.
    [Show full text]
  • Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families
    Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Lars Strande Grini Master’s Thesis Master of Science in Information Security 30 ECTS Department of Computer Science and Media Technology Gjøvik University College, 2015 Avdeling for informatikk og medieteknikk Høgskolen i Gjøvik Postboks 191 2802 Gjøvik Department of Computer Science and Media Technology Gjøvik University College Box 191 N-2802 Gjøvik Norway Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Lars Strande Grini 15/12/2015 Feature Extraction and Static Analysis for Large-Scale Detection of Malware Types and Families Abstract There exist different methods of identifying malware, and widespread method is the one found in almost every antivirus solution on the market today; the signature based ap- proach. This approach uses a one-way cryptographic function to generate a unique hash of each file. Afterwards, each hash is checked against a database of hashes of known mal- ware. This method provides close to none false positives, but this does also mean that this approach can only detect previously known malware, and will in many cases also provide a number of false negatives. Malware authors exploit this weakness in the way that they change a small part of the malicious code, and thereby changes the entire hash of the file, which then leaves the malicious code undetectable until the sample is discovered, analyzed and updated in the vendors database(s). In the light of this relatively easy mit- igation for malware authors, it is clear that we need other ways to identify malware.
    [Show full text]
  • Contents in This Issue
    JULY 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT CHOOSE YOUR WEAPOX Adapt or die No doubt to the surprise of some in the Macintosh community, the MacOS X platform has a rootkit. 3 NEWS Peter Ferrie provides all the details of OSX/Weapox. Symantec takes initiative in adware lawsuit page 4 Microsoft announces plans for Sybari (Attempting an) altered image ON YOUR GUARD Virus reveals power plant data Incidents of malicious applications that steal Eagle eyes financial account information have increased dramatically over the last year. Candid Wueest 4 VIRUS PREVALENCE TABLE demonstrates that the biggest threat to online banking is malicious code executed carelessly on 4 VIRUS ANALYSIS the end-user’s computer, and advises users of online Got [Mac]root? banking to tread carefully. page 6 FEATURES 6 Threats to online banking AN ENEMY DIVIDED 8 Spammer readme Brian McWilliams explains why, despite the recent 10 The ideal tools of an ideal virus lab outbreak of Sober.Q, which showered the Internet with neo-Nazi propaganda emails, he disagrees 13 Q & A with the notion that virus writers and spammers are Microsoft’s dog-and-bone OS – smart and safe? in cahoots. page 8 16 PRODUCT REVIEW Symantec AntiVirus 10 20 END NOTES & NEWS In the VB Spam Supplement this month: anti-spam news & events and how free software Mail Avenger can be used to block unwanted mail. ISSN 0956-9979 COMMENT ‘With any great server. [For a different take on the idea that spammers are converging with virus writers, see p.8 - Ed] invention, there is IronPort’s SenderBase Network monitors global email always a flip side traffic patterns and determined that at the beginning of just waiting to be 2004, less than 30 per cent of spam was coming from infected zombie PCs, but by the end of 2004 this figure exploited and the had jumped to more than 70 per cent.
    [Show full text]