Computer Viruses

• A computer virus is a type of malicious software that, when executed, replicates itself by modifying other computer programs and inserting its own code.

MAIN VIRUS PARTS

† Trigger (logic bomb) is the compiled version that could be activated any time. † Payload is the actual body or data that perform the actual malicious purpose of the virus.

LIFE CYCLE ‡ Dormant phase

‡ Propagation phase

The virus program has managed to access the target user's computer or software, but during this stage, the virus does not take any action. Not all viruses have this stage.

The virus starts multiplying and replicating itself. The virus places a copy of itself into other programs or into certain system areas on the disk.

‡ Triggering phase

‡ Execution phase This is the actual

A dormant virus moves into this phase when it is activated, and will now perform the function for which it was intended.

work of the virus, where the "payload" will be released. It can be destructive or relatively harmless such as popping up humorous or political messages on screen.

SOME COMPUTER VIRUSES ◊ ILOVEYOU- The virus was created by two Filipino programers. What it did was get people to click on the attachment, in this case, a love confession. Once clicked, it will send itself to everyone in the user’s mailing list and proceed to overwrite files with itself, making the computer unbootable.

◊ MELISSA- Named after an exotic dancer from Florida, it was created in 1999. It started as an infected Word document claiming to be a list of passwords for pornographic sites. The virus will mail itself to the top 50 people in the user’s email address book and this caused an increase of email traffic, disrupting the email services of governments and corporations.

◊ STUXNET- Believed to have been created by the Israeli Defence Force together with the American Government, Stuxnet is an example of a virus created for the purpose of cyberwarfare, as it was intended to disrupt the nuclear efforts of the Iranians.

COUNTERMEASURES: ANTIVIRUS SOFTWARE A specific component of anti-virus and anti-malware software, hooks deep into the operating system's core or kernel and functions in a manner similar to how certain malware itself would attempt to operate. Any time the operating system accesses a file, the on-access scanner checks if the file is a 'legitimate' file or not. If the file is identified as malware by the scanner, the access operation will be stopped, the file will be dealt with by the scanner in a pre-defined way and the user will be notified.