{"id":151,"date":"2018-07-12T05:15:36","date_gmt":"2018-07-12T05:15:36","guid":{"rendered":"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/?post_type=chapter&#038;p=151"},"modified":"2019-05-14T05:50:32","modified_gmt":"2019-05-14T05:50:32","slug":"virus-part-ii","status":"publish","type":"chapter","link":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/chapter\/virus-part-ii\/","title":{"rendered":"Virus Part II"},"content":{"raw":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/n5wibAwbKZ4\" target=\"_blank\" rel=\"noopener\"><img src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a>\r\n<\/span><\/div>\r\n\r\n<div>\r\n\r\n<strong>Virus Signatures :<\/strong>\r\n\r\n&nbsp;\r\n<ul>\r\n \t<li>\u00a0Each of virus characteristics yields a pattern, called a signature.<\/li>\r\n \t<li>The virus's signature is important for creating a program, called a virus scanner, that can automatically detect and, in some cases, remove viruses.<\/li>\r\n<\/ul>\r\nCode red worm:\r\n\r\n&nbsp;\r\n\r\n\/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN\r\n\r\nNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN\r\n\r\nNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN\r\n\r\nNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN\r\n\r\nNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN\r\n\r\n%u9090%u6858%ucbd3\r\n\r\n%u7801%u9090%u6858%ucdb3%u7801%u9090%u6858\r\n\r\n%ucbd3%u7801%u9090\r\n\r\n%u9090%u8190%u00c3%u0003%ub00%u531b%u53ff\r\n\r\n%u0078%u0000%u00=a\r\n\r\n&nbsp;\r\n\r\nHTTP\/1.0\r\n\r\n&nbsp;\r\n\r\n<strong>Storage patterns:<\/strong>\r\n<ul>\r\n \t<li>\u00a0 The attached virus piece is invariant, so that the start of the virus code becomes a detectable signature.<\/li>\r\n \t<li>\u00a0 The attached piece is always located at the same position relative to its attached file.<\/li>\r\n \t<li>\u00a0For example, the virus might always be at the beginning, 400 bytes from the top, or at the bottom of the infected file.<\/li>\r\n \t<li>\u00a0the virus code sits at the top of the program, and the entire virus does its malicious duty before the normal code is invoked.<\/li>\r\n \t<li>\u00a0In other cases, the virus infection consists of only a handful of instructions that point or jump to other, more detailed instructions elsewhere.<\/li>\r\n \t<li>\u00a0For example, the infected code may consist of condition testing and a jump or call to a separate virus module.<\/li>\r\n \t<li>\u00a0In either case, the code to which control is transferred will also have a recognizable pattern.<\/li>\r\n<\/ul>\r\n<img class=\"size-full wp-image-152 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90.png\" alt=\"\" width=\"457\" height=\"348\" \/>\r\n<ul>\r\n \t<li>l A virus may attach itself to a file, in which case the file's size grows. Or the virus may obliterate all or part of the underlying program, in which case the program's size does not change but the program's functioning will be impaired.<\/li>\r\n \t<li>l The virus writer chooses one of these detectable effects.<\/li>\r\n \t<li>l The virus scanner can use a code or checksum to detect changes to a file. It can also look for suspicious patterns, such as a JUMP instruction as the first instruction of a system program (in case the virus has positioned itself at the bottom of the file but wants to be executed first)<\/li>\r\n<\/ul>\r\n<strong>Execution Patterns:<\/strong>\r\n\r\n&nbsp;\r\n\r\nA virus writer may want a virus to do several things at the same time, namely,\r\n<ul>\r\n \t<li>l spread infection,<\/li>\r\n \t<li>l avoid detection,<\/li>\r\n \t<li>l cause harm.<\/li>\r\n<\/ul>\r\n<table class=\"aligncenter\" style=\"width: 623px\" border=\"1\">\r\n<tbody>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\">Virus effect<\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">How it is caused<\/td>\r\n<\/tr>\r\n<tr style=\"height: 29px\">\r\n<td style=\"width: 132.063px;height: 29px\">Attach to executable<\/td>\r\n<td style=\"width: 242.063px;height: 29px\"><\/td>\r\n<td style=\"width: 264.063px;height: 29px\">Modify file directory<\/td>\r\n<\/tr>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\">program<\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">Write to executable program file<\/td>\r\n<\/tr>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\">Attach to data or<\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">Modify directory<\/td>\r\n<\/tr>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\">control file<\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">Rewrite data<\/td>\r\n<\/tr>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\"><\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">Append to data<\/td>\r\n<\/tr>\r\n<tr style=\"height: 14px\">\r\n<td style=\"width: 132.063px;height: 14px\"><\/td>\r\n<td style=\"width: 242.063px;height: 14px\"><\/td>\r\n<td style=\"width: 264.063px;height: 14px\">Append data to self<\/td>\r\n<\/tr>\r\n<tr style=\"height: 44px\">\r\n<td style=\"width: 132.063px;height: 44px\">Remain in memory\u00a0handler address table<\/td>\r\n<td style=\"width: 242.063px;height: 44px\">Load self in nontransient memory area<\/td>\r\n<td style=\"width: 264.063px;height: 44px\">Intercept interrupt by modifying interrupt<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<img class=\"size-full wp-image-153 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91.png\" alt=\"\" width=\"593\" height=\"677\" \/>\r\n\r\n<strong>Transmission Patterns:<\/strong>\r\n\r\n&nbsp;\r\n<ul>\r\n \t<li>l A virus can arrive on a diskette or from a network connection, travel during its host's execution to a hard disk boot sector, reemerge next time the host computer is booted, and remain in memory to infect other diskettes as they are accessed.<\/li>\r\n<\/ul>\r\n<strong>Polymorphic Viruses:<\/strong>\r\n<ul>\r\n \t<li>Example - virus always begins with the string 47F0F00E08 (in hexadecimal) and has string 00113FFF located at word 12<\/li>\r\n \t<li>Less probability that other virus may have the same signature.<\/li>\r\n \t<li>For longer signatures, the probability of a correct match increases.<\/li>\r\n \t<li>If the virus scanner will always look for those strings, then the clever virus writer can change the strings to be in those positions.<\/li>\r\n \t<li>The virus could have two alternative but equivalent beginning words; after being installed, the virus will choose one of the two words for its initial word. Then, a virus scanner would have to look for both patterns.<\/li>\r\n \t<li>A virus that can change its appearance is called a polymorphic virus<strong>.<\/strong><\/li>\r\n \t<li>(<em>Poly<\/em> means \"many\" and <em>morph<\/em> means \"form\".)<\/li>\r\n \t<li>To prevent detection virus will want either a large or an unlimited number of forms So virus scanner cannot search it.<\/li>\r\n \t<li>A polymorphic virus has to randomly reposition all parts of itself and randomly change all fixed data.<\/li>\r\n \t<li>Instead of containing the fixed (searchable) string \"HA! INFECTED BY A VIRUS,\" a polymorphic virus has to change the pattern.<\/li>\r\n<\/ul>\r\n<\/div>\r\n<img class=\"size-full wp-image-154 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92.png\" alt=\"\" width=\"561\" height=\"293\" \/>\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ul>\r\n \t<li>virus writer can create enough different appearances to fool simple virus scanners.<\/li>\r\n \t<li>scanner writers refine their signature definitions by knowing virus writer tricks.<\/li>\r\n<\/ul>\r\n<strong>Sophisticated polymorphic virus:<\/strong>\r\n<ul>\r\n \t<li>randomly intersperses harmless instructions throughout its code.<\/li>\r\n \t<li>Puts \"extra\" instructions, such as - addition of zero to a number, movement of a data value to its own location , a jump to the next instruction which are difficult to locate and make it more difficult to locate an invariant signature.<\/li>\r\n<\/ul>\r\n<strong>Encrypting viruses:<\/strong>\r\n<ul>\r\n \t<li>polymorphic virus uses encryption under various keys to make the stored form of the virus different.<\/li>\r\n \t<li style=\"text-align: justify\">This type of virus must contain three distinct parts: a decryption key,the (encrypted) object code of the virus, and the (unencrypted) object code of the decryption routine.<\/li>\r\n<\/ul>\r\n<div>\r\n\r\n<strong>The Source of Viruses:<\/strong>\r\n\r\n&nbsp;\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Since a virus can be rather small, its code can be \"hidden\" inside other larger and more complicated programs.<\/p>\r\n&nbsp;\r\n\r\n<strong>Prevention of Virus Infection:<\/strong>\r\n\r\n&nbsp;\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 to prevent the infection of a virus is not to share executable code with an infected source.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 On PCs, a <em>.exe<\/em> extension suggests that the file was executable.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 a word processor may have commands within the document file, these commands, called macros, make it easy for the user to do complex or repetitive things.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 spreadsheets, presentation slides, and other office- or business-related files can contain code or scripts that can be executed in various ways\u2014and thereby harbor viruses<\/p>\r\n<strong>Approach of virus writer:<\/strong>\r\n\r\n&nbsp;\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 A <em>.doc<\/em> extension is a Word document, the true document type is hidden in a field at the start of the file.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 a Word document with a <em>.ppt<\/em> (Power-Point) or having any other extension, the operating system will try to open the associated application but, if that fails, the system will switch to the application of the hidden file type.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 The virus writer creates an executable file, names it with an inappropriate extension, and sends it to the victim, describing it is\u00a0<span style=\"text-align: initial;font-size: 1em\">as a picture or a necessary code add-in or something else desirable.<\/span><\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 The unwitting recipient opens the file, executes the malicious code.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Executable code has been hidden in files containing large data sets, such as pictures or read-only documents.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 These bits of viral code are not easily detected by virus scanners and certainly not by the human eye.<\/p>\r\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 For example, In a file containing a photograph; if every sixteenth bit is part of a command string that can be executed, then the virus is very difficult to detect.<\/p>\r\n&nbsp;\r\n\r\n<strong>Precautions against virus:<\/strong>\r\n\r\n&nbsp;\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Assume that any outside source is infected.\r\n\r\n&nbsp;\r\n\r\n<strong>Several techniques for building a reasonably safe community for electronic contact:<\/strong>\r\n\r\n&nbsp;\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Use only commercial software acquired from reliable, well-established vendors.\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Test all new software on an isolated computer.\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Open attachments only when you know them to be safe.\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Make a recoverable system image and store it safely.\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Make and retain backup copies of executable system files\r\n\r\n\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Use virus detectors (often called virus scanners) regularly and update them daily.\r\n<ul>\r\n \t<li><strong>Truths and Misconceptions About Viruses:<\/strong><\/li>\r\n \t<li>Viruses can infect only Microsoft Windows systems. \u2013 False<\/li>\r\n \t<li>Viruses can modify \"hidden\" or \"read only\" files. True<\/li>\r\n \t<li>Viruses can appear only in data files, or only in Word documents, or only in programs. False.<\/li>\r\n \t<li>Viruses spread only on disks or only in e-mail. False.<\/li>\r\n \t<li>Viruses cannot remain in memory after a complete power off\/power on reboot. True.<\/li>\r\n \t<li>Viruses cannot infect hardware. True.<\/li>\r\n \t<li>Viruses can be malevolent, benign, or benevolent. True.<\/li>\r\n<\/ul>\r\n<strong>First Example of Malicious Code: The Brain Virus<\/strong>\r\n<ul>\r\n \t<li style=\"text-align: justify\">The so-called Brain virus was given its name because it changes the label of any disk it attacks to the word \"BRAIN.\"<\/li>\r\n \t<li style=\"text-align: justify\">This virus first locates itself in upper memory and then executes a system call to reset the upper memory bound below itself, so that it is not disturbed as it works.<\/li>\r\n \t<li style=\"text-align: justify\">It traps interrupt number 19 (disk read) by resetting the interrupt address table to point to it and then sets the address for interrupt number 6 (unused) to the former address of the interrupt 19.<\/li>\r\n \t<li style=\"text-align: justify\">the virus screens disk read calls, handling any that would read the boot sector (passing back the original boot contents that were moved to one of the bad sectors); other disk calls go to the normal disk read handler, through interrupt 6.<\/li>\r\n \t<li style=\"text-align: justify\"><\/li>\r\n<\/ul>\r\n<strong>How does it spread?<\/strong>\r\n<ul>\r\n \t<li style=\"text-align: justify\">The Brain virus positions itself in the boot sector and in six other sectors of the disk.<\/li>\r\n \t<li style=\"text-align: justify\">One of the six sectors will contain the original boot code, moved there from the original boot sector, while two others contain the remaining code of the virus.<\/li>\r\n \t<li style=\"text-align: justify\">The remaining three sectors contain a duplicate of the others.<\/li>\r\n \t<li style=\"text-align: justify\">The virus marks these six sectors \"faulty\" so that the operating system will not try to use them. (With low-level calls, you can force the disk drive to read from what the operating system has marked as bad sectors.)<\/li>\r\n \t<li style=\"text-align: justify\">The virus allows the boot process to continue.<\/li>\r\n \t<li style=\"text-align: justify\">Once established in memory, the virus intercepts disk read requests for the disk drive under attack.<\/li>\r\n \t<li style=\"text-align: justify\">With each read, the virus reads the disk boot sector and inspects the fifth and sixth bytes for the hexadecimal value 1234 (its signature).<\/li>\r\n \t<li style=\"text-align: justify\">If it finds that value, it concludes the disk is infected; if not, it infects the disk.<\/li>\r\n<\/ul>\r\n<\/div>\r\n\r\n<table>\r\n<tbody>\r\n<tr>\r\n<td><strong>you can view video on Virus Part II<\/strong><\/td>\r\n<td><a href=\"https:\/\/youtu.be\/n5wibAwbKZ4\" target=\"_blank\" rel=\"noopener\"><img class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n\r\n<strong>Suggested Reading:<\/strong>\r\n\r\n&nbsp;\r\n<ol>\r\n \t<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\r\n \t<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\r\n \t<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\r\n \t<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\r\n \t<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\r\n \t<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\r\n \t<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\r\n \t<li><a style=\"text-align: initial;font-size: 1em\" href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\r\n<\/ol>","rendered":"<div><span style=\"float: right;\"><a href=\"https:\/\/youtu.be\/n5wibAwbKZ4\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"epgp books\" width=\"75px\" height=\"75px;\" \/><\/a><br \/>\n<\/span><\/div>\n<div>\n<p><strong>Virus Signatures :<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>\u00a0Each of virus characteristics yields a pattern, called a signature.<\/li>\n<li>The virus&#8217;s signature is important for creating a program, called a virus scanner, that can automatically detect and, in some cases, remove viruses.<\/li>\n<\/ul>\n<p>Code red worm:<\/p>\n<p>&nbsp;<\/p>\n<p>\/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN<\/p>\n<p>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN<\/p>\n<p>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN<\/p>\n<p>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN<\/p>\n<p>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN<\/p>\n<p>%u9090%u6858%ucbd3<\/p>\n<p>%u7801%u9090%u6858%ucdb3%u7801%u9090%u6858<\/p>\n<p>%ucbd3%u7801%u9090<\/p>\n<p>%u9090%u8190%u00c3%u0003%ub00%u531b%u53ff<\/p>\n<p>%u0078%u0000%u00=a<\/p>\n<p>&nbsp;<\/p>\n<p>HTTP\/1.0<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Storage patterns:<\/strong><\/p>\n<ul>\n<li>\u00a0 The attached virus piece is invariant, so that the start of the virus code becomes a detectable signature.<\/li>\n<li>\u00a0 The attached piece is always located at the same position relative to its attached file.<\/li>\n<li>\u00a0For example, the virus might always be at the beginning, 400 bytes from the top, or at the bottom of the infected file.<\/li>\n<li>\u00a0the virus code sits at the top of the program, and the entire virus does its malicious duty before the normal code is invoked.<\/li>\n<li>\u00a0In other cases, the virus infection consists of only a handful of instructions that point or jump to other, more detailed instructions elsewhere.<\/li>\n<li>\u00a0For example, the infected code may consist of condition testing and a jump or call to a separate virus module.<\/li>\n<li>\u00a0In either case, the code to which control is transferred will also have a recognizable pattern.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-152 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90.png\" alt=\"\" width=\"457\" height=\"348\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90.png 457w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90-300x228.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90-65x49.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90-225x171.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-90-350x267.png 350w\" sizes=\"auto, (max-width: 457px) 100vw, 457px\" \/><\/p>\n<ul>\n<li>l A virus may attach itself to a file, in which case the file&#8217;s size grows. Or the virus may obliterate all or part of the underlying program, in which case the program&#8217;s size does not change but the program&#8217;s functioning will be impaired.<\/li>\n<li>l The virus writer chooses one of these detectable effects.<\/li>\n<li>l The virus scanner can use a code or checksum to detect changes to a file. It can also look for suspicious patterns, such as a JUMP instruction as the first instruction of a system program (in case the virus has positioned itself at the bottom of the file but wants to be executed first)<\/li>\n<\/ul>\n<p><strong>Execution Patterns:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>A virus writer may want a virus to do several things at the same time, namely,<\/p>\n<ul>\n<li>l spread infection,<\/li>\n<li>l avoid detection,<\/li>\n<li>l cause harm.<\/li>\n<\/ul>\n<table class=\"aligncenter\" style=\"width: 623px\">\n<tbody>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\">Virus effect<\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">How it is caused<\/td>\n<\/tr>\n<tr style=\"height: 29px\">\n<td style=\"width: 132.063px;height: 29px\">Attach to executable<\/td>\n<td style=\"width: 242.063px;height: 29px\"><\/td>\n<td style=\"width: 264.063px;height: 29px\">Modify file directory<\/td>\n<\/tr>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\">program<\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">Write to executable program file<\/td>\n<\/tr>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\">Attach to data or<\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">Modify directory<\/td>\n<\/tr>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\">control file<\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">Rewrite data<\/td>\n<\/tr>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\"><\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">Append to data<\/td>\n<\/tr>\n<tr style=\"height: 14px\">\n<td style=\"width: 132.063px;height: 14px\"><\/td>\n<td style=\"width: 242.063px;height: 14px\"><\/td>\n<td style=\"width: 264.063px;height: 14px\">Append data to self<\/td>\n<\/tr>\n<tr style=\"height: 44px\">\n<td style=\"width: 132.063px;height: 44px\">Remain in memory\u00a0handler address table<\/td>\n<td style=\"width: 242.063px;height: 44px\">Load self in nontransient memory area<\/td>\n<td style=\"width: 264.063px;height: 44px\">Intercept interrupt by modifying interrupt<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-153 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91.png\" alt=\"\" width=\"593\" height=\"677\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91.png 593w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91-263x300.png 263w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91-65x74.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91-225x257.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-91-350x400.png 350w\" sizes=\"auto, (max-width: 593px) 100vw, 593px\" \/><\/p>\n<p><strong>Transmission Patterns:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>l A virus can arrive on a diskette or from a network connection, travel during its host&#8217;s execution to a hard disk boot sector, reemerge next time the host computer is booted, and remain in memory to infect other diskettes as they are accessed.<\/li>\n<\/ul>\n<p><strong>Polymorphic Viruses:<\/strong><\/p>\n<ul>\n<li>Example &#8211; virus always begins with the string 47F0F00E08 (in hexadecimal) and has string 00113FFF located at word 12<\/li>\n<li>Less probability that other virus may have the same signature.<\/li>\n<li>For longer signatures, the probability of a correct match increases.<\/li>\n<li>If the virus scanner will always look for those strings, then the clever virus writer can change the strings to be in those positions.<\/li>\n<li>The virus could have two alternative but equivalent beginning words; after being installed, the virus will choose one of the two words for its initial word. Then, a virus scanner would have to look for both patterns.<\/li>\n<li>A virus that can change its appearance is called a polymorphic virus<strong>.<\/strong><\/li>\n<li>(<em>Poly<\/em> means &#8220;many&#8221; and <em>morph<\/em> means &#8220;form&#8221;.)<\/li>\n<li>To prevent detection virus will want either a large or an unlimited number of forms So virus scanner cannot search it.<\/li>\n<li>A polymorphic virus has to randomly reposition all parts of itself and randomly change all fixed data.<\/li>\n<li>Instead of containing the fixed (searchable) string &#8220;HA! INFECTED BY A VIRUS,&#8221; a polymorphic virus has to change the pattern.<\/li>\n<\/ul>\n<\/div>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-154 aligncenter\" src=\"http:\/\/itp4.epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92.png\" alt=\"\" width=\"561\" height=\"293\" srcset=\"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92.png 561w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92-300x157.png 300w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92-65x34.png 65w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92-225x118.png 225w, https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-content\/uploads\/sites\/25\/2018\/07\/Untitled-92-350x183.png 350w\" sizes=\"auto, (max-width: 561px) 100vw, 561px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>virus writer can create enough different appearances to fool simple virus scanners.<\/li>\n<li>scanner writers refine their signature definitions by knowing virus writer tricks.<\/li>\n<\/ul>\n<p><strong>Sophisticated polymorphic virus:<\/strong><\/p>\n<ul>\n<li>randomly intersperses harmless instructions throughout its code.<\/li>\n<li>Puts &#8220;extra&#8221; instructions, such as &#8211; addition of zero to a number, movement of a data value to its own location , a jump to the next instruction which are difficult to locate and make it more difficult to locate an invariant signature.<\/li>\n<\/ul>\n<p><strong>Encrypting viruses:<\/strong><\/p>\n<ul>\n<li>polymorphic virus uses encryption under various keys to make the stored form of the virus different.<\/li>\n<li style=\"text-align: justify\">This type of virus must contain three distinct parts: a decryption key,the (encrypted) object code of the virus, and the (unencrypted) object code of the decryption routine.<\/li>\n<\/ul>\n<div>\n<p><strong>The Source of Viruses:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Since a virus can be rather small, its code can be &#8220;hidden&#8221; inside other larger and more complicated programs.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Prevention of Virus Infection:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 to prevent the infection of a virus is not to share executable code with an infected source.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 On PCs, a <em>.exe<\/em> extension suggests that the file was executable.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 a word processor may have commands within the document file, these commands, called macros, make it easy for the user to do complex or repetitive things.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 spreadsheets, presentation slides, and other office- or business-related files can contain code or scripts that can be executed in various ways\u2014and thereby harbor viruses<\/p>\n<p><strong>Approach of virus writer:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 A <em>.doc<\/em> extension is a Word document, the true document type is hidden in a field at the start of the file.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 a Word document with a <em>.ppt<\/em> (Power-Point) or having any other extension, the operating system will try to open the associated application but, if that fails, the system will switch to the application of the hidden file type.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 The virus writer creates an executable file, names it with an inappropriate extension, and sends it to the victim, describing it is\u00a0<span style=\"text-align: initial;font-size: 1em\">as a picture or a necessary code add-in or something else desirable.<\/span><\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 The unwitting recipient opens the file, executes the malicious code.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Executable code has been hidden in files containing large data sets, such as pictures or read-only documents.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 These bits of viral code are not easily detected by virus scanners and certainly not by the human eye.<\/p>\n<p style=\"text-align: justify\">\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 For example, In a file containing a photograph; if every sixteenth bit is part of a command string that can be executed, then the virus is very difficult to detect.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Precautions against virus:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Assume that any outside source is infected.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Several techniques for building a reasonably safe community for electronic contact:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Use only commercial software acquired from reliable, well-established vendors.<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Test all new software on an isolated computer.<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Open attachments only when you know them to be safe.<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Make a recoverable system image and store it safely.<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Make and retain backup copies of executable system files<\/p>\n<p>\u2022\u00a0\u00a0\u00a0\u00a0\u00a0 Use virus detectors (often called virus scanners) regularly and update them daily.<\/p>\n<ul>\n<li><strong>Truths and Misconceptions About Viruses:<\/strong><\/li>\n<li>Viruses can infect only Microsoft Windows systems. \u2013 False<\/li>\n<li>Viruses can modify &#8220;hidden&#8221; or &#8220;read only&#8221; files. True<\/li>\n<li>Viruses can appear only in data files, or only in Word documents, or only in programs. False.<\/li>\n<li>Viruses spread only on disks or only in e-mail. False.<\/li>\n<li>Viruses cannot remain in memory after a complete power off\/power on reboot. True.<\/li>\n<li>Viruses cannot infect hardware. True.<\/li>\n<li>Viruses can be malevolent, benign, or benevolent. True.<\/li>\n<\/ul>\n<p><strong>First Example of Malicious Code: The Brain Virus<\/strong><\/p>\n<ul>\n<li style=\"text-align: justify\">The so-called Brain virus was given its name because it changes the label of any disk it attacks to the word &#8220;BRAIN.&#8221;<\/li>\n<li style=\"text-align: justify\">This virus first locates itself in upper memory and then executes a system call to reset the upper memory bound below itself, so that it is not disturbed as it works.<\/li>\n<li style=\"text-align: justify\">It traps interrupt number 19 (disk read) by resetting the interrupt address table to point to it and then sets the address for interrupt number 6 (unused) to the former address of the interrupt 19.<\/li>\n<li style=\"text-align: justify\">the virus screens disk read calls, handling any that would read the boot sector (passing back the original boot contents that were moved to one of the bad sectors); other disk calls go to the normal disk read handler, through interrupt 6.<\/li>\n<li style=\"text-align: justify\"><\/li>\n<\/ul>\n<p><strong>How does it spread?<\/strong><\/p>\n<ul>\n<li style=\"text-align: justify\">The Brain virus positions itself in the boot sector and in six other sectors of the disk.<\/li>\n<li style=\"text-align: justify\">One of the six sectors will contain the original boot code, moved there from the original boot sector, while two others contain the remaining code of the virus.<\/li>\n<li style=\"text-align: justify\">The remaining three sectors contain a duplicate of the others.<\/li>\n<li style=\"text-align: justify\">The virus marks these six sectors &#8220;faulty&#8221; so that the operating system will not try to use them. (With low-level calls, you can force the disk drive to read from what the operating system has marked as bad sectors.)<\/li>\n<li style=\"text-align: justify\">The virus allows the boot process to continue.<\/li>\n<li style=\"text-align: justify\">Once established in memory, the virus intercepts disk read requests for the disk drive under attack.<\/li>\n<li style=\"text-align: justify\">With each read, the virus reads the disk boot sector and inspects the fifth and sixth bytes for the hexadecimal value 1234 (its signature).<\/li>\n<li style=\"text-align: justify\">If it finds that value, it concludes the disk is infected; if not, it infects the disk.<\/li>\n<\/ul>\n<\/div>\n<table>\n<tbody>\n<tr>\n<td><strong>you can view video on Virus Part II<\/strong><\/td>\n<td><a href=\"https:\/\/youtu.be\/n5wibAwbKZ4\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-120\" src=\"http:\/\/epgpbooks.inflibnet.ac.in\/wp-content\/uploads\/2018\/11\/download.png\" alt=\"\" width=\"36\" height=\"36\" \/><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Suggested Reading:<\/strong><\/p>\n<p>&nbsp;<\/p>\n<ol>\n<li>Cryptography and Network Security Principles and Practice by William Stallings, sixth Edition, PEARSON.<\/li>\n<li>Security in Computing by Charles Pfleeger &amp; Shari Lawrence Pfleeger, fourth Edition, PEARSON.<\/li>\n<li>Network Security by Charlie Kaufman, Radia Perlman, Mike Speciner, second Edition, PHI.<\/li>\n<li>The Complete Reference \u2013 Network Security by Roberta Bragg, Mark Rhodes-Ousley &amp; Keith Strassberg, Tata McGraw Hill<\/li>\n<li>Network Security Bible by Eric Cole, Ronald Krutz, James Conley, Wiley<\/li>\n<li>Hacking 6 Exposed by Stuart McClure, Joel Scambray &amp; George Kurtz , Tata McGraw Hill .<\/li>\n<li><a href=\"http:\/\/www.snort.org\/\">www.snort.org<\/a><\/li>\n<li><a style=\"text-align: initial;font-size: 1em\" href=\"https:\/\/nmap.org\/\">https:\/\/nmap.org<\/a><\/li>\n<\/ol>\n","protected":false},"author":4,"menu_order":16,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":["miss-hiteishi-diwanji"],"pb_section_license":""},"chapter-type":[],"contributor":[58],"license":[],"class_list":["post-151","chapter","type-chapter","status-publish","hentry","contributor-miss-hiteishi-diwanji"],"part":3,"_links":{"self":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/users\/4"}],"version-history":[{"count":8,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/151\/revisions"}],"predecessor-version":[{"id":452,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/151\/revisions\/452"}],"part":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/parts\/3"}],"metadata":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapters\/151\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/media?parent=151"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/pressbooks\/v2\/chapter-type?post=151"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/contributor?post=151"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/ebooks.inflibnet.ac.in\/itp4\/wp-json\/wp\/v2\/license?post=151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}