What Are Viruses and Worms, and Why You May Be At Risk, Even If You Think You're Safe

<br /> <p>Everybody has heard of computer viruses and worms - they're all over the news these days, but many people don't really understand what they are, or how to avoid them.</p><p>Basically, a virus or a worm is a program which is able to copy itself and spread from computer to computer. Kind of like a virus in a person, which gets one person sick, then that person passes it on to others, and they get sick too. Hence the name virus.</p><p>The difference between a worm and a virus is that a virus needs a person to open it to start it running and to allow it to infect your computer (for example, by opening an email attachment that hasn't been scanned for viruses) A worm on the other hand, infect a computer and spread to other computers again and again without you clicking a single thing.</p><p>Once a worm or a virus is on your computer, it can do a lot of different things. Until fairly recently, viruses (from now on, just assume that any time I say viruses, that I mean both viruses and worms, because they're very similar and it'll save time) Until recently, viruses were usually very damaging - they would delete files, completely erase hard drives, or sometimes even ruin a computers' motherboard by infecting a specific chip on the motherboard. (A motherboard, also called a "main logic board", is the main circuit board in the computer, so it's kind of like your central nervous system) When the software in the chip was replaced, you suddenly couldn't boot the computer, even with a clean hard drive.</p><p>Viruses were so damaging because the virus writers mainly wrote them to get their name known, and the bigger the damage, the more infamous they were.</p><p>These days, many viruses can lurk on your computer without you even knowing it, because the virus writers have different agendas. For example, there are millions of computers out there which are infected with viruses that cause the computers to send out spam (junk mail), and the computer owner has no idea this is happening.</p><p>These days, virus writers want to make money, and so to allow the virus to spread the most, the infected computers need to keep working. Because of this, the computer may slow down some, but nothing major seems to have gone wrong. But in reality, the computer user has had the wool pulled over their eyes and they just keep clicking away innocently while their computer silently sends out millions of junk emails.</p><p>By some estimates, there are over 100,000 viruses which specifically infect Windows PCs. These specific viruses cannot infect Linux or Unix machines, or Macs. There is literally one virus (at the time I'm recording this) which can infect some Macs running OS X, but it is pretty much what they call a "concept virus" which isn't likely to spread "in the wild."</p><p>So if you use a Mac, you are a lot safer than your friends who use Windows. But just because there aren't any Mac viruses now, doesn't mean someone won't develop one in the future. It is harder to do this for a Mac than it is to do for a Windows machine, because of the way the Mac software is designed, but it's hardly impossible.</p><p>On the other hand, Symantec (who makes Norton Antivirus) estimates that 91% (yes, that's ninety-one percent) of Windows computers are infected with some malicious software. Although this estimate includes adware and spyware (which I cover in a different chapter of this report) that's still an incredibly high number.</p><p>There are a couple of reasons for why viruses and other "malware" infect Windows machines so often. One reason is exposure - there are many times more computers running Windows than any other operating system, so they present a bigger target. But remember, just because a lot of people use something, doesn't mean it's the best option. Fast food is very very popular, but I don't think you could really say it's the best quality food.</p><p>Speaking of food, if you know your history, then you may have heard of the Irish Potato Famine that killed hundreds of thousands of people back in the 1800s.</p><p>This happened because of something called a "monoculture." In plain English, what that means is, the Irish used potatoes as the core of their diet - everybody ate them, and everybody grew them. And they were all growing one just one breed of potato.</p><p>What does that have to do with computers, you might be wondering.</p><p>Well, because they were only growing one type of potato, when a disease came along, it spread like wildfire, and killed off all of the potatoes, since they were all of the same type, and all had the same weakness to this disease.</p><p>This is just like how most people are using Windows, which creates something called a "computing monoculture." So that latest virus or worm, spreads all over the world sometimes in a matter of hours, because most computers are vulnerable.</p><p>Does that make sense?</p><p>And aside from that, Windows has so many security flaws (which mostly happen because of programming mistakes made by Microsoft) that they're discovering dozens and dozens more of these critical flaws every year. Any one of these critical flaws can allow anyone with a little knowledge to take control of your computer and use it any way they want. Or they can write a program (a virus) which does the same thing. For each of these flaws, you must install the update or "patch," which fixes the flaw, or you run the risk of your computer being hacked or infected.</p><p>Mac OS X in contrast to Windows, has had some of it's own security flaws in the last few years, but as yet we haven't seen a single real threat to them. Other operating systems such as Linux have similar track records. It is just as important on these computers to install any security updates, too, just in case.</p><p>Bottom line is, if you're running Windows it is absolutely essential that not only do you have antivirus software installed, but you must make sure your one-year subscription hasn't expired, and the software is updated every day. Your computer may have antivirus software installed, but if the subscription has expired, it's not protecting you!</p><p>I see this all the time -- people with Dells, HPs, or most of the big brand names will find their computer came with Norton or McAfee antivirus, but it only works for 90 days before the subscription expires. People get prompted to renew their subscription, but they don't do it.</p><p>I have been called by so many people, especially in the last few years, who have had me clean their systems up for them. In most cases I've found they either never put antivirus software on their PCs, or had ignored the repeated warnings from Norton or McAfee telling them their subscription had expired.</p><p>In many of those cases, I discovered a computer that barely worked anymore (or was so slow it literally took 10-20 minutes before you could start using it after you turned it on). In these situations I'm faced with either wiping their computer clean, and spending hours reinstalling Windows and their various programs (assuming they even had all their disks), etc., or spending hours scanning and cleaning up the computer with a variety of programs just to get them working again. Either way it takes time and effort to recover from a bad virus infection.</p><p>Hundreds of dollars, and hours, days, or weeks of aggravation, just because they didn't spend $40-$50 for antivirus software and take a few minutes to install it.</p><p>Another critical mistake people make with their antivirus software, is assuming that because Norton Antivirus and McAfee Antivirus are two of the best known, and most popular programs, that they are also the best ones.</p><p>This turns out not to be true. In fact, just the opposite.</p><p>A recent study by CERT, the Computer Emergency Response Team (one of the world's leading computer security organizations) revealed that the most popular antivirus programs, which include Norton and McAfee, missed 80% of new malicious software!</p><p>So in other words, 80% of the time, those programs are useless when trying protecting your computer!</p><p>So you're much better off with a less-known, but high quality program like <a href="http://www.kaspersky.com" rel="nofollow" target="_new">Kaspersky Internet Security</a>, which has been consistently rated as one of the best, with a success rate of over 99% effective. It's also a really good deal as you get a license to use it on 3 computers for less than the price of Symantec Antivirus (Norton) on one PC.</p><p>Aside from having effective antivirus software, which is current and up-to-date, you also need to be getting your security updates installed as soon as they come out.</p><p>On Windows computers, this is called Windows Update, and on Macs this is called Software Update.</p><p>Both Macs and Windows users (if you have Windows XP service pack 2 installed or any newer version of Windows) probably have their computer checking for these updates automatically, but they may not get installed unless you follow the steps when the computer tells you there are updates available.</p><p>Hopefully these tips will help you keep yourself safe.</p> <br /> <br /> <br /> <br /> <br /> <br /><br /> <p>Worth Godwin is a computer coach with over 15 years' experience helping computer users of all levels, and has also worked for many years "in the trenches" as a hardware and software tech, solving real-world computer problems.</p><p>Worth has also been studying the human mind, and how people learn, since the early 1990s. He draws upon all of this experience, as well as his English and writing degrees, to teach people in a unique way with explanations that really make sense.</p><p>In 2006, Worth began putting his easy lessons together on CD, helping you with either <a href="http://www.worthgodwin.com/apple-mac-os-x-how-to-training/" target="_new">Apple Mac training</a> or <a href="http://www.worthgodwin.com/windows-computer-how-to-training/" target="_new">Windows computer training</a> that lets you go at your own pace, for an affordable price, with a system that is both simple and easy.</p> <br />

What Are Viruses and Worms, and Why You May Be At Risk, Even If You Think You're Safe

Everybody has heard of computer viruses and worms - they're all over the news these days, but many people don't really understand...

Continue Reading>>

Viruses and Worms, Protection from Disaster

<br /> <p>Virus damage estimated at $55 billion in 2003. "SINGAPORE - Trend Micro Inc, the world's third-largest anti-virus software maker, said Friday that computer virus attacks cost global businesses an estimated $55 billion in damages in 2003, a sum that would rise this year. Companies lost roughly $20 billion to $30 billion in 2002 from the virus attacks, up from about $13 billion in 2001, according to various industry estimates." This was the story across thousands of news agencies desk January 2004. Out of $55 billion, how much did it cost your company? How much did it cost someone you know?</p><p>I. The Why</p><p>There is an average of 10-20 viruses released every day. Very few of these viruses actually make ?Wild? stage. Viruses are designed to take advantage of security flaws in software or operating systems. These flaws can be as blatant as Microsoft Windows NetBIOS shares to exploits using buffer overflows. Buffer overflows happen when an attacker sends responses to a program longer then what is expected. If the victim software is not designed well, then the attacker can overwrite the memory allocated to the software and execute malicious code.</p><p>People make viruses for various reasons. These reasons range from political to financial to notoriety to hacking tools to plain malicious intent.</p><p>Political: Mydoom is a good example of a virus that was spread with a political agenda. The two targets of this virus were Microsoft and The SCO Group. The SCO Group claims that they own a large portion of the Linux source code threatened to sue everyone using Linux operating systems (with "stolen" programming source). The virus was very effective knocking down SCO's website. However, Microsoft had enough time to prepare for the second attack and efficiently sidestepped disaster.</p><p>Financial: Some virus writers are hired by other parties to either leach financial data from a competitor or make the competitor look bad in the public eye. Industrial espionage is a high risk/high payout field that can land a person in prison for life.</p><p>Notoriety: There are some that write viruses for the sole purpose of getting their name out. This is great when the virus writers are script kiddies because this helps the authorities track them down. There are several famous viruses that have the author's email in the source code or open script</p><p>Hacking Hackers sometimes write controlled viruses to assist in the access of a remote computer. They will add a payload to the virus such as a Trojan horse to allow easy access into the victims system.</p><p>Malious: These are the people that are the most dangerous. These are the blackhat hackers that code viruses for the sole intention of destroying networks and systems without prejudice. They get high on seeing the utter destruction of their creation, and are very rarely script kiddies.</p><p>Many of the viruses that are written and released are viruses altered by script kiddies. These viruses are known as generations of the original virus and are very rarely altered enough to be noticeable from the original. This stems back to the fact that script kiddies do not understand what the original code does and only alters what they recognize (file extension or victim's website). This lack of knowledge makes script kiddies very dangerous.</p><p>II. The How</p><p>Malicious code has been plaguing computer systems since before computers became a common household appliance. Viruses and worms are examples of malicious code designed to spread and cause a system to perform a function that it was not originally designed to do.</p><p>Viruses are programs that need to be activated or run before they are dangerous or spread. The computer system only becomes infected once the program is run and the payload has bee deployed. This is why Hackers and Crackers try to crash or restart a computer system once they copy a virus onto it.</p><p>There are four ways a virus can spread:<br /><br>1.) Email<br /><br>2.) Network<br /><br>3.) Downloading or installing software<br /><br>4.) Inserting infected media</p><p>Spreading through Email</p><p>Many emails spread when a user receives an infected email. When the user opens this email or previews it, the virus is now active and starts to immediately spread.</p><p>Spreading through Network</p><p>Many viruses are network aware. This means that they look for unsecured systems on the network and copy themselves to that system. This behavior destroys network performance and causes viruses to spread across your system like wildfire. Hackers and Crackers also use Internet and network connections to infect systems. They not only scan for unprotected systems, but they also target systems that have known software vulnerabilities. This is why keeping systems up to date is so important.</p><p>Spreading through manual installation</p><p>Installing software from downloads or disks increase the risk of infection. Only install trusted and scanned software that is known to be safe. Stay away from freeware and shareware products. These programs are known to contain Spyware, Adware, and viruses. It is also good policy to deny all Internet software that attempts to install itself unless explicitly needed.</p><p>Spreading through boot sectors</p><p>Some viruses corrupt the boot sector of disks. This means that if another disks scans the infected disk, the infection spreads. Boot sector viruses are automatically run immediately after the disk is inserted or hard drive connected.</p><p>III. Minimizing the effect of viruses and worms</p><p>We have all heard stories about the virus that destroyed mission critical company data, which cost companies months to recover and thousands of dollars and man-hours restoring the information. In the end, there are still many hours, costs, and would be profits that remain unaccounted. Some companies never recover fully from a devastating attack. Taking simple precautions can save your business</p><p>Anti-virus Software</p><p>Another step is to run an antivirus program on the local computer. Many antivirus programs offer live update software and automatically download the newest virus definitions minutes after they are released (Very important that you verify these updates weekly if not daily). Be careful of which antivirus program you chose. Installing a PC antivirus on a network can be more destructive on performance than a virus at work. Norton makes an effective corporate edition specifically designed for Windows NT Server and network environments. When using antivirus software on a network, configure it to ignore network drives and partitions. Only scan the local system and turn off the auto protection feature. The auto-protect constantly scans your network traffic and causes detrimental network issues. Corporate editions usually have this disabled by default. PC editions do not.</p><p>Email Clients<br /><br>Do not open emails from unknown sources. If you have a website for e-commerce transactions or to act as a virtual business card, make sure that the emails come up with a preset subject. If the emails are being sent through server side design instead of the users email client, specify whom it is coming from so you know what emails to trust. Use common sense when looking at your email. If you see a strange email with an attachment, do not open it until you verify whom it came from. This is how most MM worms spread.</p><p>Disable preview panes in email clients. Email clients such as Outlook and Outlook Express have a feature that will allow you to preview the message when the email is highlighted. This is a Major security flaw and will instantly unleash a virus if the email is infected.</p><p>It is also a good idea to turn off the feature that enables the client to view HTML formatted emails. Most of these viruses and worms pass by using the html function "" and run the attached file within the email header.</p><p>We will take a quick look at an email with the subject header of "You're now infected" that will open a file called readme.exe.</p><p>"Subject: You're now infected <br /><br>MIME-Version: 1.0<br /><br>Content-Type: multipart/related;</p><p>type="multipart/alternative";</p><p>boundary="====_ABC1234567890DEF_===="<br /><br>X-Priority: 3<br /><br>X-MSMail-Priority: Normal<br /><br>X-Unsent: 1<br /><br>To: undisclosed-recipients:;</p><p>--====_ABC1234567890DEF_====<br /><br>Content-Type: multipart/alternative;</p><p>boundary="====_ABC0987654321DEF_====" *** (This calls the iframe)</p><p>--====_ABC0987654321DEF_====<br /><br>Content-Type: text/html;</p><p>charset="iso-8859-1"<br /><br>Content-Transfer-Encoding: quoted-printable</p><p>*** (This calls readme.exe)</p><p>--====_ABC0987654321DEF_====--</p><p>--====_ABC1234567890DEF_====<br /><br>Content-Type: audio/x-wav;</p><p>name="readme.exe" *** (This is the virus/worm)<br /><br>Content-Transfer-Encoding: base64<br /><br>Content-ID: *** (Notice the )</p><p>PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9u<br /><br>YWwvL0VOIj4NIDxodG1sPg08aGVhZD4NPHRpdGxlPldobydzIHRoZSBiZXN0LS0tLS0tPyAt<br /><br>IHd3dy5lemJvYXJkLmNvbTwvdGl0bGU+DQ0NDTxzY3JpcHQgbGFuZ3VhZ2U9amF2YXNjcmlw<br /><br>dCBzcmM9aHR0cDovL3d3dzEuZXpib2FyZC5jb20vc3BjaC5qcz9jdXN0b21lcmlkPTExNDc0<br /><br>NTgwODI+PC9zY3JpcHQ+DTxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPg08IS0tDWZ1<br /><br>bmN0aW9uIE1NX29wZW5CcldpbmRvdyh0aGVVUkwsd2luTmFtZSxmZWF0dXJlcykgeyAvL3Yy</p><p>*** Broken to protect the innocent. (Worm is encoded in Base64)</p><p>aHJlZj1odHRwOi8vY2l0YWRlbDMuZXpib2FyZC5jb20vZmNhbGhpc3BvcnRzZnJtMT5Gb290<br /><br>YmFsbDwvYT4NIA08Zm9udCBjb2xvcj0jRkYwMDAwPiAtIDwvZm9udD4NDTxicj48YnI+PGJy<br /><br>Pjxicj5Qb3dlcmVkIEJ5IDxhIGhyZWY9aHR0cDovL3d3dy5lemJvYXJkLmNvbS8+ZXpib2Fy<br /><br>ZK48L2E+IFZlci4gNi43LjE8YnI+Q29weXJpZ2h0IKkxOTk5LTIwMDEgZXpib2FyZCwgSW5j<br /><br>Lg08L2NlbnRlcj4NPC9ib2R5Pg08L2h0bWw+DQ0NDQoNCj==</p><p>--====_ABC1234567890DEF_====--"</p><p>Email Servers<br /><br>The first step to minimizing the effect of viruses is to use an email server that filters incoming emails using antivirus software. If the server is kept up to date, it will catch the majority of Mass Mailer (MM) worms. Ask your Internet Service Provider (ISP) if they offer antivirus protection and spam filtering on their email servers. This service is invaluable and should always be included as the first line of defense.</p><p>Many companies house an internal email server that downloads all of the email from several external email accounts and then runs an internal virus filter. Combining an internal email server with the ISP protection is a perfect for a company with an IT staff. This option adds an extra layer of control, but also adds more administration time.<br /><br>Sample specs for an internal email server are:</p><p>Setup #1</p><p>* Linux: OS</p><p>* Sendmail: mail server</p><p>* Fetchmail: Grabs email from external email addresses</p><p>* F-prot: Antivirus</p><p>* SpamAssassin: Spam Filter</p><p>Setup #2</p><p>* Win 2003 Server: OS</p><p>* Exchange: Email server</p><p>* Symantec antivirus: Antivirus</p><p>* Exchange Intelligent Message Filter: Spam Filter</p><p>Software Updates<br /><br>Keep you software up to date. Some worms and viruses replicate through vulnerabilities in services and software on the target system. Code red is a classic example. In august 2001, the worm used a known buffer overflow vulnerability in Microsoft's IIS 4.0 and 5.0 contained in the Idq.dll file. This would allow an attacker to run any program they wanted to on the affected system. Another famous worm called Slammer targeted Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000.</p><p>When updating your software, make sure to disable features and services that are not needed. Some versions of WinNT had a web server called IIS installed by default. If you do not need the service, make sure it is turned off (Code red is a perfect example). By only enabling services you need, you decrease the risk of attack.</p><p>Telecommunications Security<br /><br>Install a firewall on the network. A firewall is a device or software that blocks unwanted traffic from going to or from the internal network. This gives you control of the traffic coming in and going out of your network. At minimum, block ports 135,137,139,445. This stops most network aware viruses and worms from spreading from the Internet. However, it is good practice to block all traffic unless specifically needed.</p><p>Security Policies<br /><br>Implementing security policies that cover items such as acceptable use, email retention, and remote access can go a long way to protecting your information infrastructure. With the addition of annual training, employees will be informed enough to help keep the data reliable instead of hinder it. Every individual that has access to your network or data needs to follow these rules. It only takes one incident to compromise the system. Only install proven and scanned software on the system. The most damaging viruses come from installing or even inserting a contaminated disk. Boot sector viruses can be some of the hardest malware to defeat. Simply inserting a floppy disk with a boot sector virus can immediately transfer the virus to the hard drive.</p><p>When surfing the Internet, do not download untrusted files. Many websites will install Spyware, Adware, Parasites, or Trojans in the name of "Marketing" on unsuspecting victims computers. Many prey on users that do not read popup windows or download freeware or shareware software. Some sites even use code to take advantage of vulnerability in Internet explorer to automatically download and run unauthorized software without giving you a choice.</p><p>Do not install or use P2P programs like Kazaa, Morpheus, or Limewire. These programs install server software on your system; essentially back dooring your system. There are also thousands of infected files floating on those networks that will activate when downloaded.</p><p>Backups & Disaster Recovery Planning<br /><br>Keep daily backups offsite. These can be in the form of tape, CD-R, DVD-R, removable hard drives, or even secure file transfers. If data becomes damaged, you would be able to restore from the last known good backup. The most important step while following a backup procedure is to verify that the backup was a success. Too many people just assume that the backup is working only to find out that the drive or media was bad six<br /><br>months earlier when they were infected by a virus or lost a hard drive. If the data that you are trying to archive is less then five gig, DVD-R drives are a great solution. Both the drives and disks have come down in price and are now a viable option. This is also one of the fastest backup methods to process and verify. For larger backups, tape drives and removable hard drives are the best option. If you choose this method, you will need to rotate the backup with five or seven different media (tapes, CD/DVD, removable drives) to get the most out of the process. It is also suggested to take a "master" backup out of the rotation on a scheduled basis and archive offsite in a fireproof safe. This protects the data from fire, flood, and theft.</p><p>In the Internet age, understanding that you have to maintain these processes will help you become successful when preventing damage and minimizes the time, costs, and liabilities involved during the disaster recovery phase if you are affected.</p><p>Resources</p><p>Virus Resources<br /><br>F-PROT: <a href="http://www.f-prot.com/virusinfo/" rel="nofollow" target="_new">http://www.f-prot.com/virusinfo/</a><br /><br>McAfee : <a href="http://vil.nai.com/vil/default.asp" rel="nofollow" target="_new">http://vil.nai.com/vil/default.asp</a><br /><br>Symantec Norton: <a href="http://www.symantec.com/avcenter/" rel="nofollow" target="_new">http://www.symantec.com/avcenter/</a><br /><br>Trend Micro: <a href="http://www.trendmicro.com/vinfo/" rel="nofollow" target="_new">http://www.trendmicro.com/vinfo/</a><br /><br>NIST GOV: <a href="http://csrc.nist.gov/virus/" rel="nofollow" target="_new">http://csrc.nist.gov/virus/</a></p><p>Free software<br /><br>AVG Anti-Virus - <a href="http://free.grisoft.com" rel="nofollow" target="_new">http://free.grisoft.com</a> Free<br /><br>F-Prot - <a href="http://www.f-prot.com" rel="nofollow" target="_new">http://www.f-prot.com</a> Free for home users</p><p>Free online Virus scan<br /><br>BitDefender - <a href="http://www.bitdefender.com/scan" rel="nofollow" target="_new">http://www.bitdefender.com/scan</a><br /><br>HouseCall - <a href="http://housecall.trendmicro.com" rel="nofollow" target="_new">http://housecall.trendmicro.com</a><br /><br>McAffe - <a href="http://us.mcafee.com/root/mfs" rel="nofollow" target="_new">http://us.mcafee.com/root/mfs</a><br /><br>Panda ActiveScan - <a href="http://www.pandasoftware.es/activescan/activescan-com.asp" rel="nofollow" target="_new">http://www.pandasoftware.es/activescan/activescan-com.asp</a><br /><br>RAV Antivirus - [http://www.ravantivirus.com/scan]</p><p>Free online Trojan scan<br /><br>TrojanScan - <a href="http://www.windowsecurity.com/trojanscan/" rel="nofollow" target="_new">http://www.windowsecurity.com/trojanscan/</a></p><p>Free online Security scan<br /><br>Symanted Security Check - <a href="http://security.symantec.com/sscv6" rel="nofollow" target="_new">http://security.symantec.com/sscv6</a><br /><br>Test my Firewall - <a href="http://www.testmyfirewall.com/" rel="nofollow" target="_new">http://www.testmyfirewall.com/</a></p><p>More Security Resources<br /><br>Forum of Incident Response and Security Teams: <a href="http://www.first.org/" rel="nofollow" target="_new">http://www.first.org/</a><br /><br>Microsoft: <a href="http://www.microsoft.com/technet/security/current.aspx" rel="nofollow" target="_new">http://www.microsoft.com/technet/security/current.aspx</a><br /><br>SANS Institute: <a href="http://www.sans.org/resources/" rel="nofollow" target="_new">http://www.sans.org/resources/</a><br /><br>Webopedia: <a href="http://www.pcwebopedia.com/" rel="nofollow" target="_new">http://www.pcwebopedia.com/</a><br /><br>Definitions</p><p>Adware: *A form of spyware that collects information about the user in order to display advertisements in the Web browser based on the information it collects from the user's browsing patterns.</p><p>Software that is given to the user with advertisements already embedded in the application</p><p>Malware: *Short for malicious software, software designed specifically to damage or disrupt a system, such as a virus or a Trojan horse.</p><p>Script Kiddie: *A person, normally someone who is not technologically sophisticated, who randomly seeks out a specific weakness over the Internet in order to gain root access to a system without really understanding what it is s/he is exploiting because the weakness was discovered by someone else. A script kiddie is not looking to target specific information or a specific company but rather uses knowledge of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.</p><p>Spyware: *Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet; however, it should be noted that the majority of shareware and freeware applications do not come with spyware. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.</p><p>Spyware is similar to a Trojan horse in that users unwittingly install the product when they install something else. A common way to become a victim of spyware is to download certain peer-to-peer file swapping products that are available today.</p><p>Aside from the questions of ethics and privacy, spyware steals from the user by using the computer's memory resources and also by eating bandwidth as it sends information back to the spyware's home base via the user's Internet connection. Because spyware is using memory and system resources, the applications running in the background can lead to system crashes or general system instability.</p><p>Because spyware exists as independent executable programs, they have the ability to monitor keystrokes, scan files on the hard drive, snoop other applications, such as chat programs or word processors, install other spyware programs, read cookies, change the default home page on the Web browser, consistently relaying this information back to the spyware author who will either use it for advertising/marketing purposes or sell the information to another party.<br /><br>Licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the requested software, but the licensing agreements may not always be read completely because the notice of a spyware installation is often couched in obtuse, hard-to-read legal disclaimers.</p><p>Trojan: *A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.</p><p>The term comes from a story in Homer's Iliad, in which the Greeks give a giant wooden horse to their foes, the Trojans, ostensibly as a peace offering. But after the Trojans drag the horse inside their city walls, Greek soldiers sneak out of the horse's hollow belly and open the city gates, allowing their compatriots to pour in and capture Troy.</p><p>Virus: *A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.</p><p>Since 1987, when a virus infected ARPANET, a large network used by the Defense Department and many universities, many antivirus programs have become available. These programs periodically check your computer system for the best-known types of viruses.</p><p>Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs.</p><p>Worm: *A program or algorithm that replicates itself over a computer network and usually performs malicious actions, such as using up the computer's resources and possibly shutting the system down.</p><p>* Definitions provided by Webopedia</p><p>A special thanks goes out to the CISSP community, various Chief Information Security Officer (CISO)s, and to those in the Risk assessment specialty of Information Systems Security for their help in proof reading and suggestions.</p> <br /> <br /> <br /> <br /> <br /> <br /><br /> <p>Jeremy Martin CISSP,CHS-III,CEH</p><p><a href="http://www.infosecwriter.com" target="_new">http://www.infosecwriter.com</a></p> <br />

Viruses and Worms, Protection from Disaster

Virus damage estimated at $55 billion in 2003. "SINGAPORE - Trend Micro Inc, the world's third-largest anti-virus software maker...

Continue Reading>>