Tuesday, April 13, 2010

The Nimda Virus...

Because of the increased activity over the Internet, viruses and worms have become serious pests. As the Internet advances, these pests are becoming much more sophisticated. There capacity to spread across the Internet in just a matter of hours can cause serious floods of payloads to systems. One recent virus that caused, and still is causing, an up-roar across the Internet is the 'Nimda'. What is Nimda?Nimda is a computer virus appearing first on September 18, 2001 when it caused massive delays by creating huge amounts of traffic as it spread across the Internet.
Nimda has four main attach mechanisms: web server to web server (IIS 4 / 5), to desktops through an e-mail attachment called README.EXE or ADMIN.DLL; browsing infected Web sites from Windows desktop or server machines; and by shares across internal networks. Once an internal machine is infected, it is possible for the virus to spread to shared drives and machines.Nimda is a 'resource hungry' virus that steals a lot of bandwidth and in some cases results in a denial of service effect.

Nimda does not seem to damage or destroy any files however it is known to be one of the most malicious viruses created, because of the considerable amount of down time it causes systems, resulting in a slow down to a loss of traffic. The most affected industry is the 'web hosting' industry, where, even though you may be protected from the immediate affects of the virus, you still get 'hammered' by the residue, the excess traffic produced from other non-protected systems on the Internet.

Hence the industry result of this is a slow, to non-existent, service; or even a shut down of servers, until all traffic is attended to; causing great grief and many misunderstandings.The name of this virus came from the reverse spelling of "admin" apparently referring to the "admin.DLL" file that, when run, propagates the virus.

The Secret Computer Virus That is Virtually Undetectable.

Introduction

For the most part, computer viruses and Trojans are characterized by obvious computer malfunctions from blatant graphical on-screen representations to the computer automatically accessing the Internet, printing documents or switching on its video camera without user interaction. Most virus utility software detects and quarantines approximately 90% of those currently in distribution. As for Trojans (rogue programs that allow an unknown third party to access and control your computer), commercial virus utility software detects and quarantines approximately 60% of these, while a dedicated Trojan utility software fares better at approximately 98%.

Although these performance figures may offer a guarded level of comfort, there is a threat that even the most robust and efficient virus or Trojan utility commercially available today cannot protect you from. That threat is known as an instructive code Trojan, or as those in the cracker underworld call it, a "backstop".

The instructive code Trojan defies detection because unlike most viruses and Trojans out there, each instructive code Trojan to date has been specifically written for its victim and the targeted information it must access. While over 90% of viruses and Trojans are variations or replications of others before them, backstops are unique. Backstops or instructive code Trojans are created to obtain specific files from a targeted computer or network without detection. While it is improbable that the average computer user will encounter a backstop, the threat is very real to governments and corporate entities that routinely use or create any form of proprietary, financial or competitive data.

How it works

The instructive code searches for specific keywords or phrases.
It is delivered to its target as a hidden file attachment piggybacked to an expected attachment, embedded in the body of an e-mail, automatically loaded from a webpage the target is known to frequent, or via external media such as a floppy disk or CD. In one case, the instructive code was delivered on a music CD to an employee known to play music on her laptop. Once she connected her laptop to the network, the instructive code transferred itself to its target. Once on the target system, the code resides in a hidden file that cannot be viewed on the system under regular default settings. The code then searches all files and folders for occurrences of the specific keywords or phrases programmed into it. When matches are found, copies of the data are made, compressed, encrypted and made into a hidden archive file. After a predetermined time, the code automatically e-mails the entire file during a routine e-mail session initiated by the target user. Once sent, the code deletes the hidden archive and invokes a self-delete procedure to remove itself, leaving all other files and programs intact. Thus, there is virtually no trace that the instructive code existed on the target system.

Users

In an age where information is a prized commodity, instructive code Trojans are the new digital tool of high level corporate espionage. From R&D data, confidential financial records to other information not meant for a wide audience, the backstop offers a potential key to gain access.
Protection
While there is no direct way to thwart a backstop being placed on your computer or network, there are measures you can take to manage the risk. Your first line of defense is a robust firewall that is properly configured to your system. Proper configuration is by no means the factory or default settings of your firewall product. Nor is it configuring your firewall once on installation and forgetting about it. The configuration of your firewall has to be reviewed every time hardware and software are upgraded, replaced or added.

Another security measure is to deploy utility software that monitors and sounds an alarm when any changes to operating system registry and configuration files are executed. In addition, audit trail and network management logging utilities should be configured to track and alert system operators whenever files of a specific size are deleted. Windows users should ensure that hidden files can be viewed by enabling the "Show All Files" option in the View>Folder Options menu. Information that is of the utmost secrecy or value should never reside on a system connected permanently or even temporarily to the outside world.

Due to the very nature and purpose of instructive code Trojans, it is unlikely that accurate victim statistics will truly reflect the real financial impact the backstop will have in the corporate sector, or on national and international security. As with any act of espionage, an average of only 3% globally ever get reported for fear of repercussions of corporate non-competence and weakened government diplomatic relations.

Top 10 things everyone must know about computer viruses

1. What is a virus?A virus is the name for a parasitic program written to intentionally enter a computer without the user's permission or knowledge. The word parasitic is used because a virus attaches to files or boot sectors and replicates itself so it can spread. Though some viruses do little more than copy themselves, others can cause serious damage or affect program and system performance. Therefore a virus should never be assumed harmless or left on a system.

2. One way you can’t get a virusYou cannot get a virus simply by being on the internet or using an online service. You will only become infected via the internet if you download an infected file and then run that file.

3. Three ways you can get a virusThere are only three ways you can get a virus: i) by executing an infected program ii) booting from an infected diskette iii) opening an infected email attachment. Strictly speaking i) and iii) are pretty much the same, but most people think of them quite differently, so I will too.

4. What are infected program viruses?Infected program viruses are often attached to other software programs like games, disk utilities, the macros in office documents and screen-savers. They are activated when these normally harmless programs are started. When the infected application is run the virus activates and loads into memory, where it can infect any new program that you open. This means that ever more applications on your system will become infected, which will almost certainly cause system problems. Files downloaded directly from the Internet (either through file-sharing programs or direct download from websites), are among the fastest growing sources of computer virus infections.

5. What is a boot infector?Booting from an infected disk simply means allowing your computer to start up with a disc, CD or DVD in the drive. Even so called ‘non bootable’ diskettes, CD's, and DVD's can be infected by a boot sector virus, so make a point of removing all kinds of discs when you’ve finished with them. Once the ‘boot code’ on your hard drive is infected, the virus will be loaded into your computer’s memory every time you start your computer, from where the virus can infect each and every disk that is put into your computer. Floppy disks, though not as commonly used as in the past, are still a very common way viruses being spread from machine to machine. Anyone with an infected machine, using a floppy disk to copy and save files, can also copy and transfer the virus.

6. How do email infections happen?Email is now a favorite way to spread viruses. They are contained in the attachments (the files that can be sent along with an e-mail message). Often the user of an infected computer unknowingly attaches an infected file to an email message, and then sends the email to a friend or colleague. When the email is received andthe file attachment is opened, the virus launches itself. Email messages with animations, automated greeting cards, jokes, photographs, even spreadsheets and document files, all have been documented to contain virus files. Many of the most dangerous viruses are primarily spread through e-mail attachments.

7. One simple way to avoid infectionsObtain software from reputable sources. Downloading a service pack for Windows NT from Microsoft's web site is a very different proposition than downloading a freeware disk utility from a company you've never heard of, on a site in a province of the former Soviet Union. You use common sense – for instance, beware of Automatic Downloads – take care when using programs that download and run update patches and programs automatically. While in most cases these will not be a problem, having downloaded software run automatically without virus checking exposes you to potential problems in my opinion. Regardless of where you get your software even shrink-wrapped CDs from a reputable supplier, ALWAYS scan it for viruses BEFORE you execute the program or installer.

8. A second simple way to avoid infectionsControl your network connections and access to your computer. You could limit access just to those who have a need - fully 80% of damage caused to information systems is caused by action taken (either accidental or deliberate) by an employee or friend, and not from outside sources.

9. Be safe rather than sorryMake sure you have backups for all your files. Backups are essential not only to safely recover from virus infections, but also to recover from the other threats to your data (such as a hard disk failure or a major coffee spilling accident).

10. Use quality virus protection softwareLast, but certainly not least, use good quality market leading commercial virus protection software packages. The primary benefit of using top commercial software is the frequency and ease of updating the virus definition files that these programs use to detect viruses. With new viruses popping up all the time, unless your protection software is kept updated (daily and automatically), you become ever more vulnerable to infection.

Top 10 Ways To Protect Yourself From Computer Viruses

As more and more people are becoming comfortable using their computers at school, home or in the office it's only a matter of time before they encounter a computer virus. Here are our top 10 steps to protect you from computer viruses.
Use a high quality anti-virus program. There are many different anti-virus computers programs on the market some of them are better than others. Look to reputable computer magazines or websites for ratings to help you find the one that matches your needs.
Always use your anti-virus software. Make sure your anti-virus software is always turned on and scanning, incoming and outgoing email messages, and any software programs you run.
Keep your antivirus programs up to date. Most programs come with a yearly subscription make sure you take advantage of the updates. More advanced programs allow you to schedule updates or full system scans for "off hours" like 2AM when you aren't likely to be using your computer.
Keep your computer up to date. From time to time operating systems fall victim to security holes or issue updates. Make sure you check periodically to make sure you are running stable up to date versions of your software.
Backup your data regularly. Most windows computer users keep their documents in the "My documents" folder. This makes it easy to back up all of your important documents. Make weekly or monthly copies to CD or USB drives.
If you use floppy disks or USB drives on public computers like your school computer lab,Kinko's, or even digital photo printing store make sure you scan them for viruses. Public computers are notorious for not being up to date and properly protected.
Be wary of email attachments. Treat any email attachment as potentially dangerous. Never open attachments from people you weren't expecting. Also be careful of attachments from people you know but weren't expecting. Many computer viruses replicate themselves by reading the contacts from an infected computer.
Use text email if possible. While HTML email is prettier and allows you more control over formatting it also can carry computer viruses. If you use text based email the only way to get a virus is by opening an attachment.
Use downloaded freeware and shareware files or software with caution. Try to download them from popular reputable sources that scan the programs before they are uploaded. To make sure you are safe scan the program before you install it on your computer.
Be wary of links in IM or instant messaging software. Don't accept invitations from people you don't know and never click a link from someone you don't trust, they can easily redirect you to another website that will try to install a virus on your computer system.

Why Do I Need Anti Virus Software For My Computer?

If you've recently purchased a computer, or are just learning about using email and the internet, you may have heard about computer viruses and anti-virus software. You may be wondering if this is something that you should be concerned about, and if so, what you should do about it. This article will attempt to answer these questions for you.
First, you may be wondering just what a computer virus is. Basically a computer virus is one of many types of small programs that install themselves on your computer without your consent. Usually they enter your program through an email, or while you are browsing a website.
When these programs run, usually without you knowing, they can cause all types of problems with your computer. Some viruses can be mildly annoying, slowing down your computer as they use your computer's resources for another purpose. Others can be very dangerous, collecting your personal information and sending it to another party, or damaging your hard-drive.
True to their name, viruses are able to use your internet connection and email program and send themselves to the computers of other people you know, spreading themselves just like a contagious disease.
Because of this, just like the health of your body, when it comes to computer viruses, an ounce of prevention is worth a pound of cure. It is much easier to prevent viruses from entering your computer than it is to get rid of them and cure your computer once it becomes infected. This is why Anti-Virus software is important.
you realize that you need anti-virus software installed and running on your computer, you'll have to choose which one to purchase and install. This can be a complicated process, but here are some tips to make it a bit easier.
First, check your computer to see if it came with anti-virus software. Many new computers are shipped with anti-virus programs already to go on them, you just need to turn them on. Check your instruction manual to see if this is the case with your computer.
Check with the vendor. If you purchased your computer from a local retailer, check with them to see what anti-virus program they recommend. They should be more than willing to help you and may even be able to provide you with a discount since you purchased a computer from them.
Once you have your anti-virus installed and running on your computer, be sure to contact the software's support if you have any questions. It is also important to keep your software updated. Many of these programs will automatically update themselves when you are online. This is very important since new viruses are always appearing and you want to make sure your computer is protected.

9 Steps to Protect your MS Windows System from Viruses

Nowadays as the Internet and other networks are greatly developed computer viruses are distributed rapidly and intensively. Everyday several new viruses capable to damage considerably your computer system arise. Anti-virus specialists work hardly to make updates their software against new viruses as soon as possible. The viruses can get inside computer in different ways. That is why there is no simple method to protect system. Only series of measures can give you reliable protection from the infection. Below are 9 steps to protect MS Windows based PC system from viruses.

1. Make regular backups. It should be said that there is no absolutely safe way of protection. Virus creators regularly find holes in new computer products to use them for infection of computer systems. Some dangerous viruses can considerably damage data files or even erase entire file system. Make regular backups of your data files to separate file storage device. It can be separate hard drive, flash card, compact disc or another file storage device which you choose. To ease the procedure you can use some automatic backup software. And be ready if the system will die because of virus infection.

2. Be ready to reinstall your system if it dies because of viruses. Get distributives of your operation system and distributives of software which you use and keep them together, for instance, on a set of CDs not far away from you. In this case if virus infection will cause unrecoverable system failure you can rapidly reinstall your working medium.

3. Protect your network connection with Firewall. Firewall is a software which blocks suspicious potentially dangerous connections to preventing viruses from network to penetrate into your system. Windows XP system has quit simple but reliable built-in firewall. You can enable it as follows.

1) in Control Panel, double-click Networking and Internet Connections, and then click Network Connections.

2) Right-click the connection on which you would like to enable firewall, and then click Properties.

3) On the Advanced tab, check the option to Protect my computer and network.
If you need more flexible control of connections with network you can get and install more advanced firewall software like Norton Personal Firewall or Outpost Firewall. If you use this software you have ability to permit or to block particular connections and to monitor network activity.

4. Use antivirus software. Install antivirus software which will scan your system searching and erasing viruses on a regular basis. Leaders in antivirus software products for Windows systems are Norton Antivirus, McAfee, Kaspersky Anti-Virus and PC-cilin.

5. Regularly update operating system. Windows XP has built-in automatic update service. It regularly contacts Microsoft server to find updates and notifies you if updates are ready to be installed. Updates are important because hackers regularly find holes in operating system which are often used by virus creators.

6. Don't install and don't run suspicious software. Check new programs which you are going to install with anti-virus software. Don't download software from suspicious websites. To download software always seek website of software creator or official distributor. Do not open applications received by email from unknown persons.

7. Limit access to your computer. Protect enter to system with password.

8. If you use Internet Explorer, consider moving to another browser. As IE is the most distributed browser today virus creators actively use defects in its security system to infect computers. Infection may arise if you will visit webpage which contains invisible harmful code. You are more safe if you use less known browser only because virus creators do not pay much attention to it. Major IE competitors Firefox and Opera browsers provide now the same comfortable interface and range of services for working on the Web.

9. Use spam protection. Viruses are often distributed via email. Switch on spam filters in your email box to block spam receiving. If you need assistance with using of the filters you can ask your email service provider.