NationMaster - Encyclopedia: Computer virus

A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user. The term "virus" is also commonly used, albeit erroneously, to refer to many different types of malware and adware programs. The original virus may modify the copies, or the copies may modify themselves, as occurs in a metamorphic virus. A virus can only spread from one computer to another when its host is taken to the uninfected computer, for instance by a user sending it over a network or the Internet, or by carrying it on a removable medium such as a floppy disk, CD, or USB drive. Meanwhile viruses can spread to other computers by infecting files on a network file system or a file system that is accessed by another computer. Viruses are sometimes confused with computer worms and Trojan horses. A worm can spread itself to other computers without needing to be transferred as part of a host, and a Trojan horse is a file that appears harmless. Worms and Trojans may cause harm to either a computer system's hosted data, functional performance, or networking throughput, when executed. In general, a worm does not actually harm either the system's hardware or software, while at least in theory, a Trojan's payload may be capable of almost any type of harm if executed. Some can't be seen when the program is not running, but as soon as the infected code is run, the Trojan horse kicks in. That is why it is so hard for people to find viruses and other malware themselves and why they have to use spyware programs and registry processors. A computer program is a collection of instructions that describe a task, or set of tasks, to be carried out by a computer. ... A screenshot of a malicious website attempting to install spyware via an ActiveX Control in Internet Explorer 6 Malware is software designed to infiltrate or damage a computer system without the owners informed consent. ... This article is about advertising-supported software. ... In computer virus terms, metamorphic code is code that can reprogram itself. ... A floppy disk is a data storage device that is composed of a disk of thin, flexible (floppy) magnetic storage medium encased in a square or rectangular plastic shell. ... CD redirects here. ... JumpDrive redirects here. ... For the protocol of this name, see Network File System (protocol). ... A computer worm is a self-replicating computer program. ... In the context of computing and software, a Trojan horse, or simply trojan, is a piece of software which appears to perform a certain action but in fact performs another such as a computer virus. ...

Most personal computers are now connected to the Internet and to local area networks, facilitating the spread of malicious code. Today's viruses may also take advantage of network services such as the World Wide Web, e-mail, Instant Messaging and file sharing systems to spread, blurring the line between viruses and worms. Furthermore, some sources use an alternative terminology in which a virus is any form of self-replicating malware. LAN redirects here. ... The World Wide Web and WWW redirect here. ... Wikipedia does not yet have an article with this exact name. ... // Instant messaging (IM) is a form of real-time communication between two or more people based on typed text. ... File sharing is the activity of making files available to other users for download over the Internet, but also over smaller networks. ... A screenshot of a malicious website attempting to install spyware via an ActiveX Control in Internet Explorer 6 Malware is software designed to infiltrate or damage a computer system without the owners informed consent. ...

Some malware is programmed to damage the computer by damaging programs, deleting files, or reformatting the hard disk. Other malware programs are not designed to do any damage, but simply replicate themselves and perhaps make their presence known by presenting text, video, or audio messages. Even these less sinister malware programs can create problems for the computer user. They typically take up computer memory used by legitimate programs. As a result, they often cause erratic behavior and can result in system crashes. In addition, much malware is bug-ridden, and these bugs may lead to system crashes and data loss. Many CiD programs are programs that have been downloaded by the user and pop up every so often. This results in slowing down of the computer, but it is also very difficult to find and stop the problem. User in a computing context refers to one who uses a computer system. ... This article does not cite any references or sources. ... A software bug is an error, flaw, mistake, failure, or fault in a computer program that prevents it from behaving as intended (e. ... In the field of information technology, data loss refers to the unforseen loss of data or information. ...

History

The Creeper virus was first detected on ARPANET, the forerunner of the Internet in the early 1970s.^[1] It propagated via the TENEX operating system and could make use of any connected modem to dial out to remote computers and infect them. It would display the message "I'M THE CREEPER : CATCH ME IF YOU CAN.". It is rumored^[who?] that the Reaper program, which appeared shortly after and sought out copies of the Creeper and deleted them, may have been written by the creator of the Creeper in a fit of regret.^{[original research?]} ARPANET logical map, March 1977. ... The TOPS-20 operating system by DEC was the second proprietary OS for the PDP-10. ...

A common misconception is that a program called "Rother J" was the first computer virus to appear "in the wild" — that is, outside the single computer or lab where it was created, but that claim is false. See the Timeline of notable computer viruses and worms for other earlier viruses. It was however the first virus to infect computers "in the home". Written in 1982 by Richard Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread by floppy disk.^[2] This virus was originally a joke, created by a high school student and put onto a game on floppy disk. On its 50th use the Elk Cloner virus would be activated, infecting the computer and displaying a short poem beginning "Elk Cloner: The program with a personality". This is a list of noteworthy computer viruses and worms. ... Rich Skrenta is a computer programmer. ... Beneath Apple DOS was a popular guide to Apple DOS. Apple DOS refers to operating systems for the Apple II series of microcomputers from 1978 through early 1983. ... A floppy disk is a data storage device that is composed of a disk of thin, flexible (floppy) magnetic storage medium encased in a square or rectangular plastic shell. ... This article does not cite any references or sources. ...

The first PC virus in the wild was a boot sector virus called (c)Brain^[3], created in 1986 by the Farooq Alvi Brothers, operating out of Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software they had written. However, analysts have claimed that the Ashar virus, a variant of Brain, possibly predated it based on code within the virus.^{[original research?]} (c)Brain (the industry standard name being Brain) is a 1986 computer virus that infects DOS File Allocation Table file systems. ... Lahore (لاةور) is a major city in Pakistan that is the capital of the province of Punjab. ...

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk, usually inadvertently. PCs of the era would attempt to boot first from a floppy if one had been left in the drive. This was the most successful infection strategy until floppy disks fell from favour, making boot sector viruses the most common in the wild^[4]. Removable media are transportable drives or disks that can be moved easily from one computer to another. ... A floppy disk is a data storage device that is composed of a disk of thin, flexible (floppy) magnetic storage medium encased in a square or rectangular plastic shell. ... A boot sector is a sector of a hard disc, floppy disc, or similar data storage device that contains code for bootstrapping programs (usually, but not necessarily, operating systems) stored in other parts of the disc. ...

Traditional computer viruses emerged in the 1980s, driven by the spread of personal computers and the resultant increase in BBS and modem use, and software sharing. Bulletin board driven software sharing contributed directly to the spread of Trojan horse programs, and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBS's.^{[citation needed]} Within the "pirate scene" of hobbyists trading illicit copies of retail software, traders in a hurry to obtain the latest applications and games were easy targets for viruses.^{[original research?]} Ward Christensen and the computer that ran the first public Bulletin Board Systems, CBBS A Bulletin board system, or BBS, is a computer system running software that allows users to dial into the system over a phone line (or Telnet) and, using a terminal program, perform functions such as downloading... For other uses, see Modem (disambiguation). ... Look up bulletin board, notice board in Wiktionary, the free dictionary. ... Look up shareware in Wiktionary, the free dictionary. ... Copyright infringement is the unauthorized use of copyrighted material in a manner that violates one of the copyright owners exclusive rights, such as the right to reproduce or perform the copyrighted work, or to make derivative works that build upon it. ... A vector in computing, specifically when talking about malicious code such as viruses or worms, is the method that this code uses to propagate itself or infect the computer and this sense is similar to, and derived from, its meaning in biology. ... Commercial software is software that is sold for profit, and represented, until recently, the vast majority of all software used. ...

Since the mid-1990s, macro viruses have become common. Most of these viruses are written in the scripting languages for Microsoft programs such as Word and Excel. These viruses spread in Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most of these viruses were able to spread on Macintosh computers as well. Most of these viruses did not have the ability to send infected e-mail. Those viruses which did spread through e-mail took advantage of the Microsoft Outlook COM interface.^{[citation needed]} In computing terminology, a macro virus is a virus that is written in a macro language. ... Microsoft Word is Microsofts flagship word processing software. ... Microsoft Excel (full name Microsoft Office Excel) is a spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS. It features calculation and graphing tools which, along with aggressive marketing, have made Excel one of the most popular microcomputer applications to date. ... Microsoft Office is an office suite from Microsoft for Microsoft Windows and Apple Mac OS X operating systems. ... This article relates to both the original Classic Mac OS as well as Mac OS X, Apples more recent operating system. ... For other uses, see Macintosh (disambiguation) and Mac. ... Electronic mail, abbreviated e-mail or email, is a method of composing, sending, and receiving messages over electronic communication systems. ... For the e-mail and news client bundled with certain versions of Microsoft Windows, see Outlook Express. ... Component Object Model (COM) is a platform for software componentry introduced by Microsoft in 1993. ...

Macro viruses pose unique problems for detection software^{[citation needed]}. For example, some versions of Microsoft Word allowed macros to replicate themselves with additional blank lines. The virus behaved identically but would be misidentified as a new virus. In another example, if two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, can appear as a "mating" of the two and would likely be detected as a virus unique from the "parents".^[5]

A virus may also send a web address link as an instant message to all the contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating. // Uniform Resource Locator (URL) formerly known as Universal Resource Locator, is a technical, Web-related term used in two distinct meanings: In popular usage and many technical documents, it is a synonym for Uniform Resource Identifier (URI); Strictly, the idea of a uniform syntax for global identifiers of network-retrievable... An instant messenger is a computer application which allows instant text communication between two or more people through a network such as the Internet. ...

The newest species of the virus family is the cross-site scripting virus.^{[citation needed]} The virus emerged from research and was academically demonstrated in 2005.^[6] This virus utilizes cross-site scripting vulnerabilities to propagate. Since 2005 there have been multiple instances of the cross-site scripting viruses in the wild, most notable sites affected have been MySpace and Yahoo. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. ... Samy[1] was a cross-site scripting computer worm[2] targeting the social-networking site MySpace. ... Yahoo! - Wikipedia, the free encyclopedia /**/ @import /skins-1. ...

Infection strategies

In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user tries to start an infected program, the virus' code may be executed first. Viruses can be divided into two types, on the basis of their behavior when they are executed. Nonresident viruses immediately search for other hosts that can be infected, infect these targets, and finally transfer control to the application program they infected. Resident viruses do not search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operating system itself. Application software is a subclass of computer software that employs the capabilities of a computer directly and thoroughly to a task that the user wishes to perform. ...

Nonresident viruses

Nonresident viruses can be thought of as consisting of a finder module and a replication module. The finder module is responsible for finding new files to infect. For each new executable file the finder module encounters, it calls the replication module to infect that file.

Resident viruses

Resident viruses contain a replication module that is similar to the one that is employed by nonresident viruses. However, this module is not called by a finder module. Instead, the virus loads the replication module into memory when it is executed and ensures that this module is executed each time the operating system is called to perform a certain operation. For example, the replication module can be called each time the operating system executes a file. In this case, the virus infects every suitable program that is executed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. For instance, a fast infector can infect every potential host file that is accessed. This poses a special problem to anti-virus software, since a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner fails to notice that such a virus is present in memory, the virus can "piggy-back" on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus may slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors, on the other hand, are designed to infect hosts infrequently. For instance, some slow infectors only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: they are less likely to slow down a computer noticeably, and will at most infrequently trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach does not seem very successful, however.

Vectors and hosts

Viruses have targeted various types of transmission media or hosts. This list is not exhaustive:

PDFs, like HTML, may link to malicious code.^{[citation needed]} An executable or executable file, in computer science, is a file whose contents are meant to be interpreted as a program by a computer. ... In MS-DOS and compatible DOSes, and in 8-bit CP/M, a COM file is a simple type of executable file. ... EXE is the common filename extension for denoting an executable file (a program) in the OpenVMS, DOS, Microsoft Windows, ReactOS, and OS/2 operating systems. ... Microsofts disk operating system, MS-DOS, was Microsofts implementation of DOS, which was the first popular operating system for the IBM PC, and until recently, was widely used on the PC compatible platform. ... The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems. ... Windows redirects here. ... In computing, the Executable and Linking Format (ELF, formerly called Extensible Linking Format) is a common standard file format for executables, object code, shared libraries, and core dumps. ... This article is about operating systems that use the Linux kernel. ... A Volume Boot Record (also known as a volume boot sector or a partition boot sector, although the latter is not strictly correct) is a type of boot sector, stored in a disc volume on a hard disk, floppy disk, or similar data storage device, that contains code for booting... A floppy disk is a data storage device that is composed of a disk of thin, flexible (floppy) magnetic storage medium encased in a square or rectangular plastic shell. ... A Master Boot Record (MBR), or partition sector, is the 512-byte boot sector that is the first sector (Sector 0) of a partitioned data storage device such as a hard disk. ... This article or section should be merged with script programming language In computer applications, a script, roughly speaking, is a computer program that automates the sort of task that a user might otherwise do interactively at the keyboard. ... Wikibooks has more about this subject: Guide to Windows commands In MS-DOS, OS/2 and Windows, a batch file is a text file containing a series of commands intended to be executed by the command interpreter. ... Microsofts disk operating system, MS-DOS, was Microsofts implementation of DOS, which was the first popular operating system for the IBM PC, and until recently, was widely used on the PC compatible platform. ... Windows redirects here. ... VBScript (short for Visual Basic Scripting Edition) is an Active Scripting language developed by Microsoft. ... A shell script is a script written for the shell, or command line interpreter, of an operating system. ... Diagram of the relationships between several Unix-like systems A Unix-like operating system is one that behaves in a manner similar to a Unix system, while not necessarily conforming to or being certified to any version of the Single UNIX Specification. ... Wikipedia does not have an article with this exact name. ... For other uses, see Macro (disambiguation) A macro in computer science is a rule or pattern that specifies how a certain input sequence (often a sequence of characters) should be mapped to an output sequence (also often a sequence of characters) according to a defined procedure. ... Microsoft Word is Microsofts flagship word processing software. ... Microsoft Excel (full name Microsoft Office Excel) is a spreadsheet application written and distributed by Microsoft for Microsoft Windows and Mac OS. It features calculation and graphing tools which, along with aggressive marketing, have made Excel one of the most popular microcomputer applications to date. ... Lotus Word Pro is word processor software produced by IBMs Lotus Software group for use on Microsoft Windows-compatible computers. ... Microsoft Office Access, previously known as Microsoft Access, is a relational database management system from Microsoft that combines the relational Microsoft Jet Database Engine with a graphical user interface and software development tools. ... Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications which allow code injection by malicious web users into the web pages viewed by other users. ... [[Media:Media:Example. ... A race condition or race hazard is a flaw in a system or process whereby the output of the process is unexpectedly and critically dependent on the sequence or timing of other events. ... A typical vision of a computer architecture as a series of abstraction layers: hardware, firmware, assembler, kernel, operating system and applications (see also Tanenbaum 79). ... The NX bit, which stands for No eXecute, is a technology used in CPUs to segregate areas of memory for use by either storage of processor instructions (or code) or for storage of data, a feature normally only found in Harvard architecture processors. ... HTML, an initialism of HyperText Markup Language, is the predominant markup language for web pages. ...

It is worth noting that some virus authors have written an .EXE extension on the end of .PNG (for example), hoping that users would stop at the trusted file type without noticing that the computer would start with the final type of file. (Many operating systems hide the extensions of known file types by default, so for example a filename ending in ".png.exe" would be shown ending in ".png".) See Trojan horse (computing). In the context of computing and software, a Trojan horse, or simply trojan, is a piece of software which appears to perform a certain action but in fact performs another such as a computer virus. ...

Methods to avoid detection

In order to avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the MS-DOS platform, make sure that the "last modified" date of a host file stays the same when the file is infected by the virus. This approach does not fool anti-virus software, however, especially that which maintains and dates Cyclic redundancy check on file changes. A cyclic redundancy check (CRC) is a type of function that takes an input of data stream of any length and produces as output a value of a certain fixed size. ...

Some viruses can infect files without increasing their sizes or damaging the files. They accomplish this by overwriting unused areas of executable files. These are called cavity viruses. For example the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because those files had many empty gaps, the virus, which was 1 KB in length, did not add to the size of the file. CIH, also known as Chernobyl or Spacefiller, is a computer virus written by Chen Ing Hau of Taiwan. ... CIH, also known as Chernobyl or Spacefiller, is a computer virus written by Chen Ing Hau of Taiwan. ... The Portable Executable (PE) format is a file format for executables, object code, and DLLs, used in 32-bit and 64-bit versions of Windows operating systems. ... A kilobyte (derived from the SI prefix kilo-, meaning 1,000) is a unit of information or computer storage equal to either 1,000 bytes or 1,024 bytes (210), depending on context. ...

Some viruses try to avoid detection by killing the tasks associated with antivirus software before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defending a computer against viruses may demand that a file system migrate towards detailed and explicit permission for every kind of file access.

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti-virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti-virus software. Another type of host that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or by anti-virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus:

Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of 'garbage instructions'. In computer terminology, polymorphic code is code that mutates while keeping the original algorithm intact. ...

A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti-virus software, so that it seems that the file is "clean". Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean. An operating system (OS) is a software that manages computer resources and provides programmers with an interface used to access those resources. ...

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or (in some cases) "clean" or "heal" the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. Since these would be symmetric keys, stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably isn't required, since self-modifying code is such a rarity that it may be reason for virus scanners to at least flag the file as suspicious. Encrypt redirects here. ...

An old, but compact, encryption involves XORing each byte in a virus with a constant, so that the exclusive-or operation had only to be repeated for decryption. It is suspicious code that modifies itself, so the code to do the encryption/decryption may be part of the signature in many virus definitions. Exclusive disjunction (usual symbol xor) is a logical operator that results in true if one of the operands (not both) is true. ...

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See Polymorphic code for technical detail on how such engines operate. In computer terminology, polymorphic code is code that mutates while keeping the original algorithm intact. ... In computer terminology, polymorphic code is code that mutates while keeping the original algorithm intact. ...

Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for anti-virus professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of Assembly language code, 90% of which is part of the metamorphic engine.^[7] In computer virus terms, metamorphic code is code that can reprogram itself. ... In computer virus terms, metamorphic code is code that can reprogram itself. ... Win32/Simile is the latest product of the developments in metamorphic virus code. ... An assembly language is a low-level language for programming computers. ...

Vulnerability and countermeasures

The vulnerability of operating systems to viruses

Just as genetic diversity in a population decreases the chance of a single disease wiping out a population, the diversity of software systems on a network similarly limits the destructive potential of viruses. Genetic diversity is a characteristic of ecosystems and gene pools that describes an attribute which is commonly held to be advantageous for survival -- that there are many different versions of otherwise similar organisms. ...

This became a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. The users of Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of viruses. Microsoft software is targeted by virus writers due to their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated and non-integrated Microsoft appications (such as Microsoft Office) and applications with scripting languages with access to the file system (for example Visual Basic Script (VBS), and applications with networking features) are also particularly vulnerable. Microsoft Corporation, (NASDAQ: MSFT, HKSE: 4338) is a multinational computer technology corporation with global annual revenue of US$44. ... In computing, an office suite, sometimes called an office application suite or productivity suite is a software suite intended to be used by typical clerical and knowledge workers. ... For the e-mail and news client bundled with certain versions of Microsoft Windows, see Outlook Express. ... Windows Internet Explorer (formerly Microsoft Internet Explorer abbreviated MSIE), commonly abbreviated to IE, is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems starting in 1995. ... Microsoft Office is an office suite from Microsoft for Microsoft Windows and Apple Mac OS X operating systems. ... VBScript (short form of Microsoft Visual Basic Scripting Edition) is a subset of Visual Basic used in ASP and in Windows Scripting Host as a general-purpose scripting language. ...

Although Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS's (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their protected space in their own directories.

An Internet based research revealed that there were cases when people willingly pressed a particular button to download a virus. A security firm F-Secure ran a half year advertising campaign on Google AdWords which said "Is your PC virus-free? Get it infected here!". The result was 409 clicks.^[8] A Google promotional graphic, highlighting AdWords AdWords is Googles flagship advertising product, and main source of revenue. ...

As of 2006, there are relatively few security exploits^[9] targeting Mac OS X (with a Unix-based file system and kernel). The number of viruses for the older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple stating that there are only four known viruses, and independent sources stating there are as many as 63 viruses. It is safe to say that Macs are less likely to be targeted because of low market share and thus a Mac-specific virus could only infect a small proportion of computers (making the effort less desirable). Virus vulnerability between Macs and Windows is a chief selling point, one that Apple uses in their Get a Mac advertising.^[10] That said, Macs have also had security issues just as Microsoft Windows has, though none have ever been fully taken advantage of successfully in the wild.^{[citation needed]} 2006 is a common year starting on Sunday of the Gregorian calendar. ... Mac OS X (pronounced ) is a line of graphical operating systems developed, marketed, and sold by Apple Inc. ... A kernel connects the application software to the hardware of a computer. ... Independent sources in journalism, criminal justice and general research, represent two or more people or organizations which attest to a given piece of information. ... Apple Inc. ... John Hodgman as PC and Justin Long as Mac The Get a Mac campaign is a current (2006â€“present) television advertising campaign created for Apple Inc. ...

Windows and Unix have similar scripting abilities, but while Unix natively blocks normal users from having access to make changes to the operating system environment, older copies of Windows such as Windows 95 and 98 do not. In 1997, when a virus for Linux was released – known as "Bliss" – leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows.^[11] The Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly (so it is a trojan), and it can only infect programs that the user has the access to modify. Unlike Windows users, most Unix users do not log in as an administrator user except to install or configure software; as a result, even if a user ran the virus, it could not harm their operating system. The Bliss virus never became widespread, and remains chiefly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked.^[12] Bliss is a computer virus that infects GNU/Linux systems. ... Diagram of the relationships between several Unix-like systems A Unix-like operating system is one that behaves in a manner similar to a Unix system, while not necessarily conforming to or being certified to any version of the Single UNIX Specification. ... In computer security, logging (or signing) in and out is the process by which individual access to a computer system is controlled by identification of the user in order to obtain credentials to permit access. ...

The role of software development

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses must exploit software bugs in a system or application to spread. Software development strategies that produce large numbers of bugs will generally also produce potential exploits. A software bug is an error, flaw, mistake, failure, or fault in a computer program that prevents it from behaving as intended (e. ... Software engineering is the application of a systematic, disciplined, quantifiable approach to the development, operation, and maintenance of software. ...

Anti-virus software and other preventive measures

Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or runs the executable. There are two common methods that an anti-virus software application uses to detect viruses. The first, and by far the most common method of virus detection is using a list of virus signature definitions. This works by examining the content of the computer's memory (its RAM, and boot sectors) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus "signatures". The disadvantage of this detection method is that users are only protected from viruses that pre-date their last virus definition update. The second method is to use a heuristic algorithm to find viruses based on common behaviors. This method has the ability to detect viruses that anti-virus security firms have yet to create a signature for. Anti-virus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware). ... This article is about the computer terms. ... Anti-virus software consists of computer programs that attempt to identify, thwart and eliminate computer viruses and other malicious software (malware). ... A virus signature is a unique string of bits, or the binary pattern, of all or part of a computer virus. ... RAM redirects here. ... A boot sector is a sector of a hard disc, floppy disc, or similar data storage device that contains code for bootstrapping programs (usually, but not necessarily, operating systems) stored in other parts of the disc. ... This article is principally about managing and structuring the collections of data held on computers. ... In computer science, besides the common use as rule of thumb (see heuristic), the term heuristic has two well-defined technical meanings. ...

Some anti-virus programs are able to scan opened files in addition to sent and received e-mails 'on the fly' in a similar manner. This practice is known as "on-access scanning." Anti-virus software does not change the underlying capability of host software to transmit viruses. Users must update their software regularly to patch security holes. Anti-virus software also needs to be regularly updated in order to prevent the latest threats. In computing, a patch is a small piece of software designed to update or fix problems with a computer program or its supporting data. ...

One may also minimise the damage done by viruses by making regular backups of data (and the Operating Systems) on different media, that are either kept unconnected to the system (most of the time), read-only or not accessible for other reasons, such as using different file systems. This way, if data is lost through a virus, one can start again using the backup (which should preferably be recent). If a backup session on optical media like CD and DVD is closed, it becomes read-only and can no longer be affected by a virus. Likewise, an Operating System on a bootable can be used to start the computer if the installed Operating Systems become unusable. Another method is to use different Operating Systems on different file systems. A virus is not likely to affect both. Data backups can also be put on different file systems. For example, Linux requires specific software to write to NTFS partitions, so if one does not install such software and uses a separate installation of MS Windows to make the backups on an NTFS partition, the backup should remain safe from any Linux viruses. Likewise, MS Windows can not read file systems like ext3, so if one normally uses MS Windows, the backups can be made on an ext3 partition using a Linux installation. For other uses of Backup, see Backup (disambiguation). ... For library and office filing systems, see Library classification. ... â€œOptical mediaâ€ redirects here. ... CD may stand for: Compact Disc Canadian Forces Decoration Cash Dispenser (at least used in Japan) CD LPMud Driver Centrum-Demokraterne (Centre Democrats of Denmark) Certificate of Deposit ÄŒeskÃ© DrÃ¡hy (Czech Railways) Chad (NATO country code) Chalmers DatorfÃ¶rening (computer club of the Chalmers University of Technology) a 1960s... DVD (also known as Digital Versatile Disc or Digital Video Disc - see Etymology) is a popular optical disc storage media format. ... In computing, booting is a bootstrapping process that starts operating systems when the user turns on a computer system. ... NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, and Windows Vista. ... The ext3 or third extended filesystem is a journaled file system that is commonly used by the Linux operating system. ...

Recovery methods

Once a computer has been compromised by a virus, it is usually unsafe to continue using the same computer without completely reinstalling the operating system. However, there are a number of recovery options that exist after a computer has a virus. These actions depend on severity of the type of virus.

Virus removal

One possibility on Windows Me, Windows XP and Windows Vista is a tool known as System Restore, which restores the registry and critical system files to a previous checkpoint. Often a virus will cause a system to hang, and a subsequent hard reboot will render a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to corrupt the restore files. Some viruses, however, disable system restore and other important tools such as Task Manager and Command Prompt. An example of a virus that does this is CiaDoor. Windows Millennium Edition, or Windows Me (IPA pronunciation: [miË], [É›m iË]), is a hybrid 16-bit/32-bit graphical operating system released on September 14, 2000 by Microsoft. ... Windows XP is a line of operating systems developed by Microsoft for use on personal computers, including home and business desktops, notebook computers, and media centers. ... Windows Vista (pronounced ) is a line of operating systems developed by Microsoft for use on personal computers, including home and business desktops, laptops, Tablet PCs, and media centers. ... System Restore is a component of Microsofts Windows Me, Windows XP and Windows Vista operating systems that allows for the rolling back of system files, registry keys, installed programs, etc. ...

Administrators have the option to disable such tools from limited users for various reasons. The virus modifies the registry to do the same, except, when the Administrator is controlling the computer, it blocks all users from accessing the tools. When an infected tool activates it gives the message "Task Manager has been disabled by your administrator.", even if the user trying to open the program is the administrator.

Users running a Microsoft operating system can go to Microsoft's website to run a free scan, if they have their 20-digit registration number.

Operating system reinstallation

Reinstalling the operating system is another approach to virus removal. It involves simply reformatting the OS partition and installing the OS from its original media, or imaging the partition with a clean backup image (taken with Ghost or Acronis for example). Disk cloning is a category of software which copies the contents of one computer hard disk to another. ... Ghost is a disk cloning program, originally produced by Binary Research, but purchased by Symantec in 1998. ... Acronis is a technology company producing file system-related software tools, including disaster recovery, backup and restore, partitioning, boot management, privacy, data migration, and other storage management products for enterprises, corporations and home users. ...

This method has the benefits of being simple to do, can be faster than running multiple anti-virus scans, and is guaranteed to remove any malware. Downsides include having to reinstall all other software as well as the operating system. User data can be backed up by booting off of a Live CD or putting the hard drive into another computer and booting from the other computer's operating system. Gnoppix 0. ...

Contents