Computer viruses

Presented by

Rajiv ranjan priyadarshi

Khushboo dungdung
G yugashakthi
Content
1. Introduction to computer viruses
2. Different types of viruses
3. Viruses source
4. How viruses act
5. How boot sector viruses spread
6. How viruses activate
7. What are the sign of viruses
8. What to do when you find viruses
9. Life cycle of virus
10. How to remove virus
11.How antivirus detect viruses
12.unwanted or malicious software
13. Viruses history
14. conclusion
Fullform of VIRUS

Vital Information Resources Under Seize

Introduction
A computer virus is a small software program that
spreads from one computer to another computer
and that interferes with computer operation.
computer virus may corrupt or delete data on a
computer.

It is a computer program that can reproduce by

changing other programs to include a copy of
itself and infect a computer.
Types of Viruses
There are six broad categories or types of computer viruses:

1. Boot sector virus - This type of virus affects the boot sector
of a floppy or hard disk.

2. File Infection Virus - This type of virus infects programs or

executable files (files with an .BIN,.EXE or .COM
extension).These programs are loaded in memory during
execution, taking the virus with them.
4. Network Virus- Network viruses rapidly spreads through a
Local Network Area ( LAN), and sometimes throughout the
internet.

5. E-mail Virus- These viruses spreads in your emails and

affect your emails.

6. Macro Virus- The most common of these are the Microsoft

Office files created in Excel spreadsheets, Word documents,
Access databases, Powerpoint presentations.
Viruses Sources
Viruses do not just appear, there is always
somebody who has made it and they have own
reason to so. Viruses are written everywhere in
the world.

Most of the writers are young men. There are also

few university students, professors, computer
store managers, writers and even a doctor has
written a virus.
How Viruses Act
 Main mission of viruses is to spread out and then get active. Then it hack
into user account and sent data to its owner or slow that machine.
 Many viruses automatically send files without the e-mail account owner’s
knowledge.
 Suspect messages that appear more than once in your Inbox.
 You may receive the same e-mail from a virus repeatedly.
 Display a message.
 Erase files.
 Scramble data on a hard disk.
 Cause erratic screen behavior.
 Halt the PC.
 Many viruses do nothing obvious at all except spread .
Your computer stops responding or locks up often.
Your computer crashes and restarts every few minutes
Applications on your computer don't work correctly.
Disks or disk drives are inaccessible.
You can't print correctly.
You see distorted menus and dialog boxes.
New icons appear on the desktop that you did not put
there, or the icons are not associated with any
recently installed programs.
How Boot sector Virus Spread

A computer is infected with boot sector virus if it

is booted from an infected disk. These viruses
spread normally via floppy disks. load itself into
memory immediately, and it is able to run
whenever the computer is on.
Pieces of code attached
to a legitimate program run when the legitimate
program gets executed.
 1. Virus program is launched.

2. Virus code is loaded into PC memory.

3. Virus delivers its destructive payload.

4. Virus copies itself to other programs.

How viruses activate
Most common methods:-
 Executed by someone clicking on an email attachment.
 Automatically through a network via security holes/flaws.
 By clicking on infected files.

when viruses activate they do very different things.

Viruses can not do any harm to
hardware but they can do harm to programs and for example
to BIOS so that computer does not start after that.
Virus File Extensions
Common File Extensions
The classic computer virus arrives as an executable file, ending in .exe, or a
Visual Basic file, which ends in .vb*.
Other File Extension

SYS--System Config/Driver
URL--Internet Shortcut (Uniform Resource Locator)
MSI, MSP--Windows Installer
ADP--Microsoft Access Project
BAS--Visual Basic Class Module
BAT--Batch File

COM--MS-DOS Application
CRT--Security Certificate
DLL--Dynamic Link Library
HLP--Windows Help File
What To Do When You Find Viruses
 Make sure that you should get sure that it is virus and what
virus it is.
 Attachment Precautions
 Don’t open files that you are not expecting.
 Many viruses automatically send files without the e-mail
account owner’s knowledge.
 Ask the sender to confirm unexpected files. Verify that
attachments have been sent by the author of the email.
 Make File Extensions Visible.
 Avoid booting off a diskette by never leaving a floppy disk in
your system when you turn it off. Write protect all your
system and software diskettes when you obtain them.
 Always make regular backups of your computer
files.
 
 Word on Safety
 Of course, your computer should
always be running anti-virus software with the
latest definitions installed. You should also have
a firewall, and keep your operating system
updated with any necessary service packs or
security patches.
Lifecycle Of Viruses
Activation Discovery

Replication Assimilation

Creation Eradication

Start End
How To Remove Viruses
 By updating your computer and using antivirus
software such as Microsoft Security Essentials, you
can help permanently remove (and prevent)
unwanted software.

 If you currently use antivirus software, visit the

manufacturer's Web site, update your software, and
then perform a thorough scan of your computer. If
you don't use antivirus software, subscribe to a
service and scan your computer immediately.
How Antivirus detect the viruses
An anti-virus software program is a computer program
that can be used to scan files to identify and eliminate
computer viruses and other malicious software.

Anti-virus software typically uses two different

techniques to accomplish this:
1> Virus dictionary approach
2> Suspicious behavior approach
Virus dictionary approach

In the virus dictionary approach, when the anti-virus software

examines a file, it refers to a dictionary of known viruses that
have been identified by the author of the anti-virus software. If
a piece of code in the file matches any virus identified in the
dictionary, then the anti-virus software can then either delete
the file.
so that the file is inaccessible to other programs and its virus is
unable to spread, or attempt to repair the file by removing the
virus itself from the file.
Dictionary-based anti-virus software typically
examines files when the computer's operating
system creates, opens, and closes them; and
when the files are e-mailed.
Suspicious behavior approach

The suspicious behavior approach, by

contrast, doesn't attempt to identify known viruses, but
instead monitors the behavior of all programs. If one
program tries to write data to an executable program .
Other ways to detect viruses

Some antivirus-software will try to emulate the beginning of

the code of each new executable that is being executed
before transferring control to the executable. If the program
seems to be using self-modifying code or otherwise appears
as a virus (it immeadeatly tries to find other executables),
one could assume that the executable has been infected
with a virus.
Yet another detection method is using a sandbox.
A sandbox emulates the operating system and
runs the executable files. After the program has
terminated, the sandbox is analysed for changes
which might indicate a virus. Because of
performance issues this type of detection is
normally only performed during on-demand
scans.
Virus History
In 1949, computer pioneer John von Neumann wrote a paper titled
“Theory and Organization of Complicated Automata.” In this paper, von
Neumann postulated that a computer program could be self-replicating—
and thus predicted today’s self-replicating virus programs.

The theories of von Neumann came to life in the 1950s, at Bell Labs.
Programmers there developed a game called “Core Wars,” where two
players would unleash software “organisms” into the mainframe
computer, and watch as the competing programs would vie for control of
the machine—just as viruses do today.

In the real world, computer viruses came to the fore in the early 1980s,
These early viruses were typically spread by users
sharing programs and documents on floppy disks; a shared floppy was the
perfect medium for spreading virus files.
Unwanted Or Malicious Software
Maleware :- Malware is a software program that has bad
intentions. It can either be installed by the computer user
accidentally or it can sneak into your computer through various
avenues. Its not the same as a piece of software that by chance
causes harm to your computer, malware is software that has
been developed with the intent of causing problems with your
computer.

Adware, spyware, malware, key loggers, web hijackers,

malicious cookies, are some of the new terms used what we now
term as malware.
Unwanted Or Malicious Software
Spyware :- Spyware is software that can display
advertisements (such as pop-up ads), secretly
downloaded and installed,and collect information
about you without appropriate notice and consent.

The presence of spyware is typically hidden from the

user. spyware such as keyloggers are installed by the
owner of a shared, coropareate, or public computer
on purpose in order to secutrity monitor other
programs.
Unwanted Or Malicious Software
Adware :- adware or advertising supported
software is any software package which
automatically plays , displays , or downloads
advertisements to a computer after the software is
installed on it or while the application is being used.
Unwanted Or Malicious Software
Worm :- is a small piece of software that uses computer
networks and security holes to replicate itself.

They are often designed to exploit the file transmission

capabilities found on many computers.

Unlike a viruses,It does not need to attach itself to an existing

program worms almost always cause at least some harm to the
network, if only by consuming bandwidth ,where as virus almost
always corrupt or devour files on a targeted computer
Unwanted Or Malicious Software
Trojan horse : - it facilitates unauthorized accesss to
the user’s computer system.

it requires interaction with the a hacker

to fulfill their purpose.it is possible for hackers to scan
computers on a network using a port scanner in the
hope of finding one with a torjan horse installed .
Conclusion
There are lots of viruses in the world and new
viruses are coming up every day. There are new
anti-virus programs and techniques developed
too. It is good to be aware of viruses and other
malware and it is cheaper to protect you
environment from them rather then being
sorry.
 n k yo u
T h a