Deprecated: mysql_connect(): The mysql extension is deprecated and will be removed in the future: use mysqli or PDO instead in /home/a26f9f83/public_html/articles/includes/config.php on line 159
Viruses and Worms, Protection from Disaster > NetSparsh - Viral Content you Love & Share

Viruses and Worms, Protection from Disaster

Virus damage estimated at $55 billion in 2003. "SINGAPORE - Trend Micro Inc, the world's third-largest anti-virus software maker, said Friday that computer virus attacks cost global businesses an estimated $55 billion in damages in 2003, a sum that would rise this year. Companies lost roughly $20 billion to $30 billion in 2002 from the virus attacks, up from about $13 billion in 2001, according to various industry estimates." This was the story across thousands of news agencies desk January 2004. Out of $55 billion, how much did it cost your company? How much did it cost someone you know?

I. The Why
There is an average of 10-20 viruses released every day. Very few of these viruses actually make ?Wild? stage. Viruses are designed to take advantage of security flaws in software or operating systems. These flaws can be as blatant as Microsoft Windows NetBIOS shares to exploits using buffer overflows. Buffer overflows happen when an attacker sends responses to a program longer then what is expected. If the victim software is not designed well, then the attacker can overwrite the memory allocated to the software and execute malicious code.

People make viruses for various reasons. These reasons range from political to financial to notoriety to hacking tools to plain malicious intent.

Political: Mydoom is a good example of a virus that was spread with a political agenda. The two targets of this virus were Microsoft and The SCO Group. The SCO Group claims that they own a large portion of the Linux source code threatened to sue everyone using Linux operating systems (with "stolen" programming source). The virus was very effective knocking down SCO's website. However, Microsoft had enough time to prepare for the second attack and efficiently sidestepped disaster.

Financial: Some virus writers are hired by other parties to either leach financial data from a competitor or make the competitor look bad in the public eye. Industrial espionage is a high risk/high payout field that can land a person in prison for life.

Notoriety: There are some that write viruses for the sole purpose of getting their name out. This is great when the virus writers are script kiddies because this helps the authorities track them down. There are several famous viruses that have the author's email in the source code or open script

Hacking Hackers sometimes write controlled viruses to assist in the access of a remote computer. They will add a payload to the virus such as a Trojan horse to allow easy access into the victims system.

Malious: These are the people that are the most dangerous. These are the blackhat hackers that code viruses for the sole intention of destroying networks and systems without prejudice. They get high on seeing the utter destruction of their creation, and are very rarely script kiddies.

Many of the viruses that are written and released are viruses altered by script kiddies. These viruses are known as generations of the original virus and are very rarely altered enough to be noticeable from the original. This stems back to the fact that script kiddies do not understand what the original code does and only alters what they recognize (file extension or victim's website). This lack of knowledge makes script kiddies very dangerous.

II. The How
Malicious code has been plaguing computer systems since before computers became a common household appliance. Viruses and worms are examples of malicious code designed to spread and cause a system to perform a function that it was not originally designed to do.

Viruses are programs that need to be activated or run before they are dangerous or spread. The computer system only becomes infected once the program is run and the payload has bee deployed. This is why Hackers and Crackers try to crash or restart a computer system once they copy a virus onto it.

There are four ways a virus can spread:
1.) Email
2.) Network
3.) Downloading or installing softwarev 4.) Inserting infected media

Spreading through Email
Many emails spread when a user receives an infected email. When the user opens this email or previews it, the virus is now active and starts to immediately spread.

Spreading through Network
Many viruses are network aware. This means that they look for unsecured systems on the network and copy themselves to that system. This behavior destroys network performance and causes viruses to spread across your system like wildfire. Hackers and Crackers also use Internet and network connections to infect systems. They not only scan for unprotected systems, but they also target systems that have known software vulnerabilities. This is why keeping systems up to date is so important.

Spreading through manual installation
Installing software from downloads or disks increase the risk of infection. Only install trusted and scanned software that is known to be safe. Stay away from freeware and shareware products. These programs are known to contain Spyware, Adware, and viruses. It is also good policy to deny all Internet software that attempts to install itself unless explicitly needed.

Spreading through boot sectors
Some viruses corrupt the boot sector of disks. This means that if another disks scans the infected disk, the infection spreads. Boot sector viruses are automatically run immediately after the disk is inserted or hard drive connected.

III. Minimizing the effect of viruses and worms
We have all heard stories about the virus that destroyed mission critical company data, which cost companies months to recover and thousands of dollars and man-hours restoring the information. In the end, there are still many hours, costs, and would be profits that remain unaccounted. Some companies never recover fully from a devastating attack. Taking simple precautions can save your business

Anti-virus Software
Another step is to run an antivirus program on the local computer. Many antivirus programs offer live update software and automatically download the newest virus definitions minutes after they are released (Very important that you verify these updates weekly if not daily). Be careful of which antivirus program you chose. Installing a PC antivirus on a network can be more destructive on performance than a virus at work. Norton makes an effective corporate edition specifically designed for Windows NT Server and network environments. When using antivirus software on a network, configure it to ignore network drives and partitions. Only scan the local system and turn off the auto protection feature. The auto-protect constantly scans your network traffic and causes detrimental network issues. Corporate editions usually have this disabled by default. PC editions do not.

Email Clients Do not open emails from unknown sources. If you have a website for e-commerce transactions or to act as a virtual business card, make sure that the emails come up with a preset subject. If the emails are being sent through server side design instead of the users email client, specify whom it is coming from so you know what emails to trust. Use common sense when looking at your email. If you see a strange email with an attachment, do not open it until you verify whom it came from. This is how most MM worms spread.

Disable preview panes in email clients. Email clients such as Outlook and Outlook Express have a feature that will allow you to preview the message when the email is highlighted. This is a Major security flaw and will instantly unleash a virus if the email is infected.

It is also a good idea to turn off the feature that enables the client to view HTML formatted emails. Most of these viruses and worms pass by using the html function "< i f r a m e s r c >" and run the attached file within the email header.

We will take a quick look at an email with the subject header of "You're now infected" that will open a file called readme.exe.

"Subject: You're now infected MIME-Version: 1.0 Content-Type: multipart/related;


boundary="====_ABC1234567890DEF_====" X-Priority: 3 X-MSMail-Priority: Normal X-Unsent: 1 To: undisclosed-recipients:;

--====_ABC1234567890DEF_==== Content-Type: multipart/alternative;

boundary="====_ABC0987654321DEF_====" *** (This calls the iframe)

--====_ABC0987654321DEF_==== Content-Type: text/html;

charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

< H T M L > < H E A D > < / H E A D > < B O D Y b g C o l o r = 3 D # f f f f f f > < i f r a m e s r c = 3 D c i d : EA4DMGBP9p height=3D0 width=3D0> *** (This calls readme.exe) < / i f r a m e > < / B O D Y > < / H T M L >


--====_ABC1234567890DEF_==== Content-Type: audio/x-wav;

name="readme.exe" *** (This is the virus/worm) Content-Transfer-Encoding: base64 Content-ID: *** (Notice the < i f r a m e s r c = ? >)

PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9u YWwvL0VOIj4NIDxodG1sPg08aGVhZD4NPHRpdGxlPldobydzIHRoZSBiZXN0LS0tLS0tPyAt IHd3dy5lemJvYXJkLmNvbTwvdGl0bGU+DQ0NDTxzY3JpcHQgbGFuZ3VhZ2U9amF2YXNjcmlw dCBzcmM9aHR0cDovL3d3dzEuZXpib2FyZC5jb20vc3BjaC5qcz9jdXN0b21lcmlkPTExNDc0 NTgwODI+PC9zY3JpcHQ+DTxzY3JpcHQgbGFuZ3VhZ2U9ImphdmFzY3JpcHQiPg08IS0tDWZ1 bmN0aW9uIE1NX29wZW5CcldpbmRvdyh0aGVVUkwsd2luTmFtZSxmZWF0dXJlcykgeyAvL3Yy

*** Broken to protect the innocent. (Worm is encoded in Base64)

aHJlZj1odHRwOi8vY2l0YWRlbDMuZXpib2FyZC5jb20vZmNhbGhpc3BvcnRzZnJtMT5Gb290 YmFsbDwvYT4NIA08Zm9udCBjb2xvcj0jRkYwMDAwPiAtIDwvZm9udD4NDTxicj48YnI+PGJy Pjxicj5Qb3dlcmVkIEJ5IDxhIGhyZWY9aHR0cDovL3d3dy5lemJvYXJkLmNvbS8+ZXpib2Fy ZK48L2E+IFZlci4gNi43LjE8YnI+Q29weXJpZ2h0IKkxOTk5LTIwMDEgZXpib2FyZCwgSW5j Lg08L2NlbnRlcj4NPC9ib2R5Pg08L2h0bWw+DQ0NDQoNCj==


Email Servers The first step to minimizing the effect of viruses is to use an email server that filters incoming emails using antivirus software. If the server is kept up to date, it will catch the majority of Mass Mailer (MM) worms. Ask your Internet Service Provider (ISP) if they offer antivirus protection and spam filtering on their email servers. This service is invaluable and should always be included as the first line of defense.

Many companies house an internal email server that downloads all of the email from several external email accounts and then runs an internal virus filter. Combining an internal email server with the ISP protection is a perfect for a company with an IT staff. This option adds an extra layer of control, but also adds more administration time. Sample specs for an internal email server are:

Setup #1
* Linux: OS
* Sendmail: mail server
* Fetchmail: Grabs email from external email addresses
* F-prot: Antivirus
* SpamAssassin: Spam Filter

Setup #2
* Win 2003 Server: OS
* Exchange: Email server
* Symantec antivirus: Antivirus
* Exchange Intelligent Message Filter: Spam Filter

Software Updates Keep you software up to date. Some worms and viruses replicate through vulnerabilities in services and software on the target system. Code red is a classic example. In august 2001, the worm used a known buffer overflow vulnerability in Microsoft's IIS 4.0 and 5.0 contained in the Idq.dll file. This would allow an attacker to run any program they wanted to on the affected system. Another famous worm called Slammer targeted Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000.

When updating your software, make sure to disable features and services that are not needed. Some versions of WinNT had a web server called IIS installed by default. If you do not need the service, make sure it is turned off (Code red is a perfect example). By only enabling services you need, you decrease the risk of attack.

Telecommunications Security Install a firewall on the network. A firewall is a device or software that blocks unwanted traffic from going to or from the internal network. This gives you control of the traffic coming in and going out of your network. At minimum, block ports 135,137,139,445. This stops most network aware viruses and worms from spreading from the Internet. However, it is good practice to block all traffic unless specifically needed.

Security Policies Implementing security policies that cover items such as acceptable use, email retention, and remote access can go a long way to protecting your information infrastructure. With the addition of annual training, employees will be informed enough to help keep the data reliable instead of hinder it. Every individual that has access to your network or data needs to follow these rules. It only takes one incident to compromise the system. Only install proven and scanned software on the system. The most damaging viruses come from installing or even inserting a contaminated disk. Boot sector viruses can be some of the hardest malware to defeat. Simply inserting a floppy disk with a boot sector virus can immediately transfer the virus to the hard drive.

When surfing the Internet, do not download untrusted files. Many websites will install Spyware, Adware, Parasites, or Trojans in the name of "Marketing" on unsuspecting victims computers. Many prey on users that do not read popup windows or download freeware or shareware software. Some sites even use code to take advantage of vulnerability in Internet explorer to automatically download and run unauthorized software without giving you a choice.

Do not install or use P2P programs like Kazaa, Morpheus, or Limewire. These programs install server software on your system; essentially back dooring your system. There are also thousands of infected files floating on those networks that will activate when downloaded.

Backups & Disaster Recovery Planning Keep daily backups offsite. These can be in the form of tape, CD-R, DVD-R, removable hard drives, or even secure file transfers. If data becomes damaged, you would be able to restore from the last known good backup. The most important step while following a backup procedure is to verify that the backup was a success. Too many people just assume that the backup is working only to find out that the drive or media was bad six months earlier when they were infected by a virus or lost a hard drive. If the data that you are trying to archive is less then five gig, DVD-R drives are a great solution. Both the drives and disks have come down in price and are now a viable option. This is also one of the fastest backup methods to process and verify. For larger backups, tape drives and removable hard drives are the best option. If you choose this method, you will need to rotate the backup with five or seven different media (tapes, CD/DVD, removable drives) to get the most out of the process. It is also suggested to take a "master" backup out of the rotation on a scheduled basis and archive offsite in a fireproof safe. This protects the data from fire, flood, and theft.

In the Internet age, understanding that you have to maintain these processes will help you become successful when preventing damage and minimizes the time, costs, and liabilities involved during the disaster recovery phase if you are affected.


Virus Resources F-PROT: McAfee : Symantec Norton: Trend Micro: NIST GOV:

Free software AVG Anti-Virus - Free F-Prot - Free for home users

Free online Virus scan BitDefender - HouseCall - McAffe - Panda ActiveScan - RAV Antivirus -

Free online Trojan scan TrojanScan -

Free online Security scan Symanted Security Check - Test my Firewall -

More Security Resources Forum of Incident Response and Security Teams: Microsoft: SANS Institute: Webopedia: Definitions

Adware: *A form of spyware that collects information about the user in order to display advertisements in the Web browser based on the information it collects from the user's browsing patterns.

Software that is given to the user with advertisements already embedded in the application

Malware: *Short for malicious software, software designed specifically to damage or disrupt a system, such as a virus or a Trojan horse.

Script Kiddie: *A person, normally someone who is not technologically sophisticated, who randomly seeks out a specific weakness over the Internet in order to gain root access to a system without really understanding what it is s/he is exploiting because the weakness was discovered by someone else. A script kiddie is not looking to target specific information or a specific company but rather uses knowledge of a vulnerability to scan the entire Internet for a victim that possesses that vulnerability.

Spyware: *Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet; however, it should be noted that the majority of shareware and freeware applications do not come with spyware. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.

Spyware is similar to a Trojan horse in that users unwittingly install the product when they install something else. A common way to become a victim of spyware is to download certain peer-to-peer file swapping products that are available today.

Aside from the questions of ethics and privacy, spyware steals from the user by using the computer's memory resources and also by eating bandwidth as it sends information back to the spyware's home base via the user's Internet connection. Because spyware is using memory and system resources, the applications running in the background can lead to system crashes or general system instability.

Because spyware exists as independent executable programs, they have the ability to monitor keystrokes, scan files on the hard drive, snoop other applications, such as chat programs or word processors, install other spyware programs, read cookies, change the default home page on the Web browser, consistently relaying this information back to the spyware author who will either use it for advertising/marketing purposes or sell the information to another party. Licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the requested software, but the licensing agreements may not always be read completely because the notice of a spyware installation is often couched in obtuse, hard-to-read legal disclaimers.

Trojan: *A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.

The term comes from a story in Homer's Iliad, in which the Greeks give a giant wooden horse to their foes, the Trojans, ostensibly as a peace offering. But after the Trojans drag the horse inside their city walls, Greek soldiers sneak out of the horse's hollow belly and open the city gates, allowing their compatriots to pour in and capture Troy.

Virus: *A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are man made. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

Since 1987, when a virus infected ARPANET, a large network used by the Defense Department and many universities, many antivirus programs have become available. These programs periodically check your computer system for the best-known types of viruses.

Some people distinguish between general viruses and worms. A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs.

Worm: *A program or algorithm that replicates itself over a computer network and usually performs malicious actions, such as using up the computer's resources and possibly shutting the system down.

* Definitions provided by Webopedia

A special thanks goes out to the CISSP community, various Chief Information Security Officer (CISO)s, and to those in the Risk assessment specialty of Information Systems Security for their help in proof reading and suggestions.


In The News:

This RSS feed URL is deprecated, please update. New URLs can be found in the footers at

New York Times

No Passport or Ticket: How a Woman Evaded Airport Security and Flew to London
New York Times
After Ms. Hartman joined the security line and was screened by the T.S.A., she tried to board a flight to Connecticut around 2 p.m., attempting to conceal herself behind a passenger who was waiting in line, Ms. Simonton said. As Ms. Hartman tried to ...
How Marilyn Hartman Got Past O'Hare SecurityCBS Chicago
'Serial stowaway' arrested for 10th time after slipping past airport security, flies to LondonFox 2 Detroit
Notorious 'serial stowaway' pensioner evades airport security and flies from Chicago to London without a ticketEvening Standard

all 29 news articles »

Google's Advanced Protection Program Offers Security Options For High-Risk Users
Security is not a one-size-fits-all proposition, and features that are prohibitively inconvenient for some could be critical for others. For most users, standard account security settings options are sufficient protection against common threats. But ...

BBC News

Syria offensive: US seeks to address Turkey's 'legitimate' security concerns
BBC News
The US is willing to work with Turkey to address its "legitimate" security concerns in northern Syria, Secretary of State Rex Tillerson has said. He was speaking after Turkey's military incursion into northern Syria to fight the Kurdish YPG militia at ...
US Hopes to Work With Turkey on 'Security Zone' in SyriaU.S. News & World Report
US hopes to work with Turkey to create 'security zone' in Syria: TillersonDaily Sabah
Turkey has legitimate security concerns: MattisHurriyet Daily News

all 452 news articles »


After ignoring for months, Uber fixes two-factor bypass bug after all
Uber has fixed a security bug that could've allowed an attacker to hack into user accounts by bypassing two-factor authentication, after the ride-sharing company initially said the flaw wasn't a "particularly severe" issue. The company quietly issued a ...


Uber security flaw compromised two-factor authentication
Two-factor authentication only works if it's strictly enforced in software, and it sounds like Uber might have fallen short of that goal for a while. In a chat with ZDNet, security researcher Karan Saini has revealed a flaw in Uber's two-factor ...

and more »

Report: Afghan security forces committed 75 rights abuses, including child sex assault
The report from the Special Inspector General for Afghanistan Reconstruction (SIGAR), which was first released to Congress last year but made public Tuesday, says that at least seven of the violations were child sexual assault, but also says "the full ...

and more »


Soldiers, snipers and security at Davos: Protecting the world's rich and powerful
Ensuring the safety of more than 2,500 high-profile political, economic and business guests at an event is never easy; ensuring the safety of more than 70 heads of state and government is a nightmare. The World Economic Forum (WEF) has said security is ...

and more »

New York Times

Prison Guards in France Continue Strike Over Security and Pay
New York Times
PARIS — A labor strike by prison guards around France entered its second week on Monday, as the guards vented anger over their pay and dangerous working conditions, an issue that erupted into the open this month after a string of violent assaults by ...

and more »

Sun Sentinel

Security guard shot colleague in Hollywood in fight over gate lock, police say
Sun Sentinel
Andres Aviles, 26, drove to Mexico and flew to El Salvador where he was detained while trying to reach Nicaragua, police said. Tonya AlanezContact Reporter · Privacy Policy. The security guard accused of shooting his colleague during a shift change at ...
Security guard accused of shooting colleague gets caught in El SalvadorWPLG Local 10
Fugitive security guard fled Florida. His crime caught up with him in El Salvador.Miami Herald

all 5 news articles »

Fox News

US says it wants to help Indonesia provide maritime security
Fox News
JAKARTA, Indonesia – U.S. Defense Secretary Jim Mattis says the Trump administration wants to help Indonesia play a central role in maritime security in the Asia-Pacific region. Mattis spoke briefly to reporters Tuesday after meeting with his ...
US to work with Indonesia on maritime security, counter-terrorismThe Straits Times

all 168 news articles »
Google News

A Painless Plagiarism Solution

A crowded marketplace can lead to unethical webmasters using underhand... Read More

Spyware Programs Are Out To Get You!

The average computer is packed with hidden software that can... Read More

Can I Guess Your Password?

We all know that it's dangerous to use the same... Read More

A New Low

A new variation of the Nigerian Scam theme ... Read More

The Important Steps To Protect Your Kids on the Internet

Internet is the ocean of knowledge. In this ocean you... Read More

Hacked: Who Else Is Using Your Computer?

A friend called me one day and asked if I... Read More

Social Engineering: You Have Been A Victim

Monday morning, 6am; the electric rooster is telling you it's... Read More

Identity Theft - Dont Blame The Internet

Identity theft ? also known as ID theft, identity fraud... Read More

SCAMS ? Be Aware ? And Report When Necessary

The Internet is a vast International Network of people and... Read More

Dont Get Hacked - A Guide to Protecting Your Business from Thieves

You've seen it in the news - 40 million credit... Read More

Identity Theft -- 10 Simple Ways to Protect Your Good Name!

Identity Theft is one of the most serious problems facing... Read More

Email Hoaxes, Urban Legends, Scams, Spams, And Other CyberJunk

The trash folder in my main inbox hit 4000 today.... Read More

The Move to a New Anti-Virus Model

This is the second in a series of articles highlighting... Read More

Mall Protection

The Loss Prevention Manager should be receptive to the needs... Read More

How to Protect Your Child from the Internet

When the Internet first came about, it was realized it... Read More

An Open Letter From a So-called Stupid

Someone recently told me, "You would have to be a... Read More

Eliminate Adware and Spyware

Everyone should eliminate spyware and adware from your hard drive... Read More

Lottery Scam, What It is and how to Avoid It?

Internet scams and frauds are on the rise! The quantity... Read More

3 Simple Steps to Stay Safe from Spyware

There are several basic concepts to keep in mind when... Read More

Internet Shopping - How Safe Is It?

Millions of people make purchases online, but many people are... Read More

Anti-Spyware Protection: Behind How-To Tips

There is no doubt that "how-to articles" have become a... Read More

Virus and Adware - Fix them Both!

We all get the odd virus now and then, but... Read More

Top 10 tips for Safe Internet Shopping

Over £5 billion pounds was spent on online shopping in... Read More

Corporate Security for Your Home Business

The words Corporate Security may conjure up images of a... Read More

Dont Fall Victim to Internet Fraud-10 Tips for Safer Surfing

The Internet offers a global marketplace for consumers and businesses.... Read More