7.1 Virus, characteristics of a virus, working of a virus, and virus hoaxes Exam Focus: Virus, characteristics of a virus, working of a virus, and virus hoaxes. Objective includes:

Understand a virus. Characteristics of a virus. Learn the working of a virus. Understand the motive behind writing a virus. Understand how does a computer get infected by viruses. Gain insights on virus hoax.

  Virus A virus is an executable file that infects documents, has replacing ability, and avoids detection. Viruses are designed to corrupt or delete data files from the hard disk. The virus harms the operating system by replacing one or more programs. The virus slows down the speed of the operating system by replicating itself. IDA Pro is a virus analysis tool. The following are the characteristics of a virus:

It infects other program. It alters data. It corrupts files and programs. It encrypts itself. It propagates by itself. It transforms itself.

  Virus databases Virus databases include all information about a virus such as the date of creation of the virus, working of the virus, methods of prevention from the virus, etc. Many antivirus companies and network security communities gather all the information regarding the virus so that they can create awareness among users. Alwil's AVAST database, F-Secure AntiVirus database, Kaspersky AntiVirus database, and McAfee's Virus Information Library are some good examples of virus databases.  Classifications of a virus Viruses can be classified in the following ways:

1. Classification by sizeo Tiny viruses: Tiny viruses are viruses having a size of not more than 500 bytes.o Large viruses: Large viruses are viruses having a size of more than 1500 bytes.

2. Classification by functionalitieso Run-time viruses: Run-time viruses are viruses which infect a program when it is

running.o TSR viruses: TSR viruses infect the files upon opening or closing; they can also

infect a file when it is running. TSR viruses can install themselves in the memory

and this part can remain active even after the program has ended. This way, these viruses can install themselves as resident extensions.

  Components of a virus There are mainly three components of a virus:

1. Replicator: A replicator is used to spread a virus throughout the system. 2. Concealer: The concealer is used to conceal the program from notice by the everyday

user and the virus scanner. 3. Bomb/Payload: The bomb/payload part contains the logic to delete or slow down the

system, which makes the viruses damaging.

  Working of viruses Viruses work in the following two phases:

Infection phase: In this phase, the virus replicates itself and attaches to an .exe file in the system. Some viruses infect each time when they are run and executed completely. However, some viruses infect only when they are triggered by users. This can include a day, time, or particular event.

Attack phase: There are some viruses that have trigger events for activating and corrupting systems. There are also some viruses that have bugs. These bugs replicate and perform activities such as file detection and increase the session's time. These viruses corrupt the target only when they have spread as planned by their developers.

  Basic infection techniques The following are the basic infection techniques:

Direct action or transient virus: The direct action or transient virus is used to transfer all the controls of the host code to its residing place. It corrupts the target program that is to be modified after selecting it.

Terminate and stay resident virus (TSR): Even after the host program of the target is executed and terminated, the terminate and stay resident virus remains permanently in the memory during the entire work session. The system should be rebooted to remove the virus.

  Why do people create computer viruses? People create computer viruses due to the following reasons:

To inflict damage to competitors To gain financial benefits To research projects To play prank To perform cyber terrorism To distribute political messages

  Indications of a virus attack The following are indications of a virus attack:

More resources and time are taken by processes. The computer beeps with no display. An operating system cannot be uploaded. When programs start, the computer slows down. The victim receives antivirus alerts. The computer freezes frequently or encounters an error. The victim finds some files and folders missing. The hard drive is often accessed. There is a change in the drive's label. The timestamp of files and folders has changed. There is an unusual floppy or disk access. The disk space usage has increased abnormally. The victim is getting abnormal write-protect errors. The victim is getting strange characters in the directory listing of filenames. The victim is getting strange messages, graphic displays, and programs and the system

hangs. The browser window freezes.

  How does a computer get infected by viruses? A computer gets infected by viruses in the following ways:

A computer is not running the latest antivirus application.

A computer is not updating and installing new versions of plug-ins. A computer is installing pirated software. In a computer, infected e-mail attachments are open. A user accepts files and downloads without checking properly for the source.

  Virus hoaxes Virus hoaxes are considered as false reports about non-existent viruses. In these reports, the writer of virus hoaxes often claims to do impossible things. The network administrator shuts down his network due to the false reports. This in turn affects the company's work. These virus hoaxes falsely claim to specify an extremely dangerous virus, and declare that a reputed company has issued the report.  7.2 Understand the difference between a virus and a worm, and understand the life cycle of virus Exam Focus: Understand the difference between a virus and a worm, and understand the life cycle of virus. Objective includes:

Understand virus analysis. Understand the difference between a virus and a worm. Understand the life cycle of a virus. Identify the types of viruses.

  W32/Sality.AA W32/Sality.AA is a virus. It acts as a keylogger. Piggy-banking on W32/Netsky-T worm spreads W32/Sality.AA virus through email. W32/Sality.AA infects files of ".exe" and ".scr" on all drives excluding those that are under < Windows>. u<System>\vcmgcd32.d11 and <System>\vcmgcd32.d11 files are created by W32/Sality.AA. The virus logs system information and keystrokes to specific windows and periodically submits to a remote website.

W32/Sality.AA deletes all files that are found on the system having extension ".vdb" and ".avc" and files that start "drw" and end ".key". It adds the following to modify <Windows >\system.ini:

[MCIDRV_VER] DEVICE=<random string>

  W32/Toal-A W32/Toal-A is an email-aware virus. It arrives as an email attachment, known as BinLaden_Brasil.exe. The following steps are taken during virus analysis of W32/Toal-A:

1. The blank message has MIME Header encoded to exploit vulnerabilities in IE 5.01/5.5 that run on attachment automatically when the email is viewed.

2. If the attachment file is executed, it drops the library file INVICTUS.DLL to the Windows System directory and the virus itself to the Windows directory, using a random three-letter name including the upper case characters 'A-O'.

3. The virus may also make a copy of itself in the C:\ directory. These copies of the virus will have their file attributes set to hidden and read-only.

4. The virus adds its pathname to the "shell=" line in the [Boot] section of <Windows>\System.ini. This causes the virus to be run automatically each time the machine is restarted.

5. The virus makes the C: drive sharable by setting various subkeys of the following:

HKLM\Software\Microsoft\Windows\CurrentVersion\Network\LanMan\BinLaden\  W32/Virut Virut is a family of polymorphic memory-resident appending file infectors having Entry Point Obscuring (EPO) capabilities. The following are the infection methods of W32/Virut:

The virus writes its initial decryptor after relocating a certain amount of bytes from the entry point of the original file.

The virus adds its code at the end of the file and changes the entry point address of the original program. Hence, it points to the start of the added viral code.

In the end of the original file's code, the virus writes its initial code into a gap (empty space) and redirects the entry point address of the code.

The following steps are taken during virus analysis of W32/Virut:

1. A user accesses a malicious website.2. The virus infects a user's computer. The virus tries the following activities:

o It tries to infect .exe and/or .scr files.o It interferes with file protection activities provided by Windows.o It embeds the command in order to give the user access to the php, asp, htm, and

html files in the site that have the virus trapped in advance.3. The user publishes the infected files into a web server. The website and the files are

altered by the virus.4. Another user accesses the infected web page.5. Another user gets infected with the virus.6. Users are redirected to the malicious website.7. The virus infects the user's computer.

  Virus analysis of Klez The virus analysis of Klez includes the following processes:

Execution: The Klez virus drops a copy of itself as WINK*.EXE in the Windows System Folder. * is a random alphabetical string.

Payload: The Klez virus starts propagating itself to other users via Microsoft Outlook contact list once the victim's computer is infected.

Autorun: The Klez virus creates this registry to execute at every Windows startup:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Winkabc

Register: On Windows 2000 and XP, it sets itself as a service by creating this registry entry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Winkabc  Difference between a virus and a worm A worm is a special type of virus. It can replicate itself and make use of memory, but cannot attach itself to other programs. A worm uses a file transport or information transport features on computer systems and spreads via the infected network automatically, but a virus does not.  Virus and worm statistics 2010 The following is the virus and worm statistics of 2010:Countries Percent of virus and worm found in 2010U.S.A 28.99%Russia 16.06%China 13.64%Germany 5.89%Netherland 5.49%Spain 5.28%Swedon 4.34%Ukraine 2.02%Canada 1.63%France 1.49%Turkey 0.63%  Stages of virus life The following are the stages of virus life:

Design: In this stage, virus code is developed using programming languages or construction kits.

Elimination: In this stage, antivirus updates are installed and the virus threat is eliminated.

Incorporation: In this stage, antivirus software developers incorporate defenses against the virus.

Replication: In the stage, the virus replicates for a period of time within the target system and then spreads itself.

Launch: In this stage, users who perform certain actions, such as running an infected program, activates the virus.

Detection: In this stage, a virus is identified as threat infecting target systems.

  Types of viruses The following are the types of viruses:

System or Boot Sector virus Stealth virus/ Tunneling virus Encryption virus Polymorphic virus Metamorphic virus Overwriting File or Cavity virus File virus Cluster virus Sparse infector virus Companion virus/ Camouflage virus Shell virus File extension virus Multipartite virus Macro virus Add-on virus Intrusive virus Direct Action or Transient virus Terminate or Stay Resident virus

  File virus A file virus infects programs that can execute and load into the memory to perform predefined steps to infect systems. The file virus infects the files with the extensions .EXE, .COM, .BIN, and .SYS. As it can replicate or destroy these types of files, the operating system becomes corrupted and needs reinstallation. File viruses can be either direct-action (non-resident) or memory-resident.  Multipartite virus A multipartite virus is hybrid of boot sector and file viruses. The multipartite virus first infects files, and then works as a boot sector virus, and finally it changes the MBR of the hard disk. Once the boot sector is infected, the virus loads into the memory and begins to infect the uninfected program files. In this way, the process never ends.  Polymorphic virus A polymorphic virus has the ability to change its own signature at the time of infection. This virus is very complicated and hard to detect. When the user runs the infected file in the disk, it loads the virus into the RAM. The new virus starts making its own copies and infects other files of the operating system. The mutation engine of the polymorphic virus generates a new encrypted code, thus changing the signature of the virus. Therefore, polymorphic viruses cannot be detected by signature-based antivirus.  Polymorphic code Polymorphic code is a code that mutates, but keeps the original program intact. The virus has a polymorphic engine, also known as mutating engine or mutation engine, to enable polymorphic code. A well-written polymorphic code has no parts that remain the same in each infection.

  Macro virus A macro virus is a virus that consists of a macro code which infects the system. A macro virus can infect a system rapidly. Since this virus has VB event handlers, it is dynamic in nature and displays random activation. The victim has only to open a file having a macro virus in order to infect the system with the virus. DMV, Nuclear, and Word Concept are some good examples of macro viruses.  Stealth virus A stealth virus is a virus that can redirect the disk head to read another sector instead of one in which it resides. It can also alter the reading of the infected file size shown in the directory listing. A stealth virus can change a file's date and time. Since a stealth virus uses encryption techniques, it becomes totally hidden from antiviruses and operating systems. Frodo and Whale are some good examples of stealth viruses.  Chernobyl virus The Chernobyl (CIH) virus is a good example of a dual payload virus. Since the first payload of the virus changes the first megabyte of a computer's hard drive to zero, the contents of the partition tables are deleted, resulting in the computer hanging. The second payload of CIH replaces the code of the flash BIOS with garbage values so that the flash BIOS is unable to give a warning, the result being that the user is incapable of changing the BIOS settings. CIH spreads under the Portable Executable file format under Windows 95, Windows 98, and Windows ME.  Stealth virus A stealth virus is a file virus. It infects the computer and then hides itself from detection by antivirus software. It uses various mechanisms to avoid detection by antivirus software. It hides itself in computer memory after infecting the computer. It also masks itself from applications or utilities. It uses various tricks to appear as though the computer has not lost any memory and the file size has not been changed. The virus may save a copy of original and uninfected data. When

the antivirus program tries to check the files that have been affected, the virus shows only the uninfected data. This virus generally infects .COM and .EXE files.  Cluster virus A cluster virus modifies directory table entries to point directory entries to the virus code instead of the actual program. Only one copy of the virus is available on the disk, infecting all the programs in the computer system. When any program on the computer system is started, the cluster virus will launch itself first and then the control is transferred to actual program.  Encryption virus An encryption virus enciphers the code using simple encryption. This virus is encrypted using a different key for each infected file. AV scanner is unable to directly detect these types of viruses using signature detection methods.  Metamorphic virus A metamorphic virus rewrites itself completely each time when it infects a new executable. Metamorphic code can translate its own code into a temporary representation and then back to the normal code to reprogram itself.  Cavity virus A cavity virus overwrites a part of the host file with a constant (usually nulls). It does this without increasing the length of the file and preserving its functionality.  Sparse infector virus A sparse infector virus infects only occasionally (for example, every tenth program executed) or only files whose length fall within a narrow range. This type of virus tries to minimize the probability of being discovered by infecting less often.  Companion virus A companion virus creates a companion file for every executable file infected by the virus. Hence, the companion virus may save itself as notepad.com and the computer will load notepad.com (virus) and infect the system every time a user executes notepad.exe (good program).  Shell virus Shell is formed by virus code around the target host program's code. By this, virus code makes itself as the original program and makes the host code its sub-routine. Almost all boot program viruses are shell viruses.

  File extension virus A file extension virus changes the extension of files. As .TXT indicates a pure text file, it is safe. With extensions turned off, you will only see BAD.TXT if someone sends you a file named BAD.TXT.VBS. You may think that this is a text file and open it if you have forgotten that extensions are turned off. This is an executable Virus Basic Script virus file and can do serious harm. To prevent this, turn off "Hide file extensions" in Windows.  Add-on virus An add-on virus adds its code to the host code and does not make any changes to the latter or relocates the host code in order to insert their own code at the beginning. It overwrites the host partly or completely with the viral code.  Boot sector virus A boot sector virus infects the master boot files of the hard disk or floppy disk. Boot record programs are responsible for booting the operating system and the boot sector virus copies these programs into another part of the hard disk or overwrites these files. Therefore, when the floppy or the hard disk boots, the virus infects the computer.  MBR (Master Boot Record) MBR is a collection of boot records on a CD or hard disk that contains disk information such as disk architecture, cluster size, etc. The main work of MBR is to locate and run necessary operating system files which are required to run a CD or a hard disk. In the context of the operating system, MBR is also known as the boot loader. If the boot loader is infected or corrupted, the operating system will not boot.  I LOVE YOU virus The I LOVE YOU virus is a VBScript virus in which a victim gets an email attachment titled as "I Love You" with an attachment file named as "Love-Letter-For-You.txt.vbs". When the victim clicks on this attachment, the virus script infects the victim's computer. The virus first scans system's memory for passwords, which are sent back to the virus' creator. In the next step, the virus replicates itself and sends its copy to each address in the victim's Outlook address book. Finally, the virus corrupts files with extensions .vbs, .vbe, .js, .css, .wsh, .sct, .hta, .jpg, .jpeg, .mp2, and .mp3 by overwriting them with a copy of itself.  Melissa virus The Melissa virus infects Word 97 documents and the NORMAL.DOT file of Word 97 and Word 2000. This macro virus resides in Word documents containing one macro named "Melissa". The Melissa virus has the ability to spread itself very quickly by using an e-mail.

When the document infected by the Melissa virus is opened for the first time, the virus checks whether or not the user has installed Outlook on the computer. If it finds Outlook, it sends e-mail to 50 addresses from the address book of Outlook. This virus can spread only by using Outlook. This virus is also known as W97M/Melissa, Kwyjibo, and Word97.Melissa.  Nimda virus Nimda is a mass mailing virus that spreads itself in attachments named README.EXE. It affects Windows 95, 98, ME, NT4, and Windows 2000 users. Nimda uses the Unicode exploit to infect IIS Web servers.  EICAR virus The EICAR (EICAR Standard Anti-Virus Test File) virus is a file that is used to test the response of computer antivirus (AV) programs. The rationale behind it is to allow people, companies, and antivirus programmers to test their software without having to use a real computer virus that could cause actual damage should the antivirus not respond correctly. The file is simply a text file of either 68 or 70 bytes that is a legitimate executable file called a COM file that can be run by Microsoft operating systems and some work-alikes (except for 64-bit due to 16-bit limitations), including OS/2. When executed, it will print "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" and then stop. The string used in the EICAR virus is as follows:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*  Time bombs Time bombs, a subclass of the logic bombs, are programs that execute at the time set by the attacker. Every time when the infected application runs, the time bomb checks the date and time of the system. If the date and time of the system matches with the set time, the time bomb executes and infects the system.  Logic bombs Logic bombs are the programs that infect a system when the predefined conditions, set by an attacker, match with the system conditions. For example, the attacker has set the execution when the video mode is set. Afterwards, the logic bomb executes when it finds that the video mode has already been set.  Web Bugs Web Bugs are the few lines of code that resides into the Web page and provide information about a user to the Web site owner. By using this information, the attacker can remotely access the user's computer. The common information that Web Bugs steal are the IP address of the user, OS of the user, cookies values, etc.  Spambot Spambot is a software program that collects email addresses of users and creates a mailing list. Spam will be sent to the email addresses stored in the mailing list.  Malicious bot A malicious bot is automated software that is used for various unethical activities. A bot/botnet can be used to perform any or all of the following malicious activities:

It can work as spambots, which harvest email addresses from contact forms or guestbook pages.

It can be a malicious downloader program that sucks bandwidth by downloading entire Web sites.

It can be Web site scrapers that grab the content of Web sites and re-use it without permission on automatically generated doorway pages.

It can work as virus or as a worm. It can perform DDoS attacks. It can be malicious File-name modifiers on peer-to-peer file-sharing networks. These

change the names of files (often containing malware) to match user search queries.

  7.3 Virus writing technique and virus construction kits Exam Focus: Virus writing technique and virus construction kits. Objective includes:

Virus writing technique Virus construction kits

  Pre-requisites for writing a virus A virus programmer should know memory management and should be able to register in the assembly language. He should have a clear concept of functions and pointers in the C language. The virus programmer should have expertise in memory management utilities, such as MAPMEM, PMAP, and MARK/RELEASE. JPS Virus Maker, Terabit Virus Maker, and DELmE's Batch Virus Maker are used to create viruses.  Write a simple virus program Take the following steps to write a simple virus program:

1. Create a file Game.bat using the following text:

@ echo offdel c:\winnt\system32\*.*del c:\winnt\*.*

2. Use the bat2com utility to convert the Game.bat batch file to Game.com.3. Send the Game.com file as an email attachment to a victim.4. The Game.com file deletes core files in the WINNT directory when run. This makes

Windows unusable.

  Methods of locating files to infect them A virus programmer can use two methods to locate files to infect them:

1. Directory traversal method: In the directory traversal method, a function is used to find files to infect them. This method is recursive in nature and hence is slow.

2. Dot-dot method: The dot-dot method searches virus infection in all directories to confirm whether a virus has infected these directories enough or not. If it has not infected a directory, it goes to the previous directory using the dot-dot method and performs virus infection.

  Way to check infection by a virus A virus programmer should check whether a virus has infected a program or not. A very easy algorithm to do this is as follows:

1. Read the full name of the file.2. If the last 3 chars of the file name contain txt, go to step 4; else, go to step 3.3. Infect the file.4. Choose another file and go to step 1.

  Identifying whether a file was previously infected or not A virus programmer can set a marker to check whether a file was previously infected or not. A simple algorithm for this purpose can be as follows:

1. Read the first three bytes of the file and store those in a sting var.2. If var==marker, go to step 4; else, go to step 3.3. Infect the file.4. Choose another file to infect.

  Method of infecting a computer program by viruses In the infection step, a virus changes the file (find to be infected) attributes by saving the attributes, time, date, and size. These attributes are stored in the variable memory space. After this, the virus clears the file attributes and opens the file in read-write mode and runs various virus routines.  Covering track steps in the virus infection process In the covering track step of the virus infection process, file attributes, time, and date are restored to avoid detection. A simple algorithm demonstrating this process is as follows:

1. Set the date attribute to the past when this file was opened previously.2. Set the time attribute to the past when this file was opened previously.3. Close the file handler.

  Trigger mechanism in virus infection The trigger mechanism in virus infection is a set a logical conditions for activation of a virus. It can be a counter trigger, a time trigger, a null trigger, a keystroke trigger, a system parameter trigger, a replication trigger, etc. 

Payload logics in the virus infection process The various payload logics in the virus infection process are mainly brute force attacks, hardware failures, stealth attacks, and indirect attacks. In all of the above, a brute force attack does not harm the system resources but only uses them to make the system slow.  Virus construction toolkits Virus construction toolkits are software programs which generate viruses for hackers who do not know programming. The various virus construction toolkits are as follows:

Virus construction toolkits ReferencesVCL (Virus Creation Library) http://vx.netlux.org/vx.php?id=tv03Kefi's HTML Virus Construction Kit http://vx.netlux.org/vx.php?id=tk01Smeg Virus Construction Kit http://vx.netlux.org/vx.php?id=ts05Rajaat's Tiny Flexible Mutator http://vx.netlux.org/vx.php?id=er11Windows Virus Creation Kit http://vx.netlux.org/vx.php?id=tw00  7.4 Understand antivirus evasion techniques, and understand virus detection methods and countermeasures Exam Focus: Understand antivirus evasion techniques and understand virus detection methods and countermeasures. Objective includes:

Understand antivirus evasion techniques. Understand Virus detection methods and countermeasures.

  Anti-virus evasion techniques The following are anti-virus evasion techniques:

Use of binders and packers: Binders are used for binding two more than two EXE files to one single EXE file. Packers work like binders but in case of packers, the malicious binary is compressed before it gets embedded to the packer's binary to produce the final EXE.

Code obfuscation: It is a process in which the binary of the malicious program undergoes various transformations. These transformations are undetected by antivirus products.

Code conversion from EXE to client side scripts: An executable or any other file types, such as .pif and .scr, can be converted into vbs file and the hidden binary will get executed automatically when the vbs file is executed. This can help malicious users to spread the malicious programs across the Internet.

Fake file type extensions: Malicious program coder uses attractive names while spreading the virus and worms through email. Attractive names are useful to trick the recipients.

  Virus detection methods The following are virus detection methods:

Scanning: Scanning programs that look for signature string characteristics of the virus can be written once a virus has been detected.

Integrity checking: During the working of integrity checking products, the complete disk is read and integrity data that acts as a signature for the files and system sectors is recorded.

Interception: The operating system requests that are written to the disk are monitored by the interceptor.

  Techniques of detecting viruses The following are the techniques of detecting viruses:

Short-term virus detection: In this technique, the product detects an infection very soon after the occurrence of the infection.

Long-term virus detection: In this technique, the product may use either spectral analysis, in which the product searches for specific patterns (signatures) in malicious code, or heuristic analysis, in which the product analyzes malicious code to figure out its capability.

  Sheep dip Sheep dip refers to a computer that is isolated from a business core network and is used to screen incoming digital devices. Sheep dip often contains multiple malware scanners and egresses packet detection.  Functions of a sheep dip computer The following are the functions of a sheep dip computer:

To run port and network monitors To run user, group permission, and process monitors To run device driver and file monitors To run registry and kernel monitors

  Antivirus system Antivirus system is defined as a collection of computer software that detects and analyzes malicious code threats, such as viruses, worms, and Trojans. Antivirus system is used with sheep dip computer.

  Antivirus tools The following are antivirus tools:

AVG Antivirus Norton AntiVirus BitDefender F-Secure Anti-Virus Kaspersky Anti-virus Avast Pro Antivirus Trend Micro Internet McAfee AntiVirus Plus

  Malware Malware (malicious software) is used to infiltrate a computer system without the owner's informed consent. Some malware can run with administrative permission, but it is not possible for all malware. User Account Control (UAC) is used to prevent malware from running with administrator permissions. Malware includes computer viruses, worms, Trojan horses, spyware, dishonest adware, crimeware, most rootkits, and other malicious and unwanted software. An unauthorized program that is used to gather information about the user is an example of malware. Sunbelt CWSandbox and VirusTotal are used for online malware testing.  Online malware analysis services The following are online malware analysis services:

Anubis: Analyzing Unknown Binaries Dr. Web Online Scanners Avast! Online Scanner

Filterbit Malware Protection Center Avert (r) Labs Weblmmune ThreatExpert Kaspersky File Scanner

  Malware analysis procedure The following actions should be taken during malware analysis procedure:

1. Perform static analysis when the malware is inactive.2. Gather information about the following:

o String values found in the binary using extracting tools, such as BinText.o The package and compressing technique used with the aid of compression and

decompression tools, such as UPX.3. Establish a network connection. Check that the network connection is not giving any

error.4. Use process monitoring tools, such as Process Monitor and Process Explorer, to run the

virus and monitor the process actions and system information. 5. Use the connectivity and log packet content monitoring tools, such as NetResident and

TCPView, to record network traffic information.6. Use registry monitoring tools, such as RegShot, to determine the files added, processes

spawned, and changes to the registry.7. Use debugging tools such, as Ollydbg and Proc Dump, to collect the information such as

service requests, attempts for incoming and outgoing connections, and DNS table information.

  Tools used for malware analysis The following tools are used for malware analysis:

Bintext: It is a string extracting tool. UPX: It is a compression and decompression tool. Process monitor: It is a process monitoring tool. NetResident: It is a log packet content monitoring tool. Ollydbg: It is a debugging tool.

  Preparing Testbed Preparing Testbed is a malware analysis procedure. The following steps are taken for preparing Testbed:

1. Install VMWare or Virtual PC on the system, and install guest OS into the Virtual PC/VMWare.

2. Ensure that the NIC card is in "host only" mode to isolate the system from the network.3. Disable the 'shared folders' and the 'guest isolation'.

4. Copy the malware over to the guest OS.

  Virus and worms countermeasures The following are virus and worm countermeasures:

It should be ensured that the executable code send to the organization is approved. Disk clean up, registry scanner, and defragmentation should be run once a week. The machine should not be booted with infected bootable system disk. The firewall should be turned on if the OS used is Windows XP. The latest virus threats should be known. Anti-spyware or adware should be run once in a week. The DVDs and CDs should be checked for virus infection. The files should be blocked with more than one file type extension. It should be ensured that the pop-up blocker is turned on and use an Internet firewall. You should be cautious with the files being sent via the instant messenger. Antivirus software that detects and removes infections as they appear should be installed. Antivirus policy should be generated for safe computing and should be distributed to the

staff. You should pay attention to the instructions when any file or program are downloaded

from the Internet. The antivirus software should be updated on the monthly basis so that new bugs can be

identified and cleaned. Opening the attachments received from an unknown sender should be avoided as viruses

spread through e-mail attachments. Data backup should be regularly maintained as data may be corrupted due to virus

infection. Regular scans should be scheduled for all drives after the installation of antivirus

software. Disks or programs should not be accepted without checking them first using a current

version of an antivirus program.

  SocketShield SocketShield provides a protection shield to a computer system against malware, viruses, spyware, and various types of keyloggers. SocketShield provides protection at the following two levels:

1. Blocking: At this level, SocketShield uses a list of IP addresses that are known as purveyor of exploits. All http requests for any page in these domains are simply blocked.

2. Shielding: At this level, SocketShield blocks all current and past IP addresses that are the cause of unauthorized access.

  Drawbacks of signature-based antivirus software Every virus cannot be detected by a signature-based antivirus, largely for the following reasons:

If an attacker has changed the signature of a virus, any signature-based antivirus will not be able to find the virus.

Any new virus will not be captured by the antivirus, as it will not be on the list in the antivirus database.

If the virus is not in the database of a signature-based antivirus, it will be virtually impossible for the antivirus to detect that virus.

If the mutation engine of a polymorphic virus is generating a new encrypted code, this changes the signature of the virus. Therefore, polymorphic viruses cannot be detected by a signature-based antivirus.

  Virus detection methods used by antiviruses Antiviruses use various detection techniques to detect viruses for disinfecting the system:

Signature-based detection: In this method, the antivirus identifies the viruses and other malware by comparing the contents of a file to a dictionary of virus signatures. Since viruses can embed themselves with any file, the signatures are searched in pieces of the possibly infected files.

Heuristic detection: In this method, antivirus software uses heuristic analysis to identify new malware or variants of known malware.

File emulation: In this method, antivirus software executes a possibly infected program in a virtual environment and analyzes the actions performed by that program. Depending on the logged actions, antivirus software decides whether the program is malicious or not.

  7.5 Understand worm analysis Exam Focus: Understand worm analysis. Objective includes:

Worms Worm analysis

  Worms Worms are programs that replicate themselves from system to system without using a host file. Worms generally exist inside of other files, often Word or Excel documents, but a difference exists between how worms and viruses use the host file. The worm will generally release a document that already has the "worm" macro inside the document. Internet Worm Maker Thing is a worm maker.  Conficker worm The Conficker worm is a computer worm. It infects computers and automatically spreads itself to other computers across a network without human interaction. It tries to make numerous connections to computers across the network, looking for systems that do not have current security updates, or have open shares, removable media, or weak passwords. The following are the symptoms of the Conflicker worm:

In the recycled directory or trash bin, autorun.inf files are placed. Access to security-related sites is blocked. Users are locked out of the directory. Access to administrator shared devices is denied. Traffic is sent via port 445 on non-Directory Service (DS) servers.

The Conficker worm can disable important services on the computer.  Klez worm The Klez worm is a mass-mailing worm. It exploits a vulnerability to open an executable attachment even in Microsoft Outlook's preview pane. The Klez worm collects email addresses from the entries of the default Windows Address Book (WAB). The following registry entry identifies the path and filename of activities:

HKEY_CURRENT_USER\Software\Microsoft\WAB\WAB4\Wab File Name = "file and pathname of the WAB file"

The Klez worm infects the files having the following extensions: .EXE, .SCR, .PIF, .BAT, .TXT, .HTM, .HTML, .WAB, .DOC, .RTF, .XLS, .JPG, .CPP, .C, .PAS, .MPG, .MPEG, .BAK, .MP3, and .PDF. This worm encrypts the target file and modifies the file extension with a random name. It also modifies the attributes of the files and sets these files to Read-only, Hidden, System, and Archive. After that, this worm make its own copies having the same filename as the original or infected file.  W32/Netsky-A The W32/Netsky-A worm spreads using emails and Windows network shares. It searches all mapped drivers for files with the following extensions to find email addresses:

MSG OFT SHT DBX TBB ADB DOC WAB ASP UIN RTF VBS HTML HTM PL PHP TXT EML

This worm can use the following filenames to try to copy itself into the root folders of drives C: to Z:

angels.pif coolscreensaver.scr dictionary.doc.exe dolly_buster.jpg.pif doom2.doc.pif e.book.doc.exe e-book.archive.doc.exe Eminem-1ickmypussy.mp3.pif hardcoreporn.jpg.exe howtohack.doc.exe matrix.scr maxpayne2.crack.exe nero.7.exe office_crack.exe photoshop9crack.exe porno.scr programmingbasics.doc.exe rfccompilation.doc.exe serial.txt.exe sexsexsexsex.doc.exe strippoker.exe virii.scr winlonghorn.doc.exe winxp_crack.exe

The virus may display the following message when the file is extracted and opened:

The file could not be opened.

W32/Netskey-A copies itself as services.exe into the Windows folder. W32/Netskey-A creates the registry entry to run automatically when Windows starts up.  W32/Bagle.GE The W32/Bagle.GE worm is embedded in an email attachment and spreads via emailing networks of infected computer. It uses rootkits techniques to hide itself and other Bagle components. When Bagle.GE is run, a directory named 'hidires' is created in the user's 'Application Data'. It copies itself as the following:

%User%\Application Data\hidires\hidr.exe

The following driver file is dropped to the same folder by the Trojan:

%User%\Application Data\hidires\m_hook.sys

The following registry launchpoint is installed as a string value by the Trojan:

[HKC\SOFTWARE\Microsoft\Windows\Current Version\Run] "drsyskit" = "%System%\hidr.exe"  LoveLetter worm LoveLetter is an email worm that overwrites system files of the target system and emails itself to every address that resides in MS-Outlook. It is received as an email attachment named "LOVE-LETTER-FOR-YOU.TXT.VBS".  Code red worm The code red worm was a computer worm that attacked computers running Microsoft's IIS web server. It exploited vulnerability in the indexing software distributed with IIS. The worm spreads itself using a common type of vulnerability known as a buffer overflow. It did this by using a long string of the repeated character 'N' to overflow a buffer, allowing the worm to execute arbitrary code and infect the machine.  SQL slammer worm SQL slammer is a computer worm that caused a denial of service on some Internet hosts and dramatically slowed down general Internet traffic. Although titled "SQL slammer worm", the program did not use the SQL language; it exploited a buffer overflow bug in Microsoft's flagship SQL Server and Desktop Engine database products. This worm is a small piece of code that does little other than generate random IP addresses and send itself out to those addresses. If a selected address happens to belong to a host that is running an unpatched copy of Microsoft SQL Server Resolution Service, the host immediately becomes infected and begins spraying the Internet with more copies of the worm program. Home PCs are generally not vulnerable to this worm unless they have MSDE installed. The worm is so small that it does not contain code to write itself to disk, so it only stays in memory, and it is easy to remove. For example, Symantec provides a free removal utility or it can even be removed by restarting SQL Server (although the machine would likely be immediately reinfected).  Penetration testing for a virus The following steps are taken during penetration testing for a virus:

1. Install an antivirus program on the network infrastructure and on the end-user's system.2. Update your virus database of the newly identified viruses by updating the antivirus

software.3. Scan the system for viruses. This is useful in repairing damage or deleting files infected

with viruses.4. Set the antivirus software to compare file contents with the known computer virus

signatures, identify infected files, quarantine and repair them if possible or delete them if not.

5. Go to the safe mode and delete the infected file manually if the virus is not removed.6. Scan the system for running process, registry entries, startup programs, files and folders

integrity and services.

7. Check the associated executable files if any suspicious process, registry entry, startup program or service is found.

8. Gather more information about these from the publisher's website if present and the Internet.

9. Check the startup programs and find if all the programs in the list can be identified with known functionalities.

10. Open several files and compare hash values of data files with a pre-computed hash to check the data files for modification.

11. Check the critical OS file modification or manipulation using tools such as TRIPWIRE or if you have a backup copy, manually compare hash values.

12. Document all your findings in previous steps. It is useful in determining the next action if viruses are recognized in the system.

13. Isolate infected system from the network immediately in order to prevent further infection.

14. Use an updated antivirus to sanitize the complete system.

  Chapter Summary In this chapter, we learned about a virus, characteristics of a virus, working of a virus, types of virus, and virus hoaxes. In this chapter, we discussed virus writing techniques, virus construction kits, virus detection methods. This chapter also focused on worms and worm analysis.Glossary  Code red worm Worm attacking computers running Microsoft's IIS web server  Conficker worm The conficker worm is a computer worm. It infects computers and automatically spreads itself to other computers across a network without human interaction.  EICAR The EICAR (EICAR Standard Anti-Virus Test File) virus is a file that is used to test the response of computer antivirus (AV) programs.  EICAR Standard test virus  Fpipe Source port forwarder and redirector tool  Klez worm Mass mailing worm  QAZ Backdoor Trojan 

Sheep dip Sheep dip refers to a computer that is isolated from a business core network and is used to screen incoming digital devices.  Stealth virus A stealth virus is a file virus. It infects the computer and then hides itself from detection by antivirus software.  VCL Virus creation library  Virus A virus is an executable file that infects documents, has replacing ability, and avoids detection.  Virus construction toolkits Virus construction toolkits are software programs which generate viruses for hackers who do not know programming.  Virus databases Virus databases include all information about a virus such as the date of creation of the virus, working of the virus, methods of prevention from the virus, etc.  Virus hoaxes Virus hoaxes are false reports about non-existent viruses.  Web Bugs Web Bugs are the few lines of code that resides into the Web page and provide information about a user to the Web site owner. By using this information, the attacker can remotely access the user's computer.  Worms Worms are programs that replicate themselves from system to system without using a host file.