Viruses, Worms and Trojan Horses – New Definitions

A Virus was once a viral infection, a Worm was fishing bait and a Trojan Horse was Greek mythology. The personal computer has expanded those definitions.

Computer viruses are small bits of software code that are added to legitimate programs, modify the program and then replicate themselves. Once opened viruses can do extensive damage to programs and operating systems in a computer.

The earliest viruses appeared in the 1980s on floppy disks. Once the disk was inserted and the drive and running, the virus would find another program to attach to and do its damage. Because software programs were much smaller the viruses were spread from disk to disk. This factor minimized the spread of viruses – until the Internet became accessible to home computers. Then, users could go to Internet bulletin boards and download programs onto a floppy disk. If the program contained a virus, the computer became infected.

Email viruses are contained in an email or in email attachments. Often, the virus is activated when the user double-clicks on the email or the attachment. Once activated, the email replicates itself and automatically mails itself to up to 50 addresses in the user’s address book.

A Trojan Horse virus is a computer program that appears to perform one function and, in fact, performs a different and harmful function when launched. It generally does significant damage to the computer.

Worm viruses typically reside on a network. They find security holes in a computer and attach to a resident program. A worm can simultaneously do damage to a computer while slowing down Internet traffic and taking up bandwidth space.

As viruses evolved with the transition from floppy disks to CDs that protected programs from modification, hackers created viruses that loaded into a computer’s memory and ran in the background as part of a two phase action. Once the virus infected the computer – the first phase – the second damaging “attack” phase would occur, triggered by another computer event.

Extra Computer Security Tips

Above and beyond the absolutely essential requirement to have a strong security program that includes anti-virus protection that includes email, a two-way firewall, backup capability and spyware protection installed on a computer, there are several other steps and practices that can further protect a computer.

Windows is the most popular and commonly used computer operating system. Consequently, Windows based computers are most often targeted by viruses. One solution to preventing virus attacks is to replace Windows with a different operating system such as UNIX because it is less common on PCs and therefore a less likely virus target.

Avoid downloading programs from unfamiliar sources on the Internet. Better yet, buy well known and reliable computer programs from reputable outlets. With a receipt in hand it’s much easier to resolve problems with the seller if they arise.

If a computer has Microsoft Word installed as its word processing program, make sure that Microsoft’s Macro Virus Protection is enabled in Word. Also, do not ever run macros in a received document.

Look at the extension on every email attachment before opening it and do not double-click on attachment with an executable extension such as .com, .exe or .vbs. Once opened, an executable file has the potential and freedom to do anything to a computer.

Emails in general need to be scrutinized carefully before opening them. If the message is coming from an unknown or unfamiliar source, delete it. When forwarding an email recognize that some people will not open forwarded messages to avoid viruses. Emails received from a reliable source can be sent on to others by copying and pasting the contents to a new email page.

Finally, use common sense. If something doesn’t feel right about a program or an email, trust instinct and don’t open it. Most of the time gut reactions are accurate

Malware – Theft On-Line

“Malware” is short for malicious software – software designed to secretly access a person’s computer without permission. While malware is a general term for a range of intrusive software, it is more specifically used to describe software that goes beyond annoying. In most cases, the malware creator’s intent is hostile and is often illegal under many state legal codes. Their intent is to steal.

Organized crime increasingly uses malware that is constantly changing and becoming stealthier to work its way into a computer or network for the purpose of stealing personal or sensitive information which can be used to generate illegal income. A commonly used technique is to back-door into a computer to avoid authentication. Another technique is a key logger. Once in a computer, the program intercepts and transmits the user’s keystrokes for sensitive information such as passwords and account numbers to the criminals. A dialer program is used by malware e-crime gangs to work its way into a computer and dial expensive long distance or 900 area code phone numbers which are then charged back to the computer’s owner.

How can owners know if their computer is infected with malware? Here are a few red flags that should raise an owner’s suspicions. The suspect computer slows down, repeatedly malfunctions or displays error messages. The computer fails to shut down or restart. There are too many pop-up ads displayed or unknown web pages are displayed without warning.

If there is a concern that malware exists on a computer, it is important to immediately stop performing online actions using passwords or user names. The next step is to insure that security software is installed and updated. Once confirmed, the entire system needs to be scanned by the security software for problems. If the problem persists, the best course of action is to get professional help.

Understanding and Fighting Malware

The significant increase in malware e-crimes by criminals, has caused a sift in attention from detecting viruses and spyware to focusing more closely on combating malware activity. Part of this challenge is that e-crime gangs are constantly changing and making malware more difficult to detect. As experts have learned more about malware, progress is being made in defeating these programs.

Part of combating malware is understanding the mindset and objective of the people who employ it. At the least, a person who intentionally and secretly infects someone else’s computer with malicious software wants to intrude on the computer’s operation and possibly do damage. More often, the attacker’s intent is to steal information or money from the user.

Malware software is essentially the same as viruses and spyware, and in many cases the same approach – detecting and blocking – can be used to detect malware. Again, the approach to detection differs because of the attacker’s intent. Programs have been developed to specifically scan computers for malware. Other programs can detect and remove malicious software that is already resident on a computer by scanning the registry, operating system and programs. The scan generates a list of potential intruding software for the user to act on. A few programs are capable of intercepting attempts to install malware or modify browsers.

It is important to make another distinction between viruses, spyware and malware. While the legality of viruses and spyware is often a grey area, malware is clearly an illegal intrusion on an individual’s privacy when there is an attempt to steal personal information or money. The legal term is computer containment and it is a violation of law in several states. The Federal Trade Commission (FTC) has also become increasingly aggressive in pursuing e-crime because of the financial impact of malware on businesses and consumers in the United States.

The Growing Danger of Botnets

Botnets are a rapidly growing cyber crime industry. While there are not any firm estimates of the number of cyber gangs operating botnets, organizations that track botnet activity report that one network hosted 50,000 bots, also known as zombie computers.

How does a botnet operate? Basically, a botnet is a group of computers that have been infected by software that gives control of the computer to the botnet manger, or herder. Once controlled by the herder, these computers can be instructed to send email, exploit browsers and other scams to other computers. Typically, the owner of a computer under the control of a botnet is unaware of the situation other than the possibility of reduced computer speed and performance.

How pervasive are botnets? It is estimated that as many as 25 percent of home computers using the Internet may be part of a botnet. A 2009 quarterly report issued by McAfee stated that 12 million new IP addresses had been added to botnets since January 2009 and that the largest number of these addresses – 18 percent – was located in the United States.

The March 16, 2008 addition of USA Today research indicated that as many as 40 percent of the eight million computers on the Internet were botnets. A graph included in the article showed that between August 2006 and January 2008 the number of botnets had grown from 333,023 to 7,303,148.

Russian based Kasperksy Labs and Symantec have both stated that botnets pose a much larger Internet threat than viruses of any kind. The also noted that social networks are rapidly becoming a favorite target for botnets to compromise.

Can botnets be detected and defeated? The way in which botnets are dispersed in a region and the sheer volume of traffic make it extremely difficult to track a botnet to its originating source. Cyber gangs are agile and smart at moving networks to avoid detection.

Browsers and Search Engines

One of the best features on the Internet is the ability to conduct searches for information on any subject under the sun. However, the safety of the information retrieved and downloaded is no better than the browser being used.

NSS Labs conducted at series of tests and released its findings in a report on browser security in 2010. The result of the testing showed that Internet Explorer 8 (IE8) blocked up to three times more malware than Firefox, Safari or Chrome. During the most recent testing period, IE8 successfully blocked 85 percent of the malicious code attacks observed.

According to Microsoft, the Smart Screen filter gets the credit for IE8′s security performance in blocking web-based attacks. Microsoft noted that in their ongoing monitoring of IE 8 there were no less one in 250 that contained malware and that the browser, on average, receives three million malware attack attempts a day. The company also stated that it has evaluated 250 billion URLs.

Firefox also gets high marks from several authorities as a safe and fast browser with very little vulnerability. Safari was originally designed for Mac computers and also a Windows based version that is considered by many to be clean and exceptionally fast.

When it comes to research, there is also the question of search engine safety. In recent testing, McAfee rated AOL as having the safest search engine. This finding has also been made by other testing firms.

Regardless of the browser and search engine used the first action cannot be stressed enough – make sure there is updated and strong security software installed on the computer and that all components of the software are active before starting the search. Note that some security software packages screen search engine results for problems and alert the user to potentially unsafe websites.