0
Computer Viruses
Computer viruses are harmful pieces of software which can reproduce themselves and automatically spread to other computers and networks. Questions about computer virus techniques and specific computer viruses belong here.
5,673 Questions
TrustyHound provides a search engine in the system tray and sends system information to a predetermined server.
When was the Trojan Horse computer Virus created and by who?
"Trojan Horse" does not refer to a specific computer virus, rather it refers to a particular characteristic of some computer malware. A Trojan Horse or Trojan is a bit of software that masquerades as legitimate software but contains hidden malware. It takes its name from the Greek tale from the Trojan War where the Greeks left a big wooden horse outside the gates of Troy with a bunch of Greek soldiers hidden inside. Just like the Greeks used their "Trojan Horse" to trick the Trojans into bringing them inside their defenses, Trojan malware tries to trick users into bringing the malware inside their computer defenses where it can then do its dirty work - such as (but not limited to) data theft, installing backdoors, turning the user's computer into a zombie in a botnet, trashing the computer. Since "Trojan Horse" only refers to a characteristic and not a specific virus, it is impossible to assign an actual date or perpetrator to it.
It should also be understood that a Trojan is not really a virus. A virus replicates itself without user intervention, whereas a Trojan relies on tricking a user into downloading it.
According to a survey conducted by BitDefender from January to June 2009, "Trojan-type malware is on the rise, accounting for 83-percent of the global malware detected in the world".
QuickBooks puede ser atacado en su información mediante mal uso de las librerias de la Interop QBFC??, y este malware no puede ser detectado por los antivrus. Se borrarán los nombres de las listas de vendors, customeres, etc.
What are some of the motivations behind malware and security breaches?
The motivation behind malware is varied. Some malware is intended to be a relatively harmless prank or mildly annoying vandalism. Other malware is created to distribute political messages or to disrupt operations at specific companies. In an increasing number of cases, the motivation is monetary gain.
How can you remove virus but your antivirus not detect?
You have to look for it, any files that look like they shouldn't belong you might want to delete. It can really be hidden anywhere, but the most common places are the Temp folder, System32, and the Windows folder. Check your Temp folder (Start> Run > %temp%), sometimes a virus can be sitting there in plain sight. Try not to delete the System32 folder though ;).
Is the zipped viruses are injuries for computer?
YES--man ....VIRUSES are always injuries for computer....it not depend on ZIP..or file...
What kind damage can spyware cause to you?
Spyware does what it sounds like -- "spies" on you. They can see the websites you visit, track the keyboard keys you type, or even see everything that's happening on your computer screen.
What tools are necessary to see and manipulate at the nanoscale?
SEM, TEM, and AFM are modern imaging techniques.
How does an Trojan horse virus spread?
will i did not scan my PC before i backed up my computer then after it finish backing up i scanned my PC. Norton internet security 2011 found Trojan virus so it deleted. Then next day i scanned my back up drive it found the same virus that infected my PC so that one way Trojan can spread.
Does personal computer insurance cover virus removal?
No, because i recently went to claim the insurance because of this and it did not cover virus removal. Hope this helped Claire mc kernan seskinore is a ledgend
What is virus adware spyware rootkit and other malware?
viruses
virus vital information resource under seige (VIRUS) ( its self replicating )
is small program written to alter the way a computer operates WITHOUT PERMISIION OR KNOWLEDGE OF THE USER
for a program to be considered a virus it must be able to execute and replicate itself without intervention of the user .
*
a virus is spread by inserting copies of itlself into other executable code or documentas with or without the knowledge
of the user by PIGGYBACKING with legimate application
*
the insertion of the virus into a program is known as INFECTION the infected file or executable code
-------------------------------------------------------------------------------------------------------------------------
REPLICATION - A VIRUS INFECT A HOST FILE WHICH IS A FILE THAT CONTAINS EXECUTABLE CODE
this stage is very difficult to detect . this file will attach to empty space inside an existing file .
*
ACTIVATION - the virus delivers its playload
*
PROGRAM INFECTORS - it infects .EXE OR .COM FILES
*
BOOOT SECTOR INFECTOR (BSI) - its passed at the time of disk accesss , its simple as DIR cmmnd
-------------------------------------------------------------------------------------------------------------------------
WORMS are self contained and do not need to be part of another program (host) to spread
it uses email or another transport mechanism (it dosent need user interaction for activation ) from one disk drive
to another .
some worms install BACKDOOR in an infected computer a backdoor is used to gain unauthorized access to a computer
EXAMPLE OF WORMS
MYDOOM -fastest spreading mass mailer
SOBIG WORM
--------------------------------------------------------------------------------------------------------------------------
TROGAN HORSE OR TROJAN FOR SHORT
IS A HARMFUL PROGRAM THAT IS DISGUIED as legitimate software ( like a rouge sequrity software)
it dosent look harmful intresting & useful they are quite damaging when they run
*
they r not self-replicating which distinguished them from viruses ond worms
*
additonally they require interaction with a hacker to fullfil their purpose the hacker need not be the individual
responsible for disturbing the Trojan horse
--------------------------------------------------------------------------------------------------------------------------
SPYWARE
its a generic term for a class off software designed to either gather information for marketing purpose or to deliver
advertisement to webpages
altough software of this type is legimate it can be installed on ur computer without the user's knowledge
---------------------------------------------------------------------------------------------------
adware
the term adware refers to any software which displays advertisement whether the user agreed to the advertisement or not
adware is a computer program where advertisement are automatically loaded by the software and displayed after instalation
adware is usually responsible for pop-ups that occur on an computer for no reason even when the computer is dissconnected from the internet
adware is often refferd to simply as spyware the main difference between spyware and adware is that adware programs do not
invisibilly collect and upload activity records or personal information to third parties
*************************************************************
ROOTKIT
a rootkit is a collection of tools (programs) that enable administrator-level access to a computer or computer network
typically a cracker installs a rootkit on a computer after first obtaining user level access either by exploiting a known
vulnerability or cracking a password
once the rootkit is installed . it allows the attacker to mask intrustion and gain root or privleded access to the computer and posibbily other machiens
***************************************************************
phishing
it is an act of sending an email to a user falsely claiming to be established legitamate enterprise in attempt to scam
user into surrendering private information that will be used for identity theft
the email directs the user to visit a web site where they r asked to update personal information such as passwords and
credit card social security and bank account numbers that the legimate organization already has
**************************************************************************************************************************
key logger
a computer program that captures keystrokes of a computer user and stores them keyloggers spreads via email
*************************************************************************************************************************
pharming is a hackers attack aiming to riderct website traffic to another bogus website
it can be conducted either by changing the host file on a victims computer or by exploitation of a vulnerables dns server software
it has become a major concern to buisness hosting e- commerce & online banking websites
evry host on the internet has an ip address these 32-bit
address are usually re-presented as a dotted codes 4 number seprated by dot for eg.192.152.2.245
*************************************************************************************************************************
IP ADDRESS SPOOFING
in computer networking . IP ADDRESS SPOOFING OR IP SPOOFING reffers to the creation of internet protocol (IP)
packets with a forged source ip address called spoofing with the purpose of concealing the identity of the sender
or impersonating another computing system
*************************************************************************************************************************
question
MANUAL THREAT REMOVAL
FILE REMOVAL
ENABLE FIREWALL
PROGRAM REMOVAL
****************************************************************
BOTS
bot is derived from the word "robot" and is an automated process that interacts with other network services bots often automate tasks
and provide information or services that would otherwise be coundected by a human being
bots can be used for either good or malicious intent a malicious bot is self-propagating malware desinged to infect a hosts
and connect back to a centeral server or servers that attack
************************************************************************************************************************************************
SYMPTONS OF INFECTION
you recived an email message that has a strange attachment . when you open the attachment dailog boxes appear or a sudden degradation in system
performance occurs
an antivirus programs is disabled for no reason an it cannot be restarted
an antivirus program cannot be installed on the computer or it will not run
strange dailog boxes or messages boxes appear on the computer or it will not run
strange dialog boxes or message boxes appear onscreen
someone tells you that they have recently recived e-mail message from you containing attached files ( especially with .exe .bat .scr and .vbs extentions ) that you did not send
windows will not start because certain critical system files are missing and then you receive an error message that list those files
the computer runs very slowly and it takes a long time . to start
windows spontaneously restarts unexpectedly
a partition completely dissapears
a disk utility such as scandisk reports multiple serious disk errors
THE INFECTED FILE REPLICATES and multiples itself and fills up the space on the hard disk
a virus can attacthes itself to an email and sends itself to the contact lists in an email account
the virus may reformat your disk drive and delete your files and programs
the virus may install hidden programs such as pirated software this pirated software may then be disturbed and sold from your computer
the virus may reduce security this could allow intruders to remotely access your computer or network
****************************************************************
*********************************************************************************************************************************************************************
threat identification -
a list of some of the more frequently used AUTO START ENTRY POINTS (ASEP) IN WINDOWS INCLUDING STARTUP FOLDER REGISTRY KEYS AN INIFILES ARE
WIN,INI
SYSTEM.INI
STARTUPFOLDER
REGISTRY
INTERNET EXPLORER
***************************************************************************************************************************************************
System registry run keys
Certain registry keys may contain values used to load appliocations when windows is started like run and run once
Start up folder
The windows start up folder can include shortcuts, documents, executables or other types of files and programs to be launced when Windows is started. The current logged on user can view start up filder inclusions through the start menu:
Start/Programs/startup
The common startup folder, applicable to all users, correlates to:
/Start Menu/Programs/Startup
ASEP specific to ME, 2000, XP
Also check the following keys for unexpected values:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
ASEP Laoding Sequence
The order in which Windows processes the autostart entry points is as follows:
1. RunServices/RunServicesOnce-
HKEY_LoOCAL_MACHINE and
HKEY_CURRENT_USER
RunServices/RunServicesOnce will be launced concurrently. In the event of a conflict, precedent is given to HKEY_LoOCAL_MACHINE. These ASEPs may continue loading during and after the login dialog.
2. Login Dialog (Winlogon)
3. RunOnce/Run for HKEY_CURRENT_USER hive
4. Run key in HKEY_CURRENT_USER hive
5. Startup Folder
6. RunOnce in HKEY_CURRENT_USER hive
----------------------------------------------------------------------------------------------------------------------
COMMON LOCATIONS AND AUTO START ENTRY POINTS(ASEP) OF VIRUS
System Registry Run Keys
• System Registry Run Keys - Certain registry keys may contain values used to load applications (including malware) when Windows is started. The values to examine are located in subkeys Run, RunOnce, RunServices, and RunServicesOnce, located in either of the following registry keys:
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Startup Folder
• The Windows Startup folder can include shortcuts, documents, executables, or other types of files and programs to be launched when Windows is started. The current logged on user can view startup folder inclusions through the Start menu:
• Start | Programs | Startup
• The common startup folder, applicable to all users, correlates to:
• \Start Menu\Programs\Startup
Winlogon
• Winlogon is responsible for supporting the DLL responsible for managing the interactive logon when Windows starts. Pre-Vista, that DLL provides a customizable user interface and authentication process.
• Malware that hooks into Winlogon can be particularly difficult to remove, as even booting into Safe Mode will not deactivate it. The string values that customize the Winlogon process are located in the following registry key:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ASEP Loading Sequence
The order in which Windows processes the autostart entry points is as follows:
• RunServices / RunServicesOnce - HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER RunServices/RunServicesOnce will be launched concurrently. In the event of a conflict, precedent is given to HKEY_LOCAL_MACHINE. These ASEPS may continue loading during and after the login dialog.
• Login Dialog (Winlogon)
• RunOnce / Run for HKEY_LOCAL_MACHINE hive
• Run key in HKEY_CURRENT_USER hive
• Startup Folder
• RunOnce in HKEY_CURRENT_USER hive
Some Advanced Loading points which are identified recently with rootkit enabled malwares
• C:\Documents and Settings\
• C:\Documents and Settings\
• C:\Documents and Settings\
• C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5
• C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
• C:\Windows\Temp
• C:\WINDOWS\system32\config\ systemprofile
Startup and Winlogon
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
• HKEY_CLASSES_ROOT\comfile\shell\open\command
• HKEY_CLASSES_ROOT\piffile\shell\open\command
• HKEY_CLASSES_ROOT\exefile\shell\open\command
• HKEY_CLASSES_ROOT\txtfile\shell\open\command
Services
• HKLM\SYSTEM\CurrentControlSet\Services\
• Active Setup Stub Keys (These are disabled if there is a twin in HKCU)
• HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
• ICQ Agent Autostart
• HKCU\Software\Mirabilis\ICQ\Agent\Apps
• If you suspect that a system is infected, then examine each of these keys. Determine whether Value Name or Value Data, including the (Default) value, refers to a suspicious file.
Internet Explorer (To check for IE threats)
• HKLM\Software\Microsoft\Internet Explorer\Main, Start Page
• HKCU\Software\Microsoft\Internet Explorer\Main: Start Page
• HKLM\Software\Microsoft\Internet Explorer\Main: Default_Page_URL
• HKCU\Software\Microsoft\Internet Explorer\Main: Default_Page_URL
• HKLM\Software\Microsoft\Internet Explorer\Main: Search Page
• HKCU\Software\Microsoft\Internet Explorer\Main: Search Page
• HKCU\Software\Microsoft\Internet Explorer\SearchURL: (Default)
• HKCU\Software\Microsoft\Internet Explorer\Main: Window Title
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: ProxyOverride
• HKCU\Software\Microsoft\Internet Connection Wizard: ShellNext
• HKCU\Software\Microsoft\Internet Explorer\Main: Search Bar
• HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks
• HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch =
• HKCU\Software\Microsoft\Internet Explorer\Search, CustomizeSearch
Identify Rootkit Infections
1. MSconfig -> Boot.ini tab -> Check /BOOTLOG
2. Restart the computer.
3. Go to c:\windows and open the file c:\windows\ntbtlog.txt
Check for any suspicious entries.
Program Removal
• Click on start->control panel->add/remove programs icon.
• Discuss with customer about any new program which is installed. If customer does not know about a particular program, follow the steps below -
o Click on start->My computer->Local drive C:-> Program files.
o Right click on the particular program folder-click on properties and check date created. Repeat the same to all new programs and close the program window.
Physical Location
• c:\program files
• c:\program files\common files
• C:\documents & Settings\User\Application Data
Registry
• H_Key_Local_Machine\Software
• H_Key_Current_User\Software
• H_Key_Local_Machine\Software\Microsoft\Windows\Current Version\Uninstall
File Removal GUI Mode
• Delete - Right click -> Delete or Higlight the file and hit the Delete button on the keyboard
• Rename - Right click -> Rename or Highlight the file -> Press F2 -> Type a new name -> Hit enter
• Move - Right click->Cut->Right click and paste it on the desire location
• Removing Permissions - Right click on file ->Go to properties ->Click on Security Tab ->Click Advanced -> Uncheck the box "Inherit from parent control…." -> Click Remove ->Click OK
What happens when you kick a part of the computer?
Depends what you kicked :o.
if your fan is broke, do NOT power it on. it will over heat and break.
A malicious add-on is a software extension or plugin that is designed to harm a user's system, compromise security, or exploit personal data. Often disguised as legitimate applications, these add-ons can track user activity, inject advertisements, or even install additional malware. They typically operate within web browsers or software platforms, manipulating functionality for malicious purposes. Users should exercise caution when installing add-ons and ensure they come from reputable sources.
