Computer Viruses and Worms

Introduction to Computer Viruses

• Definition: Like a virus in the human body, a computer virus can replicate itself from one computer to another.
• Activation: Requires human intervention such as clicking a link or executing a file.
• Movement: Can spread through the file system or other networked systems.
• Impact: Often associated with downtime or outages, but some can remain undetected in the background.

Antivirus Software

• Purpose: Protects against viruses by identifying malicious software.
• Operation: Continuously scans executables to detect known threats.
• Update Importance: Signature files need to be up-to-date for effective virus detection.

Types of Viruses

• Executable Viruses: Activated by running an application or link.
• Boot Sector Viruses: Run automatically when the system boots.
• Script Viruses: Exploit scripts in browsers or applications like Microsoft Office.
• Fileless Viruses:
  • Operate primarily in system memory.
  • Do not write code to storage, making detection difficult.
  • Often start when a user visits a malicious link.
  • Exploit vulnerabilities in applications like Flash or Windows.
  • Can run applications like PowerShell to execute additional scripts.
  • May add auto-start entries to the Windows Registry for persistence.

Worms

• Definition: Malicious software that can replicate without user intervention.
• Propagation: Moves quickly across networked systems without user action.
• Defense:
  • Network-based and personal firewalls.
  • Intrusion prevention systems.
  • Require awareness of the worm and predefined signatures.

Example: WannaCry Worm

• Propagation: Self-replicates across networks and installs ransomware.
• Mechanism:
  • Uses vulnerabilities to install a backdoor.
  • Downloads and executes ransomware.
  • Encrypts user files and makes them inaccessible.
• Impact: Infects all vulnerable systems within a network rapidly.

Conclusion

Understanding how viruses and worms operate is crucial for protecting computer systems. Regular updates and effective use of antivirus and network defenses are key strategies to mitigate these threats.