The document provides an overview of computer viruses, defining them as self-replicating software that infects other programs and detailing their history, detection methods, and lifecycle. It discusses the evolution of detection techniques, including traditional virus scanners and more advanced methods like machine learning and the concept of a computer immune system. Additionally, it touches on related topics such as worms and Trojan horses, as well as newer threats like RFID viruses.

1. COMPUTER VIRUSES REMOVE

2. History of Computer Viruses
How Viruses Work
Virus DetectionRemovalAnalysis
Alternative Detection Method
Computer Immune System
Miscellaneous Other Topics
OVERVIEW
Computers & Viruses

3. COMPUTERS AND VIRUSES

4. “A computer is a machine that manipulates data according to a list of
instructions.”
“A computer is, at its most basic, a machine which can take instructions, and
perform computations based on those instructions.”
“Computers are not very intelligent devices, but they handle instructions
flawlessly and fast.”
“A computer is an electronic device that executes the instructions in a
program.”
COMPUTERS AND VIRUSES
What is a Computer?

5. “A virus is a sub-microscopic infectious agent that is unable to grow or
reproduce outside a host cell.”
“A virus is not strictly alive.. nor is it strictly dead... A virus has some
fundamental information which allows it to make copies of itself. However, the
virus must be inside a living cell of some kind before the information can be
used.”
“Viruses are not living cells, but efficient parasites that commandeer living cells
and turn them into virus factories.”
“an ultramicroscopic, metabolically inert, infectious agent that replicates only
within the cells of living hosts, mainly bacteria, plants, and animals: composed
of an RNA or DNA core, a protein coat, and, in more complex types, a
surrounding envelope.”
COMPUTERS AND VIRUSES
What is a Virus?

6. “Computer Viruses are self replicating software entities that attach themselves
parasitically to existing programs.”
“We define a computer 'virus' as a program that can 'infect' other programs by
modifying them to include a possibly evolved copy of itself.”
“A computer virus is a self-replicating computer program that spreads by
attaching itself to executable files or system areas on diskettes.”
“Computer viruses are small software programs that are designed to spread
from one computer to another and to interfere with computer operation.”
COMPUTERS AND VIRUSES
What is a Computer Virus?

7. HISTORY OF COMPUTER VIRUSES

8. Early 1980’s - University of Southern California
Leonard Adleman
•Computer Science & Molecular Biology
•Famous for work with Rivest and Shamir on RSA
•DNA Computing
•Coined the term “Computer Virus”
Fred Cohen
•PhD student under Adleman
•Created the first ‘real’ computer virus November 10, 1983
•Parasitic application that seized control of computer operation
HISTORY OF COMPUTER VIRUSES
The Beginnings

9. OSX
Linux
MS-DOS
Windows
?
30
4000
>200,000
HISTORY OF COMPUTER VIRUSES
Statistics

10. HOW VIRUSES WORK

11. 1.Attachment
2.Penetration
3.Uncoating
4.Replication
5.Assembly
6.Release
HOW VIRUSES WORK
Virus Life Cycle

12. HOW VIRUSES WORK
Computer Virus Life Cycle

13. HOW VIRUSES WORK
Infection of a Program

14. VIRUS DETECTIONREMOVALANALYSIS

15. The goal of anti-virus software is to detect all viral infections on a given computer
system and to restore each infected program to its original uninfected state. If
possible.
Activity Monitors
Alert user to system activity that is indicative of a virus.
Integrity Management Systems
Warn user of suspicious changes to files.
These methods can detect presence of unknown viruses, but they are not often able
to pinpoint the nature or even location of the infecting agent. Normal, legitimate
activity can also be flagged, causing a nuisance and disrupting normal work. This can
lead to the warnings being completely ignored.
VIRUS DETECTIONREMOVALANALYSIS
Virus Detection

16. Virus Scanners scour the file system, searching through files, boot records, memory,
and anywhere else executable code can be stored, searching for characteristic byte
patterns (Signatures) that are identifying portions of viruses.
Scanners provide much more specific detection than activity monitors and integrity
management systems, and are essential for establishing the identity and location of
a virus.
Disinfectors use the identity and location information to restore programs to their
original states.
Scanning and repairing can only be applied to known viruses and variants
Every Virus strain must be examined individually to extract signatures and
information on how to remove it.
VIRUS DETECTIONREMOVALANALYSIS
Virus Detection & Removal

17. Once a new virus is discovered, it is passed around a group of anti-virus experts.
A human expert disassembles the virus and then analyzes the code to determine
both behavior and the method it uses to attach itself to host programs.
The expert than extracts a signature that is guaranteed to be found in each instance
of the virus, but which is unlikely to be found in normal programs.
The new signature is added to the database so that this virus can be detected and
removed in the wild.
This is a very time consuming process, taking anywhere from hours to days to
complete, and it is possible that a bad signature can be chosen.
VIRUS DETECTIONREMOVALANALYSIS
Virus Analysis

18. ALTERNATIVE DETECTION METHOD

19. In the middle of Scanners and Activity Monitors/Integrity Management Systems, lies
the generic detector.
A Generic Detector takes a programs code as input and determines whether or not
the program is viral or non-viral.
Perfect Generic Detection is an NP-Complete problem, which is reducible to the
Halting Problem
Imperfect Generic Detection, however, is possible, and turns out to be a problem in
pattern classification.
ALTERNATIVE DETECTION METHOD
Generic Detection of Viruses

20. The basic concept of machine learning is applied to virus detection.
Very similar to concepts in Robot Vision for face/object detection.
Features are selected, and then classifiers are trained.
85% detection rate. Other 15% escape detection due to code obscuring techniques.
This method works well for boot sector viruses, but has a few drawbacks
1. New viruses can be detected only if they have a sufficient amount of
code in common with known viruses.
2. The method is appropriate for viral detection only, and is incapable of
aiding in removal of a virus from an infected boot sector or file.
ALTERNATIVE DETECTION METHOD
Imperfect Generic Detection

21. COMPUTER IMMUNE SYSTEM

22. The Generic Detection system is a good start, but is a static, non-adaptive system.
An adaptive system, such as out own immune system is much better.
The immune system responds to virus-like anomalies by capturing and analyzing
viral samples.
The samples are analyzed, and a means for detecting and removing the virus are
found.
COMPUTER IMMUNE SYSTEM
Motivation

23. Anomaly Detection
The ability to determine self from non-self, the existence of things which are
not a part of the system.
Scanning for Known Viruses
Parallel searching through all known virus signatures looking for a match.
Virus Removal
A known virus has been discovered and is now removed.
Decoys
An anomaly has been detected that does not match any known virus signature.
Decoys, or programs which are very attractive to viruses, are placed out to bait
the viruses.
COMPUTER IMMUNE SYSTEM
Biological Defense

24. Automatic Virus Analysis
Once several decoys have become infected with the virus, they can be
compared and the inner workings of the virus can be discovered.
Automatic Signature Extraction
A signature that will minimize false negatives and false positives is the goal of
this phase.
It should be likely to be found in all instances of the virus, but not in normal
programs.
Immunological Memory
Add analysis data and signature of new virus to known virus database for quick
lookup later.
COMPUTER IMMUNE SYSTEM
Biological Defense

25. COMPUTER IMMUNE SYSTEM
Immune System Overview

26. MISCELLANEOUS OTHER TOPICS

27. Worm
•A worm can spread itself to other computers without needing to be
transferred as part of a host
Trojan Horse
•A Trojan horse is a file that appears harmless until executed.
A program that does not replicate is not a virus, regardless of whether it is malicious
or not. Maliciousness in a program does not make it a virus.
MISCELLANEOUS OTHER TOPICS
Worms & Trojan Horses & Other Non-viruses

28. MISCELLANEOUS OTHER TOPICS
Can your cat get a Computer Virus?

29. RFID – Radio Frequency Identification
RFID Virus uses RFID to spreads primarily by means of SQL Injection.
Everything about regular viruses still apply to RFID Viruses.
The primary attack of RFID Viruses is focused on Databases.
MISCELLANEOUS OTHER TOPICS
RFID Viruses

30. Examples
•Supermarket uses RFID to scan merchandise.
•Veterinarian uses RFID embedded in pets to find information about animals.
•Airport baggage handling system uses RFID to route baggage.
MISCELLANEOUS OTHER TOPICS
RFID Viruses

31. Homework
1. What feature is a requirement for a program to be a virus?
2. If a program is self-replicating, but does nothing malicious, is it still a virus?

32. Homework
Visit for quick support
http://www.911computersupport.com