1. The document discusses types of computer viruses, how they infect systems, and methods for detecting and preventing viral infections. It covers system/boot sector viruses, file viruses, macro viruses, polymorphic viruses, and others. 2. Detection methods discussed include scanning for virus signatures, integrity checking, interception, code emulation, and heuristic analysis. The document also lists countermeasures like installing antivirus software and regularly updating and running scans. 3. Real world examples of viruses are mentioned, like the "I LOVE YOU" virus from 2000 which spread through email attachments and caused major disruptions.

1. Student: Dilsher Idrees Mustafa Course: Introduction to Cybersecurity
Topic: Project _Virus_ Security Date: November 25, 2019
Contents
1.1 Introduction to Virus. 1
1.2 Types of Viruses 2
1.3 Virus Detection Methods 4
1.4 Virus and Worm Countermeasures 4
1.5 Penetration Testing for Virus 5
1.6 What has happened in real life? 5
Conclusions 5
1.1 Introduction to Virus.
Stands for VIRUS is (Vital Information Resource Under Siege). A virus is a self-replicating program that produces its
own copy by attaching itself to another program, computer boot sector or document. Viruses are generally transmitted
through file downloads, infected disk/flash drives and as Email attachments. Viruses Characteristics are (Infects other
program, alters data, transforms itself, encrypts itself, Corrupts files and Programs and Self-replication).
Stages of Virus Life:
1. Design: Developing virus code using programming languages or construction kits.
2. Replication: it replicates for a period within the target system and then spread itself.
3. Launch: it gets activated with the user performing certain actions such as running an infected program.
4. Elimination: Users install antivirus updates and eliminate the virus threats.
5. Incorporation: Antivirus software developers assimilate defenses against the virus.
6. Detection: A virus is identified as threat infecting target system.
Working of Viruses:
1. Infection Phase: the virus replicates itself and attaches to an .EXE file in the system.
2. Attack Phase: Viruses are programmed with trigger events to activate and corrupt systems. Some viruses
infect each time they are run, and others infect only when a certain predefined condition is met such as a
user’s specific task, a day, time, or a particular event.

2. Student: Dilsher Idrees Mustafa Course: Introduction to Cybersecurity
Topic: Project _Virus_ Security Date: November 25, 2019
Why Do People Create Computer Viruses?
• Inflict damage to competitors
• Vandalism
• Play prank
• Research projects
• Financial benefits
• Cyber terrorism
• Distribute political messages
Indications of Virus Attack:
❖ Abnormal Activities: if the system acts in an unprecedented manner, you can suspect a virus attack.
❖ False Positives: However, not all glitches can be attributed to virus attacks.
How does a Computer Get Infected by Viruses?
When a user accepts files and downloads without checking property for the source. Opening infected Email
attachments. Installing pirated software. Not updating and not installing new version of plug-ins. Not running the
latest Antivirus application.
1.2Types of Viruses
Virus has many types, but we can classify into two parts like (How do they infect? What do they infect?)
1) What do they infect?
❖ System or Boot Sector Viruses:
Boot sector virus moves MBR to another location on the hard disk and copies itself to the original location of MBR.
When system boots, virus code is executed first, and the control is passed to original MBR.

3. Student: Dilsher Idrees Mustafa Course: Introduction to Cybersecurity
Topic: Project _Virus_ Security Date: November 25, 2019
❖ File and Multipartite Viruses:
▪ File Viruses: infect files which are executed or interpreted in the system such as (COM, EXE, SYS, OVL, OBJ, PRG,
MNU and BAT) files. It can be either direct action or memory resident.
▪ Multipartite Virus: infect the system boot sector and the executable files at the same time
❖ Macro Viruses: infected files created by Microsoft Word or Excel. Most macro viruses are written using macro
language Visual Basic for Applications (VBA). Also, it infects templates or convert infected documents into
template files, while maintaining their appearance of ordinary document files.
❖ Cluster Viruses: modify directory table entries so that it points users or system processes to the virus code
instead of the actual program. There is only one copy of the virus on the disk infection all the programs in the
computer system. It will launch itself first when any program on the computer system is started and then the
control is passed to actual program.
2) How do they infect?
❖ Encryption Viruses: uses simple encryption to encipher the
code. The virus is encrypted with a different for each
infected file. AV scanner can’t directly detect these types of
viruses using signature detection methods.
❖ Polymorphic code: is a code that mutates while keeping the original algorithm intact. To enable polymorphic
code, the virus has to have a polymorphic engine. A well-written polymorphic virus therefore has no parts that
stay the same on each infection.
❖ File Overwriting or Cavity Viruses: Cavity virus overwrites a part of the host file that is a constant “Usually
NULL” without increasing the length of the file and preserving its functionality.

4. Student: Dilsher Idrees Mustafa Course: Introduction to Cybersecurity
Topic: Project _Virus_ Security Date: November 25, 2019
❖ Companion/Camouflage Viruses: creates a companion file for each executable file the virus infects. Therefore,
a companion virus may save itself as notepad.com and every time a user executes notepad.exe. then the
computer will load notepad.com virus and infect the system.
❖ Shell Viruses: Virus code forms a shell around the target host program’s code, making itself the original
program and host code as its sub-routine. Almost all boot program viruses are shell viruses.
❖ File Extension Viruses: change the extensions of the files. “.TXT” is safe as
it indicates a pure text file. With extensions turned off, if someone sends
you a file named “BAD.TXT.VBS”, you will only see BAD.TXT. if you have
forgotten that extensions are turned off, you may think this is a text file
and open it. This is an executable visual basic script virus file and could do
serious damage. Countermeasure is to turn off “Hide file extensions” in
Windows.
1.3Virus Detection Methods
Virus Detection Methods
Scanning Once a virus has been detected, it is possible to write scanning programs that look for
signature string characteristics of the virus.
Integrity
Checking
Integrity checking products work by reading the entire disk and recording integrity data that
acts as a signature for the files and systems sectors.
Interception The interceptor monitors the OS requests that are written to the disk.
Code
Emulation
The AV executes the malicious code inside a virtual machine to simulate CPU and memory
activities. This technique is considered very effective polymorphic viruses if the virtual
machine mimics the real machine.
Heuristic
Analysis
It can be static or dynamic. In static the AV analyses the file format and code structure to
determine if the code is viral. In dynamic the AV performs a code emulation of the suspicious
code to determine if the code is viral.
1.4 Virus and Worm Countermeasures
1. Install AV software that detects and remove infections as they appear.
2. Generate an AV policy for safe computing and distribute it to the stuff.
3. Pay attention to the instructions while Downloading files or any program from the internet.
4. Update the AV regularly.
5. Avoid opening the attachments received from an unknown sender as viruses spread via Email attachments.
6. Possibility of virus infection may corrupt data, thus regularly maintain data backup.
7. Schedule regular scans for all drives after the installation of AV.
8. Don’t accept disks or programs without checking them first using a current version of an AV program.

5. Student: Dilsher Idrees Mustafa Course: Introduction to Cybersecurity
Topic: Project _Virus_ Security Date: November 25, 2019
Anti-Virus Tools
AVG Antivirus F-Secure Antivirus Bitdefender
Kaspersky Antivirus ESET Smart Security 7 Avast Pro Antivirus 2014
Norton Antivirus McAfee Antivirus Plus 2014 Total Defense Internet Security Suite
1.5Penetration Testing for Virus
1. Test for suspicious system behavior: first, install AV program, then update the Av software, next enable real
time scanning and finally, scan the system for viruses, which helps to repair damage or delete files infected
with viruses.
1.6What has happened in real life?
Prezi Presentation link: https://prezi.com/view/0o0fN6jS4JJhx4ZReIHF/
Conclusions
In conclusion, during in this report I explained some important about general Viruses in any system because we have
another type of viruses in medicine field. First, I introduced what is virus in general system? what are stages of any
virus? and how is it working. Then classified types of system viruses into two main parts which are (How do they
infect? What do they infect?) and explained some type of viruses in each part. Next discussed methods how virus will
be detected and Virus countermeasures and some AV tools. After that I talked about penetration testing for viruses.
Finally, what happened in the real life and I mentioned the virus with name “I LOVE YOU” in 2000.