Downloaded 44 times
Uploaded bySuman Bose
Virusppt
The document discusses computer viruses, including how they spread by attaching to programs and replicating, their impact on systems by slowing performance and corrupting data, and different types like time bombs and worms. It also covers virus symptoms, how antivirus software works to detect and remove viruses through scanning and updates, and protections for office and outlook. While virus programming can be used unethically, the knowledge is still useful if applied correctly.
More Related Content
Virusppt
- 1. Presented by Soumya Suchi(14300211047) SrirupaDas(14300211048) Subhajit Karakar(14300211049) Subhendu Paul(14300211050) Sumadhura Biswas(14300211051) Suman Bose(14300211052) Sumit Kr Singh(14300211053) COMPUTER VIRUS PROGRAMS IT Dept. GNIT
- 2. Table of contents •What is virus • How they spread • Impact of virus • Types of virus • Virus languages • Symptoms of virus attack • Antivirus and their working • Office protection • Outlook protection • Antivirus warning • Conclusion IT Dept. GNIT
- 3. What is avirus? • A computer program that is designed to replicate itself by copying itself into the other programs stored in a computer. It may be have a negative effect, such as causing a program to operate incorrectly or corrupting a computer's memory. • We can only catch a virus by running a program IT Dept. GNIT
- 4. How They Spread?? •Early viruses were pieces of code attached to a common program like popular games. • A person might download the infected game from internet or copy it and run it. • A virus is a small piece of code embedded in a large and runs when the large program is executed. IT Dept. GNIT
- 5. Continue... • The virusloads itself into memory • It searches for other programs in the disk. • If it finds other program , it modifies it to add the virus code to the program. • In this way it replicates it self , and it is run when the program is executed. • Next time they infect other programs and the cycle continues. IT Dept. GNIT
- 6. Impact of virus •One important tricks is the ability to load viruses into memory so that it can keep running in the background as long as the computers remain on. • This gives viruses a easier way to replicate themselves. • Another trick is the ability to infect the boot sector on hard disks. IT Dept. GNIT
- 7. • By puttingits code in the boot sector the virus can guarantee that it gets executed. • It can load itself into the memory immediately, and it is able to run whether the computer is on. • It can infect the boot sector of any floppy disk inserted in the machine. Continue.... IT Dept. GNIT
- 8. Types of ComputerVirus Time Bomb Logical Bomb Worm Boot Sector Virus Macros Virus Script Virus Trojan Horse IT Dept. GNIT
- 9. Continue…. • Time Bomb: A time bomb is a virus program that performs an activity on a particular date. • Logical Bomb : A logical bomb is a destructive program that performs an activity when a certain action has occurred. • Worm Virus : A worm is also a destructive program that fills a computer system with self- replicating information, clogging the system so that its operations are slowed down or stopped. IT Dept. GNIT
- 10. Continue…. • Boot SectorVirus : A boot sector virus infects boot sector of computers. During system boot, boot sector virus is loaded into main memory and destroys data stored in hard disk. • Macro Virus : A macro virus is associated with application software like word and excel. When opening the infected document, macro virus is loaded into main memory and destroys the data stored in hard disk. IT Dept. GNIT
- 11. Continue…. • Script Virus: Commonly found script viruses are written using the Visual Basic Scripting edition (VBS) and the JavaScript programming languages. • Trojan Horse : Trojan Horse is a destructive program. It usually pretends as computer games or application software. If executed, computer system will be damaged. IT Dept. GNIT
- 12. Virus languages 1.ANSI COBOL 2.C/C++ 3. PASCAL 4. VBA (VISUAL BASIC FOR APPLICATIONS) 5. UNIX SHELL SCRIPT 6. JAVA SCRIPT IT Dept. GNIT
- 13. Symptoms of VirusAttack 1. Computer runs slower than usual. 2. Computer no longer Boots up. 3. Screen sometimes flicker. 4. PC speaker beeps periodically. 5. System crashes for no reason. 6. Files/directories sometimes disappear. 7. Denial of services (DoS). IT Dept. GNIT
- 14. Basic virus defense •Don’t open files that you are not expecting – Many viruses automatically send files without the e-mail account owner’s knowledge. – Ask the sender to confirm unexpected files. • Suspect messages that appear more than once in your Inbox – You may receive the same e-mail from a virus repeatedly. IT Dept. GNIT
- 15. Antivirus • Antivirus (oranti-virus) software is used to prevent, detect and remove malware, including computer viruses, worms and Trojan horses. • A software utility that searches a hard disk for viruses and removes any that are found. • These programs scan the code of every file on your computer for traces of viruses and spyware, and if found, the file is quarantined until the code can be removed or the file deleted. IT Dept. GNIT
- 16. Continue... Updates : Antivirusprograms can update themselves, keeping your computer's protection up to date without you having to manually update it. Further Protection : If an antivirus software finds an infected file that cannot be deleted, it can quarantine the file so that it cannot infect other files or programs on your computer. IT Dept. GNIT
- 17. Functions Of Anti-viruses. Protection: Antivirussoftware can provide real-time protection, meaning it can prevent unwanted processes from accessing your computer while you surf the Internet. Cleanup: Antivirus software allows you to scan your computer for viruses and other unwanted programs, and provides you with the tools to get rid of them. Alerts: Antivirus programs can alert you when something is trying to access your computer, or when something in your computer is trying to access something on the Internet. IT Dept. GNIT
- 18. How antivirus works? •Specific scanning • Generic scanning • Heuristic analysis • Sandbox method IT Dept. GNIT
- 19. • A typeof computer virus that is encoded as a macro embedded in a document. • Office allow macro programs to be embedded in documents(which can be virus), so that the programs may be run automatically when the document is opened. • When triggered, it will begin to embed itself in other documents and templates, as well as future ones created • Office will prompt you to enable macros Enable macros only when you know why office is asking. IT Dept. GNIT Office Protection
- 20. Outlook Protection • Auser open a virus-infected attachment received via an Outlook e-mail message. • Certain vulnerabilities in HTML mail can force a malicious file attachment to run even if the user only views it in the preview pane or opens the message • Viruses can propagate themselves by reading the Outlook address books and sending new virus- infected messages to everyone found there IT Dept. GNIT
- 21.
- 22. Problems with AV •Unexpected renewal costs • Rogue security applications • Problems caused by false detection • Running multiple antivirus create conflicts • Some times disable updates such as Windows Service Packs or updating graphics card drivers • Conflict with a disk encryption program
- 23. Scope of antivirus •Protection from Viruses • Protection from Spyware and Identity Theft • Protection from Spam • Antivirus software detects about 25% of the most popular malware currently • CARO (Computer Antivirus Research Organization) is an organization that was established in 1990 to research and study malware
- 24. Other methods • CloudScanning • Network firewall • Specialist tools • Trend Micro's Root kit Buster • Avira's AntiVir Removal Tool • Bootable rescue disks like Avira AntiVir Rescue System, PCTools Alternate Operating System Scanner and AVG Rescue CD • Malwarebytes anti-malware
- 25. Conclusion • Although virusprogramming is a technique of making a error free system program which causes hazards to users, but it is useful to learn if the learner mind set will only be focused on use this knowledge ethically. IT Dept. GNIT
- 26.
Editor's Notes
- #10 Logic bomb : Like other viruses, logic bombs are designed to cause harm to your computer. Logic bombs, however, only trigger when specific conditions are met. For example a computer programmer may insert code into a payroll program that deletes files if her name is not found on the list. This means that files will be deleted if she is ever fired. A company named Omega Engineering lost millions of dollars as a result of a logic bomb left by a former employee.Time bomb :Other viruses, called time bombs, may only detonate on a specific date or time. An example of this is the Jerusalem virus which, every Friday the 13th, deletes all the files on an infected computer.Worm : A computer worm is a standalone malwarecomputer program that replicates itself in order to spread to other computers.[1] Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program.[2] Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.Many worms that have been created are designed only to spread, and do not attempt to change the systems they pass through. However, as the Morris worm and Mydoom showed, even these "payload free" worms can cause major disruption by increasing network traffic and other unintended effects. A "payload" is code in the worm designed to do more than spread the worm—it might delete files on a host system (e.g., the ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via e-mail. A very common payload for worms is to install a backdoor in the infected computer to allow the creation of a "zombie" computer under control of the worm author. Networks of such machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or to cloak their website's address.[3] Spammers are therefore thought to be a source of funding for the creation of such worms,[4][5] and the worm writers have been caught selling lists of IP addresses of infected machines.[6] Others try to blackmail companies with threatened DoS attacks.[7]
- #11 Macro virusesMany common applications, such as Microsoft Outlook and Microsoft Word, allow macro programs to be embedded in documents or emails, so that the programs may be run automatically when the document is opened. A macro virus (or "document virus") is a virus that is written in a macro language, and embedded into these documents so that when users open the file, the virus code is executed, and can infect the user's computer. This is one of the reasons that it is dangerous to open unexpected attachments in e-mails.[31][32].Boot sector virusesBoot sector viruses specifically target the boot sector/Master Boot Record (MBR) of the host's hard drive or removable storage media (flash drives, floppy disks, etc.
- #12 Script virus : A script virus is one that is written in scripting language. This type of virus generally originate within admired websites that are being used for social networking purposes, to get user reviews, wikis, web-mail, chat room and message board.Trojan Horse :A Trojan horse, or Trojan, in computing is a non-self-replicating type of malwareprogram containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the story of the wooden horse used to trick defenders of Troy into taking concealed warriors into their city in ancient Anatolia, because computer Trojans often employ a form of social engineering, presenting themselves as routine, useful, or interesting in order to persuade victims to install them on their computers.[1][2][3][4][5]A Trojan often acts as a backdoor, contacting a controller which can then have unauthorized access to the affected computer.[6] The Trojan and backdoors are not themselves easily detectable, but if they carry out significant computing or communications activity may cause the computer to run noticeably slowly. Malicious programs are classified as Trojans if they do not attempt to inject themselves into other files (computer virus) or otherwise propagate themselves (worm).[7] A computer may host a Trojan via a malicious program a user is duped into executing (often an e-mail attachment disguised to be unsuspicious, e.g., a routine form to be filled in) or by drive-by download.
- #13 Basically any language that works on the system is the target of VIRUS.
- #14 (1) Due to WORM virus our computer runs slow. (2) During system Boot, BOOT SECTOR VIRUS is loaded into main memory & destroys data stored in HARD DISK.
- #19 Specific Scanningspecific scanning or signature detectionthe application scans files to look for known viruses matching definitions in a “virus dictionary”when the antivirus looks at a file it refers to a dictionary of known viruses and matches a piece of code (specific patterns of bytes) from the new file to the dictionary. after recognizing the malicious software the antivirus software can take one of the following actions: (1): attempt to repair the file by removing the virus itself from the file(2): quarantine the file(3): or delete the file completelyhowever, specific scanning is not always reliable because virus authors are creating new ways of disguising their viruses so the antivirus software does not match the virus’ signature to the virus dictionaryGeneric Scanninggeneric scanning is also referred to as the suspicious behavior approach.generic Scanning is used when new viruses appear. in this method the software does not look for a specific signature but instead monitors the behavior of all applications.if anything questionable is found by the software the application is quarantined and a warning is broadcasted to the user about what the program may be trying to do. if the software is found to be a virus the user can send it to a virus vendor.there, researchers examine it, determine its signature, name and catalogue it and release antivirus software to stop its spread. if the virus never reappears the vendors categorize the virus as dormant.heuristic analysisin the heuristic method the software, for example, “could try to emulate the beginning of the code of each new executable that the system invokes before transferring control to that executable.” if the program attempts to use “self-modifying code” or appears to be a virus, it’s assumed that the virus has infected the executable.in this method there are a lot of false positives.sandbox methodwhen an antivirus program will take suspicious code and run it in a “virtual machine” to see the purpose of the code and exactly how the code works. after the program has terminated, the software analyzes the sandbox for any changes, which could indicate a virus.
- #20 Macros can be used toautomate repetitive tasksdocument what you didshare common proceduresadd tools to the toolbaradd keyboard shortcuts macro: a big block of code can be expanded from a small sequence of charactersA macro (short for "macroinstruction", from Greek μακρο- 'long') in computer science is a rule or pattern that specifies how a certain input sequence (often a sequence of characters) should be mapped to a replacement output sequence (also often a sequence of characters) according to a defined procedure. The mapping process that instantiates (transforms) a macro use into a specific sequence is known as macro expansionA type of computer virus that is encoded as a macro embedded in a document. Many applications, such as Microsoft Word and Excel, support powerful macro languages. These applications allow you to embed a macro in a document, and have the macro execute each time the document is opened.According to some estimates, 75% of all viruses today are macro viruses. Once a macro virus gets onto your machine, it can embed itself in all future documents you create with the application.A macro virus can be spread through e-mail attachments, discs, networks, modems, and the Internet and is notoriously difficult to detect.[1] Uninfected documents contain normal macros. Most malicious macros start automatically when a document is opened or closed. A common way for a macro virus to infect a computer is by replacing normal macros with the virus. The macro virus replaces the regular commands with the same name and runs when the command is selected. In the cases where the macro is run automatically, the macro is opened without the user knowing.Once the application opens a file that contains a macro virus, the virus can infect the system. When triggered, it will begin to embed itself in other documents and templates, as well as future ones created. It may corrupt other parts of the system as well, depending on what resources a macro in this application can get access to. As the infected documents are shared with other users and systems, the virus will spread. The macro virus has also been known to be used as a way of installing software on a system without the users consent(permission)The macro virus can be avoided by exercising caution when opening email attachments and other documents. Not all macro viruses can be detected by antivirus software.A well-known example of a macro virus is the Melissa Virus from 1999. Anyone who opened a document with the virus in Microsoft Office would 'catch' the virus. The virus would then send itself by email to the first 50 people in the person’s address book. This made the virus replicate at a fast rate.
- #21 A user open a virus-infected attachment received via an Outlook e-mail message. Because this is the most common way viruses spread, many system administratorsblock certain attachments at the server or use the Outlook Email Security Update to block such attachments at the client.In the past, viruses took advantage of Outlook’s programming capability and weak security and used these methods to propagate:Messages exploiting certain vulnerabilities in HTML mail can force a malicious file attachment to run even if the user only views it in the preview pane or opens the message. Getting the latest patches for Internet Explorer provides protection.Because of Outlook’s easy-to-use programming model, viruses can propagate themselves by reading the Outlook address books and sending new virus-infected messages to everyone found there. However, virus developers seem to be aware of the new security provisions in Outlook, because the latest viruses have included their own SMTP engine to send messages, thus avoiding Outlook’s security prompts.
- #23 Unexpected renewal costs[edit]Some commercial antivirus software end-user license agreements include a clause that the subscription will be automatically renewed, and the purchaser's credit card automatically billed, at the renewal time without explicit approval. For example, McAfee requires users to unsubscribe at least 60 days before the expiration of the present subscription[28] while BitDefender sends notifications to unsubscribe 30 days before the renewal.[29]Norton AntiVirus also renews subscriptions automatically by default.[30]Rogue security applications[edit]Main article: Rogue security softwareSome apparent antivirus programs are actually malware masquerading as legitimate software, such as WinFixer, MS Antivirus, and Mac Defender.[31]Problems caused by false positives[edit]A "false positive" is when antivirus software identifies a non-malicious file as a virus. When this happens, it can cause serious problems. For example, if an antivirus program is configured to immediately delete or quarantine infected files, a false positive in an essential file can render the operating system or some applications unusable.[32] In May 2007, a faulty virus signature issued by Symantec mistakenly removed essential operating system files, leaving thousands of PCs unable to boot.[33] Also in May 2007, the executable file required by Pegasus Mail was falsely detected by Norton AntiVirus as being a Trojan and it was automatically removed, preventing Pegasus Mail from running. Norton AntiVirus had falsely identified three releases of Pegasus Mail as malware, and would delete the Pegasus Mail installer file when that happened.[34] In response to this Pegasus Mail stated:“On the basis that Norton/Symantec has done this for every one of the last three releases of Pegasus Mail, we can only condemn this product as too flawed to use, and recommend in the strongest terms that our users cease using it in favour of alternative, less buggy anti-virus packages.[34]”In April 2010, McAfee VirusScan detected svchost.exe, a normal Windows binary, as a virus on machines running Windows XP with Service Pack 3, causing a reboot loop and loss of all network access.[35][36]In December 2010, a faulty update on the AVG anti-virus suite damaged 64-bit versions of Windows 7, rendering it unable to boot, due to an endless boot loop created.[37]In October 2011, Microsoft Security Essentials (MSE) removed the Google Chrome web browser, rival to Microsoft's own Internet Explorer. MSE flagged Chrome as a Zbot banking trojan.[38]When Microsoft Windows becomes damaged by faulty anti-virus products, fixing the damage to Microsoft Windows incurs technical support costs and businesses can be forced to close whilst remedial action is undertaken.[39][40]System and interoperability related issues[edit]Running multiple antivirus programs concurrently can degrade performance and create conflicts.[41] However, using a concept called multiscanning, several companies (including G Data[42] and Microsoft[43]) have created applications which can run multiple engines concurrently.It is sometimes necessary to temporarily disable virus protection when installing major updates such as Windows Service Packs or updating graphics card drivers.[44] Active antivirus protection may partially or completely prevent the installation of a major update. Anti-virus software can cause problems during the installation of an operating system upgrade, e.g. when upgrading to a newer version of Windows "in place" — without erasing the previous version of Windows. Microsoft recommends that anti-virus software be disabled to avoid conflicts with the upgrade installation process.[45][46][47]The functionality of a few computer programs can be hampered by active anti-virus software. For example TrueCrypt, a disk encryption program, states on its troubleshooting page that anti-virus programs can conflict with TrueCrypt and cause it to malfunction or operate very slowly.[48] Anti-virus software can impair the performance and stability of games running in the Steam platform.[49]Support issues also exist around antivirus application interoperability with common solutions like SSL VPN remote access and network access control products.[50] These technology solutions often have policy assessment applications which require that an up to date antivirus is installed and running. If the antivirus application is not recognized by the policy assessment, whether because the antivirus application has been updated or because it is not part of the policy assessment library, the user will be unable to connect.Effectiveness[edit]Studies in December 2007 showed that the effectiveness of antivirus software had decreased in the previous year, particularly against unknown or zero day attacks. The computer magazine c't found that detection rates for these threats had dropped from 40-50% in 2006 to 20-30% in 2007. At that time, the only exception was the NOD32 antivirus, which managed a detection rate of 68 percent.[51]The problem is magnified by the changing intent of virus authors. Some years ago it was obvious when a virus infection was present. The viruses of the day, written by amateurs, exhibited destructive behavior or pop-ups. Modern viruses are often written by professionals, financed by criminal organizations.[52]Independent testing on all the major virus scanners consistently shows that none provide 100% virus detection. The best ones provided as high as 99.9% detection for simulated real-world situations, while the lowest provided 91.1% in tests conducted in August 2013. Many virus scanners produce false positive results as well, identifying benign files as malware.[53]Although methodologies may differ, some notable independent quality testing agencies include AV-Comparatives, ICSA Labs, West Coast Labs, Virus Bulletin, AV-TEST and other members of the Anti-Malware Testing Standards Organization.[54][55]New viruses[edit]Anti-virus programs are not always effective against new viruses, even those that use non-signature-based methods that should detect new viruses. The reason for this is that the virus designers test their new viruses on the major anti-virus applications to make sure that they are not detected before releasing them into the wild.[56]Some new viruses, particularly ransomware, use polymorphic code to avoid detection by virus scanners. Jerome Segura, a security analyst with ParetoLogic, explained:[57]“It's something that they miss a lot of the time because this type of [ransomware virus] comes from sites that use a polymorphism, which means they basically randomize the file they send you and it gets by well-known antivirus products very easily. I've seen people firsthand getting infected, having all the pop-ups and yet they have antivirus software running and it's not detecting anything. It actually can be pretty hard to get rid of, as well, and you're never really sure if it's really gone. When we see something like that usually we advise to reinstall the operating system or reinstall backups.[57]”A proof of concept virus has used the Graphics Processing Unit (GPU) to avoid detection from anti-virus software. The potential success of this involves bypassing the CPU in order to make it much harder for security researchers to analyse the inner workings of such malware.[58]Rootkits[edit]Detecting rootkits is a major challenge for anti-virus programs. Rootkits have full administrative access to the computer and are invisible to users and hidden from the list of running processes in the task manager. Rootkits can modify the inner workings of the operating system[59] and tamper with antivirus programs.Damaged files[edit]Files which have been damaged by computer viruses are normally damaged beyond recovery. Anti-virus software removes the virus code from the file during disinfection, but this does not always restore the file to its undamaged state. In such circumstances, damaged files can only be restored from existing backups; installed software that is damaged requires re-installation[60] (however, see System File Checker).Firmware issues[edit]Active anti-virus software can interfere with a firmware update process.[61] Any writeable firmware in the computer can be infected by malicious code.[62] This is a major concern, as an infected BIOS could require the actual BIOS chip to be replaced to ensure the malicious code is completely removed.[63] Anti-virus software is not effective at protecting firmware and the motherboard BIOS from infection.[64]
- #24 How useful is antivirus software?By Michael Horowitzantivirus software detects about 25% of the most popular malware currently
- #25 One of the few solid theoretical results in the study of computer viruses is Frederick B. Cohen's 1987 demonstration that there is no algorithm that can perfectly detect all possible viruses.[13]There are several methods which antivirus software can use to identify malware:Signature based detection is the most common method. To identify viruses and other malware, antivirus software compares the contents of a file to a dictionary of virus signatures. Because viruses can embed themselves in existing files, the entire file is searched, not just as a whole, but also in pieces.[19]Heuristic-based detection like malicious activity detection, can be used to identify unknown viruses.File emulation is another heuristic approach. File emulation involves executing a program in a virtual environment and logging what actions the program performs. Depending on the actions logged, the antivirus software can determine if the program is malicious or not and then carry out the appropriate disinfection actions.[20]Signature-based detection[edit]Traditionally, antivirus software heavily relied upon signatures to identify malware. This can be very effective, but cannot defend against malware unless samples have already been obtained and signatures created. Because of this, signature-based approaches are not effective against new, unknown viruses.As new viruses are being created each day, the signature-based detection approach requires frequent updates of the virus signature dictionary. To assist the antivirus software companies, the software may allow the user to upload new viruses or variants to the company, allowing the virus to be analyzed and the signature added to the dictionary.[19]Although the signature-based approach can effectively contain virus outbreaks, virus authors have tried to stay a step ahead of such software by writing "oligomorphic", "polymorphic" and, more recently, "metamorphic" viruses, which encrypt parts of themselves or otherwise modify themselves as a method of disguise, so as to not match virus signatures in the dictionary.[21]Heuristics[edit]Some more sophisticated antivirus software uses heuristic analysis to identify new malware or variants of known malware.Many viruses start as a single infection and through either mutation or refinements by other attackers, can grow into dozens of slightly different strains, called variants. Generic detection refers to the detection and removal of multiple threats using a single virus definition.[22]For example, the Vundo trojan has several family members, depending on the antivirus vendor's classification. Symantec classifies members of the Vundo family into two distinct categories, Trojan.Vundo andTrojan.Vundo.B.[23][24]While it may be advantageous to identify a specific virus, it can be quicker to detect a virus family through a generic signature or through an inexact match to an existing signature. Virus researchers find common areas that all viruses in a family share uniquely and can thus create a single generic signature. These signatures often contain non-contiguous code, using wildcard characters where differences lie. These wildcards allow the scanner to detect viruses even if they are padded with extra, meaningless code.[25] A detection that uses this method is said to be "heuristic detection."Rootkit detection[edit]Main article: RootkitAnti-virus software can attempt to scan for rootkits; a rootkit is a type of malware that is designed to gain administrative-level control over a computer system without being detected. Rootkits can change how the operating system functions and in some cases can tamper with the anti-virus program and render it ineffective. Rootkits are also difficult to remove, in some cases requiring a complete re-installation of the operating system.[26]Real-time protection[edit]Real-time protection, on-access scanning, background guard, resident shield, autoprotect, and other synonyms refer to the automatic protection provided by most antivirus, anti-spyware, and other anti-malware programs. This monitors computer systems for suspicious activity such as computer viruses, spyware, adware, and other malicious objects in 'real-time', in other words while data loaded into the computer's active memory: when inserting a CD, opening an email, or browsing the web, or when a file already on the computer is opened or executed.[27]