Hello, can you guest what I mean Hello, can you guest what I mean to you from these photos? to you from these photos? Hi, I’m W32.Blackmal .How are you? 1 Maybe you guessed correctly. Maybe you guessed correctly. That is the topic which That is the topic which we will introduce to you today. we will introduce to you today. 2 Instructor: Trần Ngân Bình Group 21: Group 21: 1. Nguyễn Ngọc Mỹ 1050942 1. Nguyễn Ngọc Mỹ 1050942 2. Nguyễn Mạnh Đạt 1040531 2. Nguyễn Mạnh Đạt 1040531 3. Lê Chí Hiện 1040544 3. Lê Chí Hiện 1040544 3 SOME KEY TERMS SOME KEY TERMS - VIRUS: VIRUS: A program loaded onto your A program loaded onto your computer without your knowledge and runs computer without your knowledge and runs against your wishes. against your wishes. - TROJAN: - TROJAN: A destructive program that A destructive program that masquerades as a benign application. masquerades as a benign application. Unlike viruses, Trojan don’t replicate Unlike viruses, Trojan don’t replicate themselves. themselves. 4 SOME KEY TERMS SOME KEY TERMS - WORM: WORM: A program or algorithm that A program or algorithm that replicates itself over a computer network replicates itself over a computer network and usually performs malicious actions. and usually performs malicious actions. - Blended threats - Blended threats combine the characteristics combine the characteristics of viruses, worms, Trojan Horses, and of viruses, worms, Trojan Horses, and malicious code with server and Internet malicious code with server and Internet vulnerabilities . vulnerabilities . 5 - COMPUTER VIRUS: - COMPUTER VIRUS: A small program A small program routine that infects a computer system & routine that infects a computer system & uses its resources to produce itself. uses its resources to produce itself. Virus patches the operating Virus patches the operating system to detect program system to detect program files. It then copies itself into files. It then copies itself into these files. these files. 6 PAYLOAD TRIGGER REPRODUCTION MISDIRECTION INFECTED PROGRAM MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS UNIFECTED PROGRAM VIRUS CODE 7 MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS PAYLOAD TRIGGER REPRODUCTION MISDIRECTION INFECTED PROGRAM VIRUS CODE 8 PAYLOAD TRIGGER REPRODUCTION INFECTED PROGRAM VIRUS CODE MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS MISDIRECTION MISDIRECTION ROUNTINE enables virus to hide itself. 9 MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS PAYLOAD TRIGGER INFECTED PROGRAM VIRUS CODE REPRODUCTION MISDIRECTION REPRODUCTION ROUTINE allows virus to copy itself to other programs. 10 [...]... letting it write data onto floppies 22 ANTIVIRUS PROGRAMS - There are actually 2 kinds of antivirus programs: + Virus shields: detect viruses as they are infecting your PC + Virus scanners: detect viruses once they are infected - Some popular antivirus programs: Bka v2006.exe 23 REMEMBER! - Viruses can’t infect a data or a text file - Before running an antivirus program, be sure to cold-boot from a... tabs - Software distributed over computer bulletin board systems 20 HOW TO AVOID VIRUSES? - Many viruses have spread through piratedillegally copied or broken- games - This is easy to avoid Pay for your games, fair and square 21 HOW TO AVOID VIRUSES? - If you use a public PC, be very careful about putting floppies into that PC’s drives without a write-protect tab - Carry a virus- checking program and scan... Lehigh infector notices and adds a copy of itself to COMMAND.COM on the floppy 17 LEHIGH VIRUS - If you take this floppy to another PC to boot, the virus will be installed in that PC - Every time you subdirectory or a COMMAND.COM, and infects it access a hard disk floppy disk containing the virus sees that file 18 LEHIGH VIRUS - Once Lehigh has infected 4 copies of COMMAND.COM, the detonator is triggered...MAIN PARTS OF A VIRUS INFECTED PROGRAM MISDIRECTION REPRODUCTION VIRUS CODE TRIGGER TRIGGER ROUTINE causes the payload to be activated at a particular time or when a particular event takes place PAYLOAD 11 MAIN PARTS OF A VIRUS INFECTED PROGRAM MISDIRECTION REPRODUCTION VIRUS CODE PAYLOAD ROUTINE may be a fairly harmless joke or may be very destructive... the host program with a command that changes the normal execution sequence - The virus then returns control to the host program 15 LEHIGH VIRUS - This is an example of a simple virus - The infector portion of Lehigh replicates by attaching a copy of itself to COMMAND.COM and enlarging it by about 1000 bytes 16 LEHIGH VIRUS - When you put a floppy containing COMMAND.COM into an infected PC, the infector... it is loaded into memory carrying the virus - It can then use a reproduction routine to infect other programs 13 WAY OF INFECTING - The virus may contain a payload that remains dormant until a trigger event activates it - The payload might do something relatively harmless, or it might do something more destructive 14 WAY OF INFECTING - When it infects a file, the virus replaces the first instruction . vulnerabilities . 5 - COMPUTER VIRUS: - COMPUTER VIRUS: A small program A small program routine that infects a computer system & routine that infects a computer system & uses. A MAIN PARTS OF A VIRUS VIRUS UNIFECTED PROGRAM VIRUS CODE 7 MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS PAYLOAD TRIGGER REPRODUCTION MISDIRECTION INFECTED PROGRAM VIRUS CODE 8 PAYLOAD TRIGGER REPRODUCTION INFECTED. PAYLOAD TRIGGER REPRODUCTION INFECTED PROGRAM VIRUS CODE MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS MISDIRECTION MISDIRECTION ROUNTINE enables virus to hide itself. 9 MAIN PARTS OF A MAIN PARTS OF A VIRUS VIRUS PAYLOAD TRIGGER INFECTED