BOARD OF TECHNICAL EDUCATION BANGLORE

V.E.S SOCIETY’S YADGIR POLYTECHNIC,

YADGIR
DEPARTMENT OF COMPUTER SCIENCE & ENGG
12/8/21 05:03:09 AM
A SEMINAR REPORT ON
“Computer Virus”

SUBMITTED BY:
Nagraj. A
Mallikarjun. M
Dodda Basavalinga. D
Devaraj. V.M
Rachappa. Guidance
Under The Esteemed T Of
 
 MD.IDRISH
V.E.S SOCIETY’S YADGIR POLYTECHNIC,
YADGIR
YEAR 2010-11
 12/8/21 05:03:09 AM

Computer virus
 1 2 6
12/8/21 05:03:09 AM

Protected
Introduction Antivirus
software's

How it’s get

3
your PC??

What do

5 4
viruses do

Software attacks
Some Real against computer&
World Viruses Difference from
viruses
 12/8/21 05:03:10 AM
Introduction of Virus
Definition : A virus is a program which reproduces its own code by attaching itself to other
programs in such a way that the virus code is executed when the infected program is
executed.
Full form : Vital Information Resources Under
Siege.
 First time the term virus used by David gerrold.
 It is was defined by the Fred Cohen in 1983.
 The first virus appear on pc was Lehigh virus.
 Then Jerusalem, dark average, ping-pong ball, raindropetc have come.
 In 1992 Basit and AmjadFarooqalvi developed the first virus called Brain.
 12/8/21 05:03:10 AM
HOW
HOW IT’S
IT’S GET’S
GET’S INTO
INTO YOUR
YOUR PC???
PC???
 12/8/21 05:03:10 AM

1. The person read email at their PC or if they use diskettes to

transfer files between the computer at work and the computer at
home, or if they just transfer files between the two computers they
have a good possibility to get a virus.
 
2. They might get viruses also when they download files from any
internet site.
 
 12/8/21 05:03:10 AM

What Do Viruses Do?

I'm going to present an easy to understand but detailed explanation of viruses and other types of
malicious software. For now, it's enough to understand that viruses are potentially destructive
software that spreads from program to program or from disk to disk. Computer viruses, like
biological viruses, need a host to infect; in the case of computer viruses this host is an innocent
program. If such a program is transferred to your PC, other programs on your PC will become
infected.

The bottom line is that if you have a virus, you are no longer in control of your PC. Every time
you boot your PC or execute a program the virus may also be executing and spreading its
infection. While most viruses haven't been written to be destructive, almost all viruses can cause
damage to your files--mostly because the viruses themselves are very poorly written programs. If
viruses destroy nothing else, they destroy your trust in your PC--something that is quite
 SOFTWARE ATTACKS AGAINST COMPUTER AND THEIRE DIFFERECE FROM
VIRUSES
Malicious programs 12/8/21 05:03:10 AM

Needs host Independent

Programs

Trap Logic Trojan Viruses Worm Zombie

doors Bombs Horses

Taxonomy of malicious programs

Viruses are one specific type of program written deliberately to cause harm to someone's computer or to use that
computer in an unauthorized way. There are many forms of malicious software; sometimes the media calls all
malicious software viruses, but it's important to understand the distinction between the various types. Let's
examine the different types of malicious software:
 12/8/21 05:03:10 AM

Trap doors : Trap doors are a secret entry point in to a program that allows some one that aware of the trap door to
gain access without going through the usual security access procedures.

Logic Bombs : Just like a real bomb, a logic bomb will lie dormant until triggered by some event. The trigger can be
a specific date, the number of times executed, a random number, or even a specific event such as deletion of an
employee's payroll record. When the logic bomb is triggered it will usually do something unpleasant

Trojans : These are named after the Trojan horse which delivered soldiers into the city of Troy. Likewise, a Trojan
program is a delivery vehicle for some destructive code (such as a logic bomb or a virus) onto a computer.

Worms : A worm is a self-reproducing program which does not infect other programs as a virus will, but instead
creates copies of itself, which create even more copies. These are usually seen on networks and on multi-processing
operating systems, where the worm will create copies of itself which are also executed.

Zombie : A zombie is a program that secretly takes over another internet –attached computer and then uses that
computer to launch that are difficult to trace to the zombie’s creator .Zombies are used in denial of services attacks,
typically against targeted websites.
 12/8/21 05:03:10 AM
General virus Behavior
Viruses come in a great many different forms, but they all potentially have three phases to their execution, the dormant, the
infection phase and the attack phase:

Dormant Phase:- The virus is idle. The virus is eventually be activated by some event, such as a date, the presence of
another program or file, or the capacity of disk exceeding some limit. Not all viruses have this phase.

Infection phase:- When the virus executes it will infect other programs. What is often not clearly understood is precisely
when it will infect the other programs. Some viruses infect other programs each time they are executed, other viruses infect
only upon a certain trigger. This trigger could by anything; it could be a day or time, an external event on your PC, a counter
within the virus etc. Some viruses are very selective about when they infect programs; this is vital to the virus's survival. If
the virus infects too often, it is more likely to be discovered before it can spread far. Virus writers want their programs to
spread as far as possible before anyone detects them. This brings up an important point which bears repeating.

Execution phase:- The second phase is the attack phase. Many viruses do unpleasant things such as deleting files or
changing random data on your disk, simulating types or merely slowing your PC down; some viruses do less harmful things
such as playing music or creating messages or animation on your screen. Viruses usually delay revealing their presence by
launching their attack only after they have had ample opportunity to spread. This means that the attack may be delayed for
years after the initial infection. The attack phase is optional; many viruses simply reproduce and have no trigger for an attack
phase. This is made worse since viruses which "just infect", with no attack phase, damage the programs or disks they infect.
This is not intentional on the part of the virus, but simply a result of the fact that many viruses contain extremely poor
quality code. One of the most common viruses, the STONED virus is not intentionally harmful.
Types of viruses
12/8/21 05:03:10 AM

1. Boot sector virus

2. Parasitic virus
3. Stealth virus
4. Polymorphic virus
5. Resident viruses
6. Overwrite viruses
7. Macro viruses
8. Directory viruses
9. Logic bomb
10. FAT viruses, etc.
 Working procedure of different types of viruses 12/8/21 05:03:10 AM
Once we understand how the computer normally works then only we would be able to understand what abnormalities occur
if a virus enters the computer. And then possibly we would be able to write the program to detect and remove these viruses.
Let us begin with the boot-time procedure.
Boot sector virus:- The entire procedure can be divided into following distinct steps:
1. When the machine is switched on the microprocessor passes the control to a set of routines called Power On self
Test (POST) routines. The POST routines perform a reliability test of the other ROM programs to find whether
they are in order or not.
2. A ROM startup routines sets up the Interrupt Vector Table (IVT), with the address of ROM BIOS routines.
3. A ROM startup routine performs the RAM test and stores the base memory size at locations 0x413 and 0x410.
4. ROM startup routines checks and initialize the standard equipment (like Keyboard, VDU, floppy Disk Drive and
Printer) and stores a list of this equipment in memory at location 0x410.
5. The ROM startup routines check for non-standard equipment attached to the computer. If found, they momentarily
transfer control to ROM extension routines. The ROM extension routines initialize the non-standard equipment (like hard
disk) and hand over the control back to the ROM startup routine.
6. A ROM startup routine reads from COMS RAM (in case of AT and above) the system boot up sequence. Usually this
sequence is A:, C: indicating that the system would first attempt to boot from the A drive and if it fails to do so then it
would attempt to boot from the C drive. This sequence can be changed by the user.
In case of an XT the booting sequence is always A:, C: and this sequence cannot be changed.
7. A ROM startup routine called Bootstrap Loader loads the contents of side 0, track 0, sector 1 of the first drive in
the system boot up sequence. Now there are two possibilities:
1. The first drive in the system boot up sequence is drive A.
2. The first drive in the system boot up sequence is drive C. Let us now study the booting form these drives
separately.
 12/8/21 05:03:11 AM

Parasitic or File Viruses:

In terms of sheer number of viruses, these are the most common kind. The simplest file viruses work by
locating a type of file that they know how to infect (usually a file name ending in ".COM" or ".EXE") and
overwriting part of the program they are infecting. When this program is executed, the virus code executes
and infects more files. These overwriting viruses do not tend to be very successful since the overwritten
program rarely continues to function correctly and the virus is almost immediately discovered.
The more sophisticated file viruses modify the program so that the original instructions are saved and
executed after the virus finishes. Be aware that many file viruses (such as 4096 which is also known as Frodo)
also infect overlay files as well as the more usual *.COM and *.EXE files. Overlay files have various
extensions, but ".OVR" and ".OVL" are common examples.
 12/8/21 05:03:11 AM

Macro Viruses:

There is particular type of file virus that that many people don't understand. These are the files from the
Microsoft Office applications (e.g., MS Word, MS Excel, MS Access, etc.). These programs all have their
own macro languages (a BASIC like language) built in. The associated files (MS Word documents or
templates and MS Excel spreadsheet files) are usually thought of only as data files so many people are
surprised that they can be infected. But these files can contain programs (the macro language) that are
executed when you load one of these files into the associated product.
A micro virus is particularly threatening for a number of reasons: 
1. A micro virus is platform independent .virtually all of the macro viruses infect M-S Word documents.
Any hardware platform and operating system that supports word can be infected.
 2. Macro V infects documents not executable portion of code. Most of the information in the computer is
stored in the form of document not program.
 3. Macro virus is easily spread. A very common method is by electronic mail.
 12/8/21 05:03:11 AM

Stealth virus:
A virus such as the one just described is easily detected because an infected version of a program is
longer than the corresponding uninfected one. One way thwart such a simple means of a detecting a virus is to
compress the executable file so that both the infected and uninfected versions are of identical length. The
following diagram describes it more clearly.
We assume that program p1 is infected with the virus CV.

When the program is invoked, control passes to its virus, which performs the following steps:
*For each uninfected file p2 that is found, the virus first compress that file to produce p2*, which is
shorter than original program by the size of virus.
*A copy of the virus is prep ended to the compressed program.
*The compressed version of the original infected program, p1* is uncompressed.
*The uncompressed original program is executed.
 12/8/21 05:03:11 AM

Polymorphic virus:

A virus is said to be polymorphic if its code appears to be different every time it replicates (though
generally each replication of the virus is functionally identical). This is usually achieved by encrypting the
body of the virus, and adding a decryption routine which is different for each replication. When a
polymorphic virus replicates, a portion of the decryption code is modified.

A portion of virus generally called a mutation engine creates a random encryption key to encrypt the
remainder of the virus. The key stored with, the virus, and the mutation engine itself is altered. When an
infected program is invoked, the virus uses the stored random key to decrypt the virus. When the virus
replicates, a different random key is selected.
Additionally, random, do-nothing blocks of code can be embedded in the program and are shuffled around to
further vary the signature. In essence, it looks like a different program to virus scanners.
 12/8/21 05:03:11 AM
Diagnosis-Indication of Virus Infection
Lots of things can go wrong with computers, with most problems usually arising from
software bugs or hardware malfunctions. However, when two or more troublesome virus like
symptoms appear at the same time, the odds on an infection increase, that’s when you should
check your system for the virus. If you have observed any of the following symptoms of virus
infection.
 
1. Program load take longer than normal.
2. Disk accesses seem to be excessive for very simple tasks.
3. Unusual error message appear.
4. Access lights come on when there is no obvious reason.
5. System memory is reduced.
6. Files mysteriously disappear.
7. Available disk space is reduced for no good reason.
8. Executable programs change size.
9. Icons change in appearance.
 12/8/21 05:03:11 AM
Recovery Tips on getting Rid of Virus Infection
Removing Boot Sector Virus:

Remember that a boot sector virus attaches itself to instructions in the disk sector, which are loaded in to
memory immediately when the system is powered on. To remove this type of virus you must reverse the
infection process, the virus out and reinstalling the original boot sector coding. To do this we must follow the
following command:

1.Use the DOS utility called the SYS command as follows Type the command SYS C: at the A> prompt. If the
transfer has been completed smoothly, you get the response

System transferred

2. The SYS command may not always remove the boot sector virus, so you may need to use a program that is
designed for this task. one such program is called MDISK and can be downloaded from the computer virus
industry Association bulletin board.

3. Third and last option is that to try to back up all your data files before carrying out the next step- reformatting
hard disk.
 12/8/21 05:03:11 AM
Removing Parasitic or File Virus:-
Follow these steps to get rid of one of these viruses-
1. Power down your system. When you switched on again, boot from a clean, write protected operating
system master diskette.
2. Use a virus scanning utility program to scan the files for these programs and identify which have been
infected.
3. Delete each of these infected file from the system.
4. Get out your original documentation and disks for the application program. Use them to repeat the
installation procedure so that the infected files are replaced by the original non infected versions.

A Tip to Avoid the Macro Virus:-

For Microsoft Office applications, there is a simple safety measure:
Word or Excel will skip loading such a macro if the [SHIFT] key is held down while the file is being
loaded from the File/Open dialog box. It does not necessarily work if the file is opened by double-clicking in
File Manager or launched from ECSMail or a Web browser.
For example, to open a Word document without automatically executing any macros:
5. Save it to a file
6. Start up Word
7. From the File menu, choose Open and select the file you wish to load
8. Hold down the [SHIFT] key and click on [OK]
9. Keep the [SHIFT] key depressed until the document has finished loading
 Some Examples of Real world Viruses 12/8/21 05:03:11 AM
1. PrettyPark.exe The W32/Pretty. Virus is yet another one of those which spread by Email. This virus infects only
Windows 9x and NT users. It is believed to have been originated in France almost a year ago. This virus arrives
by email and its structure is something like below. Subject: C:\CoolProgs\Pretty Park.exe

2. Disk Killer:- The disk killer is a boot sector virus and the most destructive of the new strains to emerge in late
1989.
When it activates, it displays the following message:
Disk killer version 1.0, From ogre computers , Now killing disk , Please do not power , Down your system.
Ten seconds before the message is displayed, disk killer has initiated a low level format of the hard disk.

3. Dark Avenger:- Dark avenger is a .COM and .EXE file infector that promises to be a steadily increasing
problem
because it is both very infectious and destructive. Dark avenger seeks new hosts programs virtually any moment
of application program activity, including loading, executing, transferring code or data between systems.

4. Zero bug:- The Zero bug is another .COM infector from Europe. It originates and destroys data both quickly
and efficiently. We should be practically concerned about zero bugs because it incorporates a new method of
outwitting many of the virus detection programs now on the market.
5. Alabama:- The Alabama is a .COM and an .EXE file infector that also introduced a new disturbing device.
Whenever file are copied or otherwise activated on an infected system, Alabama renames them, giving them the
name of another existing file on the victim’s system. Soon all the data file listing are scrambled- the data is still
 12/8/21 05:03:11 AM
6. Yankee Doodle:- The Yankee Doodle is, fortunately, an innocuous virus is its original form. it is activated by a
computer’s internal clock; at 5 p.m. it causes the tune “Yankee Doodle dandy” to be played over computer’s
speaker .

7. Sunday:- As the name implies, the Sunday virus activated when internal clock of the system it has infected
reaches
Sunday. Upon activation of Sunday, the operated is the greeted by following message.
Today is Sunday. Why are you working?
All work and no play make you a dull boy.
Before or during the display of the message, the Sunday virus has garbled the FAT (file allocation table)
section of operating system so that files cannot be located.

8. Ghost:- Ghost infects both boot sectors and the .COM files on disks and floppies. So in addition to using the
SYS command to disinfect the boot sector, it is also necessary to remove all infected .COM files.

9. Brain:- Basit and Amjad Alvi installed the brain on pirated software that they sold from their Brain software
&computer services shop in Lahore. Tourists could not resist the temptation of being able to purchase the copies
of word perfect and other popular propriety software for few bucks and so snapped up the infected disks. One
pirated program can breed many others and so the brain spread like a bushfire around the world ,and was
renamed the hard disk brain ,the clone, the shoe, and the Houston virus as it required more capabilities to infect
and cause damage .
 12/8/21 05:03:11 AM
HOW TO PREVENT THEM???
 Security features keep viruses away.
 Buy virus protection software.
 Avoid programs from unknown sources (like The internet).
 Stick with commercial software purchased on CDs.
 With E-mail viruses Never double-click on an attachment
that.
 Contains an executable program.
 Attachments that come in as Word files (.DOC), images
(.GIF and . . . JPG), etc. are data files. And they can do no
damage.
 A file with an extension like. EXE , .COM , or .VBS is an
 12/8/21 05:03:11 AM
TOP 2010 ANTIVIRUS SOFTWARES
1. Microsoft Security Essentials
2. Bit Defender Antivirus
3. Kaspersky Antivirus
4. Web root Antivirus
5. G-Data Antivirus
6. ESET Nod 32
7. AVG
8. NORTON
9. F-SECURE
 12/8/21 05:03:12 AM
Conclusion
Though there is nothing to tense if your systems have viruses. But, you shouldn’t neglect the virus threat. There are
quite a few dangerous viruses roaming the Internet. So keep your hard drive happy and don't let the viruses ruin your day.
Here is what you can do:
1. Make sure your computer runs anti-virus software. If not, buy and install it immediately.

2. Even if you have this software, it must be updated regularly, as new viruses appear daily. Configure the
programs to automatically download updates, making it easy to stay protected. Otherwise, periodically
download the updates manually.

3. DO NOT OPEN an e-mail attachment unless you know who sent it. Even then, it's not totally safe, as
a sneaky virus that has infected a friend's computer can access the e-mail address book, send a message to
everyone, and attach itself. To be completely safe, scan the attachment with your anti-virus software
BEFORE you open it.

4. If you receive a suspicious message, delete it immediately from your Inbox. When you delete a
message, however, it's still on your system. Go Into the Deleted Mail folder and delete the message
again to permanently remove it from your computer.

Regularly back up your files. Should your system become infected, you won't lose valuable data.
12/8/21 05:03:12 AM