6.1.3 Malicious Software

• Virus

• Trojan Horse

• Worm

• Prevention

• Detection

• Counter Measures

Malicious software accounts for a significant portion of computer system attacks. Billions of dollars are spent after the attacks in clean-up costs. Malicious software can manipulate your machine, alter the data on your storage media, and violate the integrity of your data. Some malicious software programs can corrupt your files and spread to other machines through the network. Important data such as login names, passwords, credit card information, financial statements, and business proposals can be deleted, altered, or rendered illegible by the machine. This section introduces three common classes of malicious software programs: virus, Trojan horse, and worm.

Virus

A virus attaches itself to a file or software application, and then replicates itself on the host computer, spreading copies of itself to other files. It can corrupt files, alter or destroy data, display irritating messages, and/or disrupt computer operations. When a computer opens an infected file, it executes the attached virus instructions. An undetected virus can hide in a computer for days or months, while reproducing itself, and attaching itself to other files. The infected files may be spread when a user transfers them via the Internet or removable storage media to other computers.

Viruses are categorized by the type of files they infect. Some common categories are as follows:

• Boot sector- compromises the system at the lowest level. This leads to difficulties in starting the system securely; it also causes recurring problems during the computers operation

• Application software- infects executable files (for example, .exe files)

• Macro- infects macro files and documents that use macros such as Microsoft Excel and Microsoft Word; it is attached to a document or worksheet, and often distributed as an e-mail attachment. When one opens the document, the macro virus copies itself into the other macro files, where it is picked up by other documents.

Virus sample: Melissa Macro Virus

The Melissa virus arrives as an email message with an infected Word document (often named "list.doc") attached. The subject line of the email usually contains, "important message from". It affects Outlook or Outlook Express mail client users. When the attachment is opened, the virus program will execute if macros are enabled. First, the virus will alter the macro security setting to allow other macros to execute. It spreads by accessing the user's Outlook address book and sends copies of itself along with the document that contains it to other users without the original user's knowledge. If the document contains sensitive information, the sensitive information may be exposed to other users. Additionally, once the infected file is opened, it can infect other Word files. If an infected Word file is emailed to another user, the receiver of the message will have a Melissa-infected attachment.

You can learn more about Melissa virus.

Viruses frequently have double extensions such as .txt.vbs, .mpg.exe, and .gif.scr. The files attached to the email messages sent by these viruses may appear to be harmless files of type: text (.txt), movie (.mpg), picture (.gif) or other file types, when in fact the file is a malicious script or executable, for example, .vbs, .exe, .scr. If you are using the Microsoft Windows operating system, be aware that the operating system hides extensions for known file types by default. To make file extensions visible, you can click on My Computer on the desktop, then from the Tools menu, select Folder Options... Click on the View tab, and uncheckHide file extensions for known file types option.

Virus sample with hidden extensions: Love Bug

This virus arrives as an email attachment, LOVE-LETTER-FOR-YOU.TXT.vbs. Once you open the attachment, the virus overwrites most of the music, graphics, document, spreadsheet, and Web files on your disk. Then the virus mails itself to everyone in your email address book. The damage due to the Love Bug cost up to US$8.7 billion in lost productivity and system repairs according to Computer Economics estimates.

For further information about viruses, visit the CERT Computer Virus Resource page.