computer virus is a type of malicious software program ("malware") that, when executed, replicates by reproducing itself (copying its own source code) by infecting other computer programs by modifying them.[1] Infecting computer programs can include as well, data files, or the "boot" sector of the hard drive. When this replication succeeds, the affected areas are then said to be "infected" with a computer virusr virus
Computer viruses currently cause billions of dollars' worth of economic damage each year
Once a virus has successfully attached to a program, file, or document,
the virus will lie dormant until circumstances cause the computer or
device to execute its code. In order for a virus to infect your
computer, you have to run the infected program, which in turn causes the
virus code to be executed. This means that a virus can remain dormant
on your computer, without showing major sings or symptoms. However, once
the virus infects your computer, the virus can infect other computers
on the same network. Stealing passwords or data, logging keystrokes,
corrupting files, spamming your email contacts, and even taking over
your machine are just some of the devastating and irritating things a
virus can do.
TYPE OF Computer virus
Most Common Types of Viruses and Other Malicious Programs
1. Resident Viruses
This type of virus is a permanent which dwells in the RAM memory.
From there it can overcome and interrupt all of the operations executed
by the system: corrupting files and programs that are opened, closed,
copied, renamed etc.
Examples include: Randex, CMJ, Meve, and MrKlunky.
2. Multipartite Viruses
Multipartite viruses are distributed
through infected media and usually hide in the memory. Gradually, the
virus moves to the boot sector of the hard drive and infects executable
files on the hard drive and later across the computer system.
3. Direct Action Viruses
The main purpose of this virus is to replicate and take action
when it is executed. When a specific condition is met, the virus will go
into action and infect files in the directory or folder that it is in
and in directories that are specified in the AUTOEXEC.BAT file PATH.
This batch file is always located in the root directory of the hard disk
and carries out certain operations when the computer is booted.
4. Overwrite Viruses
Virus of this kind is characterized by the fact that it deletes
the information contained in the files that it infects, rendering them
partially or totally useless once they have been infected.
The only way to clean a file infected by an overwrite virus is to delete the file completely, thus losing the original content.
Examples of this virus include: Way, Trj.Reboot, Trivial.88.D.
5. Boot Virus
This type of virus affects the boot sector of a floppy or hard
disk. This is a crucial part of a disk, in which information on the disk
itself is stored together with a program that makes it possible to boot
(start) the computer from the disk.
The best way of avoiding boot viruses is to ensure that floppy disks are
write-protected and never start your computer with an unknown floppy
disk in the disk drive.
Examples of boot viruses include: Polyboot.B, AntiEXE.
6. Macro Virus
Macro viruses infect files that are created using certain
applications or programs that contain macros. These mini-programs make
it possible to automate series of operations so that they are performed
as a single action, thereby saving the user from having to carry them
out one by one.
Examples of macro viruses: Relax, Melissa.A, Bablas, O97M/Y2K.
7. Directory Virus
Directory viruses change the paths that indicate the location of
a file. By executing a program (file with the extension .EXE or .COM)
which has been infected by a virus, you are unknowingly running the
virus program, while the original file and program have been previously
moved by the virus.
Once infected it becomes impossible to locate the original files.
8. Polymorphic Virus
Polymorphic viruses encrypt or encode themselves in a different
way (using different algorithms and encryption keys) every time they
infect a system.
This makes it impossible for anti-viruses to find them using string or
signature searches (because they are different in each encryption) and
also enables them to create a large number of copies of themselves.
Examples include: Elkern, Marburg, Satan Bug, and Tuareg.
9. File Infectors
This type of virus infects programs or executable files (files
with an .EXE or .COM extension). When one of these programs is run,
directly or indirectly, the virus is activated, producing the damaging
effects it is programmed to carry out. The majority of existing viruses
belongs to this category, and can be classified depending on the actions
that they carry out.
10. Encrypted Viruses
This type of viruses consists of
encrypted malicious code, decrypted module. The viruses use encrypted
code technique which make antivirus software hardly to detect them. The
antivirus program usually can detect this type of viruses when they try
spread by decrypted themselves.
11. Companion Viruses
Companion viruses can be considered file infector viruses like
resident or direct action types. They are known as companion viruses
because once they get into the system they "accompany" the other files
that already exist. In other words, in order to carry out their
infection routines, companion viruses can wait in memory until a program
is run (resident viruses) or act immediately by making copies of
themselves (direct action viruses).
Some examples include: Stator, Asimov.1539, and Terrax.1069
12. Network Virus
Network viruses rapidly spread
through a Local Network Area (LAN), and sometimes throughout the
internet. Generally, network viruses multiply through shared resources,
i.e., shared drives and folders. When the virus infects a computer, it
searches through the network to attack its new potential prey. When the
virus finishes infecting that computer, it moves on to the next and the
cycle repeats itself.
The most dangerous network viruses are Nimda and SQLSlammer.
13. Nonresident Viruses
This type of viruses is similar to
Resident Viruses by using replication of module. Besides that,
Nonresident Viruses role as finder module which can infect to files when
it found one (it will select one or more files to infect each time the
module is executed).
14. Stealth Viruses
Stealth Viruses is some sort of
viruses which try to trick anti-virus software by intercepting its
requests to the operating system. It has ability to hide itself from
some antivirus software programs. Therefore, some antivirus program
cannot detect them.
15. Sparse Infectors
In order to spread widely, a virus
must attempt to avoid detection. To minimize the probability of its
being discovered a virus could use any number of different techniques.
It might, for example, only infect every 20th time a file is executed;
it might only infect files whose lengths are within narrowly defined
ranges or whose names begin with letters in a certain range of the
alphabet. There are many other possibilities.
16. Spacefiller (Cavity) Viruses
Many viruses take the easy way out
when infecting files; they simply attach themselves to the end of the
file and then change the start of the program so that it first points to
the virus and then to the actual program code. Many viruses that do
this also implement some stealth techniques so you don't see the
increase in file length when the virus is active in memory.
A spacefiller (cavity) virus, on the other
hand, attempts to be clever. Some program files, for a variety of
reasons, have empty space inside of them. This empty space can be used
to house virus code. A spacefiller virus attempts to install itself in
this empty space while not damaging the actual program itself. An
advantage of this is that the virus then does not increase the length of
the program and can avoid the need for some stealth techniques. The
Lehigh virus was an early example of a spacefiller virus.
17. FAT Virus
The file allocation table or FAT is the part of a disk used to
connect information and is a vital part of the normal functioning of the
computer.
This type of virus attack can be especially dangerous, by preventing
access to certain sections of the disk where important files are stored.
Damage caused can result in information losses from individual files or
even entire directories.
18. Worms
A worm is technically not a virus, but a program very similar to
a virus; it has the ability to self-replicate, and can lead to negative
effects on your system and most importantly they are detected and
eliminated by antiviruses.
Examples of worms include: PSWBugbear.B, Lovgate.F, Trile.C, Sobig.D, Mapson.
19. Trojans or Trojan Horses
Another unsavory breed of malicious code (not a virus as well)
are Trojans or Trojan horses, which unlike viruses do not reproduce by
infecting other files, nor do they self-replicate like worms.
20. Logic Bombs
They are not considered viruses because they do not replicate.
They are not even programs in their own right but rather camouflaged
segments of other programs.
Their objective is to destroy data on the computer once certain
conditions have been met. Logic bombs go undetected until launched, and
the results can be destructive.
How to protect against computer viruses?
As you can see, just like a vicious flu virus, a computer virus
is something that you want to avoid. The terms virus and malware are
often used interchangeably; however, a virus is one of many types of
malware, and only one aspect of the overall threat landscape. As a
result, traditional antivirus software alone will not fully protect you
from all threats.
Instead, look into comprehensive security software like Norton Security.
The International Court of Justice (ICJ) is the principal judicial
organ of the United Nations (UN). It was established in June 1945 by the
Charter of the United Nations and began work in April 1946. The seat of the Court is at the Peace Palace in The Hague
(Netherlands). Of the six principal organs of the United Nations, it is
the only one not located in New York (United States of America). The Court’s role is to settle, in accordance with international law,
legal disputes submitted to it by States and to give advisory opinions
on legal questions referred to it by authorized United Nations organs
and specialized agencies. The Court is composed of 15 judges, who are elected for terms of
office of nine years by the United Nations General Assembly and the
Security Council. It is assisted by a Registry, its administrative
organ. Its official languages are English and French.
The first known malware extortion attack, the "AIDS Trojan"
written by Joseph Popp in 1989, had a design failure so severe it was
not necessary to pay the extortionist at all. Its payload hid the files
on the hard drive and encrypted only their names,
and displayed a message claiming that the user's license to use a
certain piece of software had expired. The user was asked to pay US$189
to "PC Cyborg Corporation" in order to obtain a repair tool even though
the decryption key could be extracted from the code of the Trojan. The
Trojan was also known as "PC Cyborg". Popp was declared mentally unfit to stand trial for his actions, but he promised to donate the profits from the malware to fund AIDS research.[27]
The notion of using public key cryptography for ransom attacks was introduced in 1996 by Adam L. Young and Moti Yung. Young and Yung critiqued the failed AIDS Information Trojan that relied on symmetric cryptography
alone, the fatal flaw being that the decryption key could be extracted
from the Trojan, and implemented an experimental proof-of-concept
cryptovirus on a Macintosh SE/30 that used RSA and the Tiny Encryption Algorithm (TEA) to hybrid encrypt the victim's data. Since public key crypto is used, the cryptovirus only contains the encryption key. The attacker keeps the corresponding private
decryption key private. Young and Yung's original experimental
cryptovirus had the victim send the asymmetric ciphertext to the
attacker who deciphers it and returns the symmetric decryption key it
contains to the victim for a fee. Long before electronic money
existed Young and Yung proposed that electronic money could be extorted
through encryption as well, stating that "the virus writer can
effectively hold all of the money ransom until half of it is given to
him. Even if the e-money was previously encrypted by the user, it is of
no use to the user if it gets encrypted by a cryptovirus".[12] They referred to these attacks as being "cryptoviral extortion", an overt attack that is part of a larger class of attacks in a field called cryptovirology, which encompasses both overt and covert attacks.[12]
Examples of extortionate ransomware became prominent in May 2005.[28] By mid-2006, Trojans such as Gpcode, TROJ.RANSOM.A, Archiveus,
Krotten, Cryzip, and MayArchive began utilizing more sophisticated RSA
encryption schemes, with ever-increasing key-sizes. Gpcode.AG, which was
detected in June 2006, was encrypted with a 660-bit RSA public key.[29]
In June 2008, a variant known as Gpcode.AK was detected. Using a
1024-bit RSA key, it was believed large enough to be computationally
infeasible to break without a concerted distributed effort.[30][31][32][33]
Encrypting ransomware returned to prominence in late 2013 with the propagation of CryptoLocker—using the Bitcoindigital currency platform to collect ransom money. In December 2013, ZDNet
estimated based on Bitcoin transaction information that between 15
October and 18 December, the operators of CryptoLocker had procured
about US$27 million from infected users.[34] The CryptoLocker technique was widely copied
in the months following, including CryptoLocker 2.0 (though not to be
related to CryptoLocker), CryptoDefense (which initially contained a
major design flaw that stored the private key on the infected system in a
user-retrievable location, due to its use of Windows' built-in encryption APIs),[24][35][36][37] and the August 2014 discovery of a Trojan specifically targeting network-attached storage devices produced by Synology.[38]
In January 2015, it was reported that ransomware-styled attacks have
occurred against individual websites via hacking, and through ransomware
designed to target Linux-based web servers.[39][40][41]
Some ransomware strains have used proxies tied to Torhidden services to connect to their command and control servers, increasing the difficulty of tracing the exact location of the criminals.[42][43] Furthermore, dark web vendors have increasingly started to offer the technology as a service.[43][44][45]
Symantec has classified ransomware to be the most dangerous cyber threat.[46]
Non-encrypting ransomware
In August 2010, Russian authorities arrested nine individuals
connected to a ransomware Trojan known as WinLock. Unlike the previous
Gpcode Trojan, WinLock did not use encryption. Instead, WinLock
trivially restricted access to the system by displaying pornographic
images, and asked users to send a premium-rate SMS
(costing around US$10) to receive a code that could be used to unlock
their machines. The scam hit numerous users across Russia and
neighboring countries—reportedly earning the group over US$16 million.[15][47]
In 2011, a ransomware Trojan surfaced that imitated the Windows Product Activation
notice, and informed users that a system's Windows installation had to
be re-activated due to "[being a] victim of fraud". An online activation
option was offered (like the actual Windows activation process), but
was unavailable, requiring the user to call one of six international numbers
to input a 6-digit code. While the malware claimed that this call would
be free, it was routed through a rogue operator in a country with high
international phone rates, who placed the call on hold, causing the user
to incur large internationallong distance charges.[13]
In February 2013, a ransomware Trojan based on the Stamp.EK exploit kit surfaced; the malware was distributed via sites hosted on the project hosting services SourceForge and GitHub that claimed to offer "fake nude pics" of celebrities.[48] In July 2013, an OS X-specific
ransomware Trojan surfaced, which displays a web page that accuses the
user of downloading pornography. Unlike its Windows-based counterparts,
it does not block the entire computer, but simply exploits the behavior of the web browser itself to frustrate attempts to close the page through normal means.[49]
In July 2013, a 21-year-old man from Virginia, whose computer
coincidentally did contain pornographic photographs of underaged girls
with whom he had conducted sexualized communications, turned himself in
to police after receiving and being deceived by ransomware purporting to
be an FBI message accusing him of possessing child pornography. An
investigation discovered the incriminating files, and the man was
charged with child sexual abuse and possession of child pornography.[50]
Leakware (also called Doxware)
The converse of ransomware is a cryptovirology attack that threatens to publish stolen information from the victim's computer system rather than deny the victim access to it.[51]
In a leakware attack, malware exfiltrates sensitive host data either to
the attacker or alternatively, to remote instances of the malware, and
the attacker threatens to publish the victim's data unless a ransom is
paid. The attack was presented at West Point
in 2003 and was summarized in the book Malicious Cryptography as
follows, "The attack differs from the extortion attack in the following
way. In the extortion attack, the victim is denied access to its own
valuable information and has to pay to get it back, where in the attack
that is presented here the victim retains access to the information but
its disclosure is at the discretion of the computer virus".[52]
The attack is rooted in game theory and was originally dubbed "non-zero
sum games and survivable malware". The attack can yield monetary gain
in cases where the malware acquires access to information that may
damage the victim user or organization, e.g., reputational damage that
could result from publishing proof that the attack itself was a success.
Mobile ransomware
With the increased popularity of ransomware on PC platforms, ransomware targeting mobile operating systems
have also proliferated. Typically, mobile ransomware payloads are
blockers, as there is little incentive to encrypt data since it can be
easily restored via online synchronization.[53] Mobile ransomware typically targets the Android platform, as it allows applications to be installed from third-party sources.[53][54] The payload is typically distributed as an APK file installed by an unsuspecting user; it may attempt to display a blocking message over top of all other applications,[54] while another used a form of clickjacking to cause the user to give it "device administrator" privileges to achieve deeper access to the system.[55]
Different tactics have been used on iOS devices, such as exploiting iCloud accounts and using the Find My iPhone system to lock access to the device.[56] On iOS 10.3, Apple patched a bug in the handling of JavaScript pop-up windows in Safari that had been exploited by ransomware websites