Submit Search
Upload
Ceh v5 module 16 virus and worms
•
5 likes
•
3,951 views
Vi Tính Hoàng Nam
Follow
Ceh v5 module 16 virus and worms
Read less
Read more
Technology
Report
Share
Report
Share
1 of 58
Download now
Download to read offline
Recommended
Stuxnet worm
Stuxnet worm
sommerville-videos
Ceh v5 module 19 evading ids firewall and honeypot
Ceh v5 module 19 evading ids firewall and honeypot
Vi Tính Hoàng Nam
Malicious software
Malicious software
msdeepika
Ceh v5 module 07 sniffers
Ceh v5 module 07 sniffers
Vi Tính Hoàng Nam
Chapter 4
Chapter 4
Amy McMullin
Network Security: Attacks, Tools and Techniques
Network Security: Attacks, Tools and Techniques
waqasahmad1995
Vulnerabilities in modern web applications
Vulnerabilities in modern web applications
Niyas Nazar
Malware
Malware
Anoushka Srivastava
Recommended
Stuxnet worm
Stuxnet worm
sommerville-videos
Ceh v5 module 19 evading ids firewall and honeypot
Ceh v5 module 19 evading ids firewall and honeypot
Vi Tính Hoàng Nam
Malicious software
Malicious software
msdeepika
Ceh v5 module 07 sniffers
Ceh v5 module 07 sniffers
Vi Tính Hoàng Nam
Chapter 4
Chapter 4
Amy McMullin
Network Security: Attacks, Tools and Techniques
Network Security: Attacks, Tools and Techniques
waqasahmad1995
Vulnerabilities in modern web applications
Vulnerabilities in modern web applications
Niyas Nazar
Malware
Malware
Anoushka Srivastava
Mitigating worm attacks
Mitigating worm attacks
dkaya
Denial of service
Denial of service
garishma bhatia
Malicious Software
Malicious Software
Hamza Muhammad
Stuxnet - Case Study
Stuxnet - Case Study
Amr Thabet
Virus and worms
Virus and worms
Vikas Sharma
How To Protect From Malware
How To Protect From Malware
INFONAUTICS GmbH
Spyware powerpoint
Spyware powerpoint
galaxy201
Key logger,Why? and How to prevent Them?
Key logger,Why? and How to prevent Them?
Bibek Sharma
Operating System Security
Operating System Security
Ramesh Upadhaya
What is malware
What is malware
Malcolm York
Stuxnet - More then a virus.
Stuxnet - More then a virus.
Hardeep Bhurji
Ceh v5 module 11 hacking webservers
Ceh v5 module 11 hacking webservers
Vi Tính Hoàng Nam
Ch03 Network and Computer Attacks
Ch03 Network and Computer Attacks
phanleson
Spywares & Keyloggers
Spywares & Keyloggers
Jithin James
Security vulnerability
Security vulnerability
A. Shamel
Cross Site Scripting Defense Presentation
Cross Site Scripting Defense Presentation
Ikhade Maro Igbape
Malware and security
Malware and security
Gurbakash Phonsa
Tools and methods used in cybercrime
Tools and methods used in cybercrime
patelripal99
Viruses andthreats@dharmesh
Viruses andthreats@dharmesh
Dharmesh Kumar Sharma
Basics of Denial of Service Attacks
Basics of Denial of Service Attacks
Hansa Nidushan
Computer viruses
Computer viruses
Harendra Singh
Ceh v5 module 06 trojans and backdoors
Ceh v5 module 06 trojans and backdoors
Vi Tính Hoàng Nam
More Related Content
What's hot
Mitigating worm attacks
Mitigating worm attacks
dkaya
Denial of service
Denial of service
garishma bhatia
Malicious Software
Malicious Software
Hamza Muhammad
Stuxnet - Case Study
Stuxnet - Case Study
Amr Thabet
Virus and worms
Virus and worms
Vikas Sharma
How To Protect From Malware
How To Protect From Malware
INFONAUTICS GmbH
Spyware powerpoint
Spyware powerpoint
galaxy201
Key logger,Why? and How to prevent Them?
Key logger,Why? and How to prevent Them?
Bibek Sharma
Operating System Security
Operating System Security
Ramesh Upadhaya
What is malware
What is malware
Malcolm York
Stuxnet - More then a virus.
Stuxnet - More then a virus.
Hardeep Bhurji
Ceh v5 module 11 hacking webservers
Ceh v5 module 11 hacking webservers
Vi Tính Hoàng Nam
Ch03 Network and Computer Attacks
Ch03 Network and Computer Attacks
phanleson
Spywares & Keyloggers
Spywares & Keyloggers
Jithin James
Security vulnerability
Security vulnerability
A. Shamel
Cross Site Scripting Defense Presentation
Cross Site Scripting Defense Presentation
Ikhade Maro Igbape
Malware and security
Malware and security
Gurbakash Phonsa
Tools and methods used in cybercrime
Tools and methods used in cybercrime
patelripal99
Viruses andthreats@dharmesh
Viruses andthreats@dharmesh
Dharmesh Kumar Sharma
Basics of Denial of Service Attacks
Basics of Denial of Service Attacks
Hansa Nidushan
What's hot
(20)
Mitigating worm attacks
Mitigating worm attacks
Denial of service
Denial of service
Malicious Software
Malicious Software
Stuxnet - Case Study
Stuxnet - Case Study
Virus and worms
Virus and worms
How To Protect From Malware
How To Protect From Malware
Spyware powerpoint
Spyware powerpoint
Key logger,Why? and How to prevent Them?
Key logger,Why? and How to prevent Them?
Operating System Security
Operating System Security
What is malware
What is malware
Stuxnet - More then a virus.
Stuxnet - More then a virus.
Ceh v5 module 11 hacking webservers
Ceh v5 module 11 hacking webservers
Ch03 Network and Computer Attacks
Ch03 Network and Computer Attacks
Spywares & Keyloggers
Spywares & Keyloggers
Security vulnerability
Security vulnerability
Cross Site Scripting Defense Presentation
Cross Site Scripting Defense Presentation
Malware and security
Malware and security
Tools and methods used in cybercrime
Tools and methods used in cybercrime
Viruses andthreats@dharmesh
Viruses andthreats@dharmesh
Basics of Denial of Service Attacks
Basics of Denial of Service Attacks
Viewers also liked
Computer viruses
Computer viruses
Harendra Singh
Ceh v5 module 06 trojans and backdoors
Ceh v5 module 06 trojans and backdoors
Vi Tính Hoàng Nam
Ceh v5 module 14 sql injection
Ceh v5 module 14 sql injection
Vi Tính Hoàng Nam
Ceh v5 module 20 buffer overflow
Ceh v5 module 20 buffer overflow
Vi Tính Hoàng Nam
Ceh v5 module 05 system hacking
Ceh v5 module 05 system hacking
Vi Tính Hoàng Nam
Ceh v5 module 09 social engineering
Ceh v5 module 09 social engineering
Vi Tính Hoàng Nam
Cehv8 - Module 06: Trojans and Backdoors
Cehv8 - Module 06: Trojans and Backdoors
Vuz Dở Hơi
Ceh v5 module 01 introduction to ethical hacking
Ceh v5 module 01 introduction to ethical hacking
Vi Tính Hoàng Nam
Cehv8 - Module 19: Cryptography
Cehv8 - Module 19: Cryptography
Vuz Dở Hơi
Virus & Worms(20120628)
Virus & Worms(20120628)
Tejas Kolge
Virus and worms analysis
Virus and worms analysis
roniee1234567890
Viruses
Viruses
yuvan80
Cehv8 - Module 07: Viruses and Worms
Cehv8 - Module 07: Viruses and Worms
Vuz Dở Hơi
Ceh v5 module 08 denial of service
Ceh v5 module 08 denial of service
Vi Tính Hoàng Nam
VIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSES
HARSORA_SEJAL
Ceh v5 module 18 linux hacking
Ceh v5 module 18 linux hacking
Vi Tính Hoàng Nam
Ceh v5 module 21 cryptography
Ceh v5 module 21 cryptography
Vi Tính Hoàng Nam
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumeration
Vi Tính Hoàng Nam
Module 3 social engineering-b
Module 3 social engineering-b
BbAOC
Ceh v5 module 15 hacking wireless networks
Ceh v5 module 15 hacking wireless networks
Vi Tính Hoàng Nam
Viewers also liked
(20)
Computer viruses
Computer viruses
Ceh v5 module 06 trojans and backdoors
Ceh v5 module 06 trojans and backdoors
Ceh v5 module 14 sql injection
Ceh v5 module 14 sql injection
Ceh v5 module 20 buffer overflow
Ceh v5 module 20 buffer overflow
Ceh v5 module 05 system hacking
Ceh v5 module 05 system hacking
Ceh v5 module 09 social engineering
Ceh v5 module 09 social engineering
Cehv8 - Module 06: Trojans and Backdoors
Cehv8 - Module 06: Trojans and Backdoors
Ceh v5 module 01 introduction to ethical hacking
Ceh v5 module 01 introduction to ethical hacking
Cehv8 - Module 19: Cryptography
Cehv8 - Module 19: Cryptography
Virus & Worms(20120628)
Virus & Worms(20120628)
Virus and worms analysis
Virus and worms analysis
Viruses
Viruses
Cehv8 - Module 07: Viruses and Worms
Cehv8 - Module 07: Viruses and Worms
Ceh v5 module 08 denial of service
Ceh v5 module 08 denial of service
VIRUSES AND ANTI-VIRUSES
VIRUSES AND ANTI-VIRUSES
Ceh v5 module 18 linux hacking
Ceh v5 module 18 linux hacking
Ceh v5 module 21 cryptography
Ceh v5 module 21 cryptography
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumeration
Module 3 social engineering-b
Module 3 social engineering-b
Ceh v5 module 15 hacking wireless networks
Ceh v5 module 15 hacking wireless networks
Similar to Ceh v5 module 16 virus and worms
Malicious software and software security
Malicious software and software security
G Prachi
virus,worms & analysis
virus,worms & analysis
Priyatham Galisetty
anti_virus
anti_virus
sharq university
Virus and its CounterMeasures -- Pruthvi Monarch
Virus and its CounterMeasures -- Pruthvi Monarch
Pruthvi Monarch
Virus.pptx
Virus.pptx
MuhammadUmair229523
Virus and malware presentation
Virus and malware presentation
Amjad Bhutto
Thur Venture
Thur Venture
Sathishkumar Vasudevan
Venture name Basics
Venture name Basics
Sathishkumar Vasudevan
Venture name Basics
Venture name Basics
Sathishkumar Vasudevan
Regression
Regression
Sathishkumar Vasudevan
Sangeetha Venture
Sangeetha Venture
Sathishkumar Vasudevan
Rajul computer presentation
Rajul computer presentation
Neetu Jain
Introduction to Virus,Worms,Trojans & Malwares - NullAhm pre-meet
Introduction to Virus,Worms,Trojans & Malwares - NullAhm pre-meet
Pranjal Vyas
6unit1 virus and their types
6unit1 virus and their types
Neha Kurale
Anti Virus Software
Anti Virus Software
Pradeepkrajyaguru
Malicious
Malicious
Khyati Rajput
COMPUTER VIRUS-WPS Office.pptx
COMPUTER VIRUS-WPS Office.pptx
T Tanujha
Information Security (Malicious Software)
Information Security (Malicious Software)
Zara Nawaz
BAIT1003 Chapter 11
BAIT1003 Chapter 11
limsh
Virus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptx
sachingwalani24
Similar to Ceh v5 module 16 virus and worms
(20)
Malicious software and software security
Malicious software and software security
virus,worms & analysis
virus,worms & analysis
anti_virus
anti_virus
Virus and its CounterMeasures -- Pruthvi Monarch
Virus and its CounterMeasures -- Pruthvi Monarch
Virus.pptx
Virus.pptx
Virus and malware presentation
Virus and malware presentation
Thur Venture
Thur Venture
Venture name Basics
Venture name Basics
Venture name Basics
Venture name Basics
Regression
Regression
Sangeetha Venture
Sangeetha Venture
Rajul computer presentation
Rajul computer presentation
Introduction to Virus,Worms,Trojans & Malwares - NullAhm pre-meet
Introduction to Virus,Worms,Trojans & Malwares - NullAhm pre-meet
6unit1 virus and their types
6unit1 virus and their types
Anti Virus Software
Anti Virus Software
Malicious
Malicious
COMPUTER VIRUS-WPS Office.pptx
COMPUTER VIRUS-WPS Office.pptx
Information Security (Malicious Software)
Information Security (Malicious Software)
BAIT1003 Chapter 11
BAIT1003 Chapter 11
Virus And Antivirus short presentation.pptx
Virus And Antivirus short presentation.pptx
More from Vi Tính Hoàng Nam
CATALOGUE QUESTEK (Tiếng Việt)
CATALOGUE QUESTEK (Tiếng Việt)
Vi Tính Hoàng Nam
CATALOG KBVISION (Tiếng Việt)
CATALOG KBVISION (Tiếng Việt)
Vi Tính Hoàng Nam
Catalogue 2015
Catalogue 2015
Vi Tính Hoàng Nam
Tl wr740 n-v4_user_guide_1910010682_vn
Tl wr740 n-v4_user_guide_1910010682_vn
Vi Tính Hoàng Nam
CATALOGUE CAMERA GIÁM SÁT
CATALOGUE CAMERA GIÁM SÁT
Vi Tính Hoàng Nam
HƯỚNG DẪN SỬ DỤNG ĐẦU GHI QTD-6108
HƯỚNG DẪN SỬ DỤNG ĐẦU GHI QTD-6108
Vi Tính Hoàng Nam
Các loại cáp mạng
Các loại cáp mạng
Vi Tính Hoàng Nam
Catalogue 10-2014-new
Catalogue 10-2014-new
Vi Tính Hoàng Nam
Qtx 6404
Qtx 6404
Vi Tính Hoàng Nam
Camera QTX-1210
Camera QTX-1210
Vi Tính Hoàng Nam
Brochua đầu ghi hình QTD-6100 Series
Brochua đầu ghi hình QTD-6100 Series
Vi Tính Hoàng Nam
NSRT: Dụng cụ tháo đầu báo
NSRT: Dụng cụ tháo đầu báo
Vi Tính Hoàng Nam
SLV-24N: Đầu báo khói quang
SLV-24N: Đầu báo khói quang
Vi Tính Hoàng Nam
SLV-24N: Đầu báo khói quang
SLV-24N: Đầu báo khói quang
Vi Tính Hoàng Nam
PEX-xx: Bộ hiển thị phụ 5-210 zone cho tủ RPP, RPS, RPQ
PEX-xx: Bộ hiển thị phụ 5-210 zone cho tủ RPP, RPS, RPQ
Vi Tính Hoàng Nam
HRA-1000: Hiển thị phụ cho TT HCP-1008E
HRA-1000: Hiển thị phụ cho TT HCP-1008E
Vi Tính Hoàng Nam
RPP-ABW: TT báo cháy 10-20 kênh
RPP-ABW: TT báo cháy 10-20 kênh
Vi Tính Hoàng Nam
RPP-ECW: TT báo cháy 3-5 kênh
RPP-ECW: TT báo cháy 3-5 kênh
Vi Tính Hoàng Nam
HCP-1008E: TT báo cháy 8-24 kênh
HCP-1008E: TT báo cháy 8-24 kênh
Vi Tính Hoàng Nam
HCV-2/4/8: TT báo cháy 2,4,8 kênh
HCV-2/4/8: TT báo cháy 2,4,8 kênh
Vi Tính Hoàng Nam
More from Vi Tính Hoàng Nam
(20)
CATALOGUE QUESTEK (Tiếng Việt)
CATALOGUE QUESTEK (Tiếng Việt)
CATALOG KBVISION (Tiếng Việt)
CATALOG KBVISION (Tiếng Việt)
Catalogue 2015
Catalogue 2015
Tl wr740 n-v4_user_guide_1910010682_vn
Tl wr740 n-v4_user_guide_1910010682_vn
CATALOGUE CAMERA GIÁM SÁT
CATALOGUE CAMERA GIÁM SÁT
HƯỚNG DẪN SỬ DỤNG ĐẦU GHI QTD-6108
HƯỚNG DẪN SỬ DỤNG ĐẦU GHI QTD-6108
Các loại cáp mạng
Các loại cáp mạng
Catalogue 10-2014-new
Catalogue 10-2014-new
Qtx 6404
Qtx 6404
Camera QTX-1210
Camera QTX-1210
Brochua đầu ghi hình QTD-6100 Series
Brochua đầu ghi hình QTD-6100 Series
NSRT: Dụng cụ tháo đầu báo
NSRT: Dụng cụ tháo đầu báo
SLV-24N: Đầu báo khói quang
SLV-24N: Đầu báo khói quang
SLV-24N: Đầu báo khói quang
SLV-24N: Đầu báo khói quang
PEX-xx: Bộ hiển thị phụ 5-210 zone cho tủ RPP, RPS, RPQ
PEX-xx: Bộ hiển thị phụ 5-210 zone cho tủ RPP, RPS, RPQ
HRA-1000: Hiển thị phụ cho TT HCP-1008E
HRA-1000: Hiển thị phụ cho TT HCP-1008E
RPP-ABW: TT báo cháy 10-20 kênh
RPP-ABW: TT báo cháy 10-20 kênh
RPP-ECW: TT báo cháy 3-5 kênh
RPP-ECW: TT báo cháy 3-5 kênh
HCP-1008E: TT báo cháy 8-24 kênh
HCP-1008E: TT báo cháy 8-24 kênh
HCV-2/4/8: TT báo cháy 2,4,8 kênh
HCV-2/4/8: TT báo cháy 2,4,8 kênh
Recently uploaded
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
Delhi Call girls
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
Puma Security, LLC
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
BookNet Canada
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
Delhi Call girls
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
Mark Billinghurst
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
Paola De la Torre
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
BookNet Canada
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
2toLead Limited
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
shyamraj55
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Katpro Technologies
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
Padma Pradeep
Azure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & Application
AndikSusilo4
Slack Application Development 101 Slides
Slack Application Development 101 Slides
praypatel2
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
carlostorres15106
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
HostedbyConfluent
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
Ridwan Fadjar
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
Scott Keck-Warren
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
Malak Abu Hammad
Recently uploaded
(20)
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
Breaking the Kubernetes Kill Chain: Host Path Mount
Breaking the Kubernetes Kill Chain: Host Path Mount
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Transcript: #StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
Neo4j - How KGs are shaping the future of Generative AI at AWS Summit London ...
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
Salesforce Community Group Quito, Salesforce 101
Salesforce Community Group Quito, Salesforce 101
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping Elbows
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Factors to Consider When Choosing Accounts Payable Services Providers.pptx
Install Stable Diffusion in windows machine
Install Stable Diffusion in windows machine
Azure Monitor & Application Insight to monitor Infrastructure & Application
Azure Monitor & Application Insight to monitor Infrastructure & Application
Slack Application Development 101 Slides
Slack Application Development 101 Slides
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
Transforming Data Streams with Kafka Connect: An Introduction to Single Messa...
My Hashitalk Indonesia April 2024 Presentation
My Hashitalk Indonesia April 2024 Presentation
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
The Codex of Business Writing Software for Real-World Solutions 2.pptx
The Codex of Business Writing Software for Real-World Solutions 2.pptx
Ceh v5 module 16 virus and worms
1.
Module XVI Virus and
Worms Ethical Hacking Version 5
2.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Module Objective This module will familiarize you with the following: • Virus • History of Virus • Different characteristics and types of virus • Basic symptoms of virus-like attack • Difference between Virus and Worm • Virus Hoaxes • Indications of virus attacks • Basic working and access methods of virus • Various damages caused by virus • Life cycle of virus • Virus Infection • Various virus detection techniques • Top ten virus of 2005 • Virus incident response
3.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Module Flow Introduction to Virus Characteristics and Types of virus Symptoms of Virus attack Access methods of virus Indications of Virus Attack Virus Hoaxes Life cycle of virus Virus Infection Writing a sample Virus code Virus Detection and DefensesAnti-Virus SoftwareVirus incident response
4.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Introduction to Virus Computer viruses are perceived as a threat to both business and personnel Virus is a self-replicating program that produces its own code by attaching copies of itself into other executable codes Operates without the knowledge or desire of the computer user
5.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus History Slammer, Sobig, Lovgate, Fizzer, Blaster/Welchia/Mimail2003 Email-Worm.Win32.Zafi.d, Net-Worm.Win32.Mytob.t2005 I-Worm.NetSky.r, I-Worm.Baqle.au2004 Melissa, Corner, Tristate, & Bubbleboy1999 Strange Brew & Back Orifice1998 Concept1995 AIDS Trojan1989 Brain, PC-Write Trojan, & Virdem1986 First Documented Virus1983 Apple II Virus- First Virus in the wild1981 Virus NameYear of Discovery
6.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Characteristics of a Virus Resides in the memory and replicates itself while the program where it attached, is running Does not reside in the memory after the execution of program Can transform themselves by changing codes to appear different Hides itself from detection by three ways: • Encrypts itself into cryptic symbols • Alters the disk directory data to compensate the additional virus bytes • Uses stealth algorithms to redirect disk data
7.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Working of Virus Trigger events and direct attack are the common modes which cause a virus to “go off” on a target system Most viruses operate in two phases: • Infection Phase: – Virus developers decide when to infect host system’s programs – Some infect each time they are run and executed completely – Ex: Direct Viruses – Some virus codes infect only when users trigger them which include a day, time, or a particular event – Ex: TSR viruses which get loaded into memory and infect at later stages • Attack Phase: – Some viruses have trigger events to activate and corrupt systems – Some viruses have bugs which replicate and perform activities like file deletion, increasing session time – They corrupt the targets only after spreading completely as intended by their developers
8.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Working of Virus: Infection Phase File HeaderFile Header IP IP Start of Program End of Program Virus Jump . EXE File . EXE File Before Infection After Infection Start of Program End of Program Attaching .EXE File to Infect the Programs
9.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Working of Virus: Attack Phase Page: 3Page: 2Page: 1 Page: 3Page: 2Page: 1 Unfragmented File Before Attack Source: www.microsoft.com File: A File: B Page: 1 File: B Page: 3 File: B Page: 1 File: A Page: 2 File: A Page:2 File: B Page: 3 File: A File Fragmentation Due to Virus Attack Slowdown of PC due to Fragmented Files
10.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Why People create computer viruses? Virus writers can have various reasons for creating and spreading malware Viruses have been written as: • Research projects • Pranks • Vandalism • To attack the products of specific companies • To distribute political messages • Financial gain • Identity theft • Spyware • Cryptoviral extortion
11.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Symptoms of Virus-Like Attack If the system acts in an unprecedented manner, you can suspect a virus attack • Example: Processes take more resources and are time consuming However, not all glitches can be attributed to virus attacks • Examples include: – Certain hardware problems – If computer beeps with no display – If one out of two anti-virus programs report virus on the system – If the label of the hard drive change – Your computer freezes frequently or encounters errors – Your computer slows down when programs are started – You are unable to load the operating system – Files and folders are suddenly missing or their content changes – Your hard drive is accessed too often (the light on your main unit flashes rapidly) – Microsoft Internet Explorer "freezes" – Your friends mention that they have received messages from you but you never sent such messages
12.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Hoaxes Hoaxes are false alarms claiming reports about a non-existing virus Warning messages propagating that a certain email message should not be viewed and doing so will damage one’s system In some cases, these warning messages themselves contain virus attachments They possess capability of vast destruction on target systems Being largely misunderstood, viruses easily generate myths. Most hoaxes, while deliberately posted, die a quick death because of their outrageous content
13.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited How is a Worm different from a Virus? There is a difference between general viruses and worms A worm is a special type of virus that can replicate itself and use memory, but cannot attach itself to other programs A worm spreads through the infected network automatically but a virus does not
14.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Indications of Virus Attack Indications of a virus attack: • Programs take longer to load than normal • Computer's hard drive constantly runs out of free space • Files have strange names which are not recognizable • Programs act erratically • Resources are used up easily
15.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Hardware Threats Power Faults: • Sudden power failure, voltage spikes, brownout and frequency shifts cause damage to system System Life: • System gets worn-out over a period of time Equipment Incompatibilities: • These occur due to improperly installed devices Typos: • Data gets corrupted due to deletion or replacement of wrong files Accidental or Malicious Damage: • Data gets deleted or changed accidentally or intentionally by other person Problems with Magnets: • Magnetic fields due to floppy disk, monitor, and telephone can damage stored data
16.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Software Threats Software Problems: • In multitasking environment, software conflicts may occur due to sharing of data by all running programs at the same time • There may be damage of information due to misplacement of data in a program Software Attacks: • Intentionally launched malicious programs enable the attacker to use the computer in an unauthorized manner • General Categories: ―Viruses and worms ―Logic bombs ―Trojans
17.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Damage Virus damage can be grouped broadly under: • Technical Attributes: The technicalities involved in the modeling and use of virus causes damage due to: – Lack of control – Difficulty in distinguishing the nature of attack – Draining of resources – Presence of bugs – Compatibility problems
18.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Damage (cont’d) Virus damage can be further attributed to: • Ethical and Legal Reasons: There are ethics and legalities that rule why virus and worms are damaging • Psychological Reasons: These are: o Trust Problems o Negative influence ―Unauthorized data modification ―Issue of Copyright ―Misuse of the virus ―Misguidance by virus writers
19.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Modes of Virus Infection Viruses infect the system in the following ways: 1. Loads itself into memory and checks for executables on the disk 2. Appends the malicious code to a legitimate program unbeknownst to the user 3. Since the user is unaware of the replacement, he/she launches the infected program 4. As a result of the infected program being executes, other programs get infected as well 5. The above cycle continues until the user realizes the anomaly within the system
20.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Stages of Virus Life Computer virus involves various stages right from its design to elimination Replication Design Launch Detection Incorporation Elimination Users are advised to install anti-virus software updates thus creating awareness among user groups Anti-virus software developers assimilate defenses against the virus A virus is identified as threat infecting target systems It gets activated with user performing certain actions like triggering or running a infected program Virus first replicates for a long period of time within the target system and then spreads itself Developing virus code using programming languages or construction kits
21.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Classification Viruses are classified based on the following criteria: • What they Infect • How they Infect
22.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Classification System Sector or Boot Virus: • Infects disk boot sectors and records File Virus: • Infects executables in OS file system Macro Virus: • Infects documents, spreadsheets and databases such as word, excel and access Source Code Virus: • Overwrites or appends host code by adding Trojan code in it Network Virus: • Spreads itself via email by using command and protocols of computer network
23.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited How does a Virus Infect? Stealth Virus: • Can hide from anti-virus programs Polymorphic Virus: • Can change their characteristics with each infection Cavity Virus: • Maintains same file size while infecting Tunneling Virus: • They hide themselves under anti-virus while infecting Camouflage Virus: • Disguise themselves as genuine applications of user
24.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Storage Patterns of a Virus Shell Virus: • Virus code forms a shell around target host program’s code, making itself the original program and host code as its sub-routine Add-on Virus: • Appends its code at the beginning of host code without making any changes to the latter one Intrusive Virus: • Overwrites the host code partly, or completely with viral code Direct or Transient Virus: • Transfers all the controls to host code where it resides • Selects the target program to be modified and corrupts it Terminate and Stay Resident Virus (TSR): • Remains permanently in the memory during the entire work session even after the target host program is executed and terminated • Can be removed only by rebooting the system
25.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited System Sector Viruses System sectors are special areas on your disk containing programs that are executed when you boot (start) your PC System sectors (Master Boot Record and DOS Boot Record) are often targets for viruses These boot viruses use all of the common viral techniques to infect and hide themselves They rely on infected floppy disk left in the drive when the computer starts, they can also be "dropped" by some file infectors or Trojans
26.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Stealth Virus These viruses evade anti-virus software by intercepting its requests to the operating system A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS The virus can then return an uninfected version of the file to the anti- virus software, so that it appears as if the file is "clean" Give me the system file tcpip.sys to scan Original TCPIP.SYS Infected TCPIP.SYS Here you go ANTI-VIRUS SOFTWARE VIRUS
27.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Bootable CD-ROM Virus These are a new type of virus that destroys the hard disk data content when booted with the infected CD-ROM Example: Someone might give you a LINUX BOOTABLE CD-ROM When you boot the computer using the CD-ROM, all your data is gone No Anti-virus can stop this because AV software or the OS is not even loaded when you boot from a CD-ROM Boot your computer using infected Virus CD-ROM Your C: drive data is destroyed
28.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Self-Modification Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for virus signatures A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses Self-modification viruses employ techniques that make detection by means of signatures difficult or impossible These viruses modify their code on each infection (each infected file contains a different variant of the virus) Explorer.exe sales.jpg Purchase.pdf
29.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Encryption with a Variable Key This type of virus use simple encryption to encipher the code The virus is encrypted with a different key for each infected file AV scanner cannot directly detect these types of viruses using signature detection methods Virus.exe Virus.exe (encrypted)
30.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Polymorphic Code A well-written polymorphic virus therefore has no parts that stay the same on each infection To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) Polymorphic code is a code that mutates while keeping the original algorithm intact
31.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Metamorphic Virus Metamorphic viruses rewrite themselves completely each time they are to infect new executables Metamorphic code is a code that can reprogram itself by translating its own code into a temporary representation, and then back to normal code again For example, W32/Simile consisted of over 14000 lines of assembly code, 90% of it is part of the metamorphic engine
32.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Cavity Virus Cavity Virus overwrites a part of the host file that is filled with a constant (usually nulls), without increasing the length of the file, but preserving its functionality Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Null Sales & Marketing Management is the leading authority for executives in the sales and marketing management industries. The suspect, Desmond Turner, surrendered to authorities at a downtown Indianapolis fast-food restaurant. Original File Size: 45 KB InfectedFile Size: 45 KB
33.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Sparse Infector Virus Sparse infector virus infects only occasionally (e.g. every tenth program executed), or only files whose lengths fall within a narrow range By infecting less often, such viruses try to minimize the probability of being discovered Wake up on 15th of every month and execute code
34.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Companion Virus A Companion virus creates a companion file for each executable file the virus infects Therefore a companion virus may save itself as notepad.com and every time a user executes notepad.exe (good program), the computer will load notepad.com (virus) and therefore infect the system Virus infects the system with a file notepad.com and saves it in c:winntsystem32 directory Notepad.comNotepad.exe
35.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited File Extension Virus File extension viruses change the extensions of files .TXT is safe as it indicates a pure text file With extensions turned off if someone sends you a file named BAD.TXT.VBS you will only see BAD.TXT If you've forgotten that extensions are actually turned off, you might think this is a text file and open it This is really an executable Visual Basic Script virus file and could do serious damage Countermeasure is to turn off “Hide file extensions” in Windows
36.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Famous Viruses /Worms I Love You Virus Love Letter is a Win32-based email worm. It overwrites certain files on the hard drives and sends itself out to everyone in the Microsoft Outlook address book Love Letter arrives as an email attachment named: LOVE- LETTER-FORYOU. TXT.VBS though new variants have different names including VeryFunny.vbs, virus_warning.jpg.vbs, and protect.vbs The virus discussed here are more of a proof of concept, as they have been instrumental in the evolution of both virus and anti-virus programs Classic tool presented here for proof of concept
37.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Melissa Virus Melissa is a Microsoft Word macro virus. Through macros, the virus alters the Microsoft Outlook email program so that the virus gets sent to the first 50 people in the address book It does not corrupt any data on the hard drive or crashes the computer. However, it affects MS Word settings Melissa arrives as an email attachment. The subject of the message containing the virus reads: "Important message from" followed by the name of the person whose email account it was sent from The body of the message reads: Here's the document you asked for...don't show anyone else ;-) Double-clicking the attached Word document (typically named LIST.DOC) will infect the machine Classic tool presented here for proof of concept
38.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Famous Virus/Worms – JS.Spth JavaScript Internet worm Propagates via email, ICQ and P2P networks Kit-Spth is used to produce JS/SPTH worm Infection Strategies: • Ms-OutLook • Morpheus • Grokster • MIrc • pIrc • vIrc • Kazaa • Kazaa-Lite • Bear Share • symLink
39.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Klez Virus Analysis - 1 Klez virus arrives as an email attachment that automatically runs when viewed or previewed in Microsoft Outlook or Outlook Express It is a memory-resident mass-mailing worm that uses its own SMTP engine to propagate via email Its email messages arrive with randomly selected subjects It spoofs its email messages so that they appear to have been sent by certain email accounts, including accounts that are not infected
40.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Klez Virus Analysis - 2 Klez Virus arrives via E-Mail
41.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Klez Virus Analysis - 3 Rebecca double clicks the attached executable in the email Upon execution, this worm drops a copy of itself as WINK*.EXE in the Windows System folder • (Where * is a randomly generated variable length string composed of alphabetical characters. For example, it may drop the copy as WINKABC.EXE) Rebecca’s machine is infected Rebecca
42.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Klez Virus Analysis - 4 Autorun Techniques • This worm creates the following registry entry so that it executes at every Windows startup: • HKEY_LOCAL_MACHINESoftwareMicrosoftWindows CurrentVersionRun Winkabc It registers itself as a process so that it is invisible on the Windows Taskbar On Windows 2000 and XP, it sets itself as a service by creating the following registry entry: • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServ ices Winkabc
43.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Klez Virus Analysis - 5 Payload • Once the victim’s computer is infected, the Klez virus starts propagating itself to other users through Microsoft Outlook contact list John@xxxxxxxx.com peter@xxxxxxxx.com raven@xxxxxxxx.com ravi@xxxxxxxx.com matthew@xxxxxxxx.co m james@xxxxxxxx.com jacob@xxxxxxxx.com karen@xxxxxxxx.com kasen@xxxxxxxx.com bondy@xxxxxxxx.com Klez Virus
44.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Writing a Simple Virus Program 1. Create a batch file Game.bat with the following text • @ echo off • del c:winntsystem32*.* • del c:winnt*.* 2. Convert the Game.bat batch file to Game.com using bat2com utility 3. Send the Game.com file as an email attachment to a victim 4. When the victim runs this program, it deletes core files in WINNT directory making Windows unusable
45.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Construction Kits Virus creation programs and construction kits can automatically generate viruses There are number of Virus construction kits available in the wild Some virus construction kits are: • Kefi's HTML Virus Construction Kit • Virus Creation Laboratory v1.0 • The Smeg Virus Construction Kit • Rajaat's Tiny Flexible Mutator v1.1 • Windows Virus Creation Kit v1.00
46.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Detection Methods Scanning • Once a virus has been detected, it is possible to write scanning programs that look for signature string characteristic of the virus Integrity Checking • Integrity checking products work by reading your entire disk and recording integrity data that acts as a signature for the files and system sectors Interception • The interceptor monitors operating system requests that write to disk
47.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Incident Response 1. Detect the attack: Not all anomalous behavior can be attributed to Viruses 2. Trace processes using utilities such as handle.exe, listdlls.exe, fport.exe, netstat.exe, pslist.exe, and map commonalities between affected systems 3. Detect the virus payload by looking for altered, replaced, or deleted files. New files, changed file attributes, or shared library files should be checked 4. Acquire the infection vector, isolate it. Update anti-virus and rescan all systems
48.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited What is Sheep Dip ? Slang term for a computer which connects to a network only under strictly controlled conditions, and is used for the purpose of running anti-virus checks on suspect files, incoming messages and so on It may be inconvenient and time-consuming for organizations to give all incoming email attachment a 'health check' but the rapid spread of macro-viruses associated with word processor and spreadsheet documents, such as the 'Resume' virus circulating in May 2000, makes this approach worthwhile
49.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Sheep Dip Computer Run Port Monitor Run File Monitor Run Registry MonitorRun Network Monitor Run the virus in this monitored environment
50.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Analysis - IDA Pro Tool It is a dissembler and debugger tool that supports both Windows and Linux platforms It is an interactive, programmable, extendible, multi-processor Used in the analysis of hostile code and vulnerability research and software reverse engineering Allows automated unpacking/ decrypting of protected binaries
51.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited IDA Pro (Virus Disassembler)
52.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Incident Response 1. Detect the Attack: Not all anomalous behavior can be attributed to Viruses 2. Trace processes using utilities such as handle.exe, listdlls.exe, fport.exe, netstat.exe, pslist.exe, and map commonalities between affected systems 3. Detect the virus payload by looking for altered, replaced or deleted files. Check new files, changed file attributes or shared library files 4. Acquire the infection vector, isolate it. Update anti-virus and rescan all systems
53.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Prevention is Better than Cure Do not accept disks or programs without checking them first using a current version of an anti-viral program Do not leave a floppy disk in the disk drive longer than necessary Do not boot the machine with a disk in the disk drive, unless it is a known “Clean” bootable system disk Keep the anti-virus software up-to-date: upgrade on a regular basis
54.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Anti-Virus Software There are many anti-virus software vendors. Here is a list of some freely available anti-virus software for personal use: • AVG Free Edition • Norton Antivirus • AntiVir Personal Edition • Bootminder • Panda Active Scan One of the preventions against viruses is to install anti-virus software and keep the updates current
55.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Socketshield SocketShield is a zero-day exploit blocker SocketShield can block exploits from entering the computer, regardless of how long it takes for the vendors of vulnerable applications to issue patches http://www.explabs.com
56.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Popular Anti-Virus Packages Aladdin Knowledge Systems http://www.esafe.com/ Central Command, Inc. http://www.centralcomma nd.com/ Computer Associates International, Inc. http://www.cai.com Frisk Software International http://www.f-prot.com/ F-Secure Corporation http://www.f-secure.com Trend Micro, Inc. http://www.trendmicro.co m Norman Data Defense Systems http://www.norman.com Panda Software http://www.pandasoftwar e.com/ Proland Software http://www.pspl.com Sophos http://www.sophos.com
57.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Virus Databases The following databases can be useful if you are looking for specific information about a particular virus Proland - Virus Encylopedia http://www.pspl.com/virus_info/ Norman - Virus Encylopedia http://www.norman.com/Virus/en-us AVG - Virus Encyclopedia http://www.grisoft.com/doc/Virus+Encyclopaedi a/lng/us/tpl/tpl01 Virus Bulletin - Virus Encyclopedia https://www.virusbtn.com/login F-Secure Virus Info Center http://www.f-secure.com/vir-info/ McAfee - Virus Information Library http://vil.mcafee.com/ Panda Software - Virus Encyclopedia http://www.pandasoftware.com/library/ Sophos Virus Information http://www.sophos.com/virusinfo/ Symantec AntiVirus Research Center http://www.symantec.com/avcenter/index.html Trend Micro - Virus Encyclopedia http://www.antivirus.com/vinfo/virusencyclo/de fault.asp
58.
EC-Council Copyright © by
EC-Council All Rights reserved. Reproduction is strictly prohibited Summary Viruses come in different forms Some are mere nuisances, others come with devastating consequences Email worms are self replicating, and clog networks with unwanted traffic Virus codes are not necessarily complex It is necessary to scan the systems/networks for infections on a periodic basis for protection against viruses Antidotes to new virus releases are promptly made available by security companies, and this forms the major countermeasure
Download now