271 lines
13 KiB
Plaintext
271 lines
13 KiB
Plaintext
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
= F.U.C.K. - Fucked Up College Kids - Born Jan. 24th, 1993 - F.U.C.K. =
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
|
||
The Epidemic
|
||
------------
|
||
|
||
Introduction:
|
||
-------------
|
||
|
||
I would like to first off start by giving a defintion of a Computer
|
||
Virus and a Trojan Horse. Although this file will be dealing mainly
|
||
with computer viruses, I thought I would stick in a comment here
|
||
and there about Trojans.
|
||
|
||
Definitions:
|
||
------------
|
||
|
||
COMPUTER VIRUS : a computer program that can infect other computer
|
||
programs by modifying them in such a way as to include a (possibly
|
||
evolved) copy of itself.
|
||
|
||
The correct English plural of "virus" is "viruses." The Latin word is
|
||
a mass noun (like "air"), and there is no correct Latin plural.
|
||
|
||
TROJAN HORSE : a program that does something undocumented which the
|
||
programmer intended, but that the user would not approve of if he knew
|
||
about it. A "Trojan" refers only to a non-replicating malicious program.
|
||
Since it is non-replicating it is seperate from the virus family.
|
||
|
||
To date there are 2500 known viruses. This is an estimate. In all
|
||
actuality there is 2300-3000 viruses depending on how you count them too.
|
||
When placed in families there is over 800 known families of viruses. As
|
||
you can probably guess too, with new viruses being created and old ones
|
||
being modified, that number is going up very rapidly. Some estimate that
|
||
there will be around 20,000 viruses or so by the year 2000. Although
|
||
this is just an opinion, in all actuality it may very well be reached.
|
||
|
||
In the following sections I will go into the different types of computer
|
||
viruses, how to tell if you are infected, how to remove them, and the
|
||
best for last: virus scanners and how they rate.
|
||
|
||
Virus Types:
|
||
------------
|
||
|
||
Viruses infect in two differnt ways. We either have FILE INFECTORS
|
||
or SYSTEM or BOOT-RECORD INFECTORS.
|
||
|
||
File infectors attach themselves to ordinary program files. These
|
||
usually infect other .COM and/or .EXE files. Some have been known,
|
||
though, to infect .SYS, .OVL, and other types of executable files.
|
||
|
||
Breaking it down even further, there are two types of file infectors,
|
||
a NON-RESIDENT or a MEMORY RESIDENT virus. A Non-Resident virus selects
|
||
one or more programs to infect at the time of execution, while a Memory
|
||
Resident virus hides somewhere in memory. The first time a memory resident
|
||
virus infected program is executed it hides in memory, after that it
|
||
begins to infect other programs when they are executed or when ever else
|
||
the virus is programmed to do. Most of the viruses written today are
|
||
memory resident.
|
||
|
||
SYSTEM or BOOT-RECORD INFECTORS are memory resident and infect certain
|
||
system areas on a disk which are not ordinary files. Boot-sector viruses
|
||
infect only the DOS boot sector, and MBR viruses infect the Master Boot
|
||
Record on fixed disks and the DOS boot sector on diskettes. Some examples
|
||
of this type of infector are the Brain, Stoned, and Michelangelo viruses.
|
||
|
||
Some viruses do special 'tricks' in order to hide themselves from
|
||
virus scanners. Three of the most common types of viruses are the
|
||
stealth, self-encrypting, and the even more powerful polymorphic virus.
|
||
|
||
A STEALTH virus is a memory resident virus which hides by monitoring the
|
||
system functions that read files or physical blocks, and make the results
|
||
to be the original uninfected form of the file instead of the actual infected
|
||
form. This makes the virus go undetected by anti-virus scanners.
|
||
|
||
A SELF-ENCRYPTING virus is one which encrypts itself using a key.
|
||
When the virus executes, it uses this key to decrypt itself, and
|
||
then performs the task it was written to do. When completed,
|
||
the virus uses this key to 'lock' itself with encryption.
|
||
|
||
A POLYMORPHIC virus is a virus which produces various copies of itself.
|
||
This makes it hard for virus scanners to detect because usually it
|
||
will not be able to detect all instances of the virus. One method a
|
||
polymorphic virus uses is to choose a variety of different encryption schemes.
|
||
Each one requiring different encryption algorithm. A signature-driven
|
||
virus scanner would have to use several signatures. It would have to
|
||
use one for each encrytion method. Another type of polymorphic virus
|
||
will vary the sequence of instructions by using unessesscary instructions
|
||
like a No Operation instruction. A signature-based virus scanner would
|
||
not be able to reliably identify this sort of virus.
|
||
|
||
The most sophisticated form of polymorphism discovered so far is the
|
||
MtE "Mutation Engine" written by the Bulgarian virus writer Dark Avenger.
|
||
It comes in the form of an object module, and when added to any virus,
|
||
the result will be a polymorphic virus by adding certain call in the code
|
||
and linking it to the mutation engine.
|
||
|
||
Polymorphic viruses have made virus-scanning more difficult than ever.
|
||
Normal signature strings will not be able to pick up these viruses.
|
||
Complex algorithms will have to be created to detect these new viruses.
|
||
|
||
Some viruses use special tricks to make the tracing, disassembling,
|
||
and virus detection more difficult. Probably the first method of
|
||
making an old virus sneak by virus scanners was by PKLITEing them.
|
||
This worked for a while until researchers picked up on this this little
|
||
trick. Then people moved onto LZ-EXE and DIET compressing files, but soon
|
||
these tricks were picked up on. One that is still able to slide by scanners
|
||
is to PGM-PAK a file. As of date, no scanner I have come across has been
|
||
able to pick this one up.
|
||
|
||
How to determine if you have been infected.
|
||
-------------------------------------------
|
||
|
||
A biological virus can only live as long as its host is alive, if it
|
||
kills of its host, then it also dies. This is also true with computer
|
||
viruses. They try to spread as much as possible before they try and
|
||
kill the host computer. This is the best time to try and remove the
|
||
virus before any real damage is done.
|
||
|
||
There are several things you should watch for if you think you might
|
||
be infected with a virus. Changes in a files size, date, and/or contents
|
||
could mean that you are infected. Also, missing RAM could be an
|
||
indicator. Watch for longer disk activity, system slowdown and other
|
||
strange hardware behavior. These factors could mean that you are
|
||
infected with a virus.
|
||
|
||
What to do if you think you are infected.
|
||
-----------------------------------------
|
||
|
||
Use the DOS MEM command. MEM /C will tell you if there are any
|
||
changes in your systems memory. Also CHKDSK or publicly available
|
||
utilities like PMAP or MAPMEM can help you notice any changes
|
||
with system memory.
|
||
|
||
Use several different virus scanners. No one virus scanner is 100%
|
||
perfect. Later in the file I list the results of several different
|
||
virus scanners of 700 various types of viruses. You can use this to
|
||
be a starting guide, and go from there to find out which virus scanner
|
||
you like best.
|
||
|
||
Be sure to scan Upper Memory (640k - 1024k) and High Memory (1024k -
|
||
1088k). It is possible for viruses to locate themselves in these areas,
|
||
so be sure to scan in these locations. Most scanners have a switch
|
||
that will make them check the Upper and High memory locations.
|
||
|
||
Virus Scanners:
|
||
---------------
|
||
|
||
There are many virus scanners out on the market, but only a few
|
||
are actually reliable. Scan (McAfee Associates), F-Prot (Fridrik
|
||
Skulason), and VireX PC (Datawatch) are the most widely known.
|
||
Scan by McAfee Associates is probably used and trusted more than any
|
||
of the other virus scanners out there. It can be easily obtained off of
|
||
any BBS, and updates come out regularly. The problem is, McAfee
|
||
associates are more into marketing than virus prevention. They boast
|
||
that they can detect over 2,149 viruses. Well we have extracted the
|
||
signature strings from Scan v104, and they only have 1131 viruses
|
||
signature strings. What happened to the remaining 569 viruses that
|
||
it supposedly detects? As you will see in the benchmarks that I did
|
||
on the virus scanners later, Scan just isn't as good as some of the
|
||
other virus scanners out there.
|
||
|
||
McAfee Associates claim that there are 2,149 known viruses, and that
|
||
Scan can detect all 2,149 of these. During a conversation with them, I
|
||
asked them how they handle polymorphic viruses, and all they had to say
|
||
was very well, and it uses a special algorithm to detect them.
|
||
|
||
F-Prot claims to pick up 95% of known viruses
|
||
95% of those are picked up by signature strings, but in a few
|
||
cases it uses algorithmic scan techniques for polymorphic viruses
|
||
|
||
BenchMark:
|
||
----------
|
||
|
||
700 Viruses Tested
|
||
|
||
Scan v108 619 infected
|
||
F-prot 2.09d Secure Scan 654 infected, 10 suspicous
|
||
F-prot 2.09d Quick Scan 496 infected, 0 suspicous
|
||
F-Prot 2.09d Huerstic Scan 654 infected, 10 suspicous
|
||
MicroSoft's Dos 6.0 Msav 434 infected
|
||
Virex 2.8 568 infected
|
||
|
||
18 Trojans Tested
|
||
|
||
Scan v108 0
|
||
F-Prot 2.09d Secure Scan 14
|
||
F-Prot 2.09d Quick Scan 0
|
||
F-Prot 2.09d Huerstic Scan 14
|
||
MicroSoft's Dos 6.0 Msav 0
|
||
Virex 2.8 thought 1 trojan was a virus
|
||
|
||
What to do if you are infected.
|
||
-------------------------------
|
||
|
||
Common rule: Do the minimum that you must to restore the system to
|
||
a normal state.
|
||
|
||
This is just common sense. Why low-level format your Hard Drive
|
||
when you could just delete an infected file, or run a virus cleaner
|
||
on it.
|
||
|
||
Start with booting the system from a CLEAN disk. Use your original
|
||
write-protected DOS diskette to boot from. This will keep any boot-
|
||
sector or other viruses from becoming active while booting.
|
||
|
||
If you have a backup of the infected files, and if the backups are
|
||
not infected, then this will be the best and easiest solution. Just
|
||
start copying the backed-up files over the infected files.
|
||
|
||
If back-ups don't exist, or if you just don't want to go through all that
|
||
trouble, then a disinfecting program can be used. Since some viruses
|
||
overwrite the files that they infect, those files can not be replaced
|
||
because of the damage caused by overwriting. If it is possible to
|
||
disinfect the file, then use your favorite virus disinfector.
|
||
|
||
If you have a boot sector infection. Then an easy two-step method
|
||
can be used. First of all replace your MBR (Master Boot Record) by
|
||
using a backup, or by using the FDISK/MBR command. Then use the
|
||
SYS command to replace the DOS boot sector.
|
||
|
||
Virus Prevention:
|
||
-----------------
|
||
|
||
There are many things one can do to help prevent being infected by a
|
||
virus. First off, boot from a clean, write-protected diskette. This
|
||
will prevent any viruses from becomming active during the booting
|
||
process. This should stop most boot sector viruses which become active
|
||
during booting.
|
||
|
||
Another method is to have a memory resident virus scanner. These
|
||
programs monitor any unusual disk activity or 'virus like' instructions.
|
||
Usually you can have different degrees of protection. Ranging from no
|
||
protection to being prompted for approval for any disk writes.
|
||
|
||
You can also write-protect your harddrive. This will stop viruses from
|
||
spreading to the disk that is protected, but it doesn't stop the virus
|
||
from running.
|
||
|
||
Setting the DOS file attributes to READ ONLY doesn't always protect
|
||
from viruses. It may stop some viruses, but most override it, and
|
||
infect as normal.
|
||
|
||
Write protect your floppies. Viruses can't infect a disk when it
|
||
is write protected.
|
||
|
||
<EFBFBD>
|
||
<EFBFBD>Max Headroom<6F>
|
||
<20>
|
||
|
||
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
= Questions, comments, bitches, ideas, etc : z1max@ttuvm1.ttu.edu :FUCK =
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
= Official F.U.C.K. Distribution sites and information =
|
||
= Board Number Other =
|
||
= ----- ------ ----- =
|
||
= Ionic Destruction 215.722.0570 Eastern HQ =
|
||
= Flatline 303.466.5368 Western HQ =
|
||
= Purple Hell 806.791.0747 Southern HQ =
|
||
= Culture Shock 717.652.5851 Dist. =
|
||
= PCI 806.794.1438 Dist. =
|
||
= Celestial Woodlands 806.798.6262 Dist. =
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|
||
= Accounts NOT guaranteed on any F.U.C.K. distribution site. If you are =
|
||
= interested in writing for, or in becoming a distribution site for =
|
||
= F.U.C.K. call the Woodlands, and apply for an account, or mail Max =
|
||
= at z1max@ttuvm1.ttu.edu or on the Woodlands. Knowledge is power... =
|
||
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
|