The home personal computer as we know it today can be traced back to the computing architecture designed by John von Neumann back in 1945.  It defined computers as a synergy of hardware and software where the latter provided an instruction set that tells the hardware just what and how to do what it was designed to.  
Many will trace the origins of the computer back to the invention of the abacus.  To the extent that the abacus was a precursor of the binary mathematics that’s at the root of any computing machine language, that may be so.  
But as a tool that does the work we expect, the first computers were purely hardware machines that don’t have an iota of flexibility and were constructed purely as a scientific calculator with very narrow focus.  The way we know computers to behave and act really got its first grounding from von Neumann who devised the stored application or program architectures that’s basic to any computer.
Making Them Smaller
Certain technological milestones paved the way for computers to become what they are today.  The most defining milestone was the emergence of transistors and Integrated circuits in the 60s. Up until the late 50s, computers used vacuum tubes that occupied large rooms or entire building floors. Getting the most computing power for any given volume of space became the trend as computers the size of a large room came down to freezer and ref sizes.
Miniaturization became an essential factor in the market acceptability of computers.  But not at the expense of computing power for sure.  Companies can often allocate the rooms and facilities to support one, no matter how large.  The IBM and Unisys mainframe computers required large rooms, often complexes to house DASD storage arrays each the size of a large washing machine and CPUs the size of 14 cu.ft refrigerators that you often find them in clusters.
A Computer in Every Home
It couldn’t be done at those sizes and the millions you need to have one.  The technological trigger that started the road to home computing came with Intel’s 8080 line of processor chips.  It didn’t make the PC home-bound right away, it will take years for this.  After this last major technical landmark came a slew of developments that made computing power cheaper and their housing a lot smaller.
Of course, not all households could afford the Personal Computer at that time, as only the rich and corporate executives can.  That was in the early 80s.  In another 10 years, the PC will see its place in the home at a rate faster than it took corporations to realize they can’t do without computers.  By then the Intel processing power has increased a hundred fold while remaining as small as it was when it started with the IBM PC.  
The Current Generation
The internet has given rise to a new generation of computing devices that has one clear advantage of computers of the past – true portability.  You can carry a laptop anywhere on the planet and stay connected with your family and colleagues in the office.  Miniaturization has been unrelenting over the last decades, making the power of a mainframe computer reside on a footprint no larger than half the size of a credit card and soldered with related component no bigger than a grade school notebook.
The new generation will see a more of this happening.  Already computer makers are talking about nanotechnologies than can further compress the computer power into even smaller footprints.  Our kids are sure to benefit from them soon.  GP

Computer speed is the currency of high performance computers today. Whenever your computer becomes sluggish or your Internet connection seems too slow, it is clear that your PC is ailing.

You need to do something. Purchase a good keyboard or get yourself a more efficient mouse and an advanced motherboard with a larger hard drive space. Then, you can be absolutely sure of speed on the Internet and on your system too!

Windows XP can carry out tasks in a much speedier way. With a little bit of focus in the right direction, you can make the adjustments to get more speed for your system.

Connection is another important aspect. You need to consider this because connecting properly to the Internet is crucial.

Check out PC Diagnostics. Let the PC diagnostics run smoothly whenever you use it for the first time. Your system registry will be kept clean daily. Do you realize that the majority of PC users don’t even realize the huge size of unnecessary information that clogs the registry?

PC diagnostics software can truly help to bring about a positive change. Although the software deals with small issues; by and large these issues tend to slow the PC down. We will consider a few ways to speed up to a high performance computer.

If you desire a high performance computer, we must bring software into the discussion. Software is akin to a conductor. It tells the computer what to do.

Unfortunately, most computer problems are software related, not hardware related. When computer problems begin, look to the software side first. There is a free utility tool known as Magic Speed. It helps to clean and revive your PC. Just follow the simple steps for using Magic Speed. Always carry out a disk check up as a protective measure.

Magic Speed has a special built-in, licensed, anti-virus engine. It can detect and clean identified viruses and spyware programs as well. Magic Speed fixes errors and checks for correct software locations.

Has your PC turned sluggish and dull over the years? You can change and improve the version of older computers simply by upgrading. It simple and very effective to add RAM if you want a high performance computer.

You must open up and check the sticker on the memory modules. It tells you which type it is. Check whether or not the motherboard is capable of accepting a speedy processor.

It is always a good idea to examine your registry files. They may contain entries that facilitate computer crashes and even computer slow downs. To compact your registry is the best way to speed up the performance of your computer. You could also opt to use registry cleaning tools for further improvements.

Technology has invaded almost every aspect of our lives – from businesses which depends on it to run their processes to education which uses it generously for finding new ways of imparting knowledge as well as increasing its reach.

Those who want to enter into the exciting, ever-changing world and work closely with technology should consider a career in IT. There are different types of computer-related degrees and programs which can train you in a specific area of Information Technology. Here’s a quick look at some of the popular computer degree programs that you can consider to start your career in IT.

Bachelor of Computer Science: This is one of the sought after computer degrees and an apparent choice for many individuals passionate about computers. But before you jump into it, you need to consider if you have the aptitude for this program. A BS in Computer Science requires above average mathematical and analytical skills. As part of your program, you will be learning complex concepts ranging from algorithms and discreet mathematics to programming languages and networking principles. You can choose from a variety of exciting career options like software engineering, network architecture, database management, etc.

A Bachelor of Computer Science degree typically takes about four years to complete, but some colleges also offer it on a fast-track schedule. You can earn this degree on-campus or enroll for online degree at an accredited institution.

Computer Engineering: This is an engineering degree that combines elements of both computer science and electrical engineering. This computer degree program is suited for individuals who want to work on the hardware side of computers. Computer hardware engineers are responsible for designing, developing, testing, installing, and maintaining computer hardware. As a result, a computer engineering degree imparts training in electronic engineering, software design and hardware-software integration. The types of courses it covers include computer architecture and organization, digital electronics, circuit analysis, embedded systems, etc. A candidate’s science and math skills need to be strong for this degree as well.

Computer Programming: This computer degree is the most pertinent choice for individuals who are singularly focused on programming. A lot of aspiring programmers gravitate towards this program because it combines the study of programming languages with courses on databases, networks, and Internet applications. This type of degree is available at the Associate’s, Bachelor’s as well as at the Master’s level. An Associate’s degree in Computer Programming is the preferred choice for students looking for a quick entry into workforce as it can be earned in two years or less.

An Associate’s of Science in Computer Programming degree qualifies graduates for entry-level programming jobs. Programmers or developers, as they are sometimes referred to, are required to convert a software design into a logical series of instructions called code that will make a computer perform a specific task. In addition to writing new programs, programmers also update, repair, and modify existing programs.

 

Computer Technology and Networking: This is another computer degree program that has captured the interest of many students aspiring to become a computer technician. As a computer technician or a support specialist, you help people to use their computers. You install software and tools on machines, fix problems when they arise, and are responsible for maintaining system upkeep. A Computer Technology and Networking degree also trains graduates for the job of a network administrator who designs, installs and supports computer systems in an organization. However, it’s possible that you may have to work as a support specialist before you’re offered the role of a network or systems administrator.

This is typically an Associate’s program and can be completed in two years’ time or even less on a flexible schedule from some colleges. Graduates of this program are encouraged to complete additional professional certifications to expand their knowledge and boost their job prospects.

Computer Information Systems: This computer program is also available at the Associate’s, Bachelor’s and Master’s level. Depending on the type of degree you earn, you will be responsible for designing, building, and implementing technology in an organization in order to drive its business forward.

A graduate degree in the field is more focused on the management of information systems in a company. A Master’s degree will qualify you for the role of an information systems manager, who plans and directs all IT-related activities in his or her firm. An Associate’s degree can help graduates obtain entry-level positions, while more responsible and superior roles are reserved for candidates who have a Bachelor’s Degree in CIS.

 

Cloud Slam 2010 is the premier international conference on cloud computing, networking, storage and analysis. The Cloud Slam Conference is global cloud computing event, covering latest trends and innovations in the world of cloud computing. Conference panels, workshops, and tutorials are selected to cover a range of the hottest topics in cloud computing.

Cloud Slam decided to make it a virtual event, since travel reduction and improved decision making are two greatest drivers of visual collaboration and communications. Video conferencing becoming popular in both business and personal communications, so they believe it is the next logical step in the evolution of business communications, and regardless of how quickly the economy improves, video conferencing solutions will continue to grow, simply because of the benefits and convenience they instill in business environments.

The 2nd Annual Virtual Conference on Cloud Computing! It is hosted online March 23-25, 2009.
This conference is the global cloud computing event, covering latest trends and innovations in the world of cloud computing. Conference panels, workshops, and tutorials are selected to cover a range of the hottest topics in cloud computing. Key topics will include the significant benefits of an open cloud, enterprise readiness of SaaS architectures, and the impact of cloud computing on application developers.

The World’s First and Largest Virtual Cloud Computing Summit Will Bring Thought-Leaders From Around the World Together for Five Days – Virtually. The Cloud Slam 10 conference invites writers, editors and industry analysts covering the fields of cloud computing and networking to attend the conference. Cloud Slam 09 provides an unparalleled opportunity to meet and talk with the world’s leading experts in CC.

You are cordially invited to participate in Cloud Slam 2010 through paper submission, a workshop or a special session organization, a tutorial, an invited speech, a demo, a poster, an exhibit, a panel discussion, whichever sounds more appropriate and convenient to you. The conference will include invited presentations by experts from academia, industry, and government as well as contributed paper presentations describing original work on the current state of research cloud computing, their use in business, their design, performance and use, and their applications.

There will also be tutorial sessions, workshops, special sessions, demos, posters, panel discussions. Conference registration is now open. The early bird registration fee is , and available until March 23. General admission is . For more information or to register, visit www.cloudslam10.com.

Twitter URL: http://twitter.com/cloudslam

Free conference calls connect businesses, organizations, and personal groups alike. Some of these services allow moderator functions, such as muting callers, question-and-answer mode, and secure conference PIN codes for moderators and conference participants. Free teleconferences take place all around the world and can have hundreds of callers. Some free conference calls use traditional telephone lines and equipment, while others add in Voice Over Internet Protocol (VOIP) technology to lower company costs and expand accessibility to international users.

Many teleconference services also require callers to dial a conference code and PIN, thus increasing the security of the conference call. It is harder for outsiders to eavesdrop on private calls if they do not know the conference code or PIN to enter.

Uses for teleconference services vary and are quite numerous. For example, people join together in distance support groups. Team leaders for fund drives motivate their members to keep working hard. Instructors hold teleclasses, teleseminars, and self-help sessions. Boards of directors hold staff meetings with attendees all across the country. Business professionals strategize about their next marketing campaign. The list could go on.

In the age of globalization, conference call services have become even more vital. People may work for the same company but live in separate countries. One free conference call could connect hundreds of them together.

In a free conference call that uses traditional telephone lines, many people dial one designated telephone number, and the free service connects all of them together.

VOIP technology may also be used to connect the many telephones. VOIP technology uses the Internet to route voice calls, and VOIP gateways connect computer users with the regular telephone network. For example, a conference participant might use their traditional landline or mobile phone provider to dial the conference telephone number, and have their call answered by a conference service running on a computer with a broadband Internet connection.

There are many free conference call services available on the Internet. Some of these services have standard telephone numbers, while others use only the Internet. To use an Internet-only free conference call service, callers may require special software or hardware. For example, they might call the service using the Internet when they download a program (called a soft phone) or program a hardware-based VOIP telephone to connect to the service.

Learn How Microsoft Is Balancing Information Communication Technology at the 2008 Government Technologies Conference and Expo

March 25, 2008 – Toronto, Canada – John Weigelt, National Technology Officer, Microsoft Canada, will be keynoting at the 2008 Government and Health Technologies Conference and Expo, taking place April 15 -16, 2008 at the Design Exchange in Toronto Ontario.

John Weigelt will discuss the fundamental issues facing government and healthcare today – achieving the right balance between ICT and the growing demands of the technically savvy citizen and business and the critical needs of patients and healthcare workers.

Microsoft believes that the time has come for a serious re-examination of the ICT options facing government and healthcare organizations, with a tide of increasing expectation and massively more technical capability, the trick is to ensure that our governments and hospitals are waving and not drowning in the turbulent mix.

So, register now to learn more about the Microsoft Solutions and Strategies for government and healthcare to embrace technology to meet the needs of patients and citizens alike while improving internal efficiencies and the jobs of your employees. This strategies and solutions are built with research driven data, market-proven Microsoft infrastructure components, uses open standards, and includes a set of common transactions that enable critical functions to be rapidly provided to citizens, patients, businesses and your employees.

This session is designed specifically for Microsoft Canada to gain insight from our strategic Municipal Government Chief Information Officers and Senior IT decision makers around its CGF and its key building blocks impacting Municipalities: Solution Oriented Architecture and Enterprise Application Integration, Communication and Collaboration, Security, Compliance and Privacy, as well as overall management.

The Microsoft Connected Government Framework is designed to assist municipalities to develop corporate infrastructure environments that will support the transformational technology projects across the breadth of their organization. The CGF helps ensure that value invested in current legacy applications continues to be realized while municipalities improve and update their solutions to deliver superior value to the constituents.

To register for Early-Bird Passes please visit http://gov.wowgao.com/registration OR call (416) 292-0038 Ext. 812.

About Microsoft Corporation

Microsoft Corporation (NASDAQ “MSFT”) is the worldwide leader in software, services and Internet technologies for personal and business computing.

Microsoft Canada Co. was founded in 1985. As the Canadian subsidiary of Microsoft Corporation in Redmond, Washington, the company provides sales, marketing, consulting and local support services in French and English. Microsoft Canada has grown from five people in 1985 to more than 900 employees. It also has strong relationships with more than 24,000 partners across Canada. More than 1,100 of these are Microsoft Certified Partners, and over 200 are Gold Certified Partners. Headquartered in Mississauga, Microsoft Canada has regional offices in Toronto, Vancouver, Calgary, Edmonton, Winnipeg, Ottawa, Montreal, Quebec and Halifax.

About the 2008 Government and Health Technologies Conference & Expo:

The 2008 Government and Health Technologies Conference and Expo will focus on the latest IT products and solutions being developed and sought after in the healthcare and public service sector, including Web 2.0, Patient Monitoring Systems, Document Management, Business Intelligence, Mobile Data Systems, RFID Solutions, Biometrics and much more.

As one of Canada’s leading annual IT conference and exposition, the event features ground breaking IT applications that aim to educate key IT professionals, Government officials, developers, architects, engineers and medical professionals with the necessary tools and techniques for the reliable, effective management of all public information services across Canada. For more information about the event, please visit http://gov.wowgao.com

About WowGao Inc.

WowGao Inc. is an award winning leading event management company that produces, since 2003, internationally renowned conferences and expositions that address the latest innovations and developments in the information technology industry. Our featured events include:

Government & Health Technologies Conference and Expo, April 15 & 16, 2008

Wireless & Mobile Expo and Conference, July 15 & 16, 2008

RFID Forum, July 15 & 16, 2008

Financial Services Technology Forum, October 2008

For more information about the events, please visit http://www.wowgao.com/

For conference inquiries:

Conference Producer

(416) 292 – 0038 ext. 840 | conference@wowgao.com

WowGao Inc. | www.wowgao.com

Learn How Microsoft Is Balancing Information Communication Technology at the 2008 Government Technologies Conference and Expo

March 25, 2008 – Toronto, Canada – John Weigelt, National Technology Officer, Microsoft Canada, will be keynoting at the 2008 Government and Health Technologies Conference and Expo, taking place April 15 -16, 2008 at the Design Exchange in Toronto Ontario.

John Weigelt will discuss the fundamental issues facing government and healthcare today – achieving the right balance between ICT and the growing demands of the technically savvy citizen and business and the critical needs of patients and healthcare workers.

Microsoft believes that the time has come for a serious re-examination of the ICT options facing government and healthcare organizations, with a tide of increasing expectation and massively more technical capability, the trick is to ensure that our governments and hospitals are waving and not drowning in the turbulent mix.

So, register now to learn more about the Microsoft Solutions and Strategies for government and healthcare to embrace technology to meet the needs of patients and citizens alike while improving internal efficiencies and the jobs of your employees. This strategies and solutions are built with research driven data, market-proven Microsoft infrastructure components, uses open standards, and includes a set of common transactions that enable critical functions to be rapidly provided to citizens, patients, businesses and your employees.

This session is designed specifically for Microsoft Canada to gain insight from our strategic Municipal Government Chief Information Officers and Senior IT decision makers around its CGF and its key building blocks impacting Municipalities: Solution Oriented Architecture and Enterprise Application Integration, Communication and Collaboration, Security, Compliance and Privacy, as well as overall management.

The Microsoft Connected Government Framework is designed to assist municipalities to develop corporate infrastructure environments that will support the transformational technology projects across the breadth of their organization. The CGF helps ensure that value invested in current legacy applications continues to be realized while municipalities improve and update their solutions to deliver superior value to the constituents.

To register for Early-Bird Passes please visit http://gov.wowgao.com/registration OR call (416) 292-0038 Ext. 812.

About Microsoft Corporation

Microsoft Corporation (NASDAQ “MSFT”) is the worldwide leader in software, services and Internet technologies for personal and business computing.

Microsoft Canada Co. was founded in 1985. As the Canadian subsidiary of Microsoft Corporation in Redmond, Washington, the company provides sales, marketing, consulting and local support services in French and English. Microsoft Canada has grown from five people in 1985 to more than 900 employees. It also has strong relationships with more than 24,000 partners across Canada. More than 1,100 of these are Microsoft Certified Partners, and over 200 are Gold Certified Partners. Headquartered in Mississauga, Microsoft Canada has regional offices in Toronto, Vancouver, Calgary, Edmonton, Winnipeg, Ottawa, Montreal, Quebec and Halifax.

About the 2008 Government and Health Technologies Conference & Expo:

The 2008 Government and Health Technologies Conference and Expo will focus on the latest IT products and solutions being developed and sought after in the healthcare and public service sector, including Web 2.0, Patient Monitoring Systems, Document Management, Business Intelligence, Mobile Data Systems, RFID Solutions, Biometrics and much more.

As one of Canada’s leading annual IT conference and exposition, the event features ground breaking IT applications that aim to educate key IT professionals, Government officials, developers, architects, engineers and medical professionals with the necessary tools and techniques for the reliable, effective management of all public information services across Canada. For more information about the event, please visit http://gov.wowgao.com

About WowGao Inc.

WowGao Inc. is an award winning leading event management company that produces, since 2003, internationally renowned conferences and expositions that address the latest innovations and developments in the information technology industry. Our featured events include:

Government & Health Technologies Conference and Expo, April 15 & 16, 2008

Wireless & Mobile Expo and Conference, July 15 & 16, 2008

RFID Forum, July 15 & 16, 2008

Financial Services Technology Forum, October 2008

For more information about the events, please visit http://www.wowgao.com/

For conference inquiries:

Conference Producer

(416) 292 – 0038 ext. 840 | conference@wowgao.com

WowGao Inc. | www.wowgao.com

Toronto, Canada – GAO Tek Inc. (www.GAOTek.com) has announced the release of its high performance QAM signal tester which is especially useful for digital CATV testing. This portable tester uses a Digital Signal Processing (DSP) and Radio Frequency (RF) technologies to enhance its usability and reliability in testing the parameters of digital TV transmission links.

This high performance QAM signal tester, model GAO771A, effectively and accurately tests channel power, C/N, and MER; it also tests the indexes of analog TV signals such as level and V/A. This portable tester features multi-mode measurements and a high-brightness backlit LCD screen and supports DVB mode. It operates at frequencies from 50MHz to 870MHz and conducts QAM analysis at a symbol rate of 5.361Mbps. The tester can be connected to a computer via a serial port to enable easy storage, analysis and printing of test data.

About GAO Tek Inc.

GAO Tek Inc. (www.GAOTek.com) is a global leader in research, development and manufacturing of high performance telecommunication testers, electronic measurement instruments, embedded development tools and other electronic products that serve the needs of electronic professionals internationally.

About GAO Tek Inc.

GAO Tek Inc. (www.GAOTek.com) is a global leader in research, development and manufacturing of high performance telecommunication testers, electronic measurement instruments, embedded development tools and other electronic products that serve the needs of electronic professionals internationally.

About GAO Tek Inc.

GAO Tek Inc. (www.GAOTek.com) is a global leader in research, development and manufacturing of high performance telecommunication testers, electronic measurement instruments, embedded development tools and other electronic products that serve the needs of electronic professionals internationally.

brief intro on computer virus

A computer virus is a computer program that can copy itself and infect a computer without the permission or knowledge of the owner. The term “virus” is also commonly but erroneously used to refer to other types of malware, adware, and spyware programs that do not have the reproductive ability. A true virus can only spread from one computer to another (in some form of executable code) when its host is taken to the target computer; for instance because a user sent it over a network or the Internet, or carried it on a removable medium such as a floppy disk, CD, DVD, or USB drive. Viruses can increase their chances of spreading to other computers by infecting files on a network file system or a file system that is accessed by another computer. The term “computer virus” is sometimes used as a catch-all phrase to include all types of malware. Malware includes computer viruses, worms, trojan horses, most rootkits, spyware, dishonest adware, crimeware, and other malicious and unwanted software), including true viruses. Viruses are sometimes confused with computer worms and Trojan horses, which are technically different. A worm can exploit security vulnerabilities to spread itself to other computers without needing to be transferred as part of a host, and a Trojan horse is a program that appears harmless but has a hidden agenda. Worms and Trojans, like viruses, may cause harm to either a computer system’s hosted data, functional performance, or networking throughput, when they are executed. Some viruses and other malware have symptoms noticeable to the computer user, but many are surreptitious. Most personal computers are now connected to the Internet and to local area networks, facilitating the spread of malicious code. Today’s viruses may also take advantage of network services such as the World Wide Web, e-mail, Instant Messaging, and file sharing systems to spread.

history

Creeper virus was first detected on ARPANET, the forerunner of the Internet in the early 1970s. 

Creeper was an experimental self-replicating program written by Bob Thomas at BBN in 1971. Creeper used the ARPANET to infect DEC PDP-10 computers running the TENEX operating system. Creeper gained access via the ARPANET and copied itself to the remote system where the message, “I’m the creeper, catch me if you can!” was displayed. The Reaper program was created to delete Creeper.

A program called “Rother J” was the first computer virus to appear “in the wild” — that is, outside the single computer or lab where it was created. Written in 1981 by Richard Skrenta, it attached itself to the Apple DOS 3.3 operating system and spread via floppy disk. This virus was created as a practical joke when Richard Skrenta was still in high school. It was injected in a game on a floppy disk. On its 50th use the Elk Cloner virus would be activated, infecting the computer and displaying a short poem beginning “Elk Cloner: The program with a personality.”

The first PC virus in the wild was a boot sector virus dubbed (c)Brain 

, created in 1986 by the Farooq Alvi Brothers, operating out of Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software they had written. However, analysts have claimed that the Ashar virus, a variant of Brain, possibly predated it based on code within the virus

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk, usually inadvertently. PCs of the era would attempt to boot first from a floppy if one had been left in the drive. Until floppy disks fell out of use, this was the most successful infection strategy and boot sector viruses were the most common in the wild for many years.

Traditional computer viruses emerged in the 1980s, driven by the spread of personal computers and the resultant increase in BBS, modem use, and software sharing. Bulletin board-driven software sharing contributed directly to the spread of Trojan horse programs, and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBS’s. Within the “pirate scene” of hobbyists trading illicit copies of retail software, traders in a hurry to obtain the latest applications were easy targets for viruses.

Macro viruses have become common since the mid-1990s. Most of these viruses are written in the scripting languages for Microsoft programs such as Word and Excel and spread throughout Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most could also spread to Macintosh computers. Although most of these viruses did not have the ability to send infected e-mail, those viruses which did took advantage of the Microsoft Outlook COM interface. Some old versions of Microsoft Word allow macros to replicate themselves with additional blank lines. If two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, can appear as a “mating” of the two and would likely be detected as a virus unique from the “parents.”

A virus may also send a web address link as an instant message to all the contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating.

Cross-site scripting viruses emerged recently, and were academically demonstrated in 2005. Since 2005 there have been multiple instances of the cross-site scripting viruses in the wild, exploiting websites such as My Space, facebook and Yahoo.

Infection strategies

In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user attempts to launch an infected program, the virus’ code may be executed simultaneously. Viruses can be divided into two types based on their behavior when they are executed. Nonresident viruses immediately search for other hosts that can be infected, infect those targets, and finally transfer control to the application program they infected. Resident viruses do not search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operating system itself.

Nonresident viruses

Nonresident viruses can be thought of as consisting of a finder module and a replication module. The finder module is responsible for finding new files to infect. For each new executable file the finder module encounters, it calls the replication module to infect that file.[11]

Resident viruses

Resident viruses contain a replication module that is similar to the one that is employed by nonresident viruses. This module, however, is not called by a finder module. The virus loads the replication module into memory when it is executed instead and ensures that this module is executed each time the operating system is called to perform a certain operation. the replication module can be called, for example, each time the operating system executes a file. In this case the virus infects every suitable program that is executed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file that is accessed. This poses a special problem when using anti-virus software, since a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner fails to notice that such a virus is present in memory the virus can “piggy-back” on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus may slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors, on the other hand, are designed to infect hosts infrequently. Some slow infectors, for instance, only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: they are less likely to slow down a computer noticeably and will, at most, infrequently trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach, however, does not seem very successful.

Vectors and hosts

Viruses have targeted various types of transmission media or hosts. This list is not exhaustive:

Binary executable files (such as COM files and EXE files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux) Volume Boot Records of floppy disks and hard disk partitions The master boot record (MBR) of a hard disk General-purpose script files (such as batch files in MS-DOS and Microsoft Windows, VBScript files, and shell script files on Unix-like platforms). Application-specific script files (such as Telix-scripts) System specific autorun script files (such as Autorun.inf file needed to Windows to automatically run software stored on USB Memory Storage Devices). Documents that can contain macros (such as Microsoft Word documents, Microsoft Excel spreadsheets, AmiPro documents, and Microsoft Access database files) Cross-site scripting vulnerabilities in web applications Arbitrary computer files. An exploitable buffer overflow, format string, race condition or other exploitable bug in a program which reads the file could be used to trigger the execution of code hidden within it. Most bugs of this type can be made more difficult to exploit in computer architectures with protection features such as an execute disable bit and/or address space layout randomization.

PDFs, like HTML, may link to malicious code.[citation needed]PDFs can also be infected with malicious code.

In operating systems that use file extensions to determine program associations (such as Microsoft Windows), the extensions may be hidden from the user by default. This makes it possible to create a file that is of a different type than it appears to the user. For example, an executable may be created named “picture.png.exe”, in which the user sees only “picture.png” and therefore assumes that this file is an image and most likely is safe.

An additional method is to generate the virus code from parts of existing operating system files by using the CRC16/CRC32 data. The initial code can be quite small (tens of bytes) and unpack a fairly large virus. This is analogous to a biological “prion” in the way it works but is vulnerable to signature based detection.

This attack has not yet been seen “in the wild”.

Methods to avoid detection

In order to avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the MS-DOS platform, make sure that the “last modified” date of a host file stays the same when the file is infected by the virus. This approach does not fool anti-virus software, however, especially those which maintain and date Cyclic redundancy checks on file changes.

Some viruses can infect files without increasing their sizes or damaging the files. They accomplish this by overwriting unused areas of executable files. These are called cavity viruses. For example the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because those files have many empty gaps, the virus, which was 1 KB in length, did not add to the size of the file.

Some viruses try to avoid detection by killing the tasks associated with antivirus software before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defending a computer against viruses may demand that a file system migrate towards detailed and explicit permission for every kind of file access.

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti-virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti-virus software. Another type of host that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or by anti-virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus:

Anti-virus professionals can use bait files to take a sample of a virus (i.e. a copy of a program file that is infected by the virus). It is more practical to store and exchange a small, infected bait file, than to exchange a large application program that has been infected by the virus. Anti-virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus can be made to infect a large number of bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus. Some anti-virus software employs bait files that are accessed regularly. When these files are modified, the anti-virus software warns the user that a virus is probably active on the system.

Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of ‘garbage instructions’.

A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti-virus software, so that it seems that the file is “clean”. Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean.

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or (in some cases) “clean” or “heal” the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. Since these would be symmetric keys, stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably isn’t required, since self-modifying code is such a rarity that it may be reason for virus scanners to at least flag the file as suspicious.

An old, but compact, encryption involves XORing each byte in a virus with a constant, so that the exclusive-or operation had only to be repeated for decryption. It is suspicious code that modifies itself, so the code to do the encryption/decryption may be part of the signature in many virus definitions.

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses, however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See Polymorphic code for technical detail on how such engines operate.[12]

Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for anti-virus professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of Assembly language code, 90% of which is part of the metamorphic engine.[13][14]

Vulnerability and countermeasures The vulnerability of operating systems to viruses

Just as genetic diversity in a population decreases the chance of a single disease wiping out a population, the diversity of software systems on a network similarly limits the destructive potential of viruses.

This became a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. The users of Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of viruses. Microsoft software is targeted by virus writers due to their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated and non-integrated Microsoft applications (such as Microsoft Office) and applications with scripting languages with access to the file system (for example Visual Basic Script (VBS), and applications with networking features) are also particularly vulnerable.

Although Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS’s (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their own protected memory space.

An Internet based research revealed that there were cases when people willingly pressed a particular button to download a virus. Security analyst Didier Stevens ran a half year advertising campaign on Google AdWords which said “Is your PC virus-free? Get it infected here!”. The result was 409 clicks.[15][16]

As of 2006[update], there are relatively few security exploits targeting Mac OS X (with a Unix-based file system and kernel).[17] The number of viruses for the older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple stating that there are only four known viruses, and independent sources stating there are as many as 63 viruses. Virus vulnerability between Macs and Windows is a chief selling point, one that Apple uses in their Get a Mac advertising.[18] In January 2009, Symantec announced discovery of a trojan that targets Macs.[19] This discovery did not gain much coverage until April 2009.[19]

Windows and Unix have similar scripting abilities, but while Unix natively blocks normal users from having access to make changes to the operating system environment, older copies of Windows such as Windows 95 and 98 do not. In 1997, when a virus for Linux was released – known as “Bliss” – leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows.[20] The Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly (so it is a trojan), and it can only infect programs that the user has the access to modify. Unlike Windows users, most Unix users do not log in as an administrator user except to install or configure software; as a result, even if a user ran the virus, it could not harm their operating system. The Bliss virus never became widespread, and remains chiefly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked.[21]

The role of software development

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses must exploit software bugs in a system or application to spread. Software development strategies that produce large numbers of bugs will generally also produce potential exploits.

Anti-virus software and other preventive measures

Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or runs the executable. There are two common methods that an anti-virus software application uses to detect viruses. The first, and by far the most common method of virus detection is using a list of virus signature definitions. This works by examining the content of the computer’s memory (its RAM, and boot sectors) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus “signatures”. The disadvantage of this detection method is that users are only protected from viruses that pre-date their last virus definition update. The second method is to use a heuristic algorithm to find viruses based on common behaviors. This method has the ability to detect viruses that anti-virus security firms have yet to create a signature for.

Some anti-virus programs are able to scan opened files in addition to sent and received e-mails ‘on the fly’ in a similar manner. This practice is known as “on-access scanning.” Anti-virus software does not change the underlying capability of host software to transmit viruses. Users must update their software regularly to patch security holes. Anti-virus software also needs to be regularly updated in order to prevent the latest threats.

One may also minimise the damage done by viruses by making regular backups of data (and the Operating Systems) on different media, that are either kept unconnected to the system (most of the time), read-only or not accessible for other reasons, such as using different file systems. This way, if data is lost through a virus, one can start again using the backup (which should preferably be recent).

If a backup session on optical media like CD and DVD is closed, it becomes read-only and can no longer be affected by a virus (so long as a virus or infected file was not copied onto the CD/DVD). Likewise, an operating system on a bootable CD can be used to start the computer if the installed operating systems become unusable. Backups on removable media must be carefully inspected before restoration. The Gammima virus, for example, propagates via removable flash drives.[22][23]

Another method is to use different operating systems on different file systems. A virus is not likely to affect both. Data backups can also be put on different file systems. For example, Linux requires specific software to write to NTFS partitions, so if one does not install such software and uses a separate installation of MS Windows to make the backups on an NTFS partition, the backup should remain safe from any Linux viruses (unless they are written to specifically provide this capability). Likewise, MS Windows can not read file systems like ext3, so if one normally uses MS Windows, the backups can be made on an ext3 partition using a Linux installation.

Recovery methods

Once a computer has been compromised by a virus, it is usually unsafe to continue using the same computer without completely reinstalling the operating system. However, there are a number of recovery options that exist after a computer has a virus. These actions depend on severity of the type of virus.

Virus removal

One possibility on Windows Me, Windows XP and Windows Vista is a tool known as System Restore, which restores the registry and critical system files to a previous checkpoint. Often a virus will cause a system to hang, and a subsequent hard reboot will render a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to corrupt the restore files or also exists in previous restore points.[24] Some viruses, however, disable system restore and other important tools such as Task Manager and Command Prompt. An example of a virus that does this is CiaDoor.

Administrators have the option to disable such tools from limited users for various reasons (for example, to reduce potential damage from and the spread of viruses). The virus modifies the registry to do the same, except, when the Administrator is controlling the computer, it blocks all users from accessing the tools. When an infected tool activates it gives the message “Task Manager has been disabled by your administrator.”, even if the user trying to open the program is the administrator.[citation needed]

Users running a Microsoft operating system can access Microsoft’s website to run a free scan, provided they have their 20-digit registration number.

Operating system reinstallation

Reinstalling the operating system is another approach to virus removal. It involves simply reformatting the OS partition and installing the OS from its original media, or imaging the partition with a clean backup image (Taken with Ghost or Acronis for example).

This method has the benefits of being simple to do, being faster than running multiple antivirus scans, and is guaranteed to remove any malware. Downsides include having to reinstall all other software, reconfiguring, restoring user preferences. User data can be backed up by booting off of a Live CD or putting the hard drive into another computer and booting from the other computer’s operating system (though care must be taken not

 

 

 

 

 

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or devour files on a targeted computer

 

Payloads

Many worms that have been created are only designed to spread, and don’t attempt to alter the systems they pass through. However, as the Morris worm and Mydoom showed, the network traffic and other unintended effects can often cause major disruption. A “payload” is code designed to do more than spread the worm – it might delete files on a host system (e.g., the ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via e-mail. A very common payload for worms is to install a backdoor in the infected computer to allow the creation of a “zombie” computer under control of the worm author – Sobig and Mydoom are examples which created zombies. Networks of such machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or to cloak their website’s address.[1] Spammers are therefore thought to be a source of funding for the creation of such worms,[2][3] and the worm writers have been caught selling lists of IP addresses of infected machines.[4] Others try to blackmail companies with threatened DoS attacks.[5]

Backdoors can be exploited by other malware, including worms. Examples include Doomjuice, which spreads better using the backdoor opened by Mydoom, and at least one instance of malware taking advantage of the rootkit and backdoor installed by the Sony/BMG DRM software utilized by millions of music CDs prior to late 2005.

Worms with good intent

Beginning with the very first research into worms at Xerox PARC there have been attempts to create useful worms. The Nachi family of worms, for example, tried to download and install patches from Microsoft’s website to fix vulnerabilities in the host system – by exploiting those same vulnerabilities. In practice, although this may have made these systems more secure, it generated considerable network traffic, rebooted the machine in the course of patching it, and did its work without the consent of the computer’s owner or user.

Some worms, such as XSS worms, have been written for research to determine the factors of how worms spread, such as social activity and change in user behavior, while other worms are little more than a prank, such as one that sends the popular image macro of an owl with the phrase “O RLY?” to a print queue in the infected computer.

Most security experts regard all worms as malware, whatever their payload or their writers’ intentions

Protecting against dangerous computer worms

Worms spread by exploiting vulnerabilities in operating systems. All vendors supply regular security updates and if these are installed to a machine then the majority of worms are unable to spread to it. If a vendor acknowledges a vulnerability, but has yet to release a security update to patch it, a zero day exploit is possible. However, these are relatively rare.

Users need to be wary of opening unexpected email, and should not run attached files or programs, or visit web sites that are linked to such emails. However, as with the ILOVEYOU worm, and with the increased growth and efficiency of phishing attacks, it remains possible to trick the end-user into running a malicious code.

Anti-virus and anti-spyware software are helpful, but must be kept up-to-date with new pattern files at least every few days. The use of a firewall is also recommended.

In the April-June, 2008, issue of IEEE Transactions on Dependable and Secure Computing, computer scientists describe a potential new way to combat internet worms. The researchers discovered how to contain the kind of worm that scans the Internet randomly, looking for vulnerable hosts to infect. They found that the key is for software to monitor the number of scans that machines on a network sends out. When a machine starts sending out too many scans, it is a sign that it has been infected, allowing administrators to take it off line and check it for viruses

A Trojan horse, or trojan for short, is a term used to describe malware that appears, to the user, to perform a desirable function but, in fact, facilitates unauthorized access to the user’s computer system. The term comes from the Trojan Horse story in Greek mythology. Trojan horses are not self-replicating which distinguishes them from viruses and worms. Additionally, they require interaction with a hacker to fulfil their purpose. The hacker need not be the individual responsible for distributing the Trojan horse. It is possible for hackers to scan computers on a network using a port scanner in the hope of finding one with a Trojan horse installed

Purpose of Trojan horses

Trojan horses are designed to allow a hacker remote access to a target computer system. Once a Trojan horse has been installed on a target computer system it is possible for a hacker to access it remotely and perform operations. The type of operations that a hacker can perform are limited by user privileges on the target computer system and the design of the Trojan horse itself.

Operations which could be performed by a hacker on a target computer system include:

Deletion of files Modification of files Uploading of files Downloading of files Installation of software (including other malware) Data Theft (e.g. passwords, security codes, credit card information) Use of the machine as part of a Botnet (e.g. to perform Distributed Denial-of-service (DDoS) attacks) Keystroke logging Viewing the user’s screen

An example of a Trojan horse attack is one that was reported in 1999:

This Trojan horse was distributed using email. Reports suggest that it was widely distributed and that there were several versions. The email sent to distribute the Trojan horse purported to be from Microsoft Corporation and to offer a free upgrade for Microsoft Internet Explorer. The email did not originate from Microsoft Corporation nor did it provide an upgrade for Microsoft Internet Explorer. The Trojan horse was an executable file named “ie0199.exe” and was provided as an email attachment. One version of the email included the message:

As an user of the Microsoft Internet Explorer, Microsoft Corporation provides you with this upgrade for your web browser. It will fix some bugs found in your Internet Explorer. To install the upgrade, please save the attached file (ie0199.exe) in some folder and run it.

Once installed the Trojan horse reportedly modified system files and attempted to initiate contact with other remote systems.

Installation Software downloads (e.g. A Trojan horse included as part of a software application downloaded from File sharing networks) Websites containing executable content (e.g. A Trojan horse in the form of an ActiveX control) Email attachments Application exploits (Flaws in a web browser, media player, messaging client or other software which can be exploited to allow installation of a Trojan horse) Social Engineering (e.g. A hacker tricking a user into installing a Trojan horse by communicating with them directly)

Additionally, there have been reports of compilers which are themselves Trojan horses. In addition to compiling code to executable form they also insert code into the output executables which cause them to become Trojan horses. This is still distinct from self-replication as the process is not automatic.

Removal

Antivirus software is designed to detect and delete Trojan horses ideally preventing them from ever being installed. It may be possible to remove a Trojan horse manually given a full understanding of how that particular Trojan horse operates, however if it is possible that a Trojan horse has been used by a hacker to access a computer system it will be difficult to know what damage has been done and what other problems have been introduced. In situations where the security of the computer system is critical it is advisable to rebuild it from known good software

 

, created in 1986 by the Farooq Alvi Brothers, operating out of Lahore, Pakistan. The brothers reportedly created the virus to deter pirated copies of software they had written. However, analysts have claimed that the Ashar virus, a variant of Brain, possibly predated it based on code within the virus

Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer, many users regularly exchanged information and programs on floppies. Some viruses spread by infecting programs stored on these disks, while others installed themselves into the disk boot sector, ensuring that they would be run when the user booted the computer from the disk, usually inadvertently. PCs of the era would attempt to boot first from a floppy if one had been left in the drive. Until floppy disks fell out of use, this was the most successful infection strategy and boot sector viruses were the most common in the wild for many years.

Traditional computer viruses emerged in the 1980s, driven by the spread of personal computers and the resultant increase in BBS, modem use, and software sharing. Bulletin board-driven software sharing contributed directly to the spread of Trojan horse programs, and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBS’s. Within the “pirate scene” of hobbyists trading illicit copies of retail software, traders in a hurry to obtain the latest applications were easy targets for viruses.

Macro viruses have become common since the mid-1990s. Most of these viruses are written in the scripting languages for Microsoft programs such as Word and Excel and spread throughout Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most could also spread to Macintosh computers. Although most of these viruses did not have the ability to send infected e-mail, those viruses which did took advantage of the Microsoft Outlook COM interface. Some old versions of Microsoft Word allow macros to replicate themselves with additional blank lines. If two macro viruses simultaneously infect a document, the combination of the two, if also self-replicating, can appear as a “mating” of the two and would likely be detected as a virus unique from the “parents.”

A virus may also send a web address link as an instant message to all the contacts on an infected machine. If the recipient, thinking the link is from a friend (a trusted source) follows the link to the website, the virus hosted at the site may be able to infect this new computer and continue propagating.

Cross-site scripting viruses emerged recently, and were academically demonstrated in 2005. Since 2005 there have been multiple instances of the cross-site scripting viruses in the wild, exploiting websites such as My Space, facebook and Yahoo.

Infection strategies

In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user attempts to launch an infected program, the virus’ code may be executed simultaneously. Viruses can be divided into two types based on their behavior when they are executed. Nonresident viruses immediately search for other hosts that can be infected, infect those targets, and finally transfer control to the application program they infected. Resident viruses do not search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operating system itself.

Nonresident viruses

Nonresident viruses can be thought of as consisting of a finder module and a replication module. The finder module is responsible for finding new files to infect. For each new executable file the finder module encounters, it calls the replication module to infect that file.[11]

Resident viruses

Resident viruses contain a replication module that is similar to the one that is employed by nonresident viruses. This module, however, is not called by a finder module. The virus loads the replication module into memory when it is executed instead and ensures that this module is executed each time the operating system is called to perform a certain operation. the replication module can be called, for example, each time the operating system executes a file. In this case the virus infects every suitable program that is executed on the computer.

Resident viruses are sometimes subdivided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file that is accessed. This poses a special problem when using anti-virus software, since a virus scanner will access every potential host file on a computer when it performs a system-wide scan. If the virus scanner fails to notice that such a virus is present in memory the virus can “piggy-back” on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The disadvantage of this method is that infecting many files may make detection more likely, because the virus may slow down a computer or perform many suspicious actions that can be noticed by anti-virus software. Slow infectors, on the other hand, are designed to infect hosts infrequently. Some slow infectors, for instance, only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: they are less likely to slow down a computer noticeably and will, at most, infrequently trigger anti-virus software that detects suspicious behavior by programs. The slow infector approach, however, does not seem very successful.

Vectors and hosts

Viruses have targeted various types of transmission media or hosts. This list is not exhaustive:

Binary executable files (such as COM files and EXE files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux) Volume Boot Records of floppy disks and hard disk partitions The master boot record (MBR) of a hard disk General-purpose script files (such as batch files in MS-DOS and Microsoft Windows, VBScript files, and shell script files on Unix-like platforms). Application-specific script files (such as Telix-scripts) System specific autorun script files (such as Autorun.inf file needed to Windows to automatically run software stored on USB Memory Storage Devices). Documents that can contain macros (such as Microsoft Word documents, Microsoft Excel spreadsheets, AmiPro documents, and Microsoft Access database files) Cross-site scripting vulnerabilities in web applications Arbitrary computer files. An exploitable buffer overflow, format string, race condition or other exploitable bug in a program which reads the file could be used to trigger the execution of code hidden within it. Most bugs of this type can be made more difficult to exploit in computer architectures with protection features such as an execute disable bit and/or address space layout randomization.

PDFs, like HTML, may link to malicious code.[citation needed]PDFs can also be infected with malicious code.

In operating systems that use file extensions to determine program associations (such as Microsoft Windows), the extensions may be hidden from the user by default. This makes it possible to create a file that is of a different type than it appears to the user. For example, an executable may be created named “picture.png.exe”, in which the user sees only “picture.png” and therefore assumes that this file is an image and most likely is safe.

An additional method is to generate the virus code from parts of existing operating system files by using the CRC16/CRC32 data. The initial code can be quite small (tens of bytes) and unpack a fairly large virus. This is analogous to a biological “prion” in the way it works but is vulnerable to signature based detection.

This attack has not yet been seen “in the wild”.

Methods to avoid detection

In order to avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the MS-DOS platform, make sure that the “last modified” date of a host file stays the same when the file is infected by the virus. This approach does not fool anti-virus software, however, especially those which maintain and date Cyclic redundancy checks on file changes.

Some viruses can infect files without increasing their sizes or damaging the files. They accomplish this by overwriting unused areas of executable files. These are called cavity viruses. For example the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because those files have many empty gaps, the virus, which was 1 KB in length, did not add to the size of the file.

Some viruses try to avoid detection by killing the tasks associated with antivirus software before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defending a computer against viruses may demand that a file system migrate towards detailed and explicit permission for every kind of file access.

Avoiding bait files and other undesirable hosts

A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti-virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti-virus software. Another type of host that viruses sometimes avoid is bait files. Bait files (or goat files) are files that are specially created by anti-virus software, or by anti-virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus:

Anti-virus professionals can use bait files to take a sample of a virus (i.e. a copy of a program file that is infected by the virus). It is more practical to store and exchange a small, infected bait file, than to exchange a large application program that has been infected by the virus. Anti-virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus can be made to infect a large number of bait files. The infected files can be used to test whether a virus scanner detects all versions of the virus. Some anti-virus software employs bait files that are accessed regularly. When these files are modified, the anti-virus software warns the user that a virus is probably active on the system.

Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of ‘garbage instructions’.

A related strategy to make baiting difficult is sparse infection. Sometimes, sparse infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

Stealth

Some viruses try to trick anti-virus software by intercepting its requests to the operating system. A virus can hide itself by intercepting the anti-virus software’s request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti-virus software, so that it seems that the file is “clean”. Modern anti-virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean.

Self-modification

Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or (in some cases) “clean” or “heal” the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is, each infected file contains a different variant of the virus.

Encryption with a variable key

A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module, which would (for example) be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. Since these would be symmetric keys, stored on the infected host, it is in fact entirely possible to decrypt the final virus, but that probably isn’t required, since self-modifying code is such a rarity that it may be reason for virus scanners to at least flag the file as suspicious.

An old, but compact, encryption involves XORing each byte in a virus with a constant, so that the exclusive-or operation had only to be repeated for decryption. It is suspicious code that modifies itself, so the code to do the encryption/decryption may be part of the signature in many virus definitions.

Polymorphic code

Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses, however, this decryption module is also modified on each infection. A well-written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signatures. Anti-virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called mutating engine or mutation engine) somewhere in its encrypted body. See Polymorphic code for technical detail on how such engines operate.[12]

Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for anti-virus professionals to obtain representative samples of the virus, because bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.

Metamorphic code

To avoid being detected by emulation, some viruses rewrite themselves completely each time they are to infect new executables. Viruses that use this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14000 lines of Assembly language code, 90% of which is part of the metamorphic engine.[13][14]

Vulnerability and countermeasures The vulnerability of operating systems to viruses

Just as genetic diversity in a population decreases the chance of a single disease wiping out a population, the diversity of software systems on a network similarly limits the destructive potential of viruses.

This became a particular concern in the 1990s, when Microsoft gained market dominance in desktop operating systems and office suites. The users of Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) are especially vulnerable to the spread of viruses. Microsoft software is targeted by virus writers due to their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated and non-integrated Microsoft applications (such as Microsoft Office) and applications with scripting languages with access to the file system (for example Visual Basic Script (VBS), and applications with networking features) are also particularly vulnerable.

Although Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS’s (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their own protected memory space.

An Internet based research revealed that there were cases when people willingly pressed a particular button to download a virus. Security analyst Didier Stevens ran a half year advertising campaign on Google AdWords which said “Is your PC virus-free? Get it infected here!”. The result was 409 clicks.[15][16]

As of 2006[update], there are relatively few security exploits targeting Mac OS X (with a Unix-based file system and kernel).[17] The number of viruses for the older Apple operating systems, known as Mac OS Classic, varies greatly from source to source, with Apple stating that there are only four known viruses, and independent sources stating there are as many as 63 viruses. Virus vulnerability between Macs and Windows is a chief selling point, one that Apple uses in their Get a Mac advertising.[18] In January 2009, Symantec announced discovery of a trojan that targets Macs.[19] This discovery did not gain much coverage until April 2009.[19]

Windows and Unix have similar scripting abilities, but while Unix natively blocks normal users from having access to make changes to the operating system environment, older copies of Windows such as Windows 95 and 98 do not. In 1997, when a virus for Linux was released – known as “Bliss” – leading antivirus vendors issued warnings that Unix-like systems could fall prey to viruses just like Windows.[20] The Bliss virus may be considered characteristic of viruses – as opposed to worms – on Unix systems. Bliss requires that the user run it explicitly (so it is a trojan), and it can only infect programs that the user has the access to modify. Unlike Windows users, most Unix users do not log in as an administrator user except to install or configure software; as a result, even if a user ran the virus, it could not harm their operating system. The Bliss virus never became widespread, and remains chiefly a research curiosity. Its creator later posted the source code to Usenet, allowing researchers to see how it worked.[21]

The role of software development

Because software is often designed with security features to prevent unauthorized use of system resources, many viruses must exploit software bugs in a system or application to spread. Software development strategies that produce large numbers of bugs will generally also produce potential exploits.

Anti-virus software and other preventive measures

Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or runs the executable. There are two common methods that an anti-virus software application uses to detect viruses. The first, and by far the most common method of virus detection is using a list of virus signature definitions. This works by examining the content of the computer’s memory (its RAM, and boot sectors) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus “signatures”. The disadvantage of this detection method is that users are only protected from viruses that pre-date their last virus definition update. The second method is to use a heuristic algorithm to find viruses based on common behaviors. This method has the ability to detect viruses that anti-virus security firms have yet to create a signature for.

Some anti-virus programs are able to scan opened files in addition to sent and received e-mails ‘on the fly’ in a similar manner. This practice is known as “on-access scanning.” Anti-virus software does not change the underlying capability of host software to transmit viruses. Users must update their software regularly to patch security holes. Anti-virus software also needs to be regularly updated in order to prevent the latest threats.

One may also minimise the damage done by viruses by making regular backups of data (and the Operating Systems) on different media, that are either kept unconnected to the system (most of the time), read-only or not accessible for other reasons, such as using different file systems. This way, if data is lost through a virus, one can start again using the backup (which should preferably be recent).

If a backup session on optical media like CD and DVD is closed, it becomes read-only and can no longer be affected by a virus (so long as a virus or infected file was not copied onto the CD/DVD). Likewise, an operating system on a bootable CD can be used to start the computer if the installed operating systems become unusable. Backups on removable media must be carefully inspected before restoration. The Gammima virus, for example, propagates via removable flash drives.[22][23]

Another method is to use different operating systems on different file systems. A virus is not likely to affect both. Data backups can also be put on different file systems. For example, Linux requires specific software to write to NTFS partitions, so if one does not install such software and uses a separate installation of MS Windows to make the backups on an NTFS partition, the backup should remain safe from any Linux viruses (unless they are written to specifically provide this capability). Likewise, MS Windows can not read file systems like ext3, so if one normally uses MS Windows, the backups can be made on an ext3 partition using a Linux installation.

Recovery methods

Once a computer has been compromised by a virus, it is usually unsafe to continue using the same computer without completely reinstalling the operating system. However, there are a number of recovery options that exist after a computer has a virus. These actions depend on severity of the type of virus.

Virus removal

One possibility on Windows Me, Windows XP and Windows Vista is a tool known as System Restore, which restores the registry and critical system files to a previous checkpoint. Often a virus will cause a system to hang, and a subsequent hard reboot will render a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to corrupt the restore files or also exists in previous restore points.[24] Some viruses, however, disable system restore and other important tools such as Task Manager and Command Prompt. An example of a virus that does this is CiaDoor.

Administrators have the option to disable such tools from limited users for various reasons (for example, to reduce potential damage from and the spread of viruses). The virus modifies the registry to do the same, except, when the Administrator is controlling the computer, it blocks all users from accessing the tools. When an infected tool activates it gives the message “Task Manager has been disabled by your administrator.”, even if the user trying to open the program is the administrator.[citation needed]

Users running a Microsoft operating system can access Microsoft’s website to run a free scan, provided they have their 20-digit registration number.

Operating system reinstallation

Reinstalling the operating system is another approach to virus removal. It involves simply reformatting the OS partition and installing the OS from its original media, or imaging the partition with a clean backup image (Taken with Ghost or Acronis for example).

This method has the benefits of being simple to do, being faster than running multiple antivirus scans, and is guaranteed to remove any malware. Downsides include having to reinstall all other software, reconfiguring, restoring user preferences. User data can be backed up by booting off of a Live CD or putting the hard drive into another computer and booting from the other computer’s operating system (though care must be taken not

 

 

 

 

 

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or devour files on a targeted computer

 

Payloads

Many worms that have been created are only designed to spread, and don’t attempt to alter the systems they pass through. However, as the Morris worm and Mydoom showed, the network traffic and other unintended effects can often cause major disruption. A “payload” is code designed to do more than spread the worm – it might delete files on a host system (e.g., the ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via e-mail. A very common payload for worms is to install a backdoor in the infected computer to allow the creation of a “zombie” computer under control of the worm author – Sobig and Mydoom are examples which created zombies. Networks of such machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or to cloak the

Did you know that you can have free conference calls by using your computer? That’s right. Technology has made it possible for you to have toll free conference calls with an internet connection, a phone service such as Skype and even a web cam. Imagine having free conference calls with your business associates or even your friends and family.

With web cams, it would be like you’re all in the same room even though you may be states or even continents apart. So if you have a computer, an internet connection and you need to make a conference call, get a service that allows you to have free conference calls and save yourself some money.

For Business

One of the things that a free conference call is good for is your business. Traveling all over the world is expensive, especially if you have to do it often. Free conference calls allows you to meet with business associates and even new clients all without leaving your home or your office. If you need to contact several business associates at once, you can use free conference calling to contact everyone at once.

For Personal Use

What if you have family and friends all over the world? It would be expensive for everyone to fly to the same spot just to catch up. That’s where free conference calls come into play. You can meet with your family members or your friends, or all of the above, all with a computer and an internet connection.

No longer do you have to pay for conference calls. You can talk as long as you want to in real time and catch up as much as you need to. Even though you may have a lot of distance between you doesn’t mean you can’t talk as if you’re in the same room. Free conference calls will bring you all together again.

Finding a Service

Some phone companies offer free conference calling but most phone services that you hook up to your computer also allow you to have this free service. You simply hook the system up to your computer and then you can use your internet connection to meet with several people all at the same time. Talk with just your voice or use a web cam for the full experience. There’s nothing else like it and there’s no longer an excuse not to stay in contact, especially when the service is absolutely free.

Grid and cloud computing are relatively new concepts in the area of information technology which abstract multiple processing tasks. Abstraction masks the actual intricate processes taking place in systems and represents a user with a simplified interface by which they can manage processes easily.

Cloud computing is an internet based model of provisioning and marketing of IT services, whereby all the shared information and resources like databases, servers etc are provided to end users through the internet. Cloud computing incorporates software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS) as well as Web 2.0.

Grid computing is an innovative approach wherein system resources combine from multiple administrative domains to reach a common goal. It is designed for a mutual sharing of resources. In grid computing, programs divide and farm into pieces as one large system image to several end users.

The fundamental difference between cloud computing versus grid computing:

1. In grid computing, computer resources are made available as a utility which can be turned on/off. Cloud computing is built on this concept and goes one step further to provide on-demand availability of resources.

2. In grid computing, a software is required which can divide a large program into smaller processing units and resources don’t need to always be part of a cloud. In cloud computing the users don’t need to worry about the infrastructure, service location and resource maintenance concepts.

There are many computing architectures within cloud computing and grid computing that have shared characteristics. The technologies are so similar that when making a decision it is extremely important to understand your business needs and requirements. Research will only help you better understand the options available.

To know more about cloud computing versus grid computing, please visit www.jumptothecloud.com