REGARDS,
M.A.HAMEED.
Sunday, January 31, 2010
IF ANY TIME U GET THE VIRUS DONT BE PANIC JUST FOLLOW THIS STEPS AND HOPE U WILL BE GET RIDE OF IT ....IF NOT U CAN JUST COMMENT ME I WILL HELP U ....
In just over a decade, most of us have been familiar with the term computer virus. Even those of us who don't know how to use a computer have heard about viruses through Hollywood films such as Independence Day or Hackers (though Hollywood's depiction of viruses is usually highly inaccurate). International magazines and newspapers regularly have virus-scares as leading stories. There is no doubt that our culture is fascinated by the potential danger of these viruses. Many people believe the worst a virus can do is format your hard disk. In fact, this type of payload is now harmless for those of us who back up our important data. Much more destructive viruses are those which subtly corrupt data. Consider, for example, the effects of a virus that randomly changes numbers in spreadsheet applications by plus or minus 10% at stockbrokers.
But don’t lay the blame for viruses on the technology or the machines that executes that technology. The fundamental truth about computer viruses is that they are a people problem. People create viruses for various reasons. People disseminate virus infections either deliberately or as a result of the very human traits of innocence, ignorance, or carelessness. And the people who are the potential victims of this phenomenon can acquire the knowledge to turn a real threat into a reasonably calculated risk that they can
For Microsoft Office applications, there is a simple safety measure:
Word or Excel will skip loading such a macro if the [SHIFT] key is held down while the file is being loaded from the File/Open dialog box. It does not necessarily work if the file is opened by double-clicking in File Manager or launched from ECSMail or a Web browser.
For example, to open a Word document without automatically executing any macros:
1. Save it to a file
2. Start up Word
3. From the File menu, choose Open and select the file you wish to load
4. Hold down the [SHIFT] key and click on [OK]
5. Keep the [SHIFT] key depressed until the document has finished loading
Follow these steps to get rid of one of these viruses-
1. Power down your system. When you switched on again, boot from a clean, write protected operating system master diskette.
2. Use a virus scanning utility program to scan the files for these programs and identify which have been infected.
3. Delete each of these infected file from the system.
4. Get out your original documentation and disks for the application program. Use them to repeat the installation procedure so that the infected files are replaced by the original non infected versions.
Removing Boot Sector Virus:-
Remember that a boot sector virus attaches itself to instructions in the disk sector, which are loaded in to memory immediately when the system is powered on.
To remove this type of virus you must reverse the infection process, the virus out and reinstalling the original boot sector coding. To do this we must follow the following command:
1. Use the DOS utility called the SYS command as follows
Type the command SYS C: at the A> prompt. If the transfer has been completed smoothly, you get the response
System transferred
2. The SYS command may not always remove the boot sector virus, so you may need to use a program that is designed for this task. one such program is called MDISK and can be downloaded from the computer virus industry Association bulletin board.
3. Third and last option is that to try to back up all your data files before carrying out the next step- reformatting hard disk.
Lots of things can go wrong with computers, with most problems usually arising from software bugs or hardware malfunctions. However, when two or more troublesome virus like symptoms appear at the same time, the odds on an infection increase, that’s when you should check your system for the virus. If you have observed any of the following symptoms of virus infection.
1.Program load take longer than normal.
2.Disk accesses seem to be excessive for very simple tasks.
3.Unusual error message appear.
4.Access lights come on when there is no obvious reason.
5.System memory is reduced.
6.Files mysteriously disappear.
7.Available disk space is reduced for no good reason.
8.Executable programs change size.
9.Icons change in appearance.
A virus is said to be polymorphic if its code appears to be different every time it replicates (though generally each replication of the virus is functionally identical). This is usually achieved by encrypting the body of the virus, and adding a decryption routine which is different for each replication. When a polymorphic virus replicates, a portion of the decryption code is modified.
A portion of virus generally called a mutation engine creates a random encryption key to encrypt the remainder of the virus. The key stored with, the virus, and the mutation engine itself is altered. When an infected program is invoked, the virus uses the stored random key to decrypt the virus. When the virus replicates, a different random key is selected.
Additionally, random, do-nothing blocks of code can be embedded in the program and are shuffled around to further vary the signature. In essence, it looks like a different program to virus scanners.
A virus such as the one just described is easily detected because an infected version of a program is longer than the corresponding uninfected one. One way thwart such a simple means of a detecting a virus is to compress the executable file so that both the infected and uninfected versions are of identical length. The following diagram describes it more clearly.
We assume that program p1 is infected with the virus CV.
When the program is invoked, control passes to its virus, which performs the following steps:
*For each uninfected file p2 that is found, the virus first compress that file to produce p2*, which is shorter than original program by the size of virus.
*A copy of the virus is prep ended to the compressed program.
*The compressed version of the original infected program, p1* is uncompressed.
*The uncompressed original program is executed.
There is particular type of file virus that that many people don't understand. These are the files from the Microsoft Office applications (e.g., MS Word, MS Excel, MS Access, etc.). These programs all have their own macro languages (a BASIC like language) built in. The associated files (MS Word documents or templates and MS Excel spreadsheet files) are usually thought of only as data files so many people are surprised that they can be infected. But these files can contain programs (the macro language) that are executed when you load one of these files into the associated product. The program inside of these files is interpreted by the MS Office application. What is now a language originally began as a very simple macro language that the user could use to combine keystrokes to automate some routine function? The macro language in these products has since grown substantially and now is a fully capable language based on Visual Basic (VBA). Since anything that contains a program can potentially be infected by a virus, these files can harbor viruses.
A micro virus is particularly threatening for a number of reasons:
1. A micro virus is platform independent .virtually all of the macro viruses infect M-S Word documents. Any hardware platform and operating system that supports word can be infected.
2. Macro V infects documents not executable portion of code. Most of the information in the computer is stored in the form of document not program.
3. Macro virus is easily spread. A very common method is by electronic mail.
In terms of sheer number of viruses, these are the most common kind. The simplest file viruses work by locating a type of file that they know how to infect (usually a file name ending in ".COM" or ".EXE") and overwriting part of the program they are infecting. When this program is executed, the virus code executes and infects more files. These overwriting viruses do not tend to be very successful since the overwritten program rarely continues to function correctly and the virus is almost immediately discovered. The more sophisticated file viruses modify the program so that the original instructions are saved and executed after the virus finishes.
Be aware that many file viruses (such as 4096 which is also known as Frodo) also infect overlay files as well as the more usual *.COM and *.EXE files. Overlay files have various extensions, but ".OVR" and ".OVL" are common examples.
