Script & Macro Viruses

Script Viruses - Types and Habitats

Script viruses (sometimes called macro viruses) generally travel embedded in email and office automation documents, although they can be found in web pages as well.

Old fashioned program viruses are usually implemented in executable system code, whereas script viruses are usually written in a powerful high-level language that is compiled and run on the fly. They often have sophisticated functionality and direct interfaces to high level applications such as word processing, spreadsheet, email, and web programs, and can wreak considerable havoc. Since they first surfaced in office automation programs, they are sometimes also called "macro" viruses. Script viruses can also propagate through IRC protocols.

On Microsoft computers, turning on your script checking virus protection is essential. However, keep in mind that there may be an associated performance hit for some applications. Many applications on Windows are written in Visual Basic, and real-time script virus checking can double the time it takes for their usual functions to run. If you find that ordinary functions take an inordinate length of time to complete, you can try temporarily turning this feature off in your anti-virus checker -- but don't forget to turn it back on afterwards!

Active threats. The following types of script viruses are currently the most active and dangerous, on the Windows platform:

Visual Basic is a flexible and powerful programming environment for Microsoft Windows, Office, and Internet applications. Script viruses written in Visual Basic can run throughout the Microsoft architecture, giving them considerable reach and power, and making them the primary virus threat today.

The first widespread Visual Basic script virus was Melissa, which brought down several of the large international corporations for several days in March 1999. Melissa traveled in a Microsoft Word document and ran when the document was opened, then opened the associated Microsoft Outlook email program, read the user's email address book, and then sent email copies of itself to the first fifty names it found. It spread very quickly.

The Melissa virus architecture was quickly followed by many similar variants programmed by hackers around the world, including the ground breaking KAK, the first Visual Basic script virus that triggered as soon as an email was opened. KAK was then followed by BubbleBoy, which triggered if an email was even viewed in the preview pane. A steady stream of Visual Basic script viruses continue to circulate to this day. There are even automated, point and click programs like VBS Love Generator to help hackers produce additional variants. Script viruses which use email to send themselves to others are also a form of worm.

The term "macro virus" is used less often, and generally refers to a virus in an office automation application macro, most commonly a Visual Basic macro in a Microsoft Word or Excel document. Macro viruses can cross system boundaries from Windows to Macintosh computers with MS Office documents. Current versions of Microsoft Office contain strong anti-macro protections to guard against known attacks.
ActiveX is one of Microsoft's distributed application technologies that enable web pages to download programs on the fly with the full power of any executable running on your machine. This makes ActiveX modules especially efficient and powerful, but also a security risk since they can create, change, and delete files, add system programming code, or take any other action your user account is allowed on your computer.

To help mitigate the risk, Microsoft provides a network architecture of encrypted security certificates for ActiveX modules. This network gives you the option of refusing the download of unsigned ActiveX modules from unknown authors, and at least disclosing the signed identity of those modules that you do accept in case they later cause problems. However, this approach is not universally accepted by the general user and professional security communities, and is sometimes called "trust me now, try to catch me later". Users running Internet Explorer on Windows machines should make sure that their browser security settings are set to "disable" for unsigned ActiveX applets, and to "prompt" for signed applets.
Hypothetical threats. The following script viruses are largely theoretical, but illustrate that they can turn up wherever there is scripting code:

Java is a standard cross platform development environment, and is often used to download scripts to add functionality like a clock or chat room interface to a web page. Java was written with a strong security model which protects your computer's data and resources, and it has so far proved remarkably resistant to script virus infection. You can turn Java off in your browser if you want to be extra careful, but it will disable some useful functionality on some web pages.
JavaScript is the standard web programming language. JavaScript also has a well-defined security model that protects data and resources, and the few JavaScript viruses that have been discovered have been mainly theoretical in nature. You can turn JavaScript off in your browser settings if you want to be extra careful, but it will disable functionality on many web pages.
MIME. The first script virus that triggered as soon as an email was opened was a MIME virus that applied to older versions of Netscape Mail, Microsoft Outlook, and Eudora Mail. In a variation on an old hacker technique, the attached MIME file was given a very long name that triggered a bug which allowed the end of the name to be run as a series of instructions, which could then be written to run the virus. However, a fix for the bug was quickly developed for each vulnerable email program, and MIME viruses have so far remained hypothetical.
Others. Several other scripting environments have also had viruses, including Corel Draw, Hypertext Preprocessor, Windows Help, Windows installation files, and Windows registry files. Anywhere there is a script interpreter there is an opportunity for a script virus to run.

Boot & Program Viruses

Boot & Program Viruses - Types and Habitats

Boot and program viruses were the first viruses. They are generally made of executable code that hides inside device boot programs and application programs, and are usually targeted for a specific computer operating system. These were the earliest types of computer viruses, and remained relatively common in the wild until overtaken in 1998 by script and macro viruses.
Boot viruses. Boot viruses hide in the boot code for a media device, such as a disk or CD, and run automatically when the media is loaded since boot programs are always the first code loaded from any device. Boot viruses proliferated on floppy disks and even CD's into the late 1990's, but aren't seen as often these days with the decline in importance of transferable, bootable media.
The first computer boot virus was built by a 15 year old kid namedRich Skrenta in 1982 for Apple II computers. Called “Elk Cloner”, it would activate whenever a floppy disk was booted on a computer, install itself on the computer, and then infect other disks used later. Once every 50 times an infected floppy was inserted in a computer it would display the following message.

Elk Cloner: The program with a personality

It will get on all your disks
It will infiltrate your chips
Yes it's Cloner!

It will stick to you like glue
It will modify ram too
Send in the Cloner!

Skrenta launched the virus into the wild in early 1982 by infecting his school’s computer and giving out disks at a computer club. Since viruses were not yet known and there were no safegaurds, it spread around the country and continued to pop up on Apple II computers for years afterwards.
The first boot virus to infect Microsoft computers was called Brain, created in 1986 by two Pakistani brothers, and displayed the phone number of their computer repair business.
Program viruses. Program viruses can travel on media like a CD or across the Internet by email attachment. They hide in an apparently useful program and then run when the program is opened. They are often called trojan horse viruses, after the hollow wooden horse containing soldiers that Ulysses and the Greeks gave to Minerva during the Trojan war, and from which the soldiers emerged that night to open the gates of the city of Troy to the Greek armies, thereby causing the city's downfall.

Program viruses may be deliberately hidden in a program by the developer, or surreptitiously attached after the fact at some point along its travels from computer to computer. Program viruses are also sometimes the vector of infection for boot viruses and worms.
Virus infection. A greeting card program emailed to you from a friend might display a holiday animation and song, while at the same time installing a remote access virus program that gives a distant hacker control over your computer whenever you're connected to the Internet. Similarly, a shareware program downloaded and emailed to you by another friend might have been infected with a virus on his computer or the server where it was stored.

The first thing a boot or program virus often does is insert commands and settings in the operating system so that they can operate freely, undetected, and unaudited, without warning messages or access log records. Some of them even change the Basic Input Output System (BIOS) that interfaces between the computer's hardware and software to help mask their activities.

The most sophisticated program viruses include "stealth viruses", which encrypt their contents to try and avoid detection by virus protection software, and "polymorphic viruses", which alter their content every time they replicate to try and avoid detection, which exhibits behavior just like real viruses. Most anti-virus programs can still catch most of these types of viruses.

What is IP Address? What is DNS?

For one computer to connect to another computer and transfer information, the IP address of that computer should be known. This IP Address is made of numbers. The 32 Bit IP address is divided into 4 sections of 8 bits each separted by a ‘.’ (dot). Each 8 bit is called an Octet. The value of each Octet will vary between 0 to 255.

For example, 203.116.56.34 is an IP address. As you can see there are four sections each separated by a dot.

Name Vs Number

If someone asks you whose phone number is 98343453 you may not know it. But instead if someone asks you whether you know ‘John peters’ immediately you will remember your friend. The reason is names are easier to remember than numbers. This is human nature.

In internet, there is a need to connect to a lot of different computers daily. If you have to remember the IP address of each computer in the internet, it is impossible. Because IP Address is made of numbers.

That’s why, computer scientists decided to give a name to each of these IP addresses. These computer names that represent IP addresses are called ‘Domain Names’. For example, www.yahoo.com is a domain name. It is easy to remember a name. Isn’t it?

Every computer that connects to the internet has a unique IP Address. Most of the computers especially servers will have a domain name.

DNS – Domain Name System

If you need to connect to a computer in the internet, you can use the IP address of that computer or the Domain Name of that computer.

But the computers need just the IP addresses. For our own convenience we use domain names. Therefore when we use the domain name, for example www.yahoo.com, our computer will first find out the IP address of this domain name and then uses the IP address to connect to it.

Let us assume that the IP address of the computer that you want to connect to is 123.232.231.132 and the domain name of this computer is www.xyz.com .

Now you connect to Internet, open your browser and key in the IP address 123.232.231.132 in the address bar and ‘Enter’. The browser will immediately connect to the computer because the computer knows how to use the IP address.

Now imagine that you typed the domain name www.xyz.com instead of the IP address in the browser. What the computer needs is the IP address not the domain name. Therefore the browser will try to find the IP address for the domain www.xyz.com . For this purpose it will contact the DNS (Domain Name System) server. The DNS server will find the IP address of that domain and will return the IP address to your browser. Then your computer will use that IP address to connect to that computer.

If you type the IP address, the browser will access that site immediately. If you type the domain name, there will be slight delay because the browser has to connect to DNS server first to determine the IP address. If for some reasons this DNS server is down or there is not DNS entry for that domain, then that domain name or website address will not be accessible.

Think Point – Fake security software attacking the web

If you’ve come across Think Point antispyware software – be aware. It is a fake program created with intention to trick scared computer users into purchasing a useless full version.

The infection sources may vary, but most popular ones include installing a video codec on an untrustworthy site, opening an e-mail attachment from a falsified e-mail named after a courier company (such as DHL, or FedEx), pop-up’s, or as even some users reported, while playing a game on Facebook.

After clicking on fake warning messages, a Trojan is installed which opens up a “backdoor” to internet. An automated script does a series of instructions hijacking your browser and changing registry entries that result in an unusable computer – desktop icons are removed, task manager and internet connection is disabled.

Some users may be presented with a Microsoft Security Essentials Alert which is actually created by the Think Point infection. This alert promotes five security programs, including Think Point. While one is given a choice to select, Think Pont will be installed no matter what you choose.

Think Point will perform a computer scan which generates a false report including massive amounts of Trojans, viruses and spyware being found your machine. It is also impossible to run any executable application, because all is blocked by Think Point – a message will be popped up stating that executable file is already infected.

All this is done in order to scare an amateur computer user and force him into purchasing a full version, which costs 90$.

Please print these instructions:

1.       As ThinkPoint infection is not giving any access to the Desktop you must restart Windows. Just after Windows boots up, press CTRL + ALT & DEL on your keyboard at once. This should bring up the Windows Task Manager.

2.       In the Task Manager window select the Processes tab on the top.

3.       Look through the list of processes until you find the hotfix.exe process.

4.       Click left mouse button on it and press END PROCESS button situated at the bottom of the Task manager. Windows should ask you to confirm killing the process, select Yes to terminate hotfix.exe .

5.       Now ThinkPoint was disabled, and you should restore a normal desktop by clicking File menu on the Task manager, select New Task (Run) and type iexplorer.exe in the OPEN field. This will grant you access to the Internet Explorer.

6.       After this you must search and delete the hotfix.exe file on your computer which may be hidden.

7.       If after deleting the file and rebooting the pc you’re still left with a blank desktop repeat step 5. You will need to fix various registry settings or use a popular and trustworthy security program.

Use Password protected ‘Screen Saver’ to increase security

You can give a password to your screen saver and make it active whenever your computer boots up. Those who do not know the password cannot enter your computer. Let us see how you can protect your computer from unwanted users accessing your computer.

To create Screen Save with Password

Right click on the blank space of your desktop and select ‘Properties’. In the new dialog box, click on the ‘Screen Saver’ tab. Select any screen saver of your choice. For example let us assume you chose ’3D Flying Objects’.

Now click on the ‘Password Protected’ check box and select it. Then click on the ‘Change’ button. In the new dialog box that opens key in your password.The effectiveness of the protection depends on your password, therefore select a password that is not easy to guess but is easy for you to remember. It is better to keep a password lengthy. Confirm your password by typing again and click on the ‘OK’ button.

You will see the ‘The password has been successfully changed’ information. Click ‘OK’ and close that box. Then finally click on the ‘OK’ button and close the ‘Properties’ dialog box.

To bring the Screen save shortcut to the desktop

The screen saver will only take effect only when your computer is idle for a specified time without any activity. What if you leave your computer and before the screen saver takes effect somebody else stars using your computer. To prevent this from happening you can create a shortcut to your screen saver and activate it whenever you leave your computer.

To create shortcut to the screen saver in the desktopn right click on the blank space of your computer and click ‘New Shortcut’. You will now see the ‘Create Shortcut’ dialog box, click on ‘Browse’ button and select teh screen saver execution file which can be found at c:/windows/system folder. In the ‘File of type’ drop down list choose ‘All Files’. Now in the list of files, scroll and look for the screen saver file (for eg. 3d flying objects) and double click on it. Then click on the ‘Next’ button then give a suitable name for your shortcut and then click on ‘Finish’ button.

Now the shorcut is visible on the shortcut. Whenever you leave your computer just double click this screen saver shortcut and activate your screen saver. Now if anyone wants to use it, when they move the mouse or click any button on the keyboard, the screen saver will prompt for the password. Since he will not know your password he cannot enter your computer.

To add screen saver shortcut to the windows ‘startup folder’

You may know that the programs inside the starup folder will automatically start when you boot your computer. Now you should bring the desktop screen saver shortcut to this startup folder. The reason is, after you shut down your computer if someone tries to start your computer without your knowledge then the screen saver will automatically prompt for the password.

Start your Windows Explorer. Choose the C:/windows folder and look for the ‘Desktop’ folder. Inside this desktop folder look for the short cut that you created. If the files are not visible then click on the ‘View-Folder Options’ menu, select the ‘View’ tab and select ‘Show all files’ option and click ‘OK’ button. In the file list selct the ’3dfo’ shortcut and copy it (Ctrl + C).

Now goto the Windows/startmenu/programs/startup folder. Now paste it here (Ctrl + V). Now close the windows explorer.

From now on when you boot your computer the screen saver will be activated and prompt for the password. Only if you key in the right password you can enter your computer.

If your friend is a bit clever then he may start your computer in ‘Safe Mode’ and enter your computer. Because in ‘Safe Mode’ it will not prompt for password. Then he can goto the start programs startup folder and delete the screen saver shortcut from that folder.

Now your screen saver will not be active anymore. So bringing the screen saver to start up folder is not a fool proof method. But not many people will go to that extent of starting in safe mode and then deleting the screen saver shotcurt. So you can still use this method.

How to remove hijack virus?

You may have read news about planes being hijacked. For example a passenger plane which is supposed to go to London may be hijacked by terrorists and flown to Turkey. The hijack virus does just that. If you key in a website address in your browser’s address bar and press ‘Enter’ then instead of going to that website the browser may open some other website such as an adult website or an advertisement website or a search engine website. If this happens in your computer then your browser has been infected by a hijack virus.

Why does this happen, you may wonder? This means a hijack virus has entered your computer without your knowledge and is working at its will. You can remove hijack virus and prevent it from happening using some software.

Process Guard is one such software. Just search for this software athttp://www.download.com/ and install it in your computer. This program will guard your computer against these hijack viruses

Free Password Management software

To keep computer files, internet connections and other resources just to ourselves, we use passwords. Some people use the same password for everything. This is a very bad practice. Because if someone comes to know about this password then they will get access to all your resources. There fore it is essential to have different passwords for different purposes. But this poses another problem. It becomes very difficult to remember all these passwords. Some write these passwords in their diary or write on a small paper and keep it on their table. This too is a bad practice. Because it is easy for other people to get hold of this information when you are not around.

If you could keep all your password in a database and then encrypt this database and protect it with a password then all your passwords will be safe. Then you just need to remember this one password, so even if you forget other passwords you can still use this password to open the database and check the password.

You can use a free password management software such as ‘Password Safe‘. You can download password safe from http://sourceforge.net/ and install it in your computer. Then you will never have to remember many passwords.

To create a master password

When you open Password safe for the first time it will ask you for the ‘Safe combination’ which is nothing but the master password for your password database. The safe combination password should be long and contain both numbers and alphabets so that it is difficult to guess. If you give a simple and easy to guess password then password safe will warn you. Now key in the same password again in the ‘Verify’ box and click on ‘OK’.

To add passwords to Password Safe

Click on the ‘Add Entry’ button in Password Safe. In the new dialog box give ‘group name’ (optional) and the title name and then key in your username and password. In the ‘Notes’ section write anything you want to write about the account. Now click on ‘OK’ to add this information to password safe.

As mentioned in the above paragraph add all your passwords one by one. When you close password safe program it will ask you where you want to save this password database in your hard disk. This is only for the first time.

To retrieve the password

If you forgot the password for any file or program and you want to retrive the password from password safe then password safe will first ask you for the ‘master password’. After you give the master password the database will open.

Then click on the ‘title’ for which you want to know the password. Now click on the ‘Copy password to clipboard’ button. Now the password will be copied to the clip board. You can use Ctrl + V to paste it anywhere you want.

When you exit the password safe program, it will automatically clear the password from the clipboard for security reasons.

You can also edit the password if you want.