1. History, Classifications and Structure
PRESENTED BY :
IMRAN AHMED KHAN
University of Texas at Tyler

2.  A computer virus is a computer program
that can replicate itself and spread from one
computer to another.
 A program that alters other programs to
include a copy of itself
 A computer program able to infect other
programs by modifying them to include a
Possibly evolved version of Itself.

3.  Computer virus is a segment of machine code
(typically 200-4000 bytes)
 Do undesirable things ( damages )
 Destructive Software

4.  Search
Search for the Host program.
 Copy
Copy itself into the executable program.
 Anti-Detection
Routines to prevent viruses from being detected.
 Payload
Performs the function(s) for which virus was
designed.

5.  Shell viruses
A shell virus is one that forms a “shell” around the
original code. In effect, the virus becomes the program,
and the original host program becomes an internal
subroutine of the viral code.
 Add-on viruses
They function by appending their code to the host code.
The add-on virus then alters the startup information of
the program, executing the viral code first. The host
code is left almost completely untouched

6.  Intrusive viruses
Intrusive viruses operate by overwriting some or all of the
original host code with viral code. The replacement
might be selective, as in replacing a subroutine with the
virus.

7.  As soon as user run the host program which is
infected.
 Specific date or time.
 Examining user keystrokes for a specific
sequence.
 Some random event.

8. Sample Source Code

9.  Setting up a test machine
 Knowledge of all viruses in detail
 How it infects executable, what to look for to
determine that the executable has been
infected.
 Knowledge of anti-detection techniques.

10.  First generation: Simple
Do Replication only.
Detect easily.
Cannot Hide itself.
 Second generation: Self-recognition
Solved one problem in prior generation viruses.
Prevent unnecessary growth of infected files.
Use of signature.
 Third Generation: Stealth
Hide itself from detection.

11.  Fourth Generation: Armored
Add confusing and unnecessary code to make it more
difficult to analyze and detect the virus code.
Direct attack against Anti-virus software.
 Fifth Generation: Polymorphic
Self mutating viruses.
Their modified version or encrypted version.
Difficult to identify

12. These viruses are not limited to computers or
laptop only. Virus can attack any hand held
device as well.
The more we know about viruses the more we
can protect our devices from it.

13.  http://en.wikipedia.org/wiki/Computer_virus
 http://
www.zdnet.com/blog/bott/the-malware-numbers-game-how-many-viruses-are-out-there/4783
 http://www.symantec.com/security_response/definitions/rapidrelease/detail.jsp?relid=2012-09-05
 http://www.infinitechusa.net/blog/2012/05/01/number-of-viruses/
 http://www.makeuseof.com/tag/history-computer-viruses-worst-today-case-wondering/
 http://www.antivirusworld.com/articles/history.php
 http://www.ehow.com/info_8706914_three-structural-parts-computer-virus.html
 “Computer Viruses as Artificial Life” - Eugene H. Spafford , Department of Computer Sciences
Purdue University