VULNERABILITIES;
VIRUSES &
SECURITY CONCERNS

Trojan programs infect 
computers by exploiting 
Internet Explorer vulnerabilities.

Virus Types and Actions
Everyone knows that computer viruses, 
like their biological cousins, are 
bad news, but beyond this and perhaps 
a rough understanding very few can 
distinguish one from another or describe 
just how these pests operate. 
To shed some light on the subject, 
following are three main virus forms 
and basic descriptions of what they do.

Macro Viruses 
most often infect Microsoft Office 
documents and other similar document forms; 
they are especially fond of Word, Excel 
and Outlook. They typically employ visual 
basic scripts and are distributed by email. 
Macro virus payloads, which are set in 
motion when an infected application is run, 
are generally not extremely vicious but 
nonetheless are certainly unwelcome and 
at the very least highly annoying to victims. 
The most famous macro virus is Melissa 
who gained infamy in the spring of '99 
by spreading itself via victim Outlook 
address books. Melissa did not cause 
tremendous damage to individual users 
but did substantial damage to large 
corporate networks that were forced 
to shutdown under the onslaught of 
emails produced by its 
multiplicative spreading.

File Infectors 
do their dirty deeds by attaching 
themselves to executable code in 
files with extensions such as 
.com or .exe or in more extreme 
cases these viruses can get into 
operating system execution files 
with extensions including 
.sys, .prg and .dll among others. 
When an infected program or OS 
is run the virus code of the file 
infector gains access to the host 
(victim) system by entering along 
with the legitimate code it has 
attached itself too. Trojan horses 
can propagate as part of file 
infector viruses. 

Boot-sector Infectors 
infect system code such as the 
boot sector of floppies or the 
Master Boot Record on hard drives. 
Once an infected drive 
(floppy or hard drive) 
is booted, these viruses load 
themselves into the system memory 
of victim machines. A process that 
makes users unaware of their presence...
well, at least not at first, but more 
on that a bit later. Once in memory, 
boot-sector infectors can infect any 
file that is executed. 

Worms fall into this category. 
Worms do not alter files but deliver 
their payload by means of propagation 
and are very hard for victims to be 
aware of and usually become evident 
when their intense regeneration grinds 
victim machines down to a halt by 
increasingly eating up system resources. 
The good news is, turning off an 
infected machine purges these 
viruses from system memory. 

Any major anti-virus solution offers 
protection against all three virus types 
described here, however, 
a neglected anti-virus program 
will provide far less protection 
than a properly updated one. 

Hackers, Thieves, 
Terrorism, War, 
Computer Viruses

A recent survey conducted by 
the Opinion Research Corporation 
posed the following question to 
a sample of 1,000 people 
(active consumers) - 
"Which of the following 
has had the most impact 
on your awareness of security issues?" 

The attack on the World Trade Center 
in New York was chosen as the 
number one cause for concern 
by 46% of the respondents, 
followed by 22% identifying 
identity theft, 
a crime often committed via 
the Internet by hackers, 
though it also involves 
less technical digressions 
including intercepting sensitive 
postal mail containing sensitive 
items and data such as issued 
credit cards etc. War ranked 
third at 19% and computer viruses 
polled 4th as the most feared threat 
6% of the time.
Of those surveyed, despite their concerns, 
40% admitting to taking no steps
toward improving their personal security 
within the past 6 months. Of the respondents 
who did take action, 39% reported installing 
anti-virus software, while 21% moved personal 
data to a more secure location and 19% 
reviewed their online service 
provider's security policies. 
The data suggests that while people 
feel anxiety from terrorism and war, 
they see these threats as mostly 
beyond their control, while other threats, 
most notably online threats such as 
viruses and hackers, are areas where 
they can actively improve their protection. 

AZ-TEK TOP 5 LIST
 
WORST ALL-TIME VIRUS TYPES:

1. BUGBEAR

2. BLASTER

3. SOBIG

4. KLEZ

5. NIMDA



And now for something
a *little different... 

WORM_HOBBIT.G
is a Win32 worm
that propagates via
Microsoft Outlook
and the KaZaa network.
In Microsoft Outlook,
it sends itself as an
email message with
the following details: 

Subject: Fwd: Scan your
computer for this
new virus threat...


Message Body:
This is a fix and
removal for the new
internet worm known
as BugBear.
1 in ever 4 
computers in infected
with this virus.
When run, it will
scan your computer
and notify you if
you're infected or not,
then clean if infected.


Attachment: Anti-Bug.exe


To make itself easily
accessible over the
Kazaa network,
this worm copies
itself to the
following folders: 


C:\KaZaa\My Shared Folders 
C:\Program Files\KaZaaMy Shared Folders


Upon execution, it displays
a message box with the title
kn0x 0wnz
and the message
System Not Infected
with Bugbear.


This worm creates copies
of itself in the
Windows directory
as shizzle.exe
and Anti-Bug.exe,
and it adds
a registry entry
that allows it
to execute at
every Windows startup.


It drops a number of
files by certain names,
which could have the
extensions .EXE, .PIF,
.BAT, or .SCR.
It also may choose
filenames from
a lengthy list
of specific possibilities. 


This worm also attempts
to perform a DoS
(Denial of Service)
attack on a
certain Web site
by continuously sends
PING requests to
this site, each
containing 10,000 Bytes.



NOTE: Az-Tek wants to know...
Are YOU interested in
what all of this means?
Send an email to get the details!
Ask Your Az-Tek What?