Liren Large Software Subsidy 15/15.iso/s/s045/3.img/TUTORIAL.LS_/TUTORIAL.bin

Text File | 1993-12-21 | 24.5 KB | 554 lines

Introduction to computer viruses
-------------------------------

This section gives a brief introduction to computer viruses:what they
are, how they can spread, and what they can do.


What is a computer virus?
________________________

A computer virusis a program that can "infect" other programs by
modifying themto include a (possibly "evolved") copy of itself.

Viruses canspread themselves, without the knowledge or permission of
theworkstation users, to potentially large numbers of programs onmany
machines.Viruses can also contain instructions that cause damageor
annoyance; the combination of possibly-damaging codewith the ability to
spread is what makes viruses a considerableconcern.

Viruses are not mysterious.They are just computer programs and only do
things thatprograms can do.However, unlike most other programs, they are
specificallydesigned to spread themselves.

Viruses can often spread without any readily visible symptoms.When a
virus is started on a workstation, it canrun any instructions that its
author chooses to include.These instructions can be event-driven effects
(for example, triggeredafter a specific number of executions),time-driven
effects (triggered on a specific date, such asFriday the 13th or Apri
l 1st), or can occur at random.

Depending on the motives of the virus author, a virus can contain
nointentionally harmful or disruptive instructions.Or, it can cause
damage simply byreplicating itself and taking up scarce resources, such
ashard disk space, CPU time, or network connections.Some typical things
that some current Personal Computer (PC)viruses do are:

* Display a message.
* Erase files.
* Scramble data on a hard disk.
* Cause erratic screen behavior.
* Halt the PC.

Many viruses do nothing obvious at all except spread!You cannot rely on
strange behavior to find viruses.The most reliable way to find viruses is
to use competentanti-virus software as discussed later.

The idea of computer viruses was first developedin its current form in
1983.Since then, people have written many viruses.Viruses are a
relatively new problemand require some new approaches to deal with them
effectively.

Although it is possible to write a virus for virtually any computer,the
viruses that are commonly spreading in the world todayare limited to
microcomputers.There are no known viruses in circulationthat run in
native sessions of IBM'sOS/2, AIX, VM, MVS or OS/400 operating
systems.Any of these operating systems that run PC-DOS programs are
capablethough, of spreading PC-DOS viruses,including DOS sessions of
OS/2and the DOS Emulation Mode of AIX.

Infected files can be stored almost anywhere.They can be stored as files
on servers (such as OS/2 LAN servers,AIX LAN servers, or OS/400 network
"folders").Even when they cannot run on the server machine,an infected
file on the server can be run by DOS machineson the network and can
spread the infection to them.


How do virus infections start?
_____________________________

The viruses under discussionenter organizations (such as companies and
businesses)because an infected diskette or programis brought into that
organization.Unlike other security problems, viruses oftenspread from
system to system without anyone's knowledge.Viruses are usually spread
within an organization byinnocent people going about their normal
business activities.

Here is an example.Suppose the organization hires an outside person to
come in andperform some work.Part of that person's work involves working
on one of theorganization's personal computers or microcomputers.The
person brings in a few programs to aid in this work,such as a favorite
text editor.

Without the person having realized it, the text editorwas infected by a
virus.By using that editor on one of the organization's machines,the
virus spread from the editor to one of the programs storedon the
organization's machine, perhaps to a spreadsheet program.The virus has
now entered the organization.

Even after the outside person took their personal programswhen they left,
the virus remained on the machinethat it infected in the spreadsheet
program.When another employee used that spreadsheet subsequently,the
virus spread to another program,such as a directory listing program that
the employeekept on the same diskette as the spreadsheet data files.The
listing program now is also infected.  The infection might spreadto other
computers to which this diskette disk is taken or,if the employee's
personal computer is connected to the organization'snetwork, the employee
might send the listing program to another user overthe network.In either
case, the virus can spread to more users and more machinesusing diskettes
or networks.Each copy of the virus can make multiple copies of itselfand
can infect any program to which it has access.As a result,the virus can
spread widely in the organization.

Each of the infected programs in each of the infected machinescan start
whatever other instructions the virus author intended.If these
instructions are harmful or disruptive,the pervasiveness of the virus
causes the harm to be widespread.


How serious is the problem?
__________________________

Traditional security measures have attempted to limit thenumber of
security incidents to an acceptable level.A single incident of lost files
in a year might be an acceptable loss,for instance.Although this is
important, it only addresses part of the problemof viruses.Because a
single virus could potentially spread throughout anorganization,the
damage it could cause might be much greater than whatcould be caused by
any individual computer user.The problem is that viruses modify software
in an uncontrolled way,which can damage the software.In addition, some
viruses actually tamper with data filesand can damage the data.

Limiting the number of initial virus infections in an organization
isimportant, but it is often not feasible to prevent them entirely.As a
result, it is important to be able to deal with themwhen they occur.

The potential damage is indeed large.By using IBM AntiVirus, and
following the advice given here,our experience is that mostvirus
incidents can be managed with little difficulty.


Anti-virus programs
------------------

In this section, we discuss the principles andfunctions of anti-virus
programs.It is impossible to completely preventsystems from becoming
infected as long as new programs can beintroduced on them or their
existing programs can be modified.It is also impossibleto detect all
possible viruses without error.Therefore, it is always possible
forsystems to become infected.It is important to plan for prevention to
the extent possiblebut equally important to plan forcontainment and
recovery of infections when they do occur.


What are anti-virus programs?
____________________________

To understand anti-virus programs, it is useful to understandthe basic
behavior of known viruses.Generally, all virusesinsert copies of
themselves inone or more of the following:

* Program files (typically stored on diskettes or hard disks).
* Boot records (initialization areas on diskettes or hard disks).

Anti-virus programs take advantage of either the general
characteristicsof all viruses (that they change file or boot records),or
characteristics of specific viruses or classes of viruses.The latter kind
of program examines the systemfor something characteristicof either the
behavior, or the appearance of specific virusesor classes of viruses.When
it finds something with one of these characteristics,it can warn the
user, try to prevent the virus from spreading, and soforth.


Techniques used by anti-virus programs
_____________________________________

This section discusses some of the common techniques used byanti-virus
programs-their advantages and their limitations.It is intended as a
technical introduction for peoplewho want to understand how anti-virus
programs work.


Scanning
_______

When a virus is known and has been analyzed,it is possible to write a
program thatdetects any file or boot record that is infected withthat
virus.In most cases, the detector can simply look for apattern of bytes
found in the virus butnot found in normal programs.Detectors that look
for these patterns of bytes are called scanners.

For many viruses, this pattern is a simple,sequential string of fixed
bytes.For other viruses, more complicated byte patterns are needed.Care
must be taken to ensure that the pattern of bytes isnot also found in
normal programs,or the detector will report a virus when there is none.


Change detection
_______________

Viruses must change files or boot records in order to infect them.A
program that notices when files and boot records changecan be used to
detect viruses even if these viruses werenot previously known.But files
and boot records change for many normal reasonsunrelated to viruses.By
itself, change detection is of limited usefulnessbecause it requires
users to understand which changes are normal and whichchanges indicate a
virus.


Heuristic analysis
_________________

Heuristic analysis attempts to detect viruses bywatching for appearance
or behavior that is characteristicof some class of known viruses.It can
look in files for operations that viruses usebut that are seldom used in
normal programs.Or it can watch forattempts to write to hard disks or
diskettes in unusual ways.

Like change detection, it can potentially detectwhole classes of
viruses,but care must be taken to ensure that normal programsare not
identified as infected.


Verification
___________

The above techniques can indicate that a file or boot recordis infected
with a virus,but by themselves they cannot be surenor can they identify
with certainty which virus it is.Programs that perform this
identification task are called verifiers.Verifiers can be written for
known virusesafter careful analysis of them.


Disinfection
___________

When a virus is found in a file or boot record,it might be possible to
remove it and restore thefile or boot record to its original, uninfected
state.This process is called disinfection.

Some viruses damage the files or boot records that theyinfect so that it
is not possible to disinfect themsuccessfully.It is also possible for two
different viruses to beidentified as the same virus by a scannerand for a
disinfector to work correctly on one virus but not the other.

Because disinfectors change your programs,they must be very reliable.


Resident and non-resident operation
__________________________________

The techniques discussed above can be used in a variety of ways.One
common way for them to be used is in programs thatexamine everything on
your disks, trying to find andeliminate viruses.Another common use is in
resident programs in DOSthat are always actively monitoring your system
for viruses.

Resident programs have the advantage ofchecking programs for infection
every time you run them.Unless they are carefully constructed,they can
cause delays in program loading and execution.

Non-resident programs have the advantage oflooking for and dealing
withviruses on your entire system at one time.They serve as a
complementary function to resident programs.


Automated operation
__________________

If users have to remember to run an anti-virus programperiodically,
experience has shown that they will forget,increasing their risk of
infecting their systems witha virus and of spreading the virus to other
systems.

A better approach is to make sure that the anti-virusprogram operates
automatically.Such programs protect the systemwithout requiring you to
take any explicit action.This protection can be accomplished by
installing resident anti-virusprograms when the system is started and by
running non-residentprograms, either at startup or periodically at a
specified time.


Prevention and detection
_______________________

Detecting that a virus exists and determiningwhat is infected are
important first stepsin taking corrective action in a virus
incident.Preventing a virus from spreading is important in limitingthe
size of the infection.


Missing viruses and false alarms
_______________________________

In general, it is impossible to detect all virusesthat might ever
existand never make mistakes.Virus detectors will always fail to detect
some viruses,incorrectly claim that a normal program is infected,or both.

This failure is not a limitation of current technology.Rather, it can be
proven mathematically.Any claim that a program can detect all possible
virusesand not make mistakes is untrue.

It is possible, on the other hand, to correctlyidentify infections from
all viruses that we currently know.It is also possible to detect large
classes of viruseswithout making mistakes.By carefully balancing accurate
detection withtechniques for avoiding false alarms,the risk due to
viruses can be drastically reduced.


Techniques used by IBM AntiVirus
_______________________________

This section discusses the techniques used byIBM AntiVirus to provide you
with extremely reliablevirus protection.


Change detection and fuzzy scanning
__________________________________

IBM AntiVirus uses change detection for two purposes.The first purposes
is as a starting point for heuristic analysisto detect new viruses, which
is discussed in the next section.The second purpose is to make known
virus detection faster.

Viruses must change files or boot records in orderto infect them.If a
file did not have a virus yesterday when we checked itand if we know that
the file has not changed, thenwe know that it does not have a virus
today.As it is normally used, IBM AntiVirusonly looks in changed and new
filesfor the viruses that it knows about.It is faster to seeif a file has
changed or is new than it is toexamine it for known viruses.This process
speeds up the check.(All specified boot records and files are checked
forchanges and other features,even if they are not examined for known
viruses.)

When IBM AntiVirus looks in files and boot records forknown viruses, it
uses a technique called "fuzzy scanning."This scanning technology used by
IBM AntiVirus looksfor sequences of bytes that indicate the presence of a
virus,as do most scanners.In addition, it recognizes when the sequence of
bytesis almost (but not exactly) matched.An inexact match is likely to
indicate the presence of a variant ofa known virus, and IBM AntiVirus
reports the file or boot recordas probably infectedwhen it shows you the
virus infection report.You will be given the opportunity to removeany
such virus.

This technique allows IBM AntiVirus to detect,and correctly identify, a
wide range of new virus variants.Without additional measures, this "fuzzy
matching" couldlead to more false alarms.IBM AntiVirus keeps its
identifications highly reliableby advanced false alarm elimination,which
is discussed in a subsequent section.


IBM AntiVirus Heuristic analysis
_______________________________

IBM AntiVirus is not limited to detecting viruses thatwe already know
about.It uses heuristic analysis to detect previouslyunknown viruses as
well.It looks for patterns of changes in files,and for features of
programs,that are typical of large classes of known DOS viruses.If it
finds anything that matches these criteria,IBM AntiVirus will report the
files or boot records as"suspicious" when it shows you the virus
infection report.You will be given the opportunity to erase/overwriteany
such suspicious file.

IBM AntiVirus heuristic analysis has been carefullydesigned to avoid
false alarms.It does not report boot records or files as suspiciousjust
because they have changed.Boot records and files change on computers all
the time forreasons unrelated to viruses.It only reports files as
suspiciousif their pattern of change is typical of virus infections.


Verification before disinfection
_______________________________

When IBM AntiVirus finds what appears to be a known virus,it checks every
relevant byte of the virus to determinethat it is exactly as
expected.This check is very important.If the virus can be verified to be
the one expected,then the file or boot record can often be disinfected
safely.If the virus turns out to be different,it might have changed the
file or boot record inunexpected ways.  Attempting to disinfect it
couldresult in a damaged file or boot record.

IBM AntiVirus does not attempt disinfectionif it will result in damaged
files or boot records.Instead, it gives you the option of
erasing/overwritingthe infected files or boot records.In cases where
disinfection could result in damaged files,but it might not,IBM AntiVirus
records this fact in the log fileof your IBM AntiVirus session.You can
then examine these programs in more detailand determine whether you
should restore them from backups.

Some viruses damage programs that they infectand make it impossible to
disinfect them safely.IBM AntiVirus recognizes these casesand deals with
them properly.When it disinfects files and boot records,IBM AntiVirus
does everything it can tomake sure you are not left with malfunctioning
programs.


Thorough examination
___________________

When you do an initial check for viruses,you might be checking only some
of the files or drives on your system.For instance, you might check only
program files,because viruses do not typically infect any other
files.Checking only program files is how IBM AntiVirus is normally
usedand is a good way to minimize the time it takes to do an initia
l check.

If the initial check finds a virus,it is possible there are files  you
have not yetchecked that are also infected.When you do not find all of
the infected files and boot records,it is very likely the virus will
continue to spread onyour system and perhaps spread to other systems as
well.

When IBM AntiVirus finds a virus during the initial check,it can then
check your entire system thoroughly.It checks all files on all local
fixed disks,even if they have not changed,and lets you eliminate any
viruses found.

If your system is infected, it is likely thatthe virus came from a
diskette recentlyor that you have accidentally spread the virus to a
diskette.IBM AntiVirus reminds you to checkall diskettes that you might
have used recently,and lets you eliminate any viruses you find on
them.This check is an important step to take to stop the local spread of
the virus.


Install and forget operation
___________________________

IBM AntiVirus is designed to do the correct thing automatically.You do
not need to develop a detailed understanding ofviruses or anti-virus
technology for IBM AntiVirus toprotect your system.

Unless you change the default settings for IBM AntiVirusyour system will
be checked periodically for viruses,and known viruses that attempt to
spread in DOSwill be detected and stopped.You are notified of any viruses
that are found,and are given recommendations about what to do.


Advanced false alarm elimination
_______________________________

Anti-virus programs should both reduce therisk of your system being
affected by a virusand avoid bothering you if you do not have a virus.IBM
AntiVirus uses a variety of techniques toensure that known viruses are
found and removed reliablyand that variants and unknown viruses are
likely to be foundas well.

IBM has gone to great lengths to eliminate false alarmsfrom IBM
AntiVirus.IBM AntiVirus is tested on a collection of several
hundredmegabytes of normal (uninfected) programs to help ensure
thatcommon programs are not identified as infected.However, this is not
enough.It is impossible to have every program in the world in
thiscollection so there might be a program somewhere that causesproblems.

To help solve this problem, IBM has developed an advancedstatistical
model to characterizewhat normal programs look like.All virus search
patterns used by IBM AntiVirus are tested againstthis model and any that
have too high a chanceof being found in normal programs are rejected,
even if they are not foundin any of the normal programs in the test
collection.

Finally, IBM's internal Personal Computers (PCs) are usedas a test
population.IBM has over 250,000 PCs.We test IBM AntiVirus on a large
numberof these PCs before releasing it to help ensurethat any problems
are found and corrected before you ever see them.


DOS shielding
____________

DOS viruses that infect program files spread when those programs
arestarted under DOS.If you have installed DOS shielding,IBM AntiVirus
will warn you when a program that youare running is infected with common,
known viruses.In addition, it prevents these viruses from spreadingand
lets you run the program as if it was not infected at all.

This has two important benefits.First, you can usually run your critical
applicationseven if you have just discovered that they are infected.It is
not necessary to shut down your system and dealwith the virus immediately
(though it is a good idea).Second, you can usuallyrun IBM AntiVirus from
your fixed disk,even if the system is infected.It is seldom necessary to
shut your system down andrestart from a diskette to handle a virus
infection.Instead, you can tell IBM AntiVirus to remove the virusand
quickly go on with what you were doing.This ability makes it more likely
that the infection is takencare of quickly and safely.

To view the list of viruses that IBM AntiVirus knows about, selectVirus
descriptionsfrom theHelppull-down on the main window.Then selectList of
viruses detected by IBM AntiVirusfrom the help screen.Viruses that are
prevented by the shield are marked on this list.


Intelligent incident management
______________________________

IBM AntiVirus is based on IBM's years of experiencein handling virus
incidents around the world.Dealing with viruses correctly and safely
without the propertraining can be difficult.We have built our anti-virus
expertise right intoIBM AntiVirus so that you can protect your
systemsfrom viruses without becoming a virus expert.

IBM AntiVirus provides default settings thatoffer the right protection
for most systems.If a virus is found, IBM AntiVirus will lead you
throughthe proper steps to remove the virus fromyour system.


IBM AntiVirus products and services
----------------------------------

IBM AntiVirus products andservices are available in several countries
around the world.The details of IBM AntiVirus Services differ fromcountry
to country; they typically offer:

* Site licenses for IBM AntiVirus/DOS and IBM AntiVirus/2,including
  regular updates.
* Support for distributing and installing IBM AntiVirusfrom LAN servers.
* Support for restricting end users from having IBM AntiVirusremove
  viruses, while permitting anti-virus personnel to do so.
* Site license for the IBM Virus Information Manual,a document that
  describes known viruses anddiscusses successful enterprise strategies
  for limiting their spread.
* Assistance in managing virus incidents.

For more information, please consult the list below.In countries that are
not yet listed,please contact your IBM Marketing Representative for more
information.


Canada          For information on IBM AntiVirus Services,call (416)
                946-3786.
Denmark         For information on IBM AntiVirus Services,call (+45) 45
                93 45 45.
Netherlands     For information on IBM AntiVirus Services,call ++31 30
                383816.
United Kingdom  For information on IBM AntiVirus Services,call
                Basingstoke [phone].
United States   For single copies of IBM AntiVirus/DOS or IBM
                AntiVirus/2,call [phone].For information on site
                licensing and IBM AntiVirus Services,call [phone].



For further reading
------------------

The following recommended reading is for thosewho want more information
about viruses and related topics:

 1. Fred Cohen,"Computer Viruses: Theory and Experiment",Computers and
    Security, Vol. 6 (1987) pp. 22-35.This is the first paper that
    defined viruses in theform that they appear today.
 2. Communications of the ACM, Vol. 32 No. 6 (June 1989)has several good
    articles on the Internet Worm incident.
 3. Lance J. Hoffman (ed.),Rogue Programs: Viruses, Worms, and Trojan
    Horses,Van Nostrand Reinhold, New York (1990),ISBN 0-442-00454-0.This
    book is a very good collection of articles spanningmany aspects of
    the virus problem.
 4. Virus Bulletin,published by Virus Bulletin, Ltd.;21 The
    Quadrant;Abingdon Science Park;Abingdon, Oxfordshire OX143YS;England,
    UK.This monthly newsletter can help technical personnelkeep up with
    the PC virus field.