Computer Virus

Malicious executables are programs designed to infiltrate or damage a computer system without the owner's consent, which have become a serious threat to the security of computer systems. There is an urgent need for effective techniques to detect polymorphic, metamorphic and previously unseen malicious executables of which detection fails in most of the commercial anti-virus software. In this paper, we develop interpretable string based malware detection system (SBMDS), which is based on interpretable string analysis and uses support vector machine (SVM) ensemble with Bagging to classify the file samples and predict the exact types of the malware. Interpretable strings contain both application

The typical antivirus approach consists of waiting for a number of computers to be infected, detecting the virus, designing a solution, and delivering and deploying the solution, in such situation, it is very difficult to prevent every machine from being compromised by virus. This paper shows that to develop new reliable antivirus software some problems must be solved such as: a new method to detect all metamorphic virus copies, new reliable monitoring techniques to discover the new viruses or attaching a digital signature and a certificate to each new software.

This paper presents methods towards making an operating system malicious activity conscious. In addition to the existing focus of operating systems mainly on resource and user management, we propose that an operating system should also try to prevent the execution of malicious code such as viruses and worms. Exploiting the fact that malicious code/programs require services from the operating system provided via system calls, we hypothesized and demonstrated that the operating system is the ideal location where malicious code prevention has to be attempted. Since computer security has a human element as well, in our approach we followed control of malicious activity by forcing them to run with the consent of the user. Our proposal is implemented and tested in a Linux environment and showed good results.

— Recent research work shows that feature fusion technique is not widely used in computer virus detection. Viruses generated from kits like NGVCK are detected effectively using feature fusion approach. Our purpose is to examine various flavours of feature fusion approach in virus detection.

Glitches are moments of disruption; they represent the exposure of technical process, moving away from the binaries of input and output to consider what comes in-between. The growing ubiquity of interconnected systems prompts a desire to understand such intangible networks around the user, an attempt to try and engage with these digital phenomena as alternate forms of ‘presence’ that cannot help but recourse to anthropocentric terms – virus, cloud, render ghost. The frequent ethereality of such language attempts to visualise, embody, and comprehend the profusion of technical systems that we share the atmosphere with, their very terming gesturing to their spectral protrusion into, ostensibly, ‘our’ reality. The eruption of pixels, voxels, and glitches haunts our peripheral vision, a deceptive representation of a far more intangible sphere.

‘Glitches and Ghosts’ seeks to diagnose and analyse contemporary cultural fascinations with the emergence of these digital artefacts, and how their spectral presence has come to define our current technological moment. This symposium aims to bring together researchers who are enticed by the prospect of re-conceptualising definitions of digital-based ontologies as a paradigm to engage with an era of technophobic anxieties and technophilic domination.

We are delighted to announce Dr. Will Slocombe as our keynote. Will’s research ranges between various aspects of twentieth and twenty-first century literature, focusing primarily on Science Fiction (particularly representations of Artificial Intelligence), Postmodernism, and metafictions of experimental literature. His upcoming book Emergent Patterns: Artificial Intelligence and the Structural Imagination is due out in 2019.

We welcome abstracts for 20 minute papers which engage with the confluence of glitches and ghosts within any medium or form. Suggested topics include:

• Digital art – glitch aesthetics, pixels, voxels, drone shadows, distortion etc.
• Détournement and system subversion – e.g. hacker ‘heroes’ and neoliberal dissent.
• Technophobia – network alienation and technological anxieties.
• Glitch and/or ghosts in music – synthwave, sampling, remixes, etc.
• Cloud spectrality, unseen network presences and how we visualise them.
• Ghosts in the machine, electronic voice phenomenon, white noise etc.
• Render ghosts, digital advertising and the disruption of imagined ontologies.
• Doppelgangers, sample image databases and the ‘ownership’ of personal data.
• Unshackled virtual consciousness, e.g. A.I. and the breaking of constraints.
• Disruption of the virtual – glitches, bugs, cheats and other subversions.
• Digital spectres - eternal or lingering existence within the network.
• Viral anxieties and data transmission; conceptualisations of network ‘presence’.
• Secular digitalities, virtual ‘gods’ or spirits and ontological transcendence.
• Permanence and/or ephemerality of data, system collapse and user anxiety.
• Creative practice and the deployment of glitches and/or ghosts within media.
• Remixed ontologies, disruption of identity boundaries and bricolage forms.
• Omnipresent networks, ‘invasive’ devices (i.e. Alexa) and disconnection.
• Machine learning and emergent behaviour from algorithmic structures.

Please submit a 300 word abstract to [email protected] with a 50 word bio-note by 17th February
#glitchesandghosts #glitchconference @GlitchGhosts

In today's information technology world, Viruses are a huge problem for anyone who uses computers. Computer viruses and worms, a program that can spread across computers and networks has gone from being a nuisance to being the cause of the loss of millions of dollars worth of data, and loss of productivity. The writers of these programmes are becoming more adept at it day by day. Corporate viruses are a major problem which costs businesses billions of dollars every year.

Computer viruses have become a major security threat to our work and home PC’s. Their complexity and quantity have increased significantly in recent years, and antivirus companies battle to deal with the solutions that detect and remove them. The aim of the project is to improve awareness of the problem, and solutions. The nature of the work undertaken to meet this aim was a study of the viral code methods,
and to enable a corporation to detect and remove these viruses thoroughly. This involved writing suitable policies, training plans for staff and the selection of specialist software to perform these tasks correctly. The first section explains the types of viruses, the software tools to remove them and guidelines for management and staff that wish to create their own anti-virus strategy. The second section of the project involved creating a generic virus scanner for word macro viruses, the most widespread type of virus problem to date. By exploiting a
common aspect in these viruses, it is possible detect and remove most word viruses both old and new. This could be marketable as a useful anti-virus tool to help combat an increasing security risk.
In conclusion: This project was successful within the scope of the problem, and a steep learning curve was achieved to understand the issues involved. This will continue to be an area of great interest for future work and employment within the field. Published in 1999.

This paper presents a general overview on evolution of concealment methods in computer viruses and defensive techniques employed by anti-virus products. In order to stay far from the anti-virus scanners, computer viruses gradually improve their codes to make them invisible. On the other hand, anti-virus technologies continually follow the virus tricks and methodologies to overcome their threats. In this process, antivirus experts design and develop new methodologies to make them stronger, more and more, every day. The purpose of this paper is to review these methodologies and outline their strengths and weaknesses to encourage those are interested in more investigation on these areas.

In today's information technology world, Viruses are a huge problem for anyone who uses computers. Computer viruses and worms, a program that can spread across computers and networks has gone from being a nuisance to being the cause of the loss of millions of dollars worth of data, and loss of productivity. The writers of these programmes are becoming more adept at it day by day. Corporate viruses are a major problem which costs businesses billions of dollars every year.

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the term biology. The main characteristic of a computer virus is that a virus requires a master file to infect when replicating itself, this is what distinguishes computer viruses from other destructive computer programs. Several categories of computer virus are boot virus, program virus, multipartite virus, stealth/polymorphic virus, metamorphic virus and macro virus.The infected master file is called the host file. Today, a computer virus refers to a program that is capable of self-replicating and spreading by duplicating virus codes into the infected file or document.

Abstract - Grid Computing is a new trend being developed in Information Technology. It helps us take full advantage of processing and storing capacity and other underused resources to provide an environment of high processing capacity and plentiful storing ability and using it to ...

Checksums, long used for random error detection in communications, is now being employed to detect changes for integrity purposes. For example, checksums are being used for the detection of computer viruses [POZ86]. The checksum algorithms for detecting random errors are not sufficient against an entity that wishes to "fool" the checksum mechanism. This entity wants to be able to insert a forgery in place of the original data such that an unsuspecting user does not realize the forgery has occurred. This paper describes checksum algorithms and features of checksum algorithms to deter this type of forgery.

Shortcut virus is a virus which Enters in to your USB flash drive, Hard Disk drive, Memory cards or mobile phone and change your files into shortcuts with the original folder icons. The logic behind your folder becoming short cuts is that, this virus hides your original folders/files in the same removable media and creates the short cut with the same name. If you are also getting the only Shortcut folder when insert the usb drive, memory card on computer. And looking for solution to get rid of this virus, Here we have some tips to remove shortcut virus with format the drive or without any data loss.

A computer virus is a program that replicates itself and spreads to computers with the goal of disrupting or destroying normal computer use. In academic computing, viruses represent a serious problem that costs millions of dollars in losses annually and hinders the free exchange of information so critical to education. Viruses operate in incubation, infection, and destroy phases. The nature, mechanisms, and preventive measures for personal-computer viruses are reviewed. Different procedures are recommended to protect research laboratories, instructional laboratories, and software lending libraries. Tradeoff'sbetween providing adequate protection and not having the security become too burdensome are considered.

Perbedaan sistem politik antara negara satu dengan negara lain, merupakan hal yang wajar karena setiap negara memiliki pengalaman sejarah yang berbedabeda. Setiap negara memiliki ciri-ciri khusus, baik dari segi ideologi, sistem politik, karakter kehidupan sosial, corak kebudayaan, lingkungan alam yang tidak sama dengan bangsa-bangsa lain. Sejarah perjuangan suatu bangsa dan perkembangan politiknya ikut berperan dalam menentukan sistem politik yang dilandasi oleh ideologi, kepribadian bangsa, serta kondisi ekonomi, sosial, dan budaya dari negara yang bersangkutan, yang pada akhirnya berpengaruh terhadap system pemerintahan, juga termasuk terhadap badan legislatifnya.

Program jahat dapat merusak sistem komputer. Semakin banyak kegunaan komputer semakin banyak juga ancaman. Ancaman-ancaman canggih terhadap sistem komputer merupakan program yang mengeksploitasi kelemahan sistem komputer. Banyak program jahat yang bisa masuk ke dalam computer yang digunakan menjadi ancaman bagi user. Ancaman itu dibagi menjadi dua kategori, yaitu : 1. Program-program yang memerlukan host program, merupakan program yang tidak dapat berdiri sendiri pada suatu program aplikasi, program utilitas, atau program sistem. 2. Program-program yang tidak memerlukan host program, merupakan program sendiri tidak memerlukan inang yang dapat dijadwalkan oleh sistem operasi. Taksonomi Bowles menghasilkan tipe-tipe program jahat : 1. Bacteria Bacteria adalah suatu program yang mengkonsumsi sumber daya sistem dengan mereplikasi dirinya sendiri. Tujuannya hanya satu yaitu mereplikasi dirinya. Pada program bacteria yang sederhana bacteria hanya bias mengeksekusi dua kopian dirinya secara simultan pada sistem multiprogramming atau menciptakan dua file baru masing-masing kopian file program bacteria kemudian mengkopi dua kali. Bacteria melakukan reproduksi secara eksponensial, dengan cepat mengambil alih pada seluruh kapasitas pemroses. Memori atau ruang disk sehingga mengakibatkan penolakan pengaksesan pengguna ke sumber daya. 2. Virus Virus komputer merupakan buatan mansia yang dapat merugikan orang lain. Virus adalah kode yang ditempelkan dalam satu program yang menyebabkan pengopian dirinya disisipkan ke satu program lain atau lebih. Program menginfeksi program-program lain dengan memodifikasi program itu, termasuk memasukkan kopian program virus yang dapat menginfeksi program lainnya. Selain itu virus biasanya melakukan fungsi yang tak diinginkan. Pada lingkingan jaringan, kemampuan mengakses aplikasi dan layanan-layanan komputer lainnya termasuk fasilitas sempurna penyebaran virus. 3. Worm Worm merupakan program yang dapat mereplikasikan dirinya kemudian mengirim kopian-kopian dari komputer ke komputer lain melalui hubungan jaringan. Begitu tiba,

A file system of Ubuntu operating system can conserve and manage a lot of configuration information and the information with forensic importance. Mining and analyzing the useful data of the Ubuntu operating system have become essential with the rise of the attack on the computer system. Investigating the File System can help to collect information relevant to the case. After considering existing research and tools, this paper suggests a new evidence collection and analysis methodology and the UbuntuForensic tool to aid in the process of digital forensic investigation of Ubuntu File System. The paper also discusses a technique for the identification of the files modified by the criminal.

This electronic edition of The Little Black Book of Computer Viruses is
copyright 1996 by Mark A. Ludwig. This original Adobe Acrobat file
may be copied freely in unmodified form. Please share it, upload it,
download it, etc. This document may not be distributed in printed form
or modified in any way without written permission from the publisher.

The Little Black Book of Computer Viruses has seen five
good years in print. In those five years it has opened a door to
seriously ask the question whether it is better to make technical
information about computer viruses known or not.
When I wrote it, it was largely an experiment. I had no idea
what would happen. Would people take the viruses it contained and
rewrite them to make all kinds of horrificly destructive viruses? Or
would they by and large be used responsibly? At the time I wrote,
no anti-virus people would even talk to me, and what I could find
in print on the subject was largely unimpressive from a factual
standpoint—lots of hype and fear-mongering, but very little solid
research that would shed some light on what might happen if I
released this book. Being a freedom loving and knowledge seeking
American, I decided to go ahead and do it—write the book and get
it in print. And I decided that if people did not use it responsibly, I
would withdraw it.
Five years later, I have to say that I firmly believe the book
has done a lot more good than harm.
On the positive side, lots and lots of people who desperately
need this kind of information—people who are responsible
for keeping viruses off of computers—have now been able to get
it. While individual users who have limited contact with other
computer users may be able to successfully protect themselves with
an off-the-shelf anti-virus, experience seems to be proving that such
is not the case when one starts looking at the network with 10,000
users on it. For starters, very few anti-virus systems will run on
10,000 computers with a wide variety of configurations, etc. Secondly,
when someone on the network encounters a virus, they have
to be able to talk to someone in the organization who has the
detailed technical knowledge necessary to get rid of it in a rational
way. You can’t just shut such a big network down for 4 days while
someone from your a-v vendor’s tech support staff is flown in to
clean up, or to catch and analyze a new virus.
Secondly, people who are just interested in how things
work have finally been able to learn a little bit about computer
viruses. It is truly difficult to deny that they are interesting. The idea
of a computer program that can take off and gain a life completely
independent of its maker is, well, exciting. I think that is important.
After all, many of the most truly useful inventions are made not by
giant, secret, government-funded labs, but by individuals who have
their hands on something day in and day out. They think of a way
to do something better, and do it, and it changes the world. However,
that will never happen if you can’t get the basic information about
how something works. It’s like depriving the carpenter of his
hammer and then asking him to figure out a way to build a better
building.
At the same time, I have to admit that this experiment called
The Little Black Book has not been without its dangers. The Stealth
virus described in its pages has succeeded in establishing itself in
the wild, and, as of the date of this writing it is #8 on the annual
frequency list, which is a concatenation of the most frequently
found viruses in the wild. I am sorry that it has found its way into
the wild, and yet I find here a stroke of divine humor directed at
certain anti-virus people. There is quite a history behind this virus.
I will touch on it only briefly because I don’t want to bore you with
my personal battles. In the first printing of The Little Black Book,
the Stealth was designed to format an extra track on the disk and
hide itself there. Of course, this only worked on machines that had
a BIOS which did not check track numbers and things like that—
particularly, on old PCs. And then it did not infect disks every time
they were accessed. This limited its ability to replicate. Some
anti-virus developers commented to me that they thought this was
The Little Black Book of Computer Viruses
a poor virus for that reason, and suggested I should have done it
differently. I hesitated to do that, I said, because I did not want it to
spread too rapidly.
Not stopping at making such suggestions, though, some of
these same a-v people lambasted me in print for having published
“lame” viruses. Fine, I decided, if they are going to criticize the
book like that, we’ll improve the viruses. Next round at the printer,
I updated the Stealth virus to work more like the Pakistani Brain,
hiding its sectors in areas marked bad in the FAT table, and to infect
as quickly as Stoned. It still didn’t stop these idiotic criticisms,
though. As late as last year, Robert Slade was evaluating this book
in his own virus book and finding it wanting because the viruses it
discussed weren’t very successful at spreading. He thought this
objective criticism. From that date forward, it would appear that
Stealth has done nothing but climb the wild-list charts. Combining
aggressive infection techniques with a decent stealth mechanism
has indeed proven effective . . . too effective for my liking, to tell
the truth. It’s never been my intention to write viruses that will make
it to the wild list charts. In retrospect, I have to say that I’ve learned
to ignore idiotic criticism, even when the idiots want to make me
look like an idiot in comparison to their ever inscrutable wisdom.
In any event, the Little Black Book has had five good years
as a print publication. With the release of The Giant Black Book of
Computer Viruses, though, the publisher has decided to take The
Little Black Book out of print. They’ve agreed to make it available
in a freeware electronic version, though, and that is what you are
looking at now. I hope you’ll find it fun and informative. And if you
do, check out the catalog attached to it here for more great information
about viruses from the publisher.

Convergence of cyberspace and terrorism, that is cyberterrorism, might be an underrated issue for the moment due to the absence of real world examples. However, the ongoing transformation from old to new terrorism and changing perceptions of war and state security proves the opposite. Cyberterrorism is a resourceful, innovative, and an unconventional way to produce unpredictable and online threats against the traditional state marked by strict physical borders. Due to the significance of new terrorism for state security and IR, it is important to understand why current definitions are remaining to be ambiguous, complex, and insufficient in combating future cyberterrorist threats. Characterizing such a complicated phenomenon might not be an easy task, whilst without knowing what cyberterrorism is, and what it is not, we cannot develop better solutions or generate better responses for state security. Departing from these concerns, this thesis asks: what could be the proper definition for cyberterrorism? The aim is to provide a new, operational framework to address lacking insights in the current literature.

In today's information technology world, Viruses are a huge problem for anyone who uses computers. Computer viruses and worms, a program that can spread across computers and networks has gone from being a nuisance to being the cause of the loss of millions of dollars worth of data, and loss of productivity. The writers of these programmes are becoming more adept at it day by day. Corporate viruses are a major problem which costs businesses billions of dollars every year. The aim of this paper is to interrogate the economic impact of computer viruses and worms attack on institutions and industries, particularly in Ghana. In achieving this, the study examined the effects of the computer viruses and worms on the financial standing of organizations by assessing the cost in terms of lost productivity through the inability to use the infected computers, the restoring of adversely affected files and the re-installing of the networks involved. The study confirmed the negative financial impact of such malicious programs on institutions. Cleaning up after a virus attack cost some Ghanaian firms $122,280, over a period of twenty one productive days.

The typical antivirus approach consists of waiting for a number of computers to be infected, detecting the virus, designing a solution, and delivering and deploying the solution, in such situation, it is very difficult to prevent every machine from being compromised by virus. This paper shows that to develop new reliable antivirus software some problems must be solved such as: a new method to detect all metamorphic virus copies, new reliable monitoring techniques to discover the new viruses or attaching a digital signature and a certificate to each new software.

To investigate the use of classical epidemiological models for studying computer virus propagation we described analogies between computer and population disease propagation using SIR (Susceptible-Infected-Removed) epidemiological models. By modifying these models with the introduction of anti-viral individuals we analyzed the stability of the disease free equilibrium points. Consequently, the basal virus reproduction rate gives some theoretical hints about how to

With increased global interconnectivity, reliance on e-commerce, network services, and Internet communication, computer security has become a necessity. Organizations must protect their systems from intrusion and computer-virus attacks. Such protection must detect anomalous patterns by exploiting known signatures while monitoring normal computer programs and network usage for abnormalities. Current antivirus and network intrusion detection (ID) solutions can become overwhelmed by the burden of capturing and classifying new viral stains and intrusion patterns. To overcome this problem, a self-adaptive distributed agent-based defense immune system based on biological strategies is developed within a hierarchical layered architecture. A prototype interactive system is designed, implemented in Java, and tested. The results validate the use of a distributed-agent biological-system approach toward the computer-security problems of virus elimination and ID.

In this research, we present a new method, termed F-Sign, for automatic extraction of unique signatures from malware files. F-Sign is primarily intended for high-speed network traffic filtering devices that are based on deep-packet inspection. Malicious executables are analyzed using two approaches: disassembly, utilizing IDA-Pro, and the application of a dedicated state machine in order to obtain the set of functions comprising the executables. The signature extraction process is based on a comparison with a common function repository. By eliminating functions appearing in the common function repository from the signature candidate list, F-Sign can minimize the risk of false-positive detection errors. To minimize false-positive rates even further, F-Sign proposes intelligent candidate selection using an entropy score to generate signatures. Evaluation of F-Sign was conducted under various conditions. The findings suggest that the proposed method can be used for automatically generating signatures that are both specific and sensitive.

Virus komputer merupakan program komputer yang dapat menggandakan atau menyalin dirinya sendiri dan menyebar dengan cara menyisipkan salinan dirinya ke dalam program atau dokumen lain pada sebuah sistem komputer. Sama dengan virus pada manusia, virus komputer dianalogikan sebagai perusak sistem di komputer. Jika terus dibiarkan dalam sistem komputer, virus akan dapat merusak sistem bahkan merusak perangkat secara keseluruhan. Tak hanya itu, berbagai jenis virus komputer yang ada dapat menghapus file, mencuri data, dan dengan mudahnya menginfeksi perangkat lain di jaringan. Hampir 95% virus komputer berbasis sistem operasi Windows. Sisanya menyerang Linux/GNU, Mac, FreeBSD, OS/2 IBM, dan Sun Operating System. Terdapat berbagai jenis virus komputer yang diketahui dapat membahayakan perangkat komputer. Jenis-jenis virus komputer ini patut Anda waspadai jika muncul pada sistem komputer Anda. Lebih lanjut, berikut Liputan6.com rangkum dari berbagai sumber, Senin (18/3/2019) jenis-jenis virus komputer. Jenis virus komputer dari cara kerjanya Dari cara kerjanya, jenis virus komputer dikategorikan sebagai berikut: Worm Worm merupakan virus komputer yang tidak terlalu berbahaya. Namun apabila dibiarkan terus menerus, maka virus ini dapat membuat penyimpanan komputer penuh dengan cepat dan membuat sistem komputer menjadi rapuh. Virus ini dapat menggandakan diri dengan cepat dan dapat membuat file acak tak berguna pada komputer. Hal inilah yang menyebabkan memori dan hardisk akan penuh dengan virus ini. Virus worm ini dapat menginfeksi komputer yang menggunakan email dan terhubung dalam jaringan internet, hal ini sama dengan yang dilakukan oleh virus Trojan. Trojan Jenis virus komputer ini dibuat dengan kemampuan mengontrol, mengendalikan data atau bahkan mencuri data yang ada pada komputer. Sama halnya dengan virus Worm, virus Trojan ini biasa muncul melalui jaringan internet dan juga email yang diterima oleh pengguna serta data pribadi yang tidak di-password. Tujuan dari Trojan adalah memperoleh informasi dari target seperti password, kebiasaan user yang tercatat dalam system log, data, dan mengendalikan target. Backdoor Backdoor merupakan jenis virus komputer yang hampir sama dengan trojan. Namun, Backdoor bisanya menyerupai file yang baik-baik saja misalnya game. Backdoor merujuk kepada mekanisme yang dapat digunakan untuk mengakses sistem, aplikasi, atau jaringan, selain dari mekanisme yang umum digunakan seperti melalui proses logon atau proses autentikasi lainnya.

The term Virus was first published academically by Fred Cohen in 1984 in a scientific paper. Computer viruses have a way of working identical to biological viruses in general, so it's no wonder the naming of computer viruses takes the term biology. The main characteristic of a computer virus is that a virus requires a master file to infect when replicating itself, this is what distinguishes computer viruses from other destructive computer programs. Several categories of computer virus are boot virus, program virus, multipartite virus, stealth/polymorphic virus, metamorphic virus and macro virus.The infected master file is called the host file. Today, a computer virus refers to a program that is capable of self-replicating and spreading by duplicating virus codes into the infected file or document.

Trojan horse is said to be one of the most serious threats to computer security. A Trojan horse is typically separated into two parts – a server and a client. It is the client that is cleverly disguised as significant software and positioned in peer-to-peer file sharing networks, or unauthorized download websites. The most common means of infection is through email attachments. In order to distribute the virus to unsuspecting users, the developer of the virus usually uses various spamming techniques. Malware developers use chat software as another method to spread their Trojan horse viruses such as Yahoo Messenger and Skype. This study aims to analyze and detect the behavior of Trojan attacks, provide ways on how to prevent, detect, and recover from Trojan attacks.

The typical antivirus approach consists of waiting for a number of computers to be infected, detecting the virus, designing a solution, and delivering and deploying the solution, in such situation, it is very difficult to prevent every machine from being compromised by virus. This paper shows that to develop new reliable antivirus software some problems must be solved such as: a new method to detect all metamorphic virus copies, new reliable monitoring techniques to discover the new viruses or attaching a digital signature and a certificate to each new software.

Computer virus programs are generally perceived to be a threat to the information stored by computer users. This research evaluated the impact computer viruses have on information stored by computer users. The emphasis was on the effects of computer viruses rather than on the detail of their operation. The main hypotheses involved the question of whether or not computer viruses do pose a threat to the information stored by computer users. The effect of computer viruses on the information of users in industry was measured by sending a questionnaire to 388 companies country-wide. &~ average of 2l,5% of the respondents claimed detrimental effects to information stored on disk due to computer viruses. This and other data was used to guide laboratory experiments on the actual damage done by computer viruses to stored information. A set of test disks was prepared to represent programs and data of a typical PC user in industry. Fifteen different virus programs were used individually to infect the test disks. After each infection, all the test disks were inspected to ascertain damage to data, system and program files as well as to separate disk sectors. The research established that: The damage done by computer viruses to stored information is generally limited to one file or disk area. Where damage to stored information did occur, it was often reversible. Irrational user responses to virus symptoms provide a large potential source for damage to stored information. The availability of master program disks (for program file restoration) and recent, validated data backup is essential to recovery from a computer virus infection. A user can solve most problems caused by virus infections if he has a basic understanding of disk structure, i.e. tracks, sectors, sides, the FAT, etc, and of the use of disk utility programs like Norton Utilities or PCTools. The fact that some of the findings of prominent virus researchers could not be verified, suggests that virus programs could be unstable. Claims regarding the damage inflicted by viruses must be considered to be valid only for a specific copy of the virus under discussion. The importance of using original application software (to minimize the transfer of viruses and to enable program file restoration) , regular back-ups (to enable data file restoration) and basic user awareness (infection prevention, symptoms, the use of anti-viral and utility programs, etc.) was emphasized. The average PC user should be able to clear up a virus infection without assistance by following the given disinfection procedure. Suggestions for further study include virus origins, generations, mutations, multiple infections, and the effect of viruses on computer networks.

Metamorphic viruses engage different mutation techniques to escape from string signature based scanning. They try to change their code in new offspring so that the variants appear non-similar and have no common sequences of string as signature. However, all versions of a metamorphic virus have similar task and performance. This obfuscation process helps to keep them safe from the string based signature detection. In this study, we make use of instructions statistical features to compare the similarity of two hosted files probably occupied by two mutated forms of a specific metamorphic virus. The introduced solution in this paper is relied on static analysis and employs the frequency histogram of machine opcodes in different instances of obfuscated viruses. We use Minkowski-form histogram distance measurements in order to check the likeness of portable executables (PE). The purpose of this research is to present an idea that for a number of special obfuscation approaches the presented solution can be used to identify morphed copies of a file. Thus, it can be applied by antivirus scanner to recognize different versions of a metamorphic virus.