Better places to find my work

          This post is just a summary of my other pages and profiles really, but they all are different genre’s and subjects, and each are pretty neat, to me at least.

I have a very artistic side from time to time when I'm not doing something technical with a computer, which I then express through the computer and defeat the purpose lol. You can check out that sort of content from me at http://panopticon36.deviantart.com/ Its mostly just backgrounds I have made. However you will also find two visual themes for Linux which I have created. I use them myself on a daily basis. They are very clean and good looking, without being anything you’ve ever seen before and without being boring. They certainly are a good find for any Linux enthusiast. Also the wallpapers are pretty kick ass.


Once long ago, my life was only music. Sure would have been nice if sound cloud was around when I was in Highschool. Anyways, here is a link to my sound cloud. Currently it only has things posted on it that are a little older. But all made by your truly. SoundCloud

My current Youtube channel. http://www.youtube.com/user/HaxxStuffFilms Here you will find new videos the very moment I finish making them. The objective here is entertainment using existing gaming engines in new, interesting, and innovative ways. Basically it’s a Machinima channel. You’ll notice that the name Tsanjuro is mentioned a lot in this channel, and you’re starting to see the Phoenix Gmod Syndicate mentioned in a few videos also. Which brings us to the next topic.

The name Tsanjuro, is the name I go by in the gaming world. And the Phoenix Gaming Syndicate (PGS) is a gaming guild/clan once ran on the Steam Gaming Network. The original PGS is no longer on the steam network, and we also changed the name to Phoenix Gaming Syndicate. Also, I am hosting a few gaming servers. We currently have FTP, MC, and TS3 severs, and who knows, maybe more to come. Keep in mind that my name in the gaming world is (PGS) Tsanjuro if i'm not going by my usual Panopticon36. Anyways, that's enough chat. Here is the link for the PGS webpage which I design, host, and run. http://pgs.servegame.com

- Panopticon36 -

Guide to Virus Removal

Guide to Virus Removal

          Virus’s, Spyware, Trojans, Worms, these are all something everyone has to deal with in today’s age. Its all malware to me. The word malware comes from two other words, the word “Malicious” meaning “of ill intent” and the word “software”. Put the two together and you get the word Malware meaning “Software of malicious intent”. For the rest of this post, we will refer to all spyware, virus’s, torjans, etc… as malware.

          DISCLAIMER: This is the effective Malware removal guide as of 4/10/2011. The field of virus removal is constantly changing as malware gets more complex. It’s a constant struggle. Its hard to say how long until any, if not all, of the tools we go over in this guide will become obsolete. So keep yourself updated!

          Before we get started, we are going to talk about the basic procedure. You’ll need two computers, one which you know is clean, and the infected computer itself. (as shown in figure 1.1) Plug a flash drive into the clean computer. (as shown in figure 1.2) On the clean computer you are going to download this pack of Utilities I have rounded up. I do not take credit for any of the tools in this pack, I’m just the guy who happened to put them all in a .zip for you to download and use. https://docs.google.com/leaf?id=0B_N3w4z6aUHpMmJiNDgwN2QtMjg4NC00Y2UzLTljYWYtZjUwNjIyMGZhNTky&sort=name&layout=list&num=50

Figure 1.1

Figure 1.2

         Go to that page and click “download”. (as shown in figure 1.3) Extract the entire contents of the .zip you just downloaded onto the flash drive which we inserted in figure 1.2. Once you have done that, remove the flash drive from the clean computer, we will be using that later in this guide. Now you will want to download my logging program I have written. This will be ran on the clean computer to keep track of what you are doing, tell you what the next appropriate step should be, and generate a complete log of what was done when you are finished. You can find that here. https://docs.google.com/leaf?id=0B_N3w4z6aUHpZDQ2OTg2NTgtMGE2MS00OTZiLWFmNTYtMzJhOGJhMjk5ZDRl&sort=name&layout=list&num=50

Figure 1.3

         

The Technicians Guide to Virus Removal 1.5 (written by me) will now guide you through the whole process. However it doesn’t really explain how to use most of the tools, so I will go over that with you in the same order my guide program brings things up. If a tool isn’t mentioned in this post, then its probably a self explanatory util.

         On the clean computer, start my Guide program which you downloaded, when it asks you which OS you want instructions for, it is referring to the infected computer. For example, lets say you are running my program on a clean Win7, but are attempting to clean a computer with Windows XP, you would tell the program Windows XP. If you have made your selection properly, type the word “yes” without quotations and press enter. My program will now want to know what to name the log file which will be generated at the end of the virus removal procedure. I usually name the log file something significant to who’s computer and current date of the procedure. For example, if I were doing it for myself today, I would type “panopticon04192011” without quotations. Also keep in mind that this should all be one word. Again, if any tools are not mentioned in this blog post, but are requested by my guide program, they have been left out of this guide intentionally as they are very simple to use and don’t need a description of how they are used.

Booting Into SafeMode (With Networking) – This is pretty easy, turn the infected computer off, and turn it on again. As it is booting up press the F8 key repeatedly just after the BIOS screen goes away, this will open up a list of available boot options for the computer. Then select “safemode with networking” using the arrow keys on your keyboard and press enter.

At this point you should plug your virus removal drive (the flash drive we were playing with earlier) into the infected computer. (as shown in figure 2)

Figure 2

Using RKill/IExplore – Merge “shell.reg” with your registry by double clicking shell.reg. Then double click rkill.com or iExplore.exe. Now just wait for that to finish running before moving on.

Turning off System Restore points – Windows XP and Vista/Win7 vary slightly in this process. We turn this off right away because Malware can embed itself in the system restore cache and remanifest itself after all other copy’s have been removed from the computer, making all your work a waste of time if this isn’t done. For a short guide to do this in XP click here, and to do so for Vista/Win7 click here.

Removing Proxy’s – If a proxy is enabled on your system and you don’t need to use one (which is true for most virus infections) this means any internet traffic you generate is going through someone else’s server un-watnedly. This is really only an issue in Windows XP. For a short guide on how to do this in XP click here.

Tempfile – Double click tempfile.bat. It will then ask for a drive letter, If windows is installed drive C: then just type C. (this is the case for almost every computer unless you have set it up differently.) It will then ask for usernames, just type the names of all users on the computer, if it asks for more users than exist just leave those blank.

ATF Cleaner – Double click ATF-Cleaner, then select “select all” then click “empty selected”

ComboFix – This program takes a while, but don’t run off just yet, as it requires a bit of user input (mostly just clicking okay). The program itself is self explanatory as it runs. Combo fix may want to restart your computer. If this is the case then make sure when the computer reboots in safemode (as discussed earlier) as long as combo fix doesn’t request to let the computer boot in regular mode. If combo fix does restart your computer, when it is done doing its thing, make sure you use RKill/iExplore again before moving on.

MBR/SDFix – This program needs to be ran from the command line (if its even required to do so, combofix will tell you if you need to run this).

SmitfraudFix – Double click Smitfraudfix.cmd and follow the instructions that follow.

DLL Compare and KillBox – In XP double click DllCompare.exe and in Vista/Win7 right click DllCompare.exe then click “run as administrator”. Then in the Scan Options section click on “Run Locate.com”, wait for that to finish then click the “Compare” button towards the bottom of the window. If any .dll’s appear in the lower section, right click the .dll and then click “copy to clipboard. (as shown in figure 3.1) Then double click KillBox.exe and right click the field labeled “Full Path of File to Delete” and then click “paste”. Next click the bullet for “Delete on Reboot” then click the red cross button right of the file path. (as shown in figure 3.2) Do this for each .dll found in the lower section of DllCompare.

Figure 3.1

Figure 3.2

BHODemon – BHODemon is a tool for cleaning up unwanted buttons from Internet Explorer.

AutoRuns – In XP double click Autoruns.exe, and in Vista/Win7 right click Autoruns.exe then click “run as administrator”. Look at every entry it finds. If an entry doesn’t have a publisher or description, examine the entry in detail and determine if it should exist on your computer. If not, uncheck it on the left. (as shown in figure 4) NOTE: Leave any entry such as “display” or “OLEAUT32” or “OLEAUT64” alone as these are parts of the operating system. (also shown in figure 4)

Figure 4

         And that’s all of this process which really needs an explanation. I hope you have found this helpful. And now you can consider yourself a malware removal pro! Keep in mind though that this field is always evolving at a very fast rate. Make sure you keep yourself up to date as to the latest developments in malware removal. A great site for doing this is http://www.bleepingcomputer.com/

- Panopticon36 -

Download a print friendly copy of this guide (has a few editing errors)

https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B_N3w4z6aUHpOWZlYmJmMjQtMTNjOC00ZjEyLTg3ZTQtODBiNTRlNWVmNzc0&hl=en&authkey=CJbR5-ID 

How to Create a Secure and Fast Server using XP Pro

Creating a Home server using XP PRO SP3

          Lets say you can’t get your hands on a copy of server 2003 or greater, or you just don’t feel like learning a whole new OS. Well fear not, in this guide I will show you how to make an XP PRO SP3 installation as secure and functional as any server OS. The point of running a server is to have a separate computer for you own to handle much more sensitive data, keep things separate, and let the server focus on only what it needs to rather than your interests. The server isn’t going to run anything more than it needs to, we are going to disable a lot of Microsoft’s “features” in this guide, as they are not necessary, and a good rule of thumb to go by is that the more you can do without the smoother a system will run and in most cases more secure as well. Lets get started.

First off, you will need create a fresh install of XP. To do this is pretty simple, insert an xp pro install disk into the computer you want to run the server on, boot from the CD, and follow the instructions on screen. (note: try not to assign obvious names to your computers, such as “My-Server” is not a good name, anyone on your network would instantly know where the server is. I name my computers after foods I like.) Once XP is installed make sure you go get ALL the drivers and updates available. These steps should be pretty basic for anyone interested in this sort of thing, thusly the lack of detail. If you get stuck in any part of that remember that Google is your friend!

          Now that you have XP installed, up to date, and using all of its hardware properly, lets go right ahead and disable all visual effects. To do this right click on “My Computer” then click on Properties. Next click on the advanced tab and then the “settings” button in the “Performance” section. Now the “Performance Options” window should be up. Simply click on the “Adjust for best performance” bullet. Click “apply” then “okay” and “okay” again. (shown in figure 1)

Figure 1 

          Now you are going to create a visual theme that makes the computer work as little as possible on the GUI. Right click any free area on the Desktop then click “Properties”. On the Desktop tab, select “none” for the background, On the Screensaver tab select “Windows XP” and set “wait” to 10 minutes, and check the box for “On resume, password protect”. In the appearance tab set “Windows and buttons” to “Windows Classic style” and “Color scheme” should be set to “Windows Standard”. Now go back to the “Themes” tab and save this theme as “ServerTheme”. Click Apply then Okay.

          At this point, you should password protect all accounts on the computer if you have not already (in fact there should only be one user account, THAT’S YOU! No one else!)

          Now that’s done, We should change the login style so that anyone who attempts to log in will need both a username and password, rather than just clicking on an existing user and then typing in the password. To do this simply open up the “User Accounts” control panel found in the control panel. Under “Pick a task…” click on “Change the way users log on or off” Then uncheck “Use the Welcome screen” and uncheck “Use Fast User Switching”. Then click “Apply Options” and close the User Accounts window. (as shown in figure 2)

Figure 2 

Lets create a Login Policy. This is a pop up window that displays a message at login. Effectively forcing anyone attempting to log in to agree with terms you have deemed necessary of administering your server. To do this click “Start” and then Run. In the Run dialogue box type “regedit” without quotations and press enter. Now navigate to (HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > policies > system) If this location does not exist then simply create it. Once you are here, Create the following keys.

-      DWORD “DisableRegistryTools” “0”

-      DWORD “dontdisplaylastusername” “1”

-      String “legalnoticecaption” “READ CAREFULLY BEFORE LOGGING IN”

-      String “legalnoticetext” “Once logged into this terminal you must take full responsibility for any and all actions regarding this server and the websites it hosts, this responsibility includes any outcomes of said actions. Click Okay to accept and continue.”

-      DWORD “shutdownwithoutlogon” “0”

-      DWORD “undockwithoutlogon” “0”

Now obviously you can change the caption and text to say whatever you want. But this is just how mine is setup. (as shown in figure 3)

Figure 3

  

As an added layer of security, you will now make it so the server cannot be used by someone who simply walks up to it. Find out what the ip address of your server is, and write that down someplace. We are now going to enable remote desktop, and you will access the server from some other computer on the same network. Right click “My Computer” and click properties. Click on the “Remote” tab and make sure “Allow Remote assistance…” is UNCHECKED. Then make sure “Allow users to connect remotely to this computer” IS checked. (as shown in figure 4.1) Now click on the button labeled “Select Remote Users…” Remove all users in the list. Then click the “Add…” button, then click the “Advanced…” button, then click the “Find Now” button, Select your username from the list. (as shown in figure 4.2) Now click Okay, then Okay, then Okay again, then Apply, and finally click Okay one more time. At this point turn off your server, unplug everything from it except the chords for the power and the internet. This is all it needs. Now turn the server back on and go to a different computer in your house. You will now open Remote Desktop on this computer and type in the IP address for your server. From here on out, we will be interacting with the server in this method.

Figure 4.1

Figure 4.2 

Now that your sever is starting to be a bit more secure, we can get into the fun stuff. Log into your server and lets start installing software. In the following section, I’ll name some software you may want, why you want it, what it does, and where to get it.

Microsoft Baseline Security Analyzer – This is a good tool to simply and easily find out how secure you are against most types of attacks. http://www.microsoft.com/downloads/en/details.aspx?FamilyID=02be8aee-a3b6-4d94-b1c9-4b1989e0900c

Microsoft IPSec Diagnostic Tool – Another security auditing tool from Microsoft. http://www.microsoft.com/downloads/en/details.aspx?FamilyID=1d4c292c-7998-42e4-8786-789c7b457881

Microsoft Network Monitor – This tool monitors network traffic in realtime and shows you what is being transferred, where its coming from, and where its going. http://www.microsoft.com/downloads/en/details.aspx?FamilyID=983b941d-06cb-4658-b7f6-3088333d062f

Process Explorer – Like the process tab in the task manager? You will love this. http://technet.microsoft.com/en-us/sysinternals/bb896653

TCP Viewer – Shows all open sockets on the server, and what process is using them. http://technet.microsoft.com/en-us/sysinternals/bb897437

WinRar – All of your archiving needs solved. http://www.win-rar.com/download.html

TrueCrypt – This amazing tool can be used to create highly secure files and volumes. http://www.truecrypt.org/downloads

PrysmHUD – This is a full system monitoring system. Its lightweight, flexible, easily customized, and a great way to see whats going on at all times. http://www.utilhaven.com/prism/

No-IP DUC – This is simply essential and we will go over it in more detail later in the article. http://www.no-ip.com/downloads.php

Google Chrome – Better web browsing. http://www.google.com/chrome/

Adblock for Chrome – Clean up all that spam while your on the net. https://chrome.google.com/extensions/detail/gighmmpiobklfepjocnamgkkbiglidom?hl=en

CCleaner – The best maintenance program you can find anywhere. http://www.filehippo.com/download_ccleaner

Malwarebytes’ Anti-Malware – One the most powerful automated malware removal programs you can get for free if you ever find yourself in trouble. http://www.malwarebytes.org/ 
EDIT: Here is my full guide to malware removal. http://panopticon36.blogspot.com/2011/04/guide-to-virus-removal.html

Up to this point, all of these programs have been pretty much mandatory, the ones listed now are up to your own discretion. Remember, the less you have on it, the better it will run.

Virtual Box – Good for testing out new software or hosting web servers separate from the host server. http://www.virtualbox.org/wiki/Downloads

FileZilla – The best/free FTP client/server you’ll find. http://filezilla-project.org/

uTorrent – Useful if you are a… “collector” http://www.utorrent.com/downloads

VLC Player – This will open any sort of video you could find, and it can also host a streaming video server. http://www.videolan.org/vlc/

Tortoise SVN – Useful if you are running software that uses a rolling release system such as SVN. http://tortoisesvn.net/

USB System Lock – For an added layer of security you could make it so that the only way the server can be accessed is if someone plugs a specific USB flash drive into the computer, like a key. This way not only does someone have to know a username and password, they also would need physical access, and your flashdrive. If you choose to do this, make sure you have a flash drive that you will not loose and can dedicate to this purpose specifically. http://sourceforge.net/projects/usl/

Just some final words about those programs

-      The Microsoft tools will not do everything for you, nor will they stop an attack, they will however better prepare you for such events.

-      Process Explorer will help you understand what is happening, not prevent evil.

-      Same for TCP Viewer

-      Adblock will not stop you from downloading and installing something you shouldn’t.

-      CCleaner should be ran once a week at the least

-      Malwarebytes is nice, but it usually requires more than just that to fully remove a virus/spyware/Trojan infection. Also, it wont stop you from doing something stupid, it only runs when you tell it to.

These programs are not fool proof. So don’t download or install anything which seems fishy in any way at all. Pay attention to download urls, lookout for unwanted redirects, and don’t look at porn on your server. Follow those guidelines and you should be fine. The biggest reason why I don’t tell you to install an antivirus program is because these tend to KILL resources, bogging down the entire computer, constantly looking over your shoulder and eating up hard drive time. Just be smart and you wont need AVG or anything of the like.

          ALRIGHT! Enough of the heavy, lets start the final steps of streamlining your Server to run at its very very best. Click on the start button and then Run. In the Run dialogue box type “services.msc” without the quotations and press enter. Below this paragraph you see a list of services. For each service listed, right click it and click properties, then change the startup type to Disabled.

-      Application Layer Gateway Service

-      Alerter

-      Application Management

-      ASP .NET State Service

-      Automatic Updates

-      Background Intelligent Transfer Service

-      ClipBook

-      COM+ Event System

-      COM+ System Application

-      Computer Browser

-      CryptSvc

-      Cryptographic Services

-      Distributed Link Tracking Client

-      Distributed Transaction Coordinator

-      Error Reporting Service

-      Event Log

-      Fast User Switching Compatibility

-      Health Key and Certificate Management Service

-      Help and Support

-      HID Input Service

-      HTTP SSL

-      Human Interface Device Access

-      Indexing Service

-      IMAPI CD-Burning COM Service

-      IPSEC Services

-      Logical Disk Manager

-      Logical Disk Manager Administrative Service

-      Microsoft .NET Framework NGEN

-      MS Software Shadow Copy Provider

-      Messenger

-      NetMeeting Remote Desktop Sharing

-      Network Access Protection Agent

-      Network DDE

-      Network DDE DSDM

-      Network Location Awareness (NLA)

-      Network Provisioning Service

-      NT LM Security Support Provider

-      Performance Logs and Alerts

-      Plug and Play

-      Portable media Serial Number Service

-      Print Spooler

-      Protected Storage

-      QoS RSVP

-      Remote Access Auto Connection Manager

-      Remote Desktop Help Session Manager

-      Remote Registry

-      Removable Storage

-      Routing and Remote Access

-      Secondary Logon

-      Security Center

-      Shell Hardware Detection

-      Smart Card

-      System Event Notification

-      System Restore Service

-      Task Scheduler

-      TCP/IP NetBIOS Helper

-      Themes

-      Telnet

-      Uninterruptible Power Supply

-      Volume Shadow Copy

-      WebClient

-      Windows Audio

-      Windows CardSpace

-      Windows Driver Foundation

-      Windows Image Acquisition

-      Windows Installer

-      Windows Media Player Network Sharing Service

-      Windows Presentation Foundation Font Cache

-      Windows Remote Management

-      Windows Search

-      Wireless Zero Configuration

-      WMI Performance Adapter

Then set “Windows Time” to “Manual” and leave “Plug and Play” and "Removable Storage" on if you are using USB System Lock. If you have services that aren’t listed, they probably aren’t anything to worry about or drivers. This setup is to make your server run as quickly and efficiently as possible. You will surely see a performance boost. However, some programs and servers may need some of these services in order to work properly depending on what you are attempting to do with your server. If such problems occurs, remember that Google is your friend!

          Now close the Services Window, click “Start” then Run. In the run dialogue box, type “msconfig” without quotations and press enter. Here, you will want to go to the “Services” tab, check “Hide all Microsoft services” then uncheck anything unwanted. Next go to the “Startup” tab and do the same. Close the System Configuration Window and restart your server.

          Its at this time I like to set up folder shares for the network, things like video’s, dropbox, and any other sort of folder sharing you want to have. Make sure to add only the users you want to restricted folders, manage read write permissions, and set the max user amount appropriately. All of those things can keep unwanted users out of places they shouldn’t be.

          We are almost ready to open your server to the world. Have you thought about how end users will be connecting to your computer? Well this is where No-IP DUC comes in handy. Rather than giving someone your home IP Address (which is likely to change anyway) you can set up a redirect domain with http://www.no-ip.com/ for free. And DUC will always keep the No-IP servers up to date with the location of your server.

            Almost there, now we just need to forward the ports on your router to your server. I’m not going to teach you how to do this, because I don’t know what type of server you will be hosting (thus the required ports) and I don’t know what type of router you have. I’m simply reminding you this needs to be done. If you have never forwarded ports before, this link should get you started. http://lmgtfy.com/?q=how+do+i+forward+ports+on+my+router

                And that should be it. I hope you found this guide to be everything you needed to create a cheap (free infact) and secure windows based home server!

- Panopticon36 -

Download your very own copy of this guide! https://docs.google.com/viewer?a=v&pid=explorer&chrome=true&srcid=0B_N3w4z6aUHpYWE4NjYzNDMtODlhYS00MDNjLWEzOTUtMTBlMDg4ZTdlOTY1&hl=en&authkey=CJm47JAE

The Manifesto

If you have never read this before, do so immediately.

The Hacker Manifesto

by
+++The Mentor+++
Written January 8, 1986

Another one got caught today, it's all over the papers. "Teenager Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...

Damn kids. They're all alike.

But did you, in your three-piece psychology and 1950's technobrain, ever take a look behind the eyes of the hacker? Did you ever wonder what made him tick, what forces shaped him, what may have molded him?

I am a hacker, enter my world...

Mine is a world that begins with school... I'm smarter than most of the other kids, this crap they teach us bores me...

Damn underachiever. They're all alike.

I'm in junior high or high school. I've listened to teachers explain for the fifteenth time how to reduce a fraction. I understand it. "No, Ms. Smith, I didn't show my work. I did it in my head..."

Damn kid. Probably copied it. They're all alike.

I made a discovery today. I found a computer. Wait a second, this is cool. It does what I want it to. If it makes a mistake, it's because I screwed it up. Not because it doesn't like me... Or feels threatened by me.. Or thinks I'm a smart ass.. Or doesn't like teaching and shouldn't be here...

Damn kid. All he does is play games. They're all alike.

And then it happened... a door opened to a world... rushing through the phone line like heroin through an addict's veins, an electronic pulse is sent out, a refuge from the day-to-day incompetencies is sought... a board is found. "This is it... this is where I belong..." I know everyone here... even if I've never met them, never talked to them, may never hear from them again... I know you all...

Damn kid. Tying up the phone line again. They're all alike...

You bet your ass we're all alike... we've been spoon-fed baby food at school when we hungered for steak... the bits of meat that you did let slip through were pre-chewed and tasteless. We've been dominated by sadists, or ignored by the apathetic. The few that had something to teach found us willing pupils, but those few are like drops of water in the desert.

This is our world now... the world of the electron and the switch, the beauty of the baud. We make use of a service already existing without paying for what could be dirt-cheap if it wasn't run by profiteering gluttons, and you call us criminals. We explore... and you call us criminals. We seek after knowledge... and you call us criminals. We exist without skin color, without nationality, without religious bias... and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try to make us believe it's for our own good, yet we're the criminals.

Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for.

I am a hacker, and this is my manifesto. You may stop this individual, but you can't stop us all... after all, we're all alike.

And there you have it. The hacker’s manifesto.

- Panopticon36 -

What is a Virus?

What is a Virus?

This post was not originally written by me, I’m just reposting it as this article points out some very good do’s, don’ts, and how come’s of what modern virus’s are. The original article is a bit old, but still completely valid to this day.

               THE BASIC CONCEPTS OF PC VIRUSES

                    written by: paranoidxe

                    date: 04/22/04

                    email: paranoidtsi@hotmail.com

DEFINITIONS…

Virus: a virus is a program that replicates itself and "injects" its code into other programs on your computer without the user's knowledge or permission. For a human example, when a human virus enters the body it attaches to a cell, it then injects its DNA coding into the cell and tells it to make copies... essentially the same concept, the computer virus attaches to a program. as defined in this guide a virus replicates on purpose NOT as a side effect.

Trojan: a program that is advertised as having a legit function, but when the user launches it it either has alternative motives or it runs fine but does something in the background. The important difference between a trojan and a virus is that a trojan is a program that DOES NOT infect other files or spread like a virus.

Worm: the third virus-like program, a worm spreads usually through security holes, it does NOT require user intervention and does not infect files on a computer. A worms primary function is to spread and under normal circumstances it causes overload on network systems causing them to crash. A worm will dissappear if the computer is turned off. The general prevention measure is to patch the security flaw the worm uses.

Bug: a bug is a unintentional flaw in software products. The reason this is mentioned is because bugs usually cause a computer to act funky on the user, and just because this happens does not mean its a virus.

Droppers: usually a shell of a virus, this is a program that has a virus encrypted into it to avoid detection. Once a dropper is launched the virus is decrypted and launched on the targeted machine.

                         [MISC. MEANINGS]

AV - antivirus: either refering to a program that combats and eliminates viruses, or a company that produces antivirus products.

MBR - master boot record: this is the program that tells you hard drive how to work and how to understand to retrieve/write data.

file system: if MBR is the program to give direction (like a ref in a football game) then the file system is the field. file system is what organizes data on a drive.

false positive: this is when a antivirus program reports a file as being infected when its really not.

false negative: this is when a antivirus program reports the file uninfected, yet really it is.

VIRUS MECHANISMS

Viruses can use various technologies to infect the targeted machine, these are some of the common methods used:

Boot Sector/MBR Infector: These viruses pray on the boot program that is on every single hard drive/floppy drive. The boot program essentially tells the size of the disk and tells the disk how to read the data...viruses have found a way to get here which insures that the virus is launched at every boot.

Polymorphic: Polymorphic is a method used by virus writers to avoid detection, the way it works is normally a virus will infect a file with the same size and code..polymorphism will actually change the codes appearance as well as size. This makes detection more difficult and antivirus companies must rely on the patterns instead of code signatures.

Stealth: This technology makes it so when reporting file sizes the virus reports the uninfected file size...this essentially means the virus makes the file appear unaltered.

Encryption: A method that seems to be getting more and more complex, encryption makes it so antivirus companies cannot decypher the viruses code, this makes it harder for antivirus companies to understand the virus and provide fixes if the virus damages anything.

TSR - terminate/stay resident: this is a virus that enters memory and stays in memory generally infecting any program written or read. This is a part of almost every virus now.

Macro virus: a 1995 invention, a macro virus thrives off microsoft word, it infects the global setting file on word and every document after the initial infection is launched it too becomes infected.

File Infector: this is the most common type of virus, it infects programs as they are launched but does NOT infect boot sectors. This is the most basic of viruses.

multi-partite: these are viruses that use both file infection and boot sector infection. This is what most viruses will use now that are non-macro viruses.

UNDERSTANDING TROJANS.

As stated in the definitions, a trojan is a program that appears to have a desireable function..but instead it has a hidden agenda.

It is important to understand that trojans do NOT infect other files. They also may function as advertised with the malicious code taking effect in the background.

Trojans can also load at every boot, however not in the same manner. Trojans rely on your operating system to load themselves everytime, unlike viruses which can get into the boot record, trojans generally cannot.

Trojans often have various malicious functions such as:

 * Steal passwords

 * Format Hard Drives

 * Random Reboots

 * Used as a server program for another user

A special type of trojan known as a "backdoor" trojan opens a port on your internet connection that allows the remote user to use his program and connect to your computer and do various functions. This could be just to annoy you, other times it could be used to take your data. Backdoor Trojans are generally able to do the following:

* rename/delete/edit files

* upload/download files

* open/close cdrom drive

* run floppy drive

* reboot computer

* send messages

Backdoor trojans can have there uses as a remote adminstrative tool, but this is rarely the case.

WHY WRITE VIRUSES

There are many reasons people want their viruses out there. The more common ones include:

a) Revenge, the virus was ment to infect one computer but instead it ends up infecting more than just one. It was designed to get revenge on someone that apparently pissed the author off.

b) Accidental, sometimes a virus is released accidently..the virus was just something to do in their spare time and was never meant to get released.

c) Make a Statement, sometimes viruses are out to make statements, like stoned made the statement "Legalize Marijuana"...Tequila was obviously made by one who liked tequila <go figure).

d) Fame, some love to see their creation make it to the media and on TV, although this rarely happens.

e) Challenge, to make a virus is challenging, one might want to make one just to see if he/she could do it.

f) Education, some do it simply to learn more complex programming. Virus writing is easily one project that requires excellent advanced programming skills.

COMMON WAYS OF INFECTION

Back in the day, floppies and BBS were probably the most common ways to get a virus. However, times have changed and there are plenty of new and "exciting" ways to contract one:

- NETWORK, this can be on a local network one user may get infected and the virus will spread to other nodes on the network.

- FLOPPY/CD, a computer infected with a virus may burn a CD unknownly writing it onto the CD, you launch it and get it. Floppies work the same way.

- WEBSITES, downloading from websites you really don't know, the webmastercould have deliberately infected the file you downloaded or was done by accident.

- P2P NETWORKS, this is probably the #1 source of viruses right now, right up there with newsgroups. P2P Networking is tricky because the description can be labeled as something else yet the file could be something completely different from the description..and generally you don't see the filename until after it has been downloaded, a good example would be Kazaa.

- EMAIL, sometimes viruses spread themselves through email programs. The virus may compose itself from one of your friends email boxes, you thinking it is safe after all it is your friend right? you run it and get infected.

COMMON MYTHS

[VIRUSES ALWAYS CAUSE MALICIOUS DAMAGE]

This is not true, in fact some viruses cause malicious damage because of a bug in the coding, go figure. Anyway, some viruses are simply around to replicate and spread, others are designed to display political messages or annoy the user. There are viruses out there that are hell bent on destroying computers, yes but there are some that don't.

 [MY COMPUTER CRASHED, I MUST HAVE A VIRUS!]

98% of the time the computer crashes because of faulty hardware, faulty hardware drivers, faulty or conflicting software, corrupted files, or corrupted operating system...just because your computer crashes DOES not mean you have a virus. Viruses like to hide before they do any damage to your computer, so the chances are you will not realize unless you have a antivirus if you have a virus active on your system.

 [I NEED MORE THAN 2 ANTIVIRUS PRODUCTS TO KEEP MY MACHINE SAFE]

What people don't understand is that having more than one antivirus doesn't make you safer, in fact it could cause conflicts on your computer. I recommend only using one antivirus at a time.

 [I CAN GET A VIRUS FROM READING EMAIL]

With the exception of the Outlook Express vulnerability, NO you cannot. The Outlook Express vulnerability was a bug that allowed execution of code through the preview window, this has been fixed with recent patches. Otherwise, you can NOT get a virus by simply reading your email using your eyeballs, but you can get a virus if you selectively download a virus infected file and run it.

 [MY CDS CAN GET INFECTED BY A VIRUS]

No, this is because cds are read-only. There is no currently known virus that can write itself using a cd burner or otherwise. HOWEVER, viruses can come from CDR media that came from an infected computer. Commercial software has maybe a 1 in a trillion chance of being infected by a virus, most companies are VERY careful about infection but it doesn't mean it can't happen. CDs can carry viruses yes, but a virus cannot infect a CD.

 [VIRUSES ARE WRITTEN BY SCRIPT KIDDIES]

No, in fact adults write viruses almost as much as kids do. Virus writers are very intelligent they just choose to waste their talent on viruses.

 [I CAN GET A VIRUS THROUGH A VIDEO]

No, video formats such as .WMV, .WMA, .AVI, .MPG, .MPEG, .ASF, etc. etc. do not contain any "executable" code to modify other files. video files CANNOT WILL NOT contain viruses. The exception is when the file has a double extension, such as home.wmv.exe...this means the file was designed to appear as a video but really isn't.

 [I CAN GET A VIRUS THROUGH MP3s]

Not true, however a bug in Winamp 2.79 may cause a executable code to be run through a mp3 data stream. MP3 files themselves CANNOT contain viruses because once again there is no executable code.

 [I CAN GET A VIRUS THROUGH PICTURE FILES]

Same as video, you cannot get a virus through a picture file. These extensions include, but not limited to: .JPG, .JPEG, .TIFF, .PIC, .BMP, .TIF, .GIF, .PSD, .PSP, etc.

 [TROJAN/WORM FILES CAN BE CLEANED BY ANTIVIRUS PRODUCTS]

This is untrue, before you mouth drops let me explain something. A virus injects its code into other programs for example:

01010101010     << orignal code

010101010103333 << orignal code with virus attached at the end

01010101010     << cleaned by antivirus product

Trojans and Worms work differently because the WHOLE program is the problem.

33333333333 << trojan/worm

There is NO good useful code in the program, thus there is nothing for the antivirus software to recover data from. The antivirus program CAN delete the trojan/worm and get the infection off of your computer, but it cannot clean it.

  [ANTIVIRUS PRODUCTS ARE 100% I AM SAFE]

No you are not. antivirus products can in fact be a false sense of security, no antivirus product is perfect. New viruses are created all the time and antivirus programs can't detect these unless they have a sample. Yes av products do reduce the chance of getting an infection but they are not fool proof.

PROTECTING YOURSELF

 [ANTI-VIRUS PRODUCTS]

There are many different products out on the market, at this point there is NO product that is really superior to the other. There are free antivirus products and pay products. here is the list of some common antivirus products used at present time:

Symantec Norton Antivirus - www.symantec.com

Mcafee Antivirus - www.mcafee.com

F-Secure Antivirus - www.f-secure.com

PC-Cillin - housecall.trendmicro.com

AVG Antivirus (free version) - www.grisoft.com

NOD32 Antivirus System - www.nod32.com

Avast Antivirus (free) - www.alwil.com

It is recommended that you have at least one antivirus product on your computer at all times. It is recommended that you have the constant virus monitor on if you do not have common knowledge about computers and how to identify a virus from a regular program.

 [ANTI-TROJAN PRODUCTS]

Many antivirus products do provide trojan protection, however they are generally not as good as antitrojan products available. You may or may not have a anti-trojan product on your computer..it is simply optional.

Trojan Hunter - www.misec.net/trojanhunter/

The Cleaner - www.moosoft.com

Tauscan - www.agnitum.com/

 [GENERAL TIPS]

* Never download attachments in email from people you don't know, in fact don't download attachments from people you DO know. Viruses can spread through friends address books and the virus could be sent to you.

* Check file sizes, if you are downloading say..AOL Instant Messenger and the file size is only 20K big..think about it..is AIM really on 20K in size? I don't think so.

* .COM/.SHS/.BAT/.VBS/.DOC are generally bad news. These files types usually contain viruses.

* Always check extensions, if there are two extensions the file is normally bad news..and the second extension is what the file REALLY is.

* Viruses are usually launched through .exe, .com, .shs, .vbs, .doc and files in .zip files can contain them.

* If unsure, use your antivirus scanner on the questionable file this should give you a good idea what you are working with.

* make sure you keep your antivirus up-to-date, a virus scanner can only be effective if it has up-to-date patterns to look for.

I am hoping this helped someone out there with a introduction to viruses and how to protect yourself from them.

RIGHT! So there you have it. Obviously some of the information and links are outdated, but all the major concepts hold true to this day. So I hope this has cleared a bit up for you and you can now browse the web with confidence and intelligence.

- Panopticon36 -