closed

Zeus

Zeus, also known as Zbot, is a Trojan horse malware package made to infect computers running Microsoft Windows, so to perform various criminal tasks on its own. The most common of these tasks are usually man-in-the-browser keylogging and form grabbing. It is also used to install the CryptoLocker ransomware. The majority of computers were infected either through drive-by downloads or phishing scams. First identified in July 2007 when it was used to steal information from the United States Department of Transportation, it became more widespread in March 2009, when it managed to compromise over 74,000 FTP accounts and computers from large multinational corporations and banks, such as Amazon, Oracle, Bank of America, Cisco, etc. Controllers of the Zeus botnet used it to steal the login credentials of social network, email, and banking accounts.

In the US alone, it was estimated that more than 1 million computers were infected. The entire operation was sophisticated, involving people from around the world to act as money mules to smuggle and transfer cash to the ringleaders in Eastern Europe. About $70 million was stolen and in possession of the ring. 100 people were arrested in connection of the operation.

Zeus is very difficult to detect, even with up-to-date antivirus and other security software, as it hides itself using stealth techniques. This is considered the primary reason why the Zeus malware has become the largest botnet on the Internet: Damballa estimated that the malware infected 3.6 million PCs in the U.S. in 2009.

nVIR

nVIR is an obsolete computer virus which can replicate on Macintosh (Mac) computers running any System version from 4.1 to OS 8. The source code to the original nVIR has been made widely available, and so numerous variants exist. Each variant causes somewhat different symptoms, such as: application crashes, printing errors on laser printers, slow system response time, or unpredictable system crashes. nVIR spreads through any nVIR-infected program, but due to the long period of time nVIR lies basically dormant in a host system, nVIR generally finds its way into system backups and is not detected until the first overt symptoms appear. For example, if a disk used in an infected Macintosh is removed and inserted in a second Macintosh, the other machine will become infected if any application on that disk is executed in the second machine. Further, any method used to transfer programs between Macintoshes will spread nVIR, including file transfer over a network. However, nVIR cannot spread via a print network's hardware.

nVIR carries an additional code resource, CODE 256 (though some variants carry CODE 255), and patches the jump table to point to it. The original application's entry point is saved in the nVIR 2 resource. nVIR introduces to the System file the INIT 32 resource which is executed at startup, at which time nVIR patches the TEInit trap. Any application subsequently calling this trap will be infected. The nVIR 3 (or nVIR 5) resource is a copy of INIT 32. An nVIR 10 resource in the System file will prevent nVIR infection. If an application calls OpenResFile prior to TEInit, that application will be damaged.

nVIR 0 resource holds a counter that is set to 1000 on the first infection of the system. Each reboot decrements the counter by 1. Each application launch decrements it by 2. When the counter reaches 0, nVIR will beep 1 out of 8 reboots and 1 of 4 infected application launches. If MacinTalk is installed in the machine's System folder, the machine may occasionally say "Don't Panic". Otherwise, it may beep unexpectedly.

Brain

Brain is the industry standard name for a computer virus that was released in its first form in January 1986, and is considered to be the first computer virus for MS-DOS. It infects the boot sector of storage media formatted with the DOS File Allocation Table (FAT) file system. Brain was written by two brothers, Basit Farooq Alvi and Amjad Farooq Alvi, from Lahore, Punjab, Pakistan. Brain affects the IBM PC computer by replacing the boot sector of a floppy disk with a copy of the virus. The real boot sector is moved to another sector and marked as bad. Infected disks usually have five kilobytes of bad sectors. The disk label is changed to ©Brain, and the following text can be seen in infected boot sectors:

ｗｅｌｃｏｍｅ ｔｏ ｔｈｅ ｄｕｎｇｅｏｎ (ｃ)  ｂａｓｉｔ & ａｍｊａｄｓ (ｐｖｔ) ｌｔｄ ｖｉｒｕｓ_ｓｈｏｅ ｒｅｃｏｒｄ ｖ. ｄｅｄｉｃａｔｅｄ ｔｏ ｔｈｅ ｄｙｎａｍｉｃ ｍｅｍｏｒｉｅｓ ｏｆ ｍｉｌｌｉｏｎｓ ｏｆ ｖｉｒｕｓｅｓ ｗｈｏ ａｒｅ ｎｏ ｌｏｎｇｅｒ ｗｉｔｈ ｕｓ ｔｏｄａｙ - ｔｈａｎｋｓ ｇｏｏｄｎｅｓｓ!! ｂｅｗａｒｅ ｏｆ ｔｈｅ ｅｒ..ｖｉｒｕｓ : ｔｈｉｓ ｐｒｏｇｒａｍ ｉｓ ｃａｔｃｈｉｎｇ ｐｒｏｇｒａｍ ｆｏｌｌｏｗｓ ａｆｔｅｒ ｔｈｅｓｅ ｍｅｓｓａｇｅｓ....$#@%$@!!

In 2011, 25 years after Brain was released, Mikko Hyppönen of F-Secure traveled to Pakistan to interview Amjad for a documentary. Being inspired by this documentary and its wide spread, a group of Pakistani bloggers interviewed Amjad, under the banner of Bloggerine.

AIDS

AIDS is a computer virus written in Turbo Pascal 3.01a which overwrites .com files. AIDS is the first virus known to exploit the MS-DOS "corresponding file" vulnerability. In MS-DOS, if both foo.com and foo.exe exist, then foo.com will always be overwritten first.

When the AIDS virus activates, it shows a message that reads:

ATTENTION I have been elected to inform you that throughout your process of collecting and executing files, you have accdientally ¶HÜ¢KΣ► [PHUCKED] yourself over: again, that's PHUCKED yourself over. No, it cannot be; YES, it CAN be, a √ìτûs [virus] has infected your system. Now what do you have to say about that? HAHAHAHAHA. Have ¶HÜÑ [PHUN] with this one and remember, there is NO cure for AIDS 

In the message above, the word "AIDS" covers about half of the screen. The system then freezes, and must be powered down manually.

The AIDS virus overwrites the first 13,952 bytes of a .com file. Overwritten files must be deleted and replaced with clean copies in order to remove the virus. It is not possible to recover the overwritten portion of the program.

Bomber

Also known as Commander Bomber, Bomber is a DOS polymorphic memory resident computer virus, known for its technique of "patchy infection". This method of infection is very similar to the one utilized by the OneHalf computer virus.

Contrary to the usual method of infecting executables (which is to append virus body to the executable  and to change the entry point), it inserts several fragments ("patches") of its code in random places inside the file. These fragments transfer control to each other using various mechanisms.

The method of infection makes the detection of the virus difficult by anti-virus programs, and it means that they would have to scan the file in its entirety in order to detect the virus.

The size of the Bomber executable is approximately 4096 bytes and contains the following text: 

ＣＯＭＭＡＮＤＥＲ ＢＯＭＢＥＲ ＷＡＳ ＨＥＲＥ

Blaster

The Blaster Worm (also known as Lovsan, Lovesan or MSBlast) was a computer worm that spread on computers running the Microsoft operating systems Windows XP and Windows 2000, during August 2003. The virus worked like this: once a network (such as a company or university) was infected, it spread faster within the network because firewalls typically did not prevent internal machines from using a certain port. Filtering by ISPs and widespread publicity about the worm curbed the spread of Blaster.

The worm was programmed to start a SYN flood against port 80 of windowsupdate.com if the system date is after August 15 and before December 31st and after the 15th day of other months, thereby creating a DDoS against the site. The damage to Microsoft was minimal as the site targeted was windowsupdate.com, rather than windowsupdate.microsoft.com to which the former was redirected. Microsoft temporarily shut down the targeted site to minimize potential effects from the worm.

The worm's executable, MSBlast.exe, contains two messages. The first reads  “I just want to say LOVE YOU SAN!!” This message gave the worm the alternative name of Lovesan. The second reads “billy gates why do you make this possible ? Stop making money and fix your software!!” This is a message to Bill Gates, the co-founder of Microsoft and the target of the worm.

The worm also creates the following registry entry so that it is launched every time Windows starts:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ windows auto update=msblast.exe

Ransomware

Much more recent, Ransomware is a type of malware which restricts access to the computer system that it infects, and demands a ransom paid to the creator(s) of the malware in order for the restriction to be removed. Some forms of ransomware encrypt files on the system's hard drive (cryptoviral extortion, a threat originally envisioned by Adam Young and Moti Yung), while some may simply lock the system and display messages intended to coax the user into paying.While initially popular in Russia, the use of ransomware scams has grown internationally; in June 2013, security software vendor McAfee released data showing that it had collected over 250,000 unique samples of ransomware in the first quarter of 2013—more than double the number it had obtained in the first quarter of 2012. CryptoLocker, a ransomware worm that surfaced in late-2013, had procured an estimated $3 million USD before it was taken down by authorities.

Ransomware typically propagates as a conventional computer worm, entering a system through, for example, a downloaded file or a vulnerability in a network service. The program will then run a payload: such as one that will begin to encrypt personal files on the hard drive. More sophisticated ransomware may hybrid-encrypt the victim's plaintext with a random symmetric key and a fixed public key. The malware author is the only party that knows the needed private decryption key. Some ransomware payloads do not use encryption. In these cases, the payload is simply an application designed to restrict interaction with the system, typically by setting the Windows Shell to itself, or even modifying the master boot record and/or partition table (which prevents the operating system from booting at all until it is repaired).

Sobig.

Sobig was a computer worm that infected millions of Internet-connected, Microsoft Windows computers in August 2003. Although there were indications that tests of the worm were carried out as early as August 2002, Sobig.A was first released to the public in January 2003. Sobig.B was released in May 2003, though first called Palyh. It was renamed after anti-virus experts discovered it was a variant of Sobig. Sobig.C was released May 31; it fixed the timing bug in Sobig.B. Sobig.D came a couple of weeks later followed by Sobig.E. On August 19, Sobig.F became known and set a record in sheer volume of e-mails. The worm was most widespread in its "Sobig.F" variant.

Sobig is not only a computer worm in the sense that it replicates by itself, but also a Trojan horse in that it masquerades as something other than malware. The e-mail contained the text: "See the attached file for details" or "Please see the attached file for details." and contains either a .pif or .scr file. When the file is installed, the virus will replicate by using its own SMTP agent engine. E-mail addresses that will be targeted by the virus are gathered from files on the host computer.

The Sobig.F variant was programmed to contact 20 IP addresses on UDP port 8998 on August 26, 2003 to install some program or update itself. It is unclear what this program was, but earlier versions of the virus had installed the WinGate proxy server software—a legitimate product—in a configuration allowing it to be used as a backdoor for spammers to distribute unsolicited e-mail. The virus was written using Microsoft Visual C++ compiler, and was compressed using a program called tElock.

Storm Worm

The Storm Worm (dubbed so by the Finnish company F-Secure) is a backdoor Trojan horse that affects computers using Microsoft operating systems, discovered in January of 2007. The worm is also known as:

Small.dam or Trojan-Downloader.Win32.Small.dam (F-Secure)

CME-711 (MITRE)

W32/Nuwar@MM and Downloader-BAI (specific variant) (McAfee)

Troj/Dorf and Mal/Dorf (Sophos)

Trojan.DL.Tibs.Gen!Pac13

Trojan.Downloader-647

Trojan.Peacomm (Symantec)

TROJ_SMALL.EDW (Trend Micro)

Win32/Nuwar (ESET)

Win32/Nuwar.N@MM!CME-711 (Windows Live OneCare)

W32/Zhelatin (F-Secure and Kaspersky)

Trojan.Peed, Trojan.Tibs (BitDefender)

Storm Worm began infecting thousands of (mostly private) computers in Europe and the United States, using an e-mail message with a subject line about a recent weather disaster, "230 dead as storm batters Europe". During the weekend there were six subsequent waves of the attack. As of January 22, 2007, the Storm Worm accounted for 8% of all malware infections globally.

Mydoom

First sighted in January of 2004, Mydoom, also known as W32.MyDoom@mm, Novarg, Mimail.R and Shimgapi is a computer worm affecting Microsoft Windows. It became the fastest-spreading e-mail worm ever (as of January 2004), exceeding previous records set by the Sobig worm and ILOVEYOU.

Mydoom appears to have been commissioned by e-mail spammers so as to send junk e-mail through infected computers. The worm contains the text message "andy; I'm just doing my job, nothing personal, sorry," leading many to believe that the worm's creator was paid. Early on, several security firms expressed their belief that the worm originated from a programmer in Russia. The actual author of the worm is unknown.

Speculative early coverage held that the sole purpose of the worm was to attack the SCO Group with a DDoS. 25 percent of Mydoom.A-infected hosts targeted www.sco.com with a flood of traffic. Trade press conjecture, spurred on by SCO Group's own claims, held that this meant the worm was created by a Linux or open source supporter in retaliation for SCO Group's controversial legal actions and public statements against Linux. This theory was rejected immediately by security researchers. 

Initial analysis of Mydoom suggested that it was a variant of the Mimail worm—hence the alternate name Mimail.R—prompting speculation that the same people were responsible for both worms. Later analyses were less conclusive as to the link between the two worms.

Conficker

First detected in 2008, Conficker, also known as Downup, Downadup and Kido, is a computer worm targeting the Microsoft Windows operating system. It uses flaws in Windows OS software and dictionary attacks on administrator passwords to propagate while forming a botnet, and has been unusually difficult to counter because of its combined use of many advanced malware techniques.The Conficker worm infected millions of computers including government, business and home computers in over 200 countries, making it the largest known computer worm infection since 2003.

SQL Slammer

In January of 2003,  the SQL Slammer worm caused a DDoS in some Internet hosts and dramatically slowed down general Internet traffic. It spread rapidly, infecting most of its 75,000 victims within ten minutes. Slammer was first brought to the attention of the public by Michael Bacarella. Although titled “SQL slammer worm”, the program did not use the SQL language; it exploited a buffer overflow bug in Microsoft’s flagship SQL Server and Desktop Engine database products, for which a patch had been released six months earlier in MS02-039. Other names include W32.SQLExp.Worm, DDOS.SQLP1434.A, the Sapphire Worm, SQL_HEL, W32/SQLSlammer and Helkern.

The worm was based on proof of concept code demonstrated at the Black Hat Briefings by David Litchfield, who had initially discovered the buffer overflow vulnerability that the worm exploited. It is a small piece of code that does little other than generate random IP addresses and send itself out to those addresses. If a selected address happens to belong to a host that is running an unpatched copy of Microsoft SQL Server Resolution Service, the host immediately becomes infected and begins spraying the Internet with more copies of the worm program. 

CIH

First emerging in 1998, CIH, also known as Chernobyl or Spacefiller, was a Windows 9x virus, considered one of the most damaging viruses to ever exist. It would overwrite critical information on infected system drives, destroying the systems BIOS. The total cost of damage was an estimated  $1 billion USD.

The virus was written by Chen Ing-hau, who was a student at Tatung University in Taiwan. Chen claims to have written the virus to challenge antivirus efficiency. He was never charged with spreading the virus because the original spread occurred at his university, he claimed he never meant for it to spread and quickly developed an antivirus to remove the virus from systems infected.