Design and implementation of computer viruses with their anti.

number: 
795
English
department: 
Degree: 
Imprint: 
Computer Science
Author: 
Husam Ali Abdul Al-Mihsen Al-Asedy
Supervisor: 
Dr. Imad H. Al-Hussiani
Dr.Taha S. Bashaga
year: 
2002

Abstract:

Malicious Software (Malware) is that annoying and in many times destructive program. Two Malwares in this work Viruses and Worms. Viruses are self-replicating programs, replicate by attaching their codes to other programs (host programs) and they may or may not be destructive. Worms are stand-alone programs (i.e. do not need a host program to replicate), But instead of spreading from file to file like viruses, they spread from computer to computer. Worms are insidious programs because they don't rely upon human behavior in order to spread, unlike viruses. The viruses also can be classified to types; one of those types is the macro virus, which is considered in this work. One Macro virus named (MV) is designed and implemented in this work. This virus infects the Microsoft Word Documents. The MV virus uses the polymorphic technique (i.e. encrypting itself) to avoid detection by anti-viruses Software. The MV virus propagated successfully from document to document, and from computer to computer through LAN, Disk and Email service. The payload (i.e. destructive or harmless part) of the virus is activated each year at the same day (31 of December). So, if any infected document is opened at that date its data will be deleted and every executable file with (EXE) extension stored in the hard disk of the infected computer will be deleted. Two Worms named (WRH and WFH) are also designed and implemented in this work. Both of these two worms propagate through Email service successfully. The payload of the WRH worm is to remove all the files stored in the hard disk of the host computer on a certain date. The payload of the WFH worm is to fill the hard disk of the host computer (i.e. replicate itself each time the host computer is started). Finally the anti-virus named (AV) of the three Malware proposed, is designed and tested successfully, by removing the three malicious codes. The three Malware proposed in this work were tested through a LAN, for its availability. The LAN is supported by Email service.