Sunday 8 April 2012

Most Dangerous Computer Viruses

Computer viruses have a relatively short history, but the damages caused by some of them pushed cyber-experts to opening a new chapter on computer viruses. Some viruses led to serious damages and affected a large number of companies, universities and even governments.
Here are some of the most dangerous computer viruses in history:
Jerusalem - 1987
This is one of the first MS-DOS viruses in history that caused enormous destructions, affecting many countries, universities and companies worldwide. On Friday 13, 1988 the computer virus managed to infect a number of institutions in Europe, America and the Middle East. The name was given to the virus after one of the first places that got "acquainted" with it - the Jerusalem University.
Along with a number of other computer viruses, including "Cascade", "Stoned" and "Vienna" the Jerusalem virus managed to infect thousands of computers and still remain unnoticed. Back then the anti-virus programs were not as advanced as they are today and a lot of users had little knowledge of the existence of computer viruses.
Morris (a.k.a. Internet Worm) - November 1988
This computer virus infected over 6,000 computer systems in the United States, including the famous NASA research Institute, which for some time remained completely paralyzed. Due to erratic code, the worm managed to send millions of copies of itself to different network computers, being able to entirely paralyze all network resources. The damages caused by the Morris computer virus were estimated at $96 millions.
To be able to spread, the computer virus used errors in such operating systems as Unix for VAX and Sun Microsystems. The virus could also pick user passwords.
Solar Sunrise - 1998
A decade later the situation didn't change, in fact it even got worse. Using a computer virus, hackers, in 1998, penetrated and took control of over 500 computer systems that belonged to the army, government and private sector of the United States. The whole situation was dubbed Solar Sunrise after the popular vulnerabilities in computers that run on the operating system called Sun Solaris. Initially it was believed that the attacks were planed by the operatives in Iraq. It was later revealed that the incidents represented the work of two American teenagers from California. After the attacks, the Defense Department took drastic actions to prevent future incidents of this kind.
Melissa - 1999
For the first time computers got acknowledged with Melissa computer virus on March 26, 1999, when the virus shut down the Internet mail system, which got blocked with e-mails infected by the worm. It is worth mentioning that at first Melissa was not meant to cause any harm, but after overloading the servers, it led to serious problems. For the first time it spread in the Usenet discussion group alt.sex. Melissa was hidden within a file called "List.DiC", which featured passwords that served as keys to unlocking 80 pornographic websites. The original form of the virus was sent through e-mail to different users.
Melissa computer virus was developed by David L. Smith in Aberdeen Township, New Jersey. Its name comes from a lap dancer that the programmer got acknowledged with while in Florida. After being caught, the creator of the virus was sentenced to 20 months in federal prison and ordered to pay a fine of $5,000. The arrest was made by a team of representatives from FBI, New Jersey State Police and Monmouth Internet.
Melissa had the ability to multiply on Microsoft Word 97 and Word 2000, as well as on Microsoft Excel 97, 2000 and 2003. In addition, the virus had the ability to mass-mail itself from Microsoft Outlook 97 and Outlook 98.
I Love You - May 2000
Using a similar method as the Melissa, the computer virus dubbed "I Love You" managed to infect millions of computers around the world overnight. Just like Melissa this computer virus sent passwords and usernames, which were stored on the attacked computers, back to the developer of the virus. After authorities traced the virus they found that a young Filipino student was behind the attack. The young man was released due to the fact that the Philippines did not have any law that would prevent hacking and spreading malware. This situation served as one of the premises for creating the European Union's global Cybercrime Treaty.
The Code Red worm - July 2001
This 21st century computer virus managed to penetrate tens of thousands of systems that ran Microsoft Windows NT and Windows 2000 server software. The damages caused by the Code Red computer virus were estimated at $2 billion. Core Red was developed to use the power of all computers it infected against the official website of the White House at a predetermined date. In collaboration with different virus hunters and tech firms, the White House managed to decipher the code of the Code Red virus and stop traffic as the malware started its attacks.
Nimda - 2001
Shortly after the September 11 tragedy this computer virus infected hundreds of thousands of computers worldwide. Nimda was considered to be one of the most complicated viruses, having 5 different methods of infecting computers systems and being able to duplicate itself.

Beast Trojan Horse (2002)


Also Known As: Remote Administration Tool or RAT (Now This is a Type)
First understand what is a Trojan Horse is ? and what it can do ?
Trojan Horse is a standalone malicious software program that does not infects computer completely automatically, until  you execute the virus or infected software program it does nothing but once executed it can make copy of itself in multiple directories and hence makes difficult to be removed, it can steal your secret information by many ways such as keystroke logging or can damage your computer system completely.
And Beast is one of the first Trojan Horse program that has capability of reverse connection, this program was written in Delphi programming language by Tataye in 2002.
It was using the injection method to inject viruses into specific process, commonly “explorer.exe” (Windows Explorer), “iexplore.exe” (Internet Explorer), or “msnmsgr.exe” (MSN Messenger) to steal information and give control to its author of your computer.

Once it connects to its author, they can do the following on your PC:

  • Access to File Manager – along with browsing victim’s directories it could upload, download, delete, or execute any file, hence becomes more dangerous.
  • Remote Registry Editor
  • Get Screenshot of your computer Screen and your Webcam
  • Passwords tool capable of recovering any stored passwords in the victim’s computer
  • Access over Power Options (e.g. shutdown, reboot, logoff, crash, etc.)
  • Also included a Chat client for providing communication between the attacker and the victim
  • Other tools such as a Remote IP scanner, live keylogger, offline logs downloader, etc.

SQL Slammer (2003)


Also Known As: Sapphire, Worm.SQL.Helkern, SQLSlammer
Appeared at the starting of the year on 27th January 2003 and very quickly it got the highest rank in the list of most dangerous worms of that year because it was the first fileless worm. SQL Slammer was able to spread by taking advantage of the vulnerability found in the SQL Servers.
According to statistics:
SQL Slammer spread to over 90 percent of all vulnerable hosts in 10 minutes and infected around 359,000 Hosts total and according to London-based market intelligence the worm caused between $950 million and $1.2 billion in lost productivity in its first five days worldwide.

Year 2003 has been one of the Most Destructive year in tech world as it got more than one more dangerous Virus, at the end of the year on 12 August call Blaster, According to Estimate it caused Damaged worth 10 billion dollars and on August 19 worm name Sobig worm has been detected which caused damage of 7 billion dollars and infected over 1 million PCs.

MyDoom (2004)


Also Known As: W32.MyDoom@mm, Novarg, Mimail.R and Shimgapi
First seen on 26th January 2004 and it caused Damage of $38 Billions.
MyDoom is still the current record holder for the fastest-spreading mass mailer worm.
Mydoom is primarily spread via e-mail attachments, it comes in email with subject lines including “Error”, “Mail Delivery System”, “Test” or “Mail Transaction Failed” in different languages, including English and French. The mail contains an attachment that, if executed, resends the worm to e-mail addresses found in local files such as a user’s address book.
Next day on 27th January SCO Group offers a US $250,000 reward for information leading to the arrest of the worm’s creator.

Bandook Rat (2005)


Also Known As: Backdoor.Win32.Bandok.bd, Troj/Bandok-J, Backdoor.Bandook, BDS/Bandok.R.2
A very similar virus as Beast Trojan Horse (2002) but with improved functionality detected first in middle of 2005. Bandook Rat abbreviation for “Bandook Remote Administration Tool” is a backdoor trojan horse that infects Windows NT, 2000, XP, 2003, Vista, Windows 7 Also, Yes that means new variants of this virus is still being released by different authors and hence making it the most destructive virus till date.

Blackworm (2006)


Also Known As: Mywife, Hunchi, I-Worm.Nyxem, Blackmal, Nyxem, Blueworm
Blackworm worm was first virus of 3 found on 20 January, 2006. The worm spreads in e-mails using an external SMTP engine. It sends itself with different subjects, body text and attachment names. The worm also copies itself multiple times to an infected hard drive with similar name as windows files in order to be hidden. Blackworm is designed to corrupt data on infected computers on every 3rd day of each month, in respect to The Day the Music Died. After corrupting the data of the computer it visits a webpage with tracking code, so it can be counted how many Systems has been infected, and over 300,000 unique IPs visited that site.
The most scary thing in this worm is, It can deletes your antivirus programs if they are installed in the same directories as the ones specified in the worm’s code. It can also delete the entries in the Windows Registry belonging to these antivirus programs, so antivirus applications will not be run automatically the next time Windows is started.
The worm also contains one GIF file which is used to make a recipient of infected e-mails think that the message was scanned by Norton Anti-Virus and no infection was found.
But its havoc ended soon and it gone off the records after October 26.
Did you Know: By the time you will finished reading this article 95,000+ new computers has been affected by viruses !
This article is half because -
More long article = More time required to read = More computers are affected.
Downadup - 2009
The latest and most dangerous virus is the "downadup" worm, which was also called "Conficker". The computer security company F-Secure stated that the computer virus has infected 3.5 million computers worldwide. This malicious program was able to spread using a patched Windows flaw. Downadup was so "successful" in spreading across the Web, because it used a flaw that Microsoft patched in October in order to distantly compromise computers that ran unpatched versions of Microsoft's operating system. But the greatest power of the worm is believed to be the ability of computers, infected with the worm, to download destructive code from a random drop point. F-Secure stated that three of the most affected countries were China, Brazil and Russia.

1 comment: