Issam_art4@yahoo.

com
Windows Dos

Com
EXE
Appending Viruses

Windows
Windows Windows
Windows

HTML
Fred
Cohen
Symantec Norton Anti Virus
windows 95

Sara Cordo
 com
EXE EXE
com
EXE
Virus Scan Network Associates
570 00

5000 3500
98%

Trend Micro 3 1
 35117

40000

35000

30000 14678

25000
9038
20000
4003
3113
15000 2806
2477
1726
10000 817
162
65
5000 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999

2000
160 1000

25

21

80%
68%
 (Beep) Form

Michelangelo
Michelangelo Bounnaroti

Assembly Language
Java C
bacterium
 WINDOWS DOS

IBM
DOS (Intel)

WINDOWS
DOS

COM EXE
EXE COM
4KB
4KB

(OVL)
COM
256 COM
PSP
DOS (Program Segment Prefix)
 PSP

64 KB

COM

EXE
EXE

(PSP) DOS
512 EXE
DOS

EXE
 (64 KB) (64 KB)
(64 KB)

EXE

COM
OBI DLL SYS EXE

Appending Viruses

(Appending)
(Prepending)
SYS EXE COM
 { (Espawn)}
COM
DTA EXE
Espawn COM

MOV ah , 9EH ;DTA+1EH, Com File Name

MOV ah , 3CH ;DOS File Create Function
MOV cx , 2 ;hidden attibute
MT 21H

MOV ah , 4OH ;DOS File Write Function

MOV CX ,Finish-Espawn ;Size of Virus
MOV dx , 100 H ;Location of Virus
Int 21 H

Espawn
 WINDOWS
WINDOWS
DOS Microsoft Winowdos

NT 9X WINDOWS
9X Windows ME
NT Windows 2000
DOS
WINDOWS

WINDOWS
WINDOWS 3.X
 WINDOWS WINDOWS
WINDOWS Win Vir
1992
EXE WINDOWS 3.0
(Application Program Interface) API
EXE DOS

Boza 1996
WINDOWS 95
32

Boza
VLDA
WINDOWS
 WINDOWS
Win 32.Kri2
PE Kir2
25 CIH
WINDOWS 9X
KRZIED.TT6
WININIT.INI
KERNEL32.DLL
API

Win95.Prizzy
Prizzy
Prizzy WINDOWS

486
Pentium
(multimedia exetension) mmx

Prizzy
Win32.Legacy Win32.Thorin
 HTML
Java Script
Java
Activex
browser add-ons

HTML

Hyper Text Mar Kup Language HTM

SGML HTML
Standarzid Ganeral Mar Kup Laguage

HTML

Tags
 Links

HTML

HTML

HEAD

TITLE Tiny HMTL document /TITLE

BODY

P Hello Word !

/BODY

/HMTL

HMTL

HMTL
 Img.Scr="graphics/picture.gif "
picture.gif Img.Scr
graphics

a herf=
http://www.myexample.com/index.html>

Aherf

<Frameset Cols=" 50% ,50% " rows=" 75% ,

25% ">
Frameset

<script Type= "text/vbscript" scr =

"hppt//www.example.com/vbcale">
/SCRIPT script

HMTL
 Cookies

Cookies

%winder%cookies
Internt INDEX.DAT
Explorer
attachment
 Activex

Microsoft Outlook

Client / server /
Web-based
Host-based

Netscape Messenger Microsoft Outlook

Microsoft Exchange
Yahoo Hot Mail
Mail
 HTML

Melissa

Melissa I Love You

Pokemon
 1-Cavity virus

2-Worm

3-CIH virus
1998
Flash BIOS
Unbootable

4-Cluster virus
 5-Marco virus

6-Melissa
Word

An Important Messaga From <user name>

user name
Microsoft Outlook
50
Word Normal.dot System Registry
Word
Melissa

7-malicious mobile code

8-Multipartite virus
boot
sector

9-VBS/VBSWG virus
Visual Basic Script/Visual Basic Script Worm Generator
Virus Creation Toolkit

10-Virus Signature

Signature

11-benign virus

12-Peachy virus
2001
Adope Acrobat Reader PDF
Adobe Acrobat
PDF

13-phage virus
 Palm OS
Palm OS phage
Beam
Palm OS

14-SHS virus
shs

15-sparse infector
sparse infector

16-Zoo virus

17-overwriting virus

18-retro virus

anti-anti-virus
 19-Explorer Zip
Microsoft Windows
Trojan Worm

20-Bomb

21-Back door

Back door

trapdoor

23-I Love You

Melissa
13

VB script
Windows WINDOWS
Scripting Host
 win98 IE 5.0
Outlook express win95
Address Book

VBS
13

Subject : I Love You

Body : Kindly checkthe attached Love Letter coming from me
Attachment : Love -Letter- From-For-You-TXT-VBS
TXT

VB script

HKEY_CURRENT_USER\SOFTWARE\Microsoft\ windows scripting

Host\settings\Time out

23-Trojan Horse
macro bootsector

MBR
24-Brontok

25-xcopy
Partion
auotorun
update
 DOS
copy CD
format

exe bat
Microsoft Visual Basic Batch

Polymorphic virus

Issam_art4@yahoo.com
2010
This document was created with Win2PDF available at http://www.daneprairie.com.
The unregistered version of Win2PDF is for evaluation or non-commercial use only.