References

1. "What is Malware?" n.d. In Website Defender. Retrieved March 19, 2014, from http://www.websitedefender.com/what-is-malware/

2. "What is social computing?" (February 2010) Margaret Rouse. In Tech Target. Retrieved March 19, 2014, from
http://www.websitedefender.com/what-is-malware/

3. David Moore,Vern Paxson,Stefan Savage, Colleen Shannon,Stuart Staniford,Nicholas Weaver,CAIDA & UCSD CSE,ICIR & LBNL,UCSD CSE,CAIDA,Silicon Defense,Silicon Defense & UC Berkeley EECS. "The Spread of the Sapphire/Slammer Worm". March 20, 2014, from http://www.caida.org/publications/papers/2003/sapphire/sapphire.html

4. SQL Slammer. n.d. In Wikipedia. Retrieved March 20, 2014, from http://en.wikipedia.org/wiki/SQL_Slammer


5. 熊貓燒香. n.d. In Wikipedia. Retrieved March 20, 2014, from http://zh.wikipedia.org/wiki/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99

6. 熊貓燒香. n.d. In Baike. Retrieved March 20, 2014, from http://www.baike.com/wiki/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99.

7. Reports Sophos. (February 13, 2007) .Panda Joss-Stick Virus Is No Pandemic. Retrieved March 20, 2014, from http://english.cri.cn/4026/2007/02/13/202@195894.htm

8.Trojan horse. n.d. In Wikipedia. Retrieved March 18, 2014, from http://en.wikipedia.org/wiki/Trojan_horse_(computing)

9. malware signature. n.d. In Wikipedia. Retrieved October 8, 2012, from http://zh.wikipedia.org/wiki/%E7%89%B9%E5%BE%81%E7%A0%81

10. "How to help protect your computer from malware" n.d. In Microsoft. Retrieved March 20, 2014, from http://www.microsoft.com/security/resources/malware-whatis.aspx

Exercise Section

Q1. What is scan malware signature method?

Ans: This method used with some anti-virus software, because programmers or software it will collect some signature. If the system can find the signature match with database it means it is virus or Trojan Horse.

Q2.Why we install the antivirus software, but still infect the worm?

Ans: Not all antivirus software can identify and block the worm.

Q3. If we infect malicious software what can we do?

Ans: We can download the malicious software removal tool.

Q4. How to reduce the opportunities of getting malware?

Ans: 1. Install the antivirus software and firewall.
       2. Keep getting the latest update to protect your computer(s)' security.
       3. Do not open or download the unknown files, emails and programs.

Conclusion

After the three examples mentioned in the blog, we discovered that there are many kinds of malicious softwares. Technological advances everyday, we do not have an exactly solution to prevent all malware, but there are still some ways for you to decrease the chances of getting malicious softwares.

1. Install the antivirus software and firewall.
2. Keep getting the latest update to protect your computer(s)' security.
3. Do not open or download the unknown files, emails and programs.

Hope these articles are useful and those methods can help. Thank you.

"How to help protect your computer from malware" n.d. In Microsoft. Retrieved March 20, 2014 from
 http://www.microsoft.com/security/resources/malware-whatis.aspx

What is Trojan Horse?

Trojan horse is a backdoor. The hacker via the Trojan Horse to collect some information from computer, such as credit card numbers, bank account. Hacker can control the computer, such as print screen, key monitor, send some commands to the computer. The important things is the hacker can transfer another version of Trojan Horse to the computer, the hacker can make sure the Trojan Horse keep working. To guarantee the anti-virus software cannot easily to fully clear it.

Criminal case

In 2012, a Trojan Horse calls "Marauder", it steal a lot of QQ accounts. Since the users download some cheat programs, but these cheat programs attach with the Trojan Horse. When the user execute the program it will execute the Trojan Horse immediately. The computer become start, the Trojan Horse will auto run. Hacker can view some contact list by the chatting software, for example QQ. Moreover, social networking sites it is contain various information, for example Facebook. Hacker can gain some information, such as E-mail address, contact numbers. Lastly, hacker can attach some Trojan Horse files, it is send by infected computers. To form a large network.

These user was steal the QQ accounts and virtual currency,  this Trojan Horse can force the verify system and changed the account password. The account holder cannot login the QQ account. These account was used to sell some virtual currency to gain the money.

Solution

Suggest the user install the anti-virus software and keep update the virus pattern. if you are not the latest version, the anti-virus software may not properly detect the signature.

References: 
1. "Trojan horse". n.d. In Wikipedia. Retrieved March 18, 2014, from http://en.wikipedia.org/wiki/Trojan_horse_(computing)

2. "Malware signature". n.d. In Wikipedia. Retrieved October 8, 2012, from http://zh.wikipedia.org/wiki/%E7%89%B9%E5%BE%81%E7%A0%81

What is Social Computing?

Social Computing is a term comes from Computer Science. It describes person having social activity through the Internet.

At present, Social Computing is very popular and becomes a "MUST" in our daily life. For example, more than 450 millions people are using an instant messenger mobile application, WhatsApp, and 70% of them are active users. Besides WhatsApp, have you ever used Facebook, the social networking website? In Tai Wan, about 11 millions users sign in Facebook daily.

On account of this trend, this may cause some law breakers take advantages from it.

Reference:
"What is social computing?" (February 2010) Margaret Rouse. In Tech Target. Retrieved March 19, 2014, from 
http://www.websitedefender.com/what-is-malware/

What is Malicious Software?

Have you ever heard about Trojan Horses? Trojan Horses is a kind of Malicious software.

Malicious software,  another name we called, Malware,  which is used to describe the softwares  access someone's computer system without asking the permission.

There are many types of Malware,  such as spyware, worms and computer viruses. These unwanted software can be caused by person, enterprises and government.

Reference:
"What is Malware?" n.d. In Website Defender. Retrieved March 19, 2014, from 
http://www.websitedefender.com/what-is-malware/

Worm.Whboy

What is Worm.Whboy?

  Worm.Whboy is a variants computer worm. It created by Li Jun in October 16, 2006. Li was sold to more than 120 people in the network and earned one hundred thousand dollars from the worm. The worm infected through the downloading files. It spread in the China, over 1 million computers had been infected in January 2007. They also sold out the online game account and QQ account which were stole to seek profit.

Symptoms of poisoning

  When Windows user poisoned the Worm.Whboy, all of the suffix name .exe files cannot be excuted and the file's icon will become panda pattern.

The following picture shows symptoms after poisoning:

  In addition, the computer would be blue screen, reboot system frequently and the data files have been destroyed.

The hazards of worm

  The worm would delete the .gho file, so that users could not use ghost to restore the operating system. If the web developer’s computer poisoned the worm, the virus code would add into the website files. After the webpage upload to the website, the user have been infected when they browser these website. As the views of these sites was very large, resulting in Worm.Whboy infected a very wide range, more than one thousand enterprises and government agencies have been poisoned.

How Worm.Whboy spread?

  Worm.Whboy used Instant Messaging software (e.g. MSN, ICQ) as its source of targets, people downloaded the infected files. If Worm.Whboy Infected systems .exe, .com, .pif, src, .html, .asp file, it would add the virus URL. User clicked to open these file, IE will automatically connect to the specified URL to download the Worm.Whboy.

Solution

  Some method can solve the Worm.Whboy problem. First of all, check the local administrator member passwords and use the strong password. Secondly, turn off autoplay feature on all drives. Thirdly, keep the operating system to the latest security updates, do not access to the site from unknown sources, especially Microsoft's MS06-014 vulnerability. Lastly, enable the firewall to protect your local computer and the share folder should stop sharing.

References:

1. 熊貓燒香. n.d. In Wikipedia. Retrieved March 20, 2014, from http://zh.wikipedia.org/wiki/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99.


2. 熊貓燒香. n.d. In Baike. Retrieved March 20, 2014, from http://www.baike.com/wiki/%E7%86%8A%E7%8C%AB%E7%83%A7%E9%A6%99.

3. Reports Sophos. (February 13, 2007) .Panda Joss-Stick Virus Is No Pandemic. Retrieved March 20, 2014, from http://english.cri.cn/4026/2007/02/13/202@195894.htm.

SQL Slammer Worm /Sapphire Worm

What is SQL Slammer?

  SQL Slammer Worm is the fastest worm in the world. It named SQL Slammer but it didn’t use any SQL language. This worm exploited some vulnerabilities of Microsoft's flagship SQL Server. SQL Slammer first appearance on 25-1- 2003. As I mentioned before SQL Slammer is the fastest worm. Most of the victims infected it within ten minutes. On 2003 in Hong Kong this worm cause ATM down and some of the Internet service down.

How SQL Slammer infect?

  SQL Slammer send the random target a UDP packet to port 1434. If the worm infected you system, it sends traffic to random ip addresses for DDOS the ip addresses to make the Internet service down and try to infect them. According to the record the traffic is up to 50Mb/s after being infected.

Solution?

  Michael Bacarella is the first person to alerted the general public. In 25-1-2003

Who posted a message "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!".  And Microsoft releases the fix packet in 31-1-2003 to end this worm.

This is the infected area after the worm releases 30minutes

References:
1. David Moore,Vern Paxson,Stefan Savage, Colleen Shannon,Stuart Staniford,Nicholas Weaver,CAIDA & UCSD CSE,ICIR & LBNL,UCSD CSE,CAIDA,Silicon Defense,Silicon Defense & UC Berkeley EECS. "The Spread of the Sapphire/Slammer Worm". March 20, 2014, from
http://www.caida.org/publications/papers/2003/sapphire/sapphire.html

2. SQL Slammer. n.d. In Wikipedia. Retrieved March 20, 2014, from http://en.wikipedia.org/wiki/SQL_Slammer.