History Of Computer Virus - Part 3

This Article Taken From http://www.cknow.com

Dr. Solomon: 1989 - Datacrime

During 1989 things really started to move. The Fu Manchu virus (a modification of Jerusalem) was sent anonymously to a virus researcher in the UK, and the 405 virus (a modification of the overwriting virus in the Burger book) was sent to another UK researcher. A third UK researcher wrote a virus and sent it to another UK researcher; in 1989, the UK was where it was all happening. But not quite all. In 1989, the Bulgarians started getting interested in viruses, and Russia was beginning to awaken.

In March of 1989, a minor event happened that was to trigger an avalanche. A new virus was written in Holland. A Dutchman calling himself Fred Vogel (a very common Dutch name) contacted a UK virus researcher, and said that he had found this virus all over his hard disk. He also said that it was called Datacrime, and that he was worried that it would trigger on the 13th of the next month.

When the virus was disassembled, it was found that on any day after October 12th, it would trigger a low level format of cylinder zero of the hard disk, which would, on most hard disks, wipe out the File Allocation Table, and leave the user effectively without any data. It would also display the virus' name: Datacrime virus. A straightforward write-up of the effect of this virus was published, but it was another non-memory-resident virus, and so highly unlikely to spread.

However, the write-up was reprinted by a magazine, another magazine repeated the story, a third party embellished it a bit, and by June it was becoming an established fact that it would trigger on October 12th (not true, it triggers on any day after the 12th, up till December 31st) and that it would low level format the whole hard disk. In America, the press started calling it "Columbus Day virus" (October 12th) and it was suggested that it had been written by Norwegian terrorists, angry at the fact that Eric the Red had discovered America, not Columbus.

Meanwhile, in Holland, the Dutch police were doing one of the things that falls within those things that police are supposed to do: crime prevention. Datacrime virus was obviously a crime, and the way to prevent it was to run a detector for it. So they commissioned a programmer to write a Datacrime detector, and offered it at Dutch police stations for $1. It sold really well. But it gave a number of false alarms, and it had to be recalled and replaced with version 2. There were long queues outside the Dutch police stations, lots of confusion about whether anyone actually had this virus (hardly anyone did, but the false alarms muddied the waters).

If the police take something seriously, it must be serious, right? So in July, large Dutch companies started asking IBM if viruses were a serious threat. Datacrime isn't, but there is a distinct possibility that a company could get Jerusalem, Cascade or Stoned (or Italian, in those days before 8088 computers became a rarity). So what is IBM doing about this threat, they asked?

IBM had internal-use-only anti-virus software. They used this to check incoming media, and to make sure that an accident like Lehulpe could never happen again. IBM had a problem: if they didn't offer this software to their customers, they could look very bad if on October 13th a lot of computers went down. The technical people knew that this wouldn't happen, but obviously they knew that someone, somewhere, might have important data on a computer that would get hit by Datacrime. IBM had to make a decision about whether to release their software, and they had a very strict deadline to work to; October the 13th would be too late.

In September of 1989, IBM sent out version 1.0 of the IBM scanning software, together with a letter telling their customers what it was, and why they were sending it out. When you get a letter like that from IBM, and a disk, you would be pretty brave to take no notice, so a lot of large companies scanned a lot of computers, for the first time. Hardly anyone found Datacrime, but there were instances of the usual viruses.

October 13th fell on a Friday, so there was a double event: Jerusalem and Datacrime. In the US, Datacrime (Columbus Day) had been hyped out of all proportion for a virus that is as uninfective as this one, and it is highly likely that not a single user had the virus. In Europe (especially in Holland) there might have been a few, but not many.

In London, the Royal National Institute for the Blind announced that they'd had a hit, and had lost large amounts of valuable research data, and months of work. We investigated this particular incident, and the truth was that they had a very minor outbreak of Jerusalem, and a few easily-replaced program files had been deleted. Four computers were infected. But the RNIB outbreak has passed into legend as a Great Disaster. Actually, the RNIB took more damage from the invasion of the television and print media than from the virus.

By the end of 1989, there were a couple of dozen viruses that we knew about, but we didn't know that in Bulgaria and Russia, big things were brewing.

Read More......

History of Computer Virus - Part 2

This Article was taken from http://www.cknow.com
Dr. Solomon: 1988 - The Game Begins

The year 1988 was fairly quiet, as far as virus writing went. Mostly, it was the year that anti-virus vendors started appearing, making a fuss about what was at that time only a potential problem, and not selling very much anti-virus software. The vendors were all small companies, selling their software for very low prices (#5 or $10 was common). Some of them were shareware, some were freeware. Occasionally some larger company tried to pop up, but no-one was paying serious cash to solve a potential problem.

In some ways, that was a pity, because 1988 was a very virus-friendly year. It gave Stoned, Cascade and Jerusalem a chance to spread undetected, and to establish a pool of infected objects that will ensure that they never become rare.

It was in 1988 that IBM realised that it had to take viruses seriously. This was not because of the well-known Christmas tree worm, which was pretty easy to deal with. It was because IBM had an outbreak of Cascade at the Lehulpe site, and found itself in

the embarrassing position of having to inform its customers that they might have become infected there. In fact, there was no real problem, but from this point on, IBM took viruses very seriously indeed, and the High Integrity Computing Laboratory in Yorktown was given responsibility for the IBM research effort in this field.

1988 saw a few scattered, sporadic outbreaks of Brain, Italian, Stoned, Cascade and Jerusalem. It also saw the final arguments about whether viruses existed or not. Peter Norton, in an interview, said that they were an urban legend, like the crocodiles in the New York sewers, and one UK expert claimed that he had a proof that viruses were a figment of the imagination. In 1988, the real virus experts would debate with such people; after that year, real virus experts would simply walk away from anyone who had such absurd beliefs.

Each outbreak of a virus was dealt with on a case-by-case basis. One American claimed that he had a fully equipped mobile home for dealing with virus outbreaks (and another one extrapolated to the notion that soon there would be many such mobile units). Existing software was used to detect boot sector viruses (by inspecting the boot sector), and one-off software was written for dealing with outbreaks of Cascade and Jerusalem.

In 1988, a virus that is called "Virus-B" was written. This is another virus that doesn't go memory resident, and it is a modification of another virus that deletes files on Friday 13th. When this virus is run, it displays "WARNING!!!! THIS PROGRAM IS INFECTED WITH VIRUS-B! IT WILL INFECT EVERY .COM FILE IN THE CURRENT SUBDIRECTORY!". A virus that is as obvious as that, was clearly not written to spread. It was obviously written as a demonstration virus. Virus researchers are often asked for "harmless viruses" or "viruses for demonstration"; most researchers offer some alternative, such as an overhead foil, or a non-virus program that does a falling letters display. But it looks as if VIRUS-B was written with the intention of giving it away as a demonstration virus - hence the warning. And, indeed, we find that an American company was offering it to "large corporations, universities and research organizations" on a special access basis.

At the end of 1988, a few things happened almost at once. The first was a big outbreak of Jerusalem at a large financial institution, which meant that dozens of people were tied up in doing a big clean-up for several days. The second was that a company called S&S did the first ever Virus Seminar that actually explained what a virus was and how they worked. The third was Friday 13th. [S&S became what was known as Dr. Solomon Software, which has subsequently been purchased by Network Associates.]

It was clear that we couldn't go out and help everyone with a virus, even if we bought a mobile home and equipped it (with what)? It was also clear that the financial institution, and the academic site, could easily handle a virus outbreak, but they didn't have the tools to do the job. All they needed was a decent virus detector, which was not available. So we wrote one, added some other tools that experience said might be useful, and created the first Anti-Virus Toolkit.
In 1989, the first Friday 13th was in January. At the end of 1988, it was clear that Jerusalem was in Spain and the UK, at least, and was in academic as well as commercial sites. Because of the destructive payload in the virus, we felt that if we failed to send out some sort of warning, we would be negligent. But the media grabbed the ball and ran with it; the predictability of the trigger day, together with the feature of it being Friday 13th, caught their imagination, and the first virus media circus was under way.

On the 13th of January, we had dozens of phone calls, mostly from the media wanting to know if the world had ended yet. But we also had calls from a large corporate site, a small vendor of PC hardware, and a couple of single users. We were invaded by TV cameras in droves, and had to schedule them carefully to avoid them tripping over each other. In the middle of all this, the PC Support person from the infected corporation arrived. The TV people wanted nothing better than a victim to film, but the corporate person wanted anonymity. We pretended that he was just one of our staff. Also, at that time, British Rail contacted us; they also had an outbreak of Jerusalem, and they went public on it. Later, they regretted that decision, because for a long time afterwards, their PC Support person was badgered by the media seeking interviews.

Read More......

Windows Command Prompt (part 8)

Ok.. after 3 weeks i forget about this cmd part........ next command are:

• Label. Label is used to view or change (rename) the label of computer disk drive. You will get the same result with renaming or giving name in My Computer.
  Here is the syntax : label [drive:][label], so if you going to give name or rename your C:\ drive, just type:
  
  label C: system
  
  [label] can be anything you wish for.

• MD. MD is abbreviation from Make Directory. So it's clearly now that MD is used to creates a new directory/folder on your drive. Just type like:
  
  md music

• MKDIR. same as MD above :)

• MORE. is used to displays a long output in continued area. This command is used after another command in pipe (|). For example:
  dir | more
  net view | more
  etc

• MOVE. this is used to moves files and renames files and directory. There are two option that you can use, so the first option's syntax to move is move [/y | /-y] [drive:][path]filename destination. if you already inside the path, you don't need to write path anymore. For Example:
  
  move c:\windows\explorer.exe D:
  
  or, if you already in windows folder just type:
  
  move explorer.exe D:
  
  and, for rename usage, i advice you use REN command than this complex command :p

• PATH. Path is used to specify the location where MS-DOS looks when using a command. For example, when using the command "format", if the path is not specified to where the command is you will receive bad command or file name. Just type path and there it go

Read More......