Prolific Viruses



Anti-Virus software gets a great deal of coverage in Click because ultimately it's a very important component of any computer system and choosing the right program to protect your computer should be carefully considered. Whilst most understand its importance, not many understand the actual effects that a virus can have on your system. To demonstrate my point I need only think back to a phone call I fielded from a gentleman last week who was convinced that a virus had caused the power supply in his printer to malfunction. I thought it might be interesting to look over some of the more realistic and prolific viruses that I've seen over the last decade:

Melissa: Named after an exotic dancer from Florida, this virus tempts users to open an e-mail attachment with a subject line such as 'Here is the document you asked for'. Once opened the virus replicates and forwards itself to the first 50 people in your address book and whilst it isn't destructive the resulting Internet traffic caused major problems for web servers around the world when it was created back in 1999.

Code Red: In 2001 this worm exploited a vulnerability known as a buffer overflow in several versions of Microsofts IIS which was used on many Internet Web Servers. The result of infection on the server was defacement of hosted websites, further propagation as the worm and denial of service attacks (Dos) against several high profile targets including the White House. A DoS attack commonly involves flooding a particular machine with an unmanageable number of requests; in this case, infected machines would continually target activity towards the White House with the intention of bringing the server down.

Blaster: Again, this worm targeted a buffer overflow so that no user intervention was required for machines to become infected. This time a Windows service known as 'DCOM RPC' was exploited with the goal of infecting machines to create a DDOS attack against the Windows Update. A serious side affect for many users running affected versions of Windows was that the instability in one of this Windows service caused the machine to automatically shut itself down after a 60 second countdown. Unleashed on 11th August 2003 the infections for this worm peaked on 13th August as widespread publicity and filtering by Internet Service Providers curved its progress.

Sasser: The first reported was on 30th April 2004, it takes advantage of a vulnerable network port so no intervention by the user is needed for the computer to contract the virus. Once infected, a computer will then begin searching for further vulnerable systems to attack. However it was not a malicious virus so the only damage was reduced computer speed and random shutdowns caused by faulty code in the worm crashing a vital Windows service.

Netsky: Created by the same 17 year old author who created Sasser (due to his age he spent no time in jail when caught), Netsky was an extremely prolific worm which first appeared in February 2004. Distributed via e-mail, if a user opened the infected attachment the worm would then scan the computer for any e-mail addresses and forward itself to all of them. The worm contained no malicious payload but provided problematic traffic to servers as it remained the most prevalent until October 2006.

Storm: Possibly one of the most destructive worms ever created, I think an overview of Storm and the vast number of infected zombie computers that it has amassed can wait until next week.