Yuwie.com | ronnel odysses's Blog

Spam - What exactly is it?

In order to combat spam effectively it is necessary to define exactly what spam is.

Most people believe that spam is unsolicitied email. However, this definition is not entirely correct and confuses some types of legitimate business correspondence with true spam.

Spam is anonymous, unsolicited bulk email.

This is the descr i ption that is being used today in the USA and Europe as a basis for the creation of anti-spam legislation. Let's take a closer look at each component of the definition:

Anonymous: real spam is sent with spoofed or harvested sender addresses to conceal the actual sender.

Mass mailing: real spam is sent in mass quantities. Spammers make money from the small percentage of recipients that actually respond, so for spam to be cost-effective, the initial mails have to be high-volume.

Unsolicited: mailing lists, newsletters and other advertising materials that end users have opted to receive may resemble spam but are actually legitimate mail. In other words, the same piece of mail can be classed as both spam and legitimate mail depending on whether or not the user elected to receive it.

It should be highlighted that the words 'advertising' and 'commercial' are not used to define spam.

Many spam messages are neither advertising nor any type of commercial proposition. In additon to offering goods and services, spam mailings can fall into the following categories:

Political messages

Quasi-charity appeals

Financial scams

Chain letters

Fake spam being used to spread malware

Unsoliticited but legitimate messages

A legitimate commercial proposition, a charity appeal, an invitation addressed personally to an existing recipient or a newsletter can certainly be defined as unsolicited mail, but not as spam. Legitimate messages may also include delivery failure messages, misdirected messages, messages from system administrators or even messages from old friends who have previously not corresponded with the recipient by email. Unsolicited - yes. Unwanted - not necessarily.

How to deal with spam

Because unsolicited correspondence may be of interest to the recipient, a quality antispam solution should be able to distinguish between true spam (unsolicited, bulk mailing) and unsolicited correspondence. This kind of mail should be flagged as 'possible spam' so it can be reviewed or deleted at the recipient's convenience.

Companies should have a spam policy, with system administrators assessing the needs of different departments. Access to different unsolicited mail folders should be given to different user groups based on this assessment. For instance, the travel manager may well want to read travel ads, whereas the HR department may wish to see all invitations to seminars and training sessions.

The continuing growth of the number of pc users over the last 25 years triggered a small group of people to get down with something that today many find foolish and dangerous : they decided to develop programs that would make the computer "go crazy" or even mulfunction for a certain period of time, either for the laugh of it, or, maybe, just to harm the computer of someone they really dislike! Still, if you find out today that your computer has a virus, you will probably panic .. And you will be right, cause most of the 75-80,000 viruses these days are certainly NOT something to laugh with!

What is a computer virus

A sequence (or a series of them) of symbols, that when executed under certain circumstances or a certain operating system, they create an exact replicate of the sequence, which they install into the hard disk or diskette. The installation usually takes place inside a directory commonly used. Of course, a virus may also have a payload function, by which it will damage the infected computer.

TYPES OF MALWARE

Trojan horses / Backdoor programs

They are surely the most famous type of viruses. They include a code, upon the execution of which, the host computer becomes valnerable to a malicious remote user. Hacker-wannabies and "lamers" usually use these viruses to "hack" :P other users. But that's not all … Some trojans and backdoors may even delete important files of the hard disk, or even format it. Fortunately, they cannot reproduce and for this reason many do not even consider them as "real" viruses.

Polymorphic

We call polymorphic a virus that hides its destructive code within the infected file in several different ways. The particular type of viruses is more difficult for the antivirus programs to detect, since there barely is a same routine inside each virus sample.

Stealth viruses

They use the memory interrupts of the computer. Once a program calls a memory interrupt, the virus gets activated instead of the program itself. Stealth viruses perform one more function. They are capable of hiding from antivirus programs. That means, whenever they detect a scan function by the antivirus program, they temporarily restore the original non-infected file, so that the antivirus program will believe that there is are no viruses inside the system. Once the antivirus has finished its scan, they infect the file again. The specific method of hiding is often called "tunneling”

Parasitic a.k.a. Appending viruses

They are called parasitic cause they infect the original file, copying the destructive code within it, without making the original file irrepairable. Once the user executes the infected file, the virus is activated without letting the original function of the file to be executed.

Overwriting viruses

The simplest way for a virus to infect a computer is to merge itself with a well-known file. This way the original file CANNOT be restored. Some of these viruses have the ability not to alter the original filesize, so that some antivirus programs will not see the difference in the original file. Nevertheless, most coders do not make such type of viruses anymore.

Companion viruses

They are viruses that are executed usually under MS-DOS. When the user types a DOS command (e.g. "edit") and the file edit.exe is not present, the OS will execute the file edit.com, which really is the virus itself. Still, if the user types "edit", the OS will execute the virus (edit.com) and not edit.exe, which is the real editing program!

Retro viruses

They are viruses that do nothing but "fight" a specific antivirus program, meaning that if they detect it inside the hard disk, they will delete all components of it.

Logic bombs

They are viruses that activate upon a certain trigger date, e.g. at 14.00 of 13 of September. They usually have a destructive payload, such as deleting files.

Droppers

They are executable files that contain the proper commands to create a virus inside the pc but do not include a virus themselves. They are harder to detect than a normal virus.

Worms

They are called worms because they are usually found in computer networks. They use the Internet as a medium to spread (emails, irc chat etc).

Boot sector viruses

These viruses infect the boot area of the hard disk or diskette. They are the ones to blame for most infection worldwide. You do not have to have an MS-DOS based OS in your pc to activate such a virus, since they do not make such .. discriminations. E.g. although the Michelangelo virus cannot spread using Windows NT, he still can wipe out the contents of the hard disk on March 6th!

Direct action viruses

These viruses just execute their destructive payload and are not memory resident.

Macro viruses

They are the well-known viruses that infect using a macro-command. They harm only Word, Excel, Office, PowerPoint and Access files. They are very easy to spread. Most typical example you can find is Microsoft itself, who - is believed to - had a macro-virus inside the first edition of MS Office ‘97.

Multi Platform viruses

They are viruses that affect on more that one operational systems. Usually, a virus that affects Windows OS, cannot harm an Apple pc.

Note :

The above article was published in E-Net magazine (issue 06-2001) at an exclusive cooperation with the webmaster of virus.gr and naturally, all copyrights belong to him and not to the specific magazine.