How viruses are hidden, and how to tell if you have downloaded one
Malware that is spread on the internet specifically torrents can be really hard to detect. Just because your Antivirus isn't picking it up, it doesn't mean that it isn't there, even if you scan the file specifically, it might not be picked up. Hackers do this in a number of ways:
Encrypting the virus:
Hackers use software called 'Crypters' this basically gets the virus, and wraps it up like a birthday present. To the untrained eye or to an antivirus software - It looks just like a birthday present, free of nasty surprises.
So all a hacker has to do is run their virus through a little bit of software and it will be undetectable for days before the Anti virus databases catch on to it.
Bloating the virus:
A virus file is usually very small ranging from about 200kb to 4mb, and this is the file size that your antivirus is looking for. Hackers can add in hundreds of lines of moot code to bloat the file up to 10 or 20mb. Instantly the file becomes less suspicious to our anti virus software, most of the time undetectable.
Binding the virus:
Say you want to download a copy of DreamWeaver or something. You find a nice download and start to install it. But a hacker can actually get a virus and clip it onto any piece of software. Antivirus software cannot usually detect it as it is hidden in the innocent software.
Contracting a virus
You may think that you are safe from viruses as long as you don't download any suspicious shit. BUT there's a thing called Java Driveby: When you visit a website which wants to infect you, you may get a popup saying "Yo, we want to run a Java applet on this page, that cool?" Or something along those lines. Java applets have almost complete access to your PC which includes downloading a virus on to it. So be ware!
Ways of catching a virus:
-Downloading bad files
-Torrents
-Java Drive Bys
Combating Viruses
Of course, the best line of defence is a good offence. Malware can spread very quickly across computers and networks, turning your computer (among many other things) into a counterpart to a DDoS attack, maybe even against to your favourite tracker site, without you even knowing. This is one good reason to avoid viruses. Just check out how quickly the 'I love you virus' spread a couple of years back. It usually takes around 24-72 hours before a new virus is put onto the anti-virus databases, this is when you are at risk as during this time the file will be marked 'clean'.
Different Anti-Virus companies get the virus' DNA onto their data bases at different speeds, if you want to check a file you can upload it to VirusTotal this can check your suspicious file again ~27 Virus data bases. As well as giving you a comprehensive scan on your file, VirusTotal also distributes your suspicious file to all of the virus companies so that they can examine it closer to see if it really is a virus or not. Doing this will decrease the time for a virus to be indexed, and will make the internet community safer.
How to tell if you have a virus
The most common type of virus spread by hackers are called Remote Administration Tools or more commonly called RATS. Popular RATS go by the brand names Dark Comet or CyberGate. When you inadvertently install a RAT a new process will arise on your system (Task Manager > Processes), the hacker can chose what the process is called - IT could be explorer.exe, utorrent.exe anything. If you have a RAT installed on your computer the hacker has complete control of your PC, including files, Webcam access, Mic access, everything.
The best way to check if you have a virus is a 'before and after' look at your processes, any new processes or duplicates are likely to be the RAT.
Tell-Tale signs of a file being malicious are:
Non-matching MD5 Hash against the published MD5 Hash
Badly done icon
Unusual File size
Slow to open (Some times system DOS flash on and off)
An extension like '.jpg.exe' or '.avi.exe'
The most fool-proof way of checking if you have a virus is to download HiJackThis, run a report, and post the findings to a PC help forum such as PCHF. Their experts will evaluate the report and let you know how to remove it.
Other ways of telling if a file is malicious are rather more technical, you can upload files to Anubis, which will reveal if a file is malicious 100% of the time (But you do need to know a bit about computing to understand the report).
