Applied Security Lab 3: Anti-Virus Software

Transcription

1 Applied Security Lab 3: Anti-Virus Software Security Tools and Technology: Personal Firewall Application using Avira Name: Due Date: MARCH 31, 2010 (Wednesday by 5:00 p.m.) Instructions: The Lab 3 must be typed using the Lab 3 Write-up template (template for answering lab questions -.doc), which can be found on the course website under the Assignment s section. Lab Write-up s must be uploaded to Blackboard in the Assignment s folder where the laboratory assignment description is located by the due date and time. ALL resources used to complete this assignment must be referenced and sited, this includes, books, articles, websites, etc.) Goal: In this lab you will learn how to: Learn about the capabilities of anti-virus software by working with a popular personal antivirus Avira. Background: Avira GmbH is a German antivirus software company. When founded, the company was called "H+BEDV Datentechnik GmbH". Its antivirus applications are based on the AntiVir scan engine also known as "Luke Filewalker" (referring to Luke Skywalker), first launched in For aesthetic reasons, the name was changed to Avira. Avira's engine has been licensed to Ashampoo antivirus, Ad-Aware, and Web root WebWasher. Avira is one of the most widely used antivirus programs in the world, with 100 million users worldwide as of September The company supports the Auerbach Stiftung, a foundation created by the company's founder and CEO, Tjark Auerbach. It supports charitable, social, cultural, and science projects. Avira AntiVir Personal is for personal use only and free of charge. Like most antivirus software, it scans disks for malware and also runs as a background process, checking each opened and closed file. It can detect and possibly remove root kits. [2] It also performs Internet updates (daily by default) in which it opens a window, with an advertisement suggesting that the user purchase Avira AntiVir Premium or Avira Premium Security Suite. Avira updated all its products to version 9.0 in March As a free service, Avira offers a bootable rescue CD to all users, regardless of whether they have any installed Avira products (free or non-free), and irrespective of the machine's operating system. This CD contains its own bootable Linux-based operating system and the AntiVir program with its latest virus database. If a computer cannot be booted, the CD may be used to boot the machine into the AntiVir program, then to scan for and remove detectable viruses and other malware, thereby possibly restoring normal boot and operation.

2 Avira AntiVir Premium has several improvements over the free version, including: scanning (POP3 and SMTP) WebGuard to block access to malicious sites Avira AntiVir Premium Security Suite Has some more improvements over both versions, including: Anti Spam for Firewall blocks hackers Backup System to protect and secure important data AntiBot prevents dangerous botnets from taking over your system Parental Controls blocks unsuitable websites for Children and Teens Figure 1: Avira Console

3 Procedure: This lab will walk through some common configurations and attack detections with the trial version of Avira AntiVir Personal. BEFORE STARTING THE INSTALLATION: 1. Start and Log into the VMware Vsphere Client. 2. Open the Virtual Environment Console. 3. After the Operating System has loaded, Press CTL + ALT + Enter to maximize the window. Activity 1: 1. Click the executable on the desktop entitled: avira antivir personal en.exe. 2. Click CONTINUE to begin installation. 3. Click NEXT to start the Set-Up wizard. 4. Read the More Threat Categories and click NEXT to continue. 5. ACCEPT the license agreement by checking the checkbox and clicking NEXT. 6. ACCEPT the piracy confirmation by checking the checkbox and clicking NEXT. 7. Choose COMPLETE for the installation type and click NEXT to continue. 8. UNCHECK the checkbox entitled Yes, I would like to register and click NEXT. 9. UNCHECK Show readme.txt and click FINISH to complete installation. Configuring the Application 1. Click NEXT to start the configuration wizard. 2. Click NEXT on the AHeAD Heuristics section. 3. Choose SELECT ALL for the extended threat categories and click NEXT. 4. Choose NORMAL START for the Guard Start Mode section and click NEXT. 5. UNCHECK Perform Short System Scan after installation and click NEXT. 6. Click FINISH to complete the configuration wizard.

4 Testing the Application 1. Open the Avira Anti-Virus application. 2. Click LOCAL PROTECTION on the left panel of the console. 3. Make sure Scanner is checked. 4. RIGHT-CLICK My Documents and select START SCAN. 5. Was there a virus detected? If so, what is the: a. Object b. Detection 6. Click CANCEL to exit the dialog box. 7. Click END to exit the Luke Filewalker. Locate the Virus File 1. Click START My Documents. 2. Open the file Virus.txt. (This is an ACTUAL virus test file) 3. What are the 68 characters of this virus file? 4. Close the NOTEPAD and MY DOCUMENTS window and return to the Avira antivirus application. 5. Re-Scan the MY DOCUMENTS folder. a. (RIGHT-CLICK My Documents and select START SCAN.) 6. Once the scan is complete, Click REPAIR ALL. 7. Now visit you re MY DOCUMENTS folder. a. (Click START My Documents.) 8. Is Virus.txt Still there? If not, where did it go? (Hint: Where do all viruses end up after scans?)

5 Outside Research Questions (Answer the following questions IN YOUR OWN WORDS by conducting research using the internet, books, etc.) 1. What is a virus? How do they work? 2. Describe how viruses are spread through Instant Messaging programs like Yahoo, AOL, and Windows Messenger. 3. Using the following link, describe the five suggestions mentioned to avoid instant message viruses. 4. What is Spyware? Also, give examples of and describe TWO free Spyware Removal applications. 5. Research and devise a list of Best Practices and/or steps to avoid computer viruses.