How to deal against worms from Internet ?

[Ebadaah]

hi,

I am using Norton Antivirus to protect my computer system from internal as well as external threats. However there are certain viruses and worms spreaded across the internet that my antivirus cannot detect. I want to ask how can I detect such worms while surfing the internet ?

Any ideas....plz suggest

[Milton.J]

An Internet worm is a self-propagating program that automatically replicates itself to vulnerable systems and spreads across the Internet.

Most deployed worm-detection systems are signature-based. They look for specific byte sequences (called attack signatures) that are known to appear in the attack traffic. Conventionally, the signatures are manually identified by human experts through careful analysis of the byte sequence from captured attack traffic.
I suggest you to embed the traffic sequence to a high-dimensional phase space using chaos theory. The signature sequence of a specific worm will occupy specific regions in the phase space, which may be appropriately called the invariant subspace of the worm. The invariant subspace of the worm separates itself widely from the subspace of the normal traffic. This separation allows us to construct three simple metrics, each of which completely separates 100 normal traffic streams from 200 worm traffic streams, without training in the conventional sense.

Advantages -
This method is atleast as accurate as any existing methods.
More importantly, this method is much faster than existing methods, such as based on expectation maximization and hidden Markov models.

[Snake08]

Your anti-virus software can't always detect new worm viruses, which are transmitted so quickly across the Internet that thousands of computers can be infected before even the anti-virus software developers are aware of their existence.

By following a few simple steps you can detect most email-borne worm viruses.

Source - How worm enters your PC ? Remember, most worms are activated by running a program or opening a Word or Excel document containing macros. This is usually attached to an email and disguised as a document or image file. The worm is only activated when you open the attachment, so the text of the message usually asks you to do that.

Precautions -
Whenever you receive an email that contains an attachment, ask yourself:

• "Do I know the person who has sent me this message with an attachment?"
• "Was I expecting to receive the attached file from this person?"
• "Does the text of the accompanying message look as if it was written by the person from whom the message seems to have come?"

If the answer to one or more of these questions is "No", probably that the message was automatically generated by a worm virus.
Do not open the attachment. Either delete the message immediately, or reply to the sender asking if they really sent the message and don't open the attachment unless they say they did.

[Big Fish]

Code Red infected more than 350,000 machines in less than 14 hours. The solution is to find a way to catch infections in their earliest stages, before they get that far.

The key to find is a software to monitor the number of scans that machines on a network send out. When a machine starts sending out too many scans -- a sign that it has been infected -- administrators should take it off line and check it for viruses.

The strategy sounds straightforward enough. A scan is just a search for Internet addresses -- what we do every time we use search engines such as Google. The difference is, a virus sends out many scans to many different destinations in a very short period of time, as it searches for machines to infect.