Computer Virus
Most of you are familiar with the term virus in real world,but what about viruses in the virtual world?
The term Computer Virus was first used by Fred Cohen in 1984.
Definition Computer Virus:
A set of computer instructions
Deliberately created
That propagates
And does unwanted things.
Characteristics of Computer Viruses:
Does not have a independent existence and usually resides in other legitimate programs.
Propagates when the host program is executed.
Has an incubation period, during which no damage is done.
After incubation period, begins to show its behavior.
Behavior of Computer Viruses:
Sudden or periodic slowing of programs.
Unexplained change in the size of any program.
- Files with extension .EXE.
- Files with extension .COM.
- Files with extension .BAT.
- Files with extension .SYS.
- Files with extension .OVL.
("Explanations" would be, for example, a new version of Windows, or re-installing a program with different options.)
- Unusual behavior of the computer, especially during a program which you have been running regularly with no problems.
- Failure of any program (such as a word processor) to install correctly from its distribution (original) disks. (Many programs check their own size after installation.)
How Virus Works?
Any virus is designed so it runs first when the legitimate program gets executed. The virus loads itself into memory and looks around to see if it can find any other programs on the disk. If it can find one, it modifies it to add the virus's code to the unsuspecting program. Then the virus launches the "real program." The user really has no way to know that the virus ever ran. Unfortunately, the virus has now reproduced itself, so two programs are infected. The next time either of those programs gets executed, they infect other programs, and the cycle continues.
Where viruses can hide:
In the "boot" sector of any floppy disk. This is a small program which runs whenever the computer is "booted" from the diskette, whether or not the diskette is "bootable." (This is the tiny program which puts the message "Non-system disk or disk error" on the screen if the disk is not bootable!)
Attached to any program: shareware, commercial or public domain.
Embedded in the hidden system files IO.SYS and MSDOS.SYS on the boot disk or drive.
Same as #2, but pay SPECIAL ATTENTION to the file COMMAND.COM on the boot disk or drive.
The "partition table" on a hard drive. (This DOES contain executable information, since it is attached to the "Master Boot Record" which is consulted at boot-up to determine whether to boot DOS, OS/2, UNIX, etc.)
(Macro viruses) Inside any document, spreadsheet or database From a standard office package (e.g. MicroSoftTM Word, Excel, Access, CorelTM WordPerfect, Quattro, Foxpro, any of the LotusTM suite*) It would not be surprising to find a macro virus that could survive a conversion between document types such as Word to WordPerfect format.
*
All of these products are good; only the good, popular ones tend to get viruses because of their popularity!
How viruses are spread:
(Macro viruses) Exchanging word-processing documents or spreadsheets via diskette or E-mail, without doing a virus scan before opening them.
Using disks from friends or letting other people use your computer, who use their own diskettes, without scanning the diskettes for viruses first.
Trading, copying or pirating software on diskettes without knowing the source.
Software salesmen giving demos on your computer from their diskettes.
Computer repair personnel using diagnostic disks.
Computer user groups and bulletin boards (BBS's).
Once a virus is in memory, it usually infects any application you run
Types of viruses:
Boot-sector viruses. Can NOT be transmitted from BBS's at all. Transmitted by floppy, ZIP disk, floptical, writable CD-ROM, tape cartridge (rare), etc. Boot-up must be attempted from infected disk. Remains memory-resident during warm boot, infects boot sectors of all other disks in system including hard and floppy disks.
The boot sector is a small program that is the first part of the operating system that the computer loads. The boot sector contains a tiny program that tells the computer how to load the rest of the operating system. By putting its code in the boot sector, a virus can guarantee it gets executed. It can load itself into memory immediately and it is able to run whenever the computer is on.
Program viruses. May be transmitted by distribution of infected programs via floppy, BBS, CD-ROM or network. Some infect ONLY COMMAND.COM; others avoid infecting COMMAND.COM, to avoid detection.
Macro viruses. Transmitted by opening infected document or spreadsheet in appropriate word processor or spreadsheet program. Hides in a system file for the program , infect all documents/spreadsheets opened and saved with the program.
Stealth viruses. Viruses which attempt to hide their presence. Some of the simple techniques include hiding the change in date and time and hiding the increase in file size. Some even prevent anti-virus software from reading the part of the file where the virus is located. Some also encrypt the virus code using variable encryption techniques.
Popular Viruses:
Pakistani Brain virus.
A boot sector virus that transfers the current boot sector to an unused portion of the disk and marks that portion of the disk as bad sectors. The virus then copies the remainder of the virus to an unused portion of the disk and marks that portion as bad sectors also. The Brain virus then periodically marks other portions of the disk as bad sectors making files and eventually the disk unusable. Early versions displayed a volume label (c) Brain. This virus was the first virus known to spread worldwide.
Jerusalem virus. Also known as the Israeli and Friday 13th virus and includes several strains including the Jerusalem-B virus. The Jerusalem virus infects both .COM and .EXE files. This virus will survive a warm boot. After the virus is resident for 1/2 hour, it slows the system down by a factor of ten. On Friday the 13th, it will delete all infected files. Besides the damage it inflicts, the Jerusalem-B virus also periodically displays a "black window" in the middle of the screen.
Black Monday. Written by a Malaysian student ,on Mondays a counter counts down from 240 each time a file is infected. When zero is reached, a low level format of the hard disk is performed.
What Viruses can't do:
There is no way that reading an E-mail message can infect your computer with a virus. You can get viruses from E-mail only by opening an attachment and executing them
Computer viruses do not infect files on write-protected disks.
Virus' don't infect computer hardware, such as monitors or chips they ONLY infect software.
[ CodeEverywhere]