1. What is computer virus?

A virus is a piece of software designed and written to adversely affect your computer by altering the way it works without your knowledge or permission. In more technical terms, a virus is a segment of program code that implants itself to one of your executable files and spreads systematically from one file to another. Computer viruses do not spontaneously generate: They must be written and have a specific purpose.
Usually a virus has two distinct functions:

. Spreads itself from one file to another without your input or knowledge. Technically, this is known as self-replication and propagation.

. Implements the symptom or damage planned by the perpetrator. This could include erasing a disk, corrupting your programs or just creating havoc on your computer. Technically, this is known as the virus payload, which can be benign or malignant at the whim of the virus creator.

A benign virus is one that is designed to do no real damage to your computer. For example, a virus that conceals itself until some predetermined date or time and then does nothing more than display some sort of message is considered benign.

A malignant virus is one that attempts to inflict malicious damage to your computer, although the damage may not be intentional. There are a significant number of viruses that cause damage due to poor programming and outright bugs in the viral code. A malicious virus might alter one or more of your programs so that it does not work, as it should. The infected program might terminate abnormally, write incorrect information into your documents. Or, the virus might alter the directory information on one of your system area. This might prevent the partition from mounting, or you might not be able to launch one or more programs, or programs might not be able to locate the documents you want to open.

Some of the viruses identified are benign; however, a high percentage of them are very malignant. Some of the more malignant viruses will erase your entire hard disk, or delete files.

What Viruses Do

Some viruses are programmed specifically to damage the data on your computer by corrupting programs, deleting files, or erasing your entire hard disk. Many of the currently known Macintosh viruses are not designed to do any damage. However, because of bugs (programming errors) within the virus, an infected system may behave erratically.

What Viruses Don't Do

Computer viruses don't infect files on write-protected disks and don't infect documents, except in the case of Word macro viruses, which infect only documents and templates written in Word 6.0 or higher. They don't infect compressed files either. However, applications within a compressed file could have been infected before they were compressed. Viruses also don't infect computer hardware, such as monitors or computer chips; they only infect software.

In addition, Macintosh viruses don't infect DOS-based computer software and vice versa. For example, the infamous Michelangelo virus does not infect Macintosh applications. Again, exceptions to this rule are the Word and Excel macro viruses, which infect spreadsheets, documents and templates, which can be opened by either Windows or Macintosh computers.

Finally, viruses don't necessarily let you know that they are there - even after they do something destructive. [1]

2. Types of Computer Viruses

Nowadays number of viruses is about 55000. It increases constantly. New unknown types of viruses appear. To classify them becomes more and more difficult. In common they can be divided by three basic signs: a place of situating, used operation system and work algorithms. For example according these three classifications virus Chernobyl can be classified as file infector and resident Windows virus. Further it will be explained what it means.

2.1 A place of existence

2.1.1File Infectors

These are viruses that attach themselves to (or replace) .COM and .EXE files, although in some cases they can infect files with extensions .SYS,
.DRV, .BIN, .OVL and .OVY. With this type of virus, uninfected programs usually become infected when they are executed with the virus in memory. In other cases they are infected when they are opened (such as using the DOS
DIR command) or the virus simply infects all of the files in the directory is run from (a direct infector).

There are three groups of file infectors.

Viruses of the first group are called overwriting viruses because they overwrite their code into infected file erasing contents. But these viruses are primitive and they can be found very quickly.

Other group is called parasitic or cavity viruses. Infected file is capable of work fully or partly but contents of last one are changed.
Viruses can copy itself into begin, middle or end of a file. They record their code in data known not to be used.

Third group is called companion viruses. They don’t change files. They make double of infected file so when infected file is being started a double file becomes managing, it means virus. For example companion viruses working with DOS use that DOS firstly runs COM. file and after if this file is not found runs EXE. file. Viruses make double file with a same name and with extension COM and copies itself in this file. During start of infected file DOS runs a COM. file with a virus firstly and then a virus starts an
EXE. file.

Sometime companion viruses rename file will be infected and record their code in a double file with old name. For example the file XCOPY.EXE is renamed into XCOPY.EXD and virus record itself in file XCOPY.EXE. When this file is started computer runs a virus code firstly and after virus starts original XCOPY, saved as XCOPY.EXD. Viruses like this were found not only in DOS. They were found in Windows and OS/2.

It is not only one way to make double files. For example there is subgroup of companion viruses called path-companion viruses. They use special feature of DOS - PATH: hierarchical record of file location. Virus copies itself in file with the same name but situated one level higher. In this case DOS will find file with virus. [2]

2.1.2Boot viruses

Поделитесь этой записью или добавьте в закладки