Virus – this is the most common type of malware that people will be aware of. The reason that it is known as a virus, rather than anything else, is historical. The press ran the stories of the first computer virus at the same time as articles concerning the spread of AIDS. At the time, there were simple parallels that could be easily drawn between the two, propagation through interaction with a contaminated party, the reliance on a host and the ultimate “death” of anything infected. This resulted, and still does occasionally, in concerns that people could become “infected” with a computer virus.
Viruses or virii are self-replicating pieces of software that, similar to a biological virus, attach themselves to another program, or, in the case of “macro viruses”, to another file. The virus is only run when the program or the file is run or opened. It is this which differentiates viruses from worms. If the program or file is not accessed in any way, then the virus will not run and will not copy itself further.
There are a number of types of viruses, although, significantly, the most common form today is the macro virus, and others, such as the boot sector virus are now only found “in captivity”.
Boot Sector Viruses
The boot sector virus was the first type of virus created. It hides itself in the executable code at the beginning of bootable disks. This meant that in order to infect a machine, you needed to boot from an infected floppy disk.
A long time ago, ( 15 years or so ) booting from floppy was a relatively regular occurrence, meaning that such viruses were actually quite well spread by the time that people figured out what was happening. This virus ( and all other types ) should leave a signature which subsequent infection attempts detect, so as not to repeatedly infect the same target. It is this signature that allows other software( such as Anti-Virus-software ) to detect the infection.
The Executable File Virus
The Executable File virus attaches itself to files, such as .exe or .com files. Some viruses would specifically look for programs which were a part of the operating system, and thus were most likely to be run each time the computer was turned on, increasing their chances of successful propagation.
There were a few ways of adding a virus to an executable file, some of which worked better than others. The simplest way ( and the least subtle ) was to overwrite the first part of the executable file with the virus code. This meant that the virus executed, but that the program would subsequently crash, leaving it quite obvious that there was an infection – especially if the file was an important system file.
The Terminate and Stay Resident (TSR) Virus
TSR is a term from DOS where an application would load itself into memory, and then remain there in the background, allowing the computer to run as normal in the foreground. The more complex of these viruses would intercept system calls that would expose them and return false results - others would attach themselves to the 'dir'
command, and then infect every application in the directory that was listed – a few even stopped ( or deleted ) Anti-Virus software installed onto the systems.
The Polymorphic Virus
Early viruses were easy enough to detect. They had a certain signature to identify them, either within themselves as a method to prevent re-infection, or simply that they had a specific structure which it was possible to detect. Then along came the polymorphic virus. Poly – meaning multiple and morphic – meaning shape. These viruses change themselves each time they replicate, rearranging their code, changing encryption and generally making themselves look totally different. This created a huge problem, as instantly there were much smaller signatures that remained the same – some of the “better” viruses were reduced to a detection signature of a few bytes. The problem was increased with the release of a number of polymorphic kits into the virus writing community which allowed any virus to be recreated as a polymorph.
The Macro Virus
The Macro Virus makes use of the built-in ability of a number of programs to execute code. Programs such as Word and Excel have limited, but very powerful, versions of the Visual Basic programming language. This allows for the automation of repetitive tasks, and the automatic configuration of specific settings. These macro languages are misused to attach viral code to documents which will automatically copy itself on to other documents, and propagate. Although Microsoft has turned off the feature by default now on new installations, it used to be that Outlook would automatically execute certain code attached to e-mails as soon as they were read. This meant that viruses were propagating very quickly by sending themselves to all of the e-mail addresses that were stored on the infected machine.
Sub Item 5.1b
0 comments