Computer Viruses

Computer Viruses

A virus is a program that copies itself without the knowledge of the computer user. Typically, a virus spreads from one computer to another by adding itself to an existing piece of executable code so that it is executed when its host code is run. If a virus if found, you shouldn't panic or be in a hurry, and you should work systematically. Don't rush!

A Viruse may be classified by it's method of concealment (hiding). Some are called stealth viruses because of the way that they hide themselves, and some polymorphic because of the way they change themselves to avoid scanners from detecting them.

The most common classification relates to the sort of executable code which the virus attaches itself to. These are:

¨ Partition Viruses ¨ Boot Viruses ¨ File Viruses ¨ Overwriting Viruses

As well as replicating, a virus may carry a Damage routine.

There is also a set of programs that are related to viruses by virtue of their intentions, appearances, or users likely reactions. For example:

¨ Droppers ¨ Failed viruses ¨ Packagers ¨ Trojans ¨ Jokes ¨ Test files

THE DAMAGE ROUTINE

Damage is defined as something that you would prefer not to have happened. It is measured by the amount of time it takes to reverse the damage.

Trivial damage happens when all you have to do is get rid of the virus. There may be some audio or visual effect; often there is no effect at all.

Minor damage occurs when you have to replace some or all of your executable files from clean backups, or by re-installing. Remember to run FindVirus again afterwards. Moderate damage is done when a virus trashes the hard disk, scrambles the FAT, or low-level formats the drive. This is recoverable from your last backup. If you take backups every day you lose, on average, half a day's work.

Major damage is done by a virus that gradually corrupts data files, so that you are unaware of what is happening. When you discover the problem, these corrupted files are also backed up, and you might have to restore a very old backup to get valid data.

Severe damage is done by a virus that gradually corrupts data files, but you cannot see the corruption (there is no simple way of knowing whether the data is good or bad). And, of course, your backups have the same problem.

Unlimited damage is done by a virus that gives a third party access to your network, by stealing the supervisor password. The damage is then done by the third party, who has control of the network.