ࡱ; & !"#$%Root EntryFMatOST:-MMMN0C@ NDࡱ; FMicrosoft Works MSWorksWPDocࡱ; N!!T<CC CFPCPCPCPC=/8dPCbC<Computer Viruses Q: Why should I learn about viruses?? When people talk about virii (a subject dear to my heart) it is common for people to treat the virus, the trojan horse, the logic bomb, etc. as if they were one and the same. Now, personally, I find the idea insulting and I am sure that many virus writers would feel the same way. Time and time again, I have seen the worthy name of VIRUS heaped upon the ranks of such undeserving pranks as the common TROJAN horse. To think that the two are one and the same is fine, if you are the common lamer that so often finds himself behind the computer screen. To be unable to differenciate between a virus and a trojan is perfectly acceptable for many. If you are entirely satisified with knowing just enough to be able to start your computer and run your application, then for heaven's sake don't read this article. In fact, why don't you go buy a MacIntosh? As for the rest of us, we realize that there IS a difference. And in order to prevent ourselves from looking like clueless idiots, we strive to learn the differences between the virus and the trojan horse and what each one is and is not capable of. What advantage is gained by learning of such things as a computer virus? The person who is well-informed in such matters gains many advantages over one who is not. For one, he will quickly notice when his system shows signs of virus activity and he will catch it before it has had time to do significant damage to his system. Since he will have taken the proper precautions in advance he will be able to quickly restore his system system while suffering minimal loss. Since he knows what a virus can and can't do, he won't believe every quirk in his hardware or software is actually the result of some devious virus. He will not be lulled into the false sense of security provided by such worthless products as CPAV or NAV. He will have the wisdom to look a trojan horse 'in the mouth'. When it comes to virii, people are inclined to believe alot of stupid shit. Let's face it, people are inclined to believe alot of stupid shit period, but when it comes to virii, they tend to get even stupider Types of Viruses Q: What is a virus? a VIRUS is a small, executable program with the ability to replicate itself by adding its code to that of a host program and/or the system area of a hard or floppy disk. The user is generally unaware of the actions of a virus as it replicates and usually only becomes aware of its presence when the virus 'activates', which it does according to a given set of conditions and at which time it is often too late. However, once the user knows what signs to look for, it can be very obvious when viral activity occurs. More on the signs in a little bit. Let's discuss the difference between viruses. Every virus has its own personality. Viruses differ in many ways, each having its own unique properties that make it different. Here are some ways that viruses differ from each other: SIZE - A virus can be as small as 66 bytes or less, or as large as 4096 bytes or more. Compared to most computer programs a virus must be very small. METHOD OF INFECTION - A virus can infect the host program in different ways. Below are three methods commonly used. They are by no means the only ways, but they are the most common. It is possible for a virus to use one or more of these methods. OVERWRITING - When a virus infects using this method, it will simply write a copy of itself over the begining of the host program. This is a very simple method and is used by more primitive viruses. An infected file has been destroyed and must be restored from a backup disk. Overwriting tends to make the user suspicious becuase the host program no longer functions. This method of infection causes no change in the size of an infected program. APPENDING - This method is a bit more complex. The virus appends itself onto the end of the host program and also edits the begining of the program. When the user runs the infected program it will jump to the end of the program where the virus is located, perform the functions of the virus, then return and continue to run the host program. To the user, the program is functioning normally. This method of infection causes infected programs to increase in size. Some appending viruses are unable to tell whether or not they have already infected a program and will continue to infect the program hundreds of times, causing it to grow considerably in size. DISK INFECTORS - Other viruses will infect the boot record or partition table. This is an executable area of the disk that is automatically run every time you boot up from the disk. This means that as soon as the computer boots up, the virus is in memory. TSR - A virus may or may not become resident in memory. If it does go TSR, then its chances of infecting files are greatly increased. Otherwise it can only do its stuff when an infected program is run. If the virus is in memory it can infect files any time it chooses. Partition table and boot sector infecting viruses are always TSRs. STEALTH - Some TSR viruses use a sophisticated technique called Stealth cloaking. What this means is the virus will fool the system so that everything appears to be normal. When a user does a directory listing the virus will intercept the disk read, and alter the data so that the file sizes appear to be unchanged, when in actuality they have increased in size. Boot sector infectors may use stealth so that when the user attempts to view the boot record, instead of showing the actual boot record, a copy of the old boot record is returned instead. Because of stealth techniques it may be impossible to detect a virus once it has become resident in memory. The only sure way to check for a stealth virus is to boot from a clean, write- protected floppy, then scan the hard drive. It is a good idea to prepare such a floppy disk ahead of time, and adding anti-virus software such as Scan and F-Prot. ACTIVATION CRITERIA AND EFFECT- The other area that gives a virus its personality is the activation criteria, or what makes it go off. Some activate by the date, others activate when a certain program is run, and other will activate when they can't find any more files that haven't been infected yet. When a virus activates it will take a certain action. I will refer to this as the activation effect. The efffect may be as simple and harmless as displaying a message or as malicious as trashing the victim's hard drive. Obviously, you want to find the virus BEFORE it activates Q: What are the ways that I can catch a virus? Just as with the AIDS virus, there is ...
kopia23