What is computer virus

1. What is computer virus?
    A virus is a piece of software designed and written to adversely affect
your computer by altering  the  way  it  works  without  your  knowledge  or
permission. In more technical terms, a virus is a segment  of  program  code
that  implants  itself  to  one  of  your  executable  files   and   spreads
systematically  from  one  file  to  another.  Computer   viruses   do   not
spontaneously generate: They must be written and have  a  specific  purpose.
Usually a virus has two distinct functions:
    . Spreads itself  from  one  file  to  another  without  your  input  or
      knowledge.  Technically,  this  is  known  as   self-replication   and
      propagation.
    . Implements the symptom or damage  planned  by  the  perpetrator.  This
      could include  erasing  a  disk,  corrupting  your  programs  or  just
      creating havoc on your computer. Technically, this  is  known  as  the
      virus payload, which can be benign or malignant at  the  whim  of  the
      virus creator.
    A benign virus is one that is designed to do no  real  damage  to  your
computer.  For  example,  a  virus   that   conceals   itself   until   some
predetermined date or time and then does  nothing  more  than  display  some
sort of message is considered benign.
    A malignant virus is one that attempts to inflict malicious  damage  to
your computer, although the damage may  not  be  intentional.  There  are  a
significant number of viruses that cause damage due to poor programming  and
outright bugs in the viral code. A malicious virus might alter one  or  more
of your programs so that it does  not  work,  as  it  should.  The  infected
program might terminate abnormally, write incorrect  information  into  your
documents. Or, the virus might alter the directory  information  on  one  of
your system area. This might prevent the partition  from  mounting,  or  you
might not be able to launch one or more programs, or programs might  not  be
able to locate the documents you want to open.
    Some of the viruses identified are benign; however, a  high  percentage
of them are very malignant. Some of the more malignant  viruses  will  erase
your entire hard disk, or delete files.

    What Viruses Do

    Some viruses are programmed specifically to damage  the  data  on  your
computer by corrupting programs, deleting  files,  or  erasing  your  entire
hard disk. Many of the currently known Macintosh viruses  are  not  designed
to do any damage. However, because of bugs (programming errors)  within  the
virus, an infected system may behave erratically.

    What Viruses Don't Do

    Computer viruses don't infect files on write-protected disks and  don't
infect documents, except in the case of Word  macro  viruses,  which  infect
only documents and templates written in  Word  6.0  or  higher.  They  don't
infect compressed files either. However, applications  within  a  compressed
file could have been infected before  they  were  compressed.  Viruses  also
don't infect computer hardware, such as monitors  or  computer  chips;  they
only infect software.
    In addition, Macintosh viruses don't infect DOS-based computer software
and vice versa. For  example,  the  infamous  Michelangelo  virus  does  not
infect Macintosh applications. Again, exceptions to this rule are  the  Word
and  Excel  macro  viruses,  which  infect   spreadsheets,   documents   and
templates, which can be opened by either Windows or Macintosh computers.
    Finally, viruses don't necessarily let you know that they are  there  -
even after they do something destructive. [1]



    2.  Types of Computer Viruses


    Nowadays number of viruses is about 55000. It increases constantly. New
unknown types of viruses appear. To classify  them  becomes  more  and  more
difficult. In common they can be divided by three basic signs:  a  place  of
situating, used operation system and work algorithms. For example  according
these three classifications virus Chernobyl    can  be  classified  as  file
infector and resident Windows virus. Further it will be  explained  what  it
means.


    2.1 A place of existence


    2.1.1File Infectors

    These are viruses that attach themselves to (or replace) .COM and  .EXE
files, although in some cases they can infect files  with  extensions  .SYS,
.DRV, .BIN, .OVL and .OVY. With this  type  of  virus,  uninfected  programs
usually become infected when they are executed with the virus in memory.  In
other cases they are infected when they are opened (such as  using  the  DOS
DIR command) or the virus simply infects all of the files in  the  directory
is run from (a direct infector).
    There are three groups of file infectors.
    Viruses of the first group are called overwriting viruses because  they
overwrite their code into infected file erasing contents. But these  viruses
are primitive and they can be found very quickly.
    Other group is called parasitic or cavity  viruses.  Infected  file  is
capable of work fully or partly  but  contents  of  last  one  are  changed.
Viruses can copy itself into begin, middle or end of  a  file.  They  record
their code in data known not to be used.
    Third group is called companion viruses. They don’t change files.  They
make double of infected file so  when  infected  file  is  being  started  a
double file becomes managing, it means virus. For example companion  viruses
working with DOS use that DOS firstly runs COM. file and after if this  file
is not found runs EXE. file. Viruses make double file with a same  name  and
with extension COM and copies itself in this file. During start of  infected
file DOS runs a COM. file with a virus firstly and then a  virus  starts  an
EXE. file.
    Sometime companion viruses rename file  will  be  infected  and  record
their code in a double file with old name. For example  the  file  XCOPY.EXE
is renamed into XCOPY.EXD and virus record itself in  file  XCOPY.EXE.  When
this file is started computer runs a virus  code  firstly  and  after  virus
starts original XCOPY, saved as XCOPY.EXD. Viruses like this were found  not
only in DOS. They were found in Windows and OS/2.
    It is not only one way to make  double  files.  For  example  there  is
subgroup of  companion  viruses  called  path-companion  viruses.  They  use
special feature of DOS - PATH: hierarchical record of file  location.  Virus
copies itself in file with the same name but situated one level  higher.  In
this case DOS will find file with virus.   [2]



    2.1.2Boot viruses


    Boot Sector Infectors

    Every logical drive, both hard disk and floppy, contains a boot sector.
This is true even of disks that are not bootable. This boot sector  contains
specific information relating to  the  formatting  of  the  disk,  the  data
stored there and also contains a  small  program  called  the  boot  program
(which loads the DOS system files). The boot program displays  the  familiar
'Non-system Disk or Disk Error' message if the  DOS  system  files  are  not
present. It is also the program that gets infected by  viruses.  You  get  a
boot sector virus by leaving an infected diskette in a drive  and  rebooting
the machine. When the boot sector program is read and  executed,  the  virus
goes into memory and infects your hard drive. Remember, because  every  disk
has a boot sector, it is possible (and common) to infect a  machine  from  a
data disk.  NOTE:  Both  floppy  diskettes  and  hard  drives  contain  boot
sectors.

    Master Boot Record Infectors

    The first physical sector of every hard disk (Side Ш, Track  Ш,  Sector
1) contains the disk's Master Boot Record and Partition  Table.  The  Master
Boot Record has a small program within it called the  Master  Boot  Program,
which looks up the values in the partition table for the  starting  location
of the bootable partition, and  then  tells  the  system  to  go  there  and
execute any code it finds. Assuming your disk is set up  properly,  what  it
finds in that location (Side 1, Track Ш, Sector 1) is a valid  boot  sector.
On floppy disks, these same viruses infect  the  boot  sectors.  You  get  a
Master Boot Record virus in exactly the same manner you get  a  boot  sector
virus -- by leaving an infected  diskette  in  a  drive  and  rebooting  the
machine. When the boot sector program is read and executed, the  virus  goes
into memory and infects the MBR of your hard  drive.  Again,  because  every
disk has a boot sector, it is possible (and  common)  to  infect  a  machine
from a data disk. [3]

    2.1.3 Multi-partite Viruses

    Multi-partite viruses are a combination of the  viruses  listed  above.
They will infect both files and MBRs or both files and boot  sectors.  These
types of viruses are currently rare, but the  number  of  cases  is  growing
steadily.

    2.1.4 Macro Viruses
     Until recently, the macro languages included  with  most  applications
were not powerful or robust enough to support writing  an  effective  virus.
However, many of the more advanced applications  that  are  being  developed
today include built-in programming  capabilities  that  rival  some  of  the
larger development packages. This has  recently  been  demonstrated  by  the
various strains of Microsoft Word  viruses,  including  the  so-called  Word
Concept  and  Word  Nuclear  viruses.  These  viruses  transport  themselves
through Microsoft Word documents. When opened in Word, they perform  various
actions, including spreading themselves  into  the  user's  installation  of
Word, thus preparing to infect all future documents on the system.
    An additional concern is that macro viruses can be cross-platform.  The
Word Concept virus has the claim to fame of being the first prominent cross-
platform virus, because it can infect both Windows and Macintosh systems.
    Because most application macro languages support passing  execution  to
an external shell, such as COMMAND.COM or CMD.EXE, the power  of  the  macro
virus is not limited to the constraints of the macro language itself[4].



    2.2 Used operation system.
    Any computer or net virus can infect files of  one  or  more  operation
systems: DOS, Windows, OS/2, Linux, MacOS and others. It is a base  of  this
way of classification. For example virus BOZA working with Windows  only  is
classified as Windows virus, virus BLISS – as Linux virus.

    2.3 Work algorithms.
    Viruses can be differed by used algorithms making them danger and  hard
for catching.
    Firstly viruses can be divided on resident and nonresident.
    Resident virus having come in  operation  memory  of  computer  doesn’t
infect memory. They are capable of copying when they are  started  only.  We
can  call  any  macro  virus  resident.  They  present  in   memory   during
application infected by them works.
    Second   viruses are visible and invisible. To be invisible means  that
users and antivirus programs can’t notice changes of infected file  done  by
virus. Invisible virus catches all requires  of  operation  system  to  read
file and to record in file and shows uninfected version of file. So  we  can
see only ‘clear’ programs during virus works. One of  first  invisible  file
infectors was FRODO and boot infector – BRAIN.
    Almost any virus uses methods of self-coding or polymorphism to  escape
antivirus programs. It means that they can change  itself.  Changing  itself
helps virus to be able work.[5]



    3. Conclusion
    In conclusion I would like to say few words about future of this
classification. Nowadays computer technologies and all software develop
very quickly. It helps new types of computer viruses to appear. Viruses are
becoming more and more dangerous and ‘cleverer’. It means that viruses can
be found more and more hard. But I think that this classification can be
saved a long time thank for principles of work of computer. It means that
this classification will be changed when computers work by principles that
differ from principles of von Neiman. So this classification can be change
by adding new subtypes of basic types if virus makers have created
something new.

[pic]



                 Buryat State University



          The paper: Types of computer viruses



                                              Presented by Nefyodov Yuri
                                          Scientific advisor: Sodboyeva L.D.



      Ulan-Ude 2003



      Abstract
    This paper is about the classification of  computer  viruses.  Firstly,
the paper tells what a computer virus is, what viruses can do and what  they
can’t  do.  Then  there  are  basic  ways  of  classification:  a  place  of
situation, used operation system and work  algorithms.  In  conclusion  it’s
said about future of classification.


    Аннотация
    Этот доклад  посвящён  классификации  компьютерных  вирусов.  В  начале
рассказывается, что такое компьютерный вирус, что вирусы могут делать и  что
не могут. Далее здесь описаны три основных способа классификации:  по  среде
обитания,  используемой   операционной  системе  и   алгоритму   работы.   В
заключении говорится о будущем классификации.



    Plan
        1. What is a computer virus?
        2. Types of computer viruses.
       2.1 a place of existence
       2.1.1 file infectors
       2.1.2 boot viruses
       2.1.3 multi-partite viruses
       2.1.4 macro viruses
        2.2 used operation system
        2.3 work algorithms
    3. Conclusion.



    References:
   1. Могилёв, Хеннер, Пак  «Информатика» Издательство «Академия» 2000г
   2. Журнал «Наука и жизнь» №7 2000 год
   3. сайт WWW.SEMANTEC.RU


-----------------------
[1] WWW.SEMANTEC.RU

[2] Наука и жизнь №7 2000 год стр. 100



[3] Могилёв, Пак ,Хеннер  Информатика  2000 изд. «Академия»
[4] WWW.SEMANTEC.RU

[5] Наука и жизнь №7 2000 год стр. 101-102