2. VIRUS DEFINITIONVIRUS DEFINITION
A virus is a program that can “infect” other programs by modifying them.A virus is a program that can “infect” other programs by modifying them.
The modification includes a copy of the virus program which can go on to infectThe modification includes a copy of the virus program which can go on to infect
other programsother programs..
A computer virus carries its instructional code for making perfect copies of itself.A computer virus carries its instructional code for making perfect copies of itself.
Lodged in a host computer virus gains temporary control of computer’s diskLodged in a host computer virus gains temporary control of computer’s disk
operating system.operating system.
Whenever the infected computer comes into contact with an uninfected piece ofWhenever the infected computer comes into contact with an uninfected piece of
software/computer, a fresh copy of virus passes into new program.software/computer, a fresh copy of virus passes into new program.
Thus, virus can be spread from one computer to other.Thus, virus can be spread from one computer to other.
3. NATURE OF VIRUSESNATURE OF VIRUSES
A virus can do anything that other programs do. The only difference is that itA virus can do anything that other programs do. The only difference is that it
attaches itself to another program and executes secretly when the host programattaches itself to another program and executes secretly when the host program
is run.is run.
Once a virus is executing, it can perform any function, such as erasing files andOnce a virus is executing, it can perform any function, such as erasing files and
programs.programs.
A virus goes through following four stages:A virus goes through following four stages:
1.1. DORMANT PHASE :DORMANT PHASE : In this phase virus is idle. The virus will eventuallyIn this phase virus is idle. The virus will eventually
activated by some event.activated by some event.
2.2. PROPAGATION PHASE:PROPAGATION PHASE: In this stage the virus places an identical copy ofIn this stage the virus places an identical copy of
itself into other programs or into certain system areas on disk.itself into other programs or into certain system areas on disk.
4. Each infected program will contain a clone of virus, which will itself enter aEach infected program will contain a clone of virus, which will itself enter a
propagation phase..propagation phase..
3.3. TRIGGERING PHASE:TRIGGERING PHASE: The virus is activated to perform the function for which itThe virus is activated to perform the function for which it
was intended. Triggering phase can be caused by variety of system event.was intended. Triggering phase can be caused by variety of system event.
4.4. EXECUTION PHASE:EXECUTION PHASE: In this phase the function is performed . The function mayIn this phase the function is performed . The function may
be harmless, such as message on screen or damaging, such as the destruction ofbe harmless, such as message on screen or damaging, such as the destruction of
program and data files.program and data files.
Most viruses carry out their work in a manner that is specific to a particularMost viruses carry out their work in a manner that is specific to a particular
operating system and in some cases, specific to a particular hardware platform.operating system and in some cases, specific to a particular hardware platform.
5. Virus structureVirus structure
A virus is prepended or postpended to an executable program or it can beA virus is prepended or postpended to an executable program or it can be
embedded in some other fashion.embedded in some other fashion.
The key operation of virus that the infected program, when invoked, will firstThe key operation of virus that the infected program, when invoked, will first
execute the virus code and then execute the original code of the program.execute the virus code and then execute the original code of the program.
An example of simple virus:An example of simple virus:
Program V : =Program V : =
{ go to main;{ go to main;
1234567;1234567;
Subroutine infect-executable :=Subroutine infect-executable :=
{ loop:{ loop:
6. file : = get-random-executable file;file : = get-random-executable file;
if (first-line-of-file =1234567)if (first-line-of-file =1234567)
then goto loopthen goto loop
else prepend V to file; }else prepend V to file; }
subroutine do-damage : ={whatever damage is to be done}subroutine do-damage : ={whatever damage is to be done}
Subroutine trigger-pulled :={return true if some condition holds}Subroutine trigger-pulled :={return true if some condition holds}
MainMain : main_program :={infect-executable;: main_program :={infect-executable;
if trigger-pulled then do-damage;if trigger-pulled then do-damage;
goto next; }goto next; }
next:next:
}}
The first line of code jumps to main virus program.The first line of code jumps to main virus program.
The second line is a special marker that is used by the virus to determine whetherThe second line is a special marker that is used by the virus to determine whether
or not potential victim program has been infected with this virus.or not potential victim program has been infected with this virus.
When program is invoked control is immediately transferred to main virusWhen program is invoked control is immediately transferred to main virus
program.program.
Virus seeks out uninfected executable files and infects them.Virus seeks out uninfected executable files and infects them.
7. Next, the virus may perform some action, determined to the system.Next, the virus may perform some action, determined to the system.
This action could be performed every time the program is invoked.This action could be performed every time the program is invoked.
Finally, virus transfers the control to original program.Finally, virus transfers the control to original program.
If the infection phase is reasonably rapid; a user can notice difference between theIf the infection phase is reasonably rapid; a user can notice difference between the
execution of infected and uninfected program.execution of infected and uninfected program.
8. TYPES OF VIRUSESTYPES OF VIRUSES
Most significant types of viruses are :Most significant types of viruses are :
II Parasitic virus:Parasitic virus: A Parasitic virus attaches itself to executable files and replicates,A Parasitic virus attaches itself to executable files and replicates,
when the infected program is executed.when the infected program is executed.
IIII Memory-resident virus:Memory-resident virus: It lodges the main memory as part of a resident systemIt lodges the main memory as part of a resident system
program. Form that point virus infect every program that executes.program. Form that point virus infect every program that executes.
IIIIII Boot sector virus:Boot sector virus: Infects a master boot record or boot record and spreads when aInfects a master boot record or boot record and spreads when a
system is booted from the disk containing the virus.system is booted from the disk containing the virus.
IVIV Stealth virus:Stealth virus: A form of virus explicitly designed to hide itself from antivirusA form of virus explicitly designed to hide itself from antivirus
software.software.
9. VV Polymorphic virus:Polymorphic virus: A virus that mutates with every infection making detection byA virus that mutates with every infection making detection by
the “signature” of virus is impossible.the “signature” of virus is impossible.
A polymorphic virus creates copies during replication that are functionallyA polymorphic virus creates copies during replication that are functionally
equivalent but have different bit patterns.equivalent but have different bit patterns.
Signature of virus will vary with each copy. To achieve this variation the virus maySignature of virus will vary with each copy. To achieve this variation the virus may
randomly insert unnecessary instructions.randomly insert unnecessary instructions.
10. VV Polymorphic virus:Polymorphic virus: A virus that mutates with every infection making detection byA virus that mutates with every infection making detection by
the “signature” of virus is impossible.the “signature” of virus is impossible.
A polymorphic virus creates copies during replication that are functionallyA polymorphic virus creates copies during replication that are functionally
equivalent but have different bit patterns.equivalent but have different bit patterns.
Signature of virus will vary with each copy. To achieve this variation the virus maySignature of virus will vary with each copy. To achieve this variation the virus may
randomly insert unnecessary instructions.randomly insert unnecessary instructions.
