Types of viruses
The viruses are able to infect programs and resist anti-virus programs more effectively. Such virus occupies a little of memory space. It is ready to continue its task before unloading, rebooting or turning off the computer. It is activated and performs actions set by the virus writer when, for example, computer reaches specific state (timer actuation etc.).All boot viruses are resident.
Most often such viruses enter user's computer in the form of email messages holding script-files in the attachments. Programs written in Visual Basic and Java Script can be located either in separate files or embedded in HTML-document. In the latter case they can be interpreted by browser from the remote server and also from the local disk.
Stealth virus - are virus programs taking special measures so as to mask its activities and to hide their presence in the infected objects.
So called Stealth technology can include:
- obstacles to the virus detection in RAM
- obstacles to the tracing and disassembling of the virus
- masking of the infection process
- obstacles to the virus detection in infected program and boot sector.
Depending on the type of infected objects computer viruses are classified by the following types:
- File viruses - viruses infecting binary files (mainly executable files and dynamic libraries). Most often such files have the extension .EXE, .COM, .DLL, .SYS. Besides the files with extensions .DRV, .BIN, .OVL и .OVY. can also be infected.
The viruses infect the operating system files, get activated when infected program is run and then outspread.
- Boot viruses - viruses that infect Boot record of diskettes, hard disk partitions, and also MBR (Master Boot Record) of hard disk drives.
- Encrypted viruses - viruses that encode their code themselves so as to make obstacles to their disassembling and detecting in file, memory or sector. Each copy of such virus will contain only short common code fragment. The decoding process of the fragment can be taken as signature. Each time it infects the virus automatically encode itself and each time differently. This way the virus tries to avoid detection by anti-virus programs.
Virus-companion - is formally a file virus. It does not infect executable files.
Such viruses use the DOS system feature which allows program files with the same names but different extensions to run with different priorities. Priority is an attribute assigned to the task, program or operation that defines the order of their execution by computer system. Majority of such viruses create .COM file which has higher priority compared to .EXE file with the same name. When a file is run by name (without specifying the extension) the .СОМ file is executed.
Such viruses can be resident and mask clone files.