"A program that can infect other programs by modifying them to include a slighty altered copy of itself. A virus can spread throughout a computer system or network using the authorization of every user using it to infect Reviews their programs. Every programs that gets infected can also act as a viral infection that grows :: Fred Cohen "
introduction
-----------------
Are You never heard what it was a virus, do you know what the virus is, here I will try to interpret what the virus. virus better known in medical terms as a virus or meaning of "biological virusses" also proved popular in the world of these electrons. these things happen because of the similarity in the distribution mechanism.
Computer viruses can be interpreted clearly is an ordinary computer program. but have fundamental differences with other programs, which he made to infect other programs, convert, manipulate even damage it.
but there needs to be noted here, the virus will infect only when the trigger program or programs that have been infected earlier executed, where it differs from the "worm". I'm not going to try to discuss the worm because it will divert us from the discussion of this virus.
origin of virus
1949, John Von Neuman, expressed "self-altering automata theory" which is the result of research mathematicians.
1960, lab BELL (AT & T), the experts in the lab BELL (AT & T) to dabble theory expressed by John V Neuman, they play around with the theory for a type of game / games. The experts have made a program that can reproduce itself and can destroy the opponent artificial programs. The program is able to survive and destroy all the other programs, it will be considered the winner. This game eventually became a favorite game each and every lab computer. the longer they were aware and cautious start this game because the program created more and more dangerous, so they do surveillance and tight security.
1980, the program is eventually known as "virus" was successfully spread beyond the lab environment, and began circulating in cyberspace.
1980, the virus began spreading viruses known in the cyber world.
Types of Viruses
-----------------
To further refine our knowledge about the virus, I will try to give an explanation of the types of viruses that often roam the cyber world.
1. Macro Virus
I think we all have very often heard about this virus. The virus is written in the programming language of an application rather than the programming language of an Operating System. The virus can be run if the constituent applications can run well, that is if the computer can run applications mac word then this virus works on Mac computer operating system.
examples of viruses:
- W97M-variant, eg W97M.Panther 1234 bytes long, it will infect and infect the Normal.dot document when opened.
- WM.Twno.A; TW :: 41 984 bytes, will infect Ms.Word document that uses a macro language, usually with extension *.DOT and *.DOC
- etc
This paper therefore I do not type in the word (:p)
2. Boot Sector Virus
Boot sector viruses are common once spread (frankly often formatted my hard drive because of a virus because of this: P, but because he was I am friends with him, :)). This virus will reproduce itself in a move or replace the original boot sector to boot virus program. So when there is a boot virus will be loaded into memory and then the virus will have the ability to control the standard hardware (ex :: monitor, printer, etc.) and from this memory is also the virus will spread throughout the existing drive and connected to computer (ex: floppy, drive other than c:\)
virus samples ::
- Wyx virus variants (I am subscription :) ex: wyx.C (B) infect the boot record and floppy; length: 520 bytes; characteristics: memory resident and encrypted)
- Variant of the V-sign: infect: Master boot record; length of 520 bytes; characteristics: living in the memory (memory resident), encrypted and polymorphic)
- Stoned.june 4th / bloody !: infect: Master boot record and floppy; length of 520 bytes; characteristics: living in the memory (memory resident), encrypted and displays the message "Bloody june 4th 1989" account after booting the computer 128 times)
3. Stealth Virus
This virus will master DOS interrupt table table that we often refer to as "Interrupt interceptor". This virus capable to control instruction DOS level instructions and usually they are hidden as well as a full name or size.
examples of viruses:
- Yankee.XPEH.4928, Infect files *.COM and *.EXE; length of 4298 bytes; characteristics: resident in memory, the size of the hidden, has a trigger
- WXYC (Which includes boot record category was due to enter the stealth category also included here), infects the master boot record and floppy; 520 bytes long; settled in the memory; size and hidden viruses.
- Vmem (S): infects files *.EXE, *.SYS, and *.COM; file length of 3275 bytes; characteristics: resident in memory, the size of the hidden, encrypted.
- etc
4. Polymorphic Virus
The virus is designed to fool antivirus programs, meaning the virus is always trying to avoid being recognized by antivirus fox by always changing the structure after each infected file/other programs.
examples of viruses:
- Necropolis A/B, infects file *.EXE and *.COM; file length 1963 bytes; characteristics: resident in memory, and the size of a virus hidden, encrypted and can change its structure
- Nightfall, Infects files *.EXE; file long 4554 bytes, characteristics: resident in memory, and the size of a hidden virus, has a trigger, encrypted, and can change its structure
- etc
5. Virus File/Program
This virus infects files that can be executed directly from the operating system, be it an application file (*.EXE), and (*.COM) usually results from infection with this virus can be identified by changing the file size is attacked.
6. Multi Partition Virus
This virus is a combination of boot sector viruses and file viruses: means work performed resulted in two, that he can infect files *.EXE and also infect the boot sector.
criteria Virus
--------------
A virus, it can be said is completely true virus when at least have 5 criteria ( the criteria I get from a reliable source :))
- ability of a virus to obtain information
- ability to check a program
- ability to replicate and infect
- ability to manipulate
- ability to hide itself.
Now I will try to briefly explain what is meant by each of the capabilities and why it is needed.
Now I will try to briefly explain what is meant by each of the capabilities and why it is needed.
The ability to obtain information
In general, a virus requires a list of the names of the files in a directory, for what? so that he can recognize what programs would he infect, such as macro viruses that will infect all files ending in (* doc) after the virus was found, where the ability to gather the necessary information so that the virus can create a list/data of all files, then sort by searching for files that can be infected. This data is usually created when a program is infected or infected with the virus program or even executed. The virus will be to collect the data and put in RAM (usually: P), so that when the computer is turned off all the lost data but will create every program run normally made hidden infected by a virus (so not plasticity).
Examine the ability of a program
A virus should also be able to check a program to be infected, for example, he served infect extension program (*.doc), he should check whether the document file has been infected or not, because if it is then he will be useless infecting 2 times. It is very useful to improve the ability of a virus to infect a speed in terms of file/program.Yang virus is commonly performed by a mark on the file / program which has infected so easy to be recognized by the virus. Examples of marking is for example provide a unique byte in every file that has been infected.
Ability to replicate itself
the core of the virus is the ability to duplicate itself by infecting other programs. A virus has found a potential victim (either a file or a program) then it will recognize the look, if not infected then the virus will begin to infect the action by writing byte identifier in the program / file, and so on to write virus code above object files / infected program. Some common ways are done by the virus to infect / reproduce itself are:
- File/program to be infected deleted or renamed. then created a file using the name by using the virus (the virus changed his name with the name of the deleted file)
- Virus program already in execution/load memory to be directly infect other files by means riding all files/programs that exist.
The ability to double the manipulation
Routine (routine) owned by a virus will be executed after the virus infects a file / program. contents of this routine can range from mild to destruction. This routine is commonly used to manipulate programs and popularizing the author! (: P) This routine utilizes the ability of an operating system (Operating System), so it has the same ability to that of the operating system.
eg:
- Creating an image or message on the monitor
- Replace / change the change the label of each file, directory, or the label of the drive in pc
- Manipulating programs / files are infected
- Undermine the program / file
- Disrupting the work printer, etc.
The ability to hide themselves
Hiding away this ability to be possessed by a virus that all the good work from the beginning to the success of transmission can be accomplished. usual steps are:
- The original program code is stored in the form of machines and combined with other programs that are considered useful by the user.
- Program Boot Record virus or placed on a track that is rarely noticed by the computer itself
- The virus program is made as short as possible, and the results do not change infected file size
- The virus does not change the description of the time a file
- etc















