Virus basics and different types of them

Q:
How does a virus begin to infest itself in a computer system? I would just like to know the beginning basics of it. Thank you for your help!

A:
If you are an avid WorldStart newsletter reader, you know that we have done several articles on viruses in the past. We've warned you about what they can do to your computer system, we've talked about antivirus and other protective software and we've even given you updates on the latest threats that loom around us everyday.

But, do you fully understand where viruses can come from? How do they get into your system and start invading through your personal property? How is that even possible? Unfortunately, it can happen very easily and quickly. It sometimes catches us off guard and we don't even know anything until a later time, when it might be too late.

So, I just wanted to give you a little reminder/update about where viruses can come from so that you can protect your computer better and be a little safer. The most common virus freeloaders come in e-mail attachments. That's good to know, because we all use our e-mail accounts pretty much everyday. Just make sure you don't open anything that comes from an unfamiliar sender. Always know who the sender is and take caution.

Another common virus area is through downloads. If you come across something on the Internet that you think you just have to download, make sure it is from a reliable source. Even if it doesn't include some sort of a virus, it could still tag along some malware on your system. Also, you should never click on any pop ups. Those are usually infested with nasty things and you should always just exit out of those pop ups to keep your system safe.

Another cause of viruses is network sharing. If you're on a network and you have everything set up to share with other users, you're leaving yourself wide open for some threats. If another user receives a virus, there really isn't anything to stop it from coming onto your computer. This is also true for wireless networks. If you are set up to go wireless, make sure your line is locked so that outside users can't get in. Some people might try to "bum" wireless access off of you and it can cause you problems in the long run. If it's not absolutely necessary that you share a network, then don't! That's the best way to keep your own system secure.

There are so many computer infections swarming around us each day, so do everything you can to protect yourself. As always, make sure you have some sort of antivirus protection software on your computer and run your scans frequently. If you don't, you never know what sort of trouble could make its way into your PC's life!

~ Erin

Virus
Like a biological virus, a computer virus is something you don't want to get. Computer viruses are small programs or scripts that can negatively affect the health of your computer. These malicious little programs can create files, move files, erase files, consume your computer's memory, and cause your computer not to function correctly. Some viruses can duplicate themselves, attach themselves to programs, and travel across networks. In fact opening an infected e-mail attachment is the most common way to get a virus.

We all know it's hard enough to get a computer to work well when it is healthy, let alone when it has been attacked by a virus. Therefore, it is better to prevent an attack than to try and cure it. There are many anti-virus programs available that scan incoming files for viruses before they can cause damage to your computer. Some of these programs include Norton AntiVirus?, McAfee VirusScan?, and Virex?. It is a good idea to have one of these programs on your computer to prevent a virus attack. It is also important to update your virus definitions file at least once a month so that your anti-virus program can check for all the latest viruses. It's a lot like having a glass of orange juice every morning -- it keeps your computer's immune system strong and healthy.

source: http://www.techterms.com/

-----

The different types of viruses that are out there.
- Worms
- Trojan Horses
- Bugs
- Droppers
- hoaxes

And of course you have then also the adware, spyware and malware. I shall explain them in the next posts

Worm
Worm has two widely different definitions. One refers to a computer virus and the other is an optical storage technology:

1) A type of computer virus
Just like regular worms tunnel through dirt and soil, computer worms tunnel through your computer's memory and hard drive. A computer worm is a type of virus that replicates itself, but does not alter any files on your machine. However, worms can still cause havoc by multiplying so many times that they take up all your computer's available memory or hard disk space. If a worm consumes your memory, your computer will run very slowly and possibly even crash. If the worm affects your hard disk space, your computer will take a long time to access files and you will not be able to save or create new files until the worm has been eradicated.

Worms are hard to detect because they are typically invisible files. They often go unnoticed until your computer begins to slow down or starts having other problems. Unlike viruses and Trojan horses, worms can replicate themselves and travel between systems without any action from the user. For these reasons, it is good to have an antivirus program installed on your system that can detect and remove worms before they have a chance to replicate or spread to other computers. Security updates such as Windows Update also patch security holes that allow worms to infect your computer. So keep your security updates and virus definitions up-to-date and you should be able to keep your computer worm-free.


2) An optical storage technology
WORM can also mean "Write Once, Read Many." It is an optical storage technology that allows a disc to be written only once but read an unlimited number of times. WORM devices were introduced in the 1970's and gained popularity as a way of archiving data. The storage capacity of WORM discs began around 140MB, but increased to more than 3.0GB over the past few decades. Yet the WORM technology has no standard format, so WORM discs are only compatible with the drives that wrote them. This limitation has kept WORM equipment relatively expensive and has kept the technology from gaining widespread acceptance.

Today, most optical drives are based on either CD-R or DVD-R technology. Unlike WORM discs, CD-Rs and DVD-Rs can typically be read by any CD or DVD drive, regardless of the manufacturer. Because of their improved compatibility and lower costs, writable CDs and DVDs have all but replaced WORM media.

-----------

Trojan Horse

In Greek mythology, there is a story about the Trojan War. This war lasted many years, as the Greeks could not penetrate the heavily barricaded city of Troy. So one day, a few of the Greek soldiers brought the people of Troy a large wooden horse, which they accepted as a peace offering. The horse was moved inside the city walls, where it sat until the night. After the people of the city had fallen asleep, Greek soldiers jumped out of the wooden horse, opened the gates to let their fellow soldiers in, and took over the city.

So what is the moral of this story? Mainly, beware of Trojan horses. But how does that relate to computers? That's a good question. In the computing world, Trojan horses are more than just a myth. They really exist and can cause damage to your computer. Trojan horses are software programs that masquerade as regular programs, such as games, disk utilities, and even antivirus programs. But if they are run, these programs can do malicious things to your computer.

For example, a Trojan horse might appear to be a computer game, but once you double-click it, the program starts writing over certain parts of your hard drive, corrupting your data. While this is certainly something you want to avoid, it is good to know that these malicious programs are only dangerous if they are given a chance to run. Also, most antivirus programs can catch Trojan horses when scanning for viruses. Unlike viruses, however, Trojan horses don't replicate themselves. Though it is possible for a Trojan horse to be attached to a virus file that spreads to multiple computers.

So as a general rule, don't open a program unless you know it is legitimate. This applies especially to e-mail attachments that are executable files. Even if you are pretty sure the attachment is OK, it is still a good idea to run it through your virus scan program (with the latest virus definitions) just to be safe. Remember what happened to the people of Troy -- don't let a Trojan horse catch you off guard.

Bug
A bug is an error in a program. It is included here even though it really isn't in the same class as viruses and trojans, because it is similar to a trojan horse in that it causes behavior other than what the user wanted. The difference of course is that with a bug, the aberrant behavior is unintentional! With a trojan horse the author is doing it on purpose.

Dropper
A dropper is a program designed to install or deliver a virus or trojan horse onto a target system. The dropper is specially designed to avoid detection by standard virus detection programs, because the virus is specially encrypted so that the dropper itself doesn't appear to the virus scanners like a regular infected program file would. In some ways, a dropper is like a "virus egg", waiting to be hatched. They are uncommon.

source: http://www.pcguide.com/care/data/virus/bg.htm


Hoax also known as spoofing in the IT world
The word "spoof" means to hoax, trick, or deceive. Therefore, in the IT world, spoofing refers tricking or deceiving computer systems or other computer users. This is typically done by hiding one's identity or faking the identity of another user on the Internet.

Spoofing can take place on the Internet in several different ways. One common method is through e-mail. E-mail spoofing involves sending messages from a bogus e-mail address or faking the e-mail address of another user. Fortunately, most e-mail servers have security features that prevent unauthorized users from sending messages. However, spammers often send spam messages from their own SMTP, which allows them to use fake e-mail addresses. Therefore, it is possible to receive e-mail from an address that is not the actual address of the person sending the message.

Another way spoofing takes place on the Internet is via IP spoofing. This involves masking the IP address of a certain computer system. By hiding or faking a computer's IP address, it is difficult for other systems to determine where the computer is transmitting data from. Because IP spoofing makes it difficult to track the source of a transmission, it is often used in denial-of-service attacks that overload a server. This may cause the server to either crash or become unresponsive to legitimate requests. Fortunately, software security systems have been developed that can identify denial-of-service attacks and block their transmissions.

Finally, spoofing can be done by simply faking an identity, such as an online username. For example, when posting on an Web discussion board, a user may pretend he is the representative for a certain company, when he actually has no association with the organization. In online chat rooms, users may fake their age, gender, and location.

While the Internet is a great place to communicate with others, it can also be an easy place to fake an identity. Therefore, always make sure you know who you are communicating with before giving out private information.

Adware
Adware is free software that is supported by advertisements. Common adware programs are toolbars that sit on your desktop or work in conjunction with your Web browser. They include features like advanced searching of the Web or your hard drive and better organization of your bookmarks and shortcuts. Adware can also be more advanced programs such as games or utilities. They are free to use, but require you to watch advertisements as long as the programs are open. Since the ads often allow you to click to a Web site, adware typically requires an active Internet connection to run.

Most adware is safe to use, but some can serve as spyware, gathering information about you from your hard drive, the Web sites you visit, or your keystrokes. Spyware programs can then send the information over the Internet to another computer. So be careful what adware you install on your computer. Make sure it is from a reputable company and read the privacy agreement that comes with it.

-----

Spyware
As the name implies, this is software that "spies" on your computer. Nobody likes to be spied on, and your computer doesn't like it either. Spyware can capture information like Web browsing habits, e-mail messages, usernames and passwords, and credit card information. If left unchecked, the software can transmit this data to another person's computer over the Internet.

So how does spyware get on your computer? Just like viruses, spyware can be installed when you open an e-mail attachment containing the malicious software. It can also be installed when you install another program that has a spyware installer attached to it. Because of the insidious nature of spyware, most people don't even know when spyware is on their computer. Fortunately, you can purchase anti-spyware utilities that will search for spyware on your computer and stomp the unwanted software out of your system. A good way to prevent spyware from infecting your computer is to install a security program that lets you know when any program is being installed, so that you can choose to authorize or stop the installation.

-----

Malware
Short for "malicious software," malware refers to software programs designed to damage or do other unwanted actions on a computer system. In Spanish, "mal" is a prefix that means "bad," making the term "badware," which is a good way to remember it (even if you're not Spanish).

Common examples of malware include viruses, worms, trojan horses, and spyware. Viruses, for example, can cause havoc on a computer's hard drive by deleting files or directory information. Spyware can gather data from a user's system without the user knowing it. This can include anything from the Web pages a user visits to personal information, such as credit card numbers.

It is unfortunate that there are software programmers out there with malicious intent, but it is good to be aware of the fact. You can install anti-virus and anti-spyware utilities on your computer that will seek and destroy the malicious programs they find on your computer. So join the fight against badware and install some protective utilities on your hard drive!

Major Virus Types and How They Work

Computer viruses are well-named: their behavior bears a striking resemblance to how real-life biological viruses work, and the ways of dealing with them can be quite similar as well! A biological virus infects a host (a creature), using it as a vehicle for life. It reproduces rapidly; one of its primary goals is to spread to other creatures and thereby perpetuate itself. It also tends to move from person to person and eventually, months later, comes back to reinfect the same people again.

Computer viruses work in the same way, including the way they tend to go around from PC to PC and then occasionally return to reinfect months or years later (in fact, there are viruses that have been circulating around since the early days of the PC that, thanks to backward compatibility, still "run" on the latest machines). Computer viruses however, differ from biological viruses in several ways: they are man-made for one thing, and they are easier to get rid of. Also, biological viruses cause symptoms as a side-effect, they do not exist to make people miserable. Most computer viruses do exist specifically to make people miserable.

There are three major types of viruses, each very different from the other. Of course, there are many subcategories within each group as well (and to make matters worse, there are virus hoaxes to confuse the issue):

* Boot Sector Infectors: Also sometimes called boot record infectors, system viruses, or boot viruses, these programs attack the vulnerable boot program that is stored on every bootable floppy disk or hard disk. This code is executed by the system when the PC is started up, making it a juicy target for virus writers: by installing themselves here they guarantee that their code will be executed whenever the system is started up, giving them full control over the system to do what they wish. They are spread most commonly through infected bootable floppy disks.

* File Infectors: These viruses directly attack and modify program files, which are usually .EXE or .COM files. When the program is run, the virus executes and does whatever it wants to do. Usually it loads itself into memory and waits for a trigger to find and infect other program files. These viruses are commonly spread through infected floppy disks, over networks, and over the Internet.

* Macro Viruses: The newest type of virus, these clever programs make use of the built-in programming languages in popular programs such as Microsoft Word and Microsoft Excel. These programs allow users to create programs that automate tasks, called macros. As the macro languages have become more powerful, virus writers have created malevolent macros that, when opened unwittingly, duplicate themselves into other documents and spread just like a conventional virus would. These programs can cause just as much damage as regular viruses, despite the fact that they are very different: regular viruses are low-level machine language programs, while macro viruses are actually high-level interpreted BASIC programs! The most common type of macro virus right now infects Microsoft Word documents.

As time goes on and virus writers get more clever, new strains and variations show up. For example, there are some viruses, termed multipartite, that infect both boot sectors and files. There are some things that are fairly universal, however: a virus is a program, and it therefore can only exist in a form that allows it to be executed as a program by the PC in some form. This means that, in general, viruses cannot exist in data files. There are a lot of myths about viruses that infect graphics pictures or email messages or recipe files. Just remember that a virus cannot do anything unless you run it, so unless you have a PC that can execute pictures or email messages somehow, it's doubtful that these can contain a virus. (Of course, you can have a virus in a program that is attached to an email message. But here again, this is a program, just in encoded form.)

There are also now viruses that target the BIOS program stored on the motherboard, on systems that employ a flash BIOS. These viruses can overwrite the system BIOS program and leave the PC in an unbootable state. (Some motherboards have jumpers that you can set to disable BIOS flashing except when you want to do it.)

Here is the general way that viruses work:

1. An infected program is run. This is either a program file (in the case of a file-infecting virus) or a boot sector program at boot time. In the case of a Microsoft Word document the virus can be activated as soon as the document that contains it is opened for reading within Microsoft Word. If the "NORMAL.DOT" document template is infected (and this is the most common target of these viruses) then the virus may be activated as soon as Microsoft Word is started up.

2. The infected program has been modified so that instead of the proper code running, the virus code runs instead. This is usually done by the virus modifying the first few instructions to "jump" to where the virus code is stored. The virus code begins to execute.

3. The virus code becomes active and takes control of the PC. There are two ways that a virus will behave when it is run: direct-action viruses will immediately execute, often seeking other programs to infect and/or exhibiting whatever other possibly malicious behavior their author coded into them. Many file-infector viruses are direct-action. In contrast, memory-resident viruses don't do anything immediately; they load themselves into memory and wait for a triggering event that will cause them to "act". Many file infectors and all boot infectors do this (boot infectors have to become memory resident, because at the time they are executed the system is just starting up and there isn't that much "interesting" for them to do immediately.)

4. What exactly the virus does depends on what the virus is written to do. Their primary goals however include replication and spreading, so viruses will generally search for new targets that they can infect. For example, a boot sector virus will attempt to install itself on hard disks or floppy disks that it finds in the system. File infectors may stay in memory and look for programs being run that they can target for infection.

5. "Malevolent" viruses that damage files or wreak havoc in other ways will often act on triggers. There are viruses that will only activate on particular days of the year (such as the infamous "Friday the 13th"), or act randomly, say, deleting a file every 8th time they are run. Some viruses do nothing other than trying to maximize their own infection to as many files and systems as possible.

As virus authors have become more "creative", they have devised increasingly more sophisticated viruses that work in different ways. In particular, newer viruses get smarter and smarter in avoiding detection. In most cases these viruses are not necessarily more hazardous than older ones, but they are harder to detect and remove using anti-virus software. Some of the tricks that authors use:

* Polymorphing: Some viruses are designed so that each time they infect, their appearance and size changes. These thwart simplistic virus scanners that look for predefined patterns and make detection much more difficult.

* Stealth: A stealth virus actively hides the changes it has made to the hard disk so that it appears that it has not infected the system. For example, a file infector might stay memory resident and misreport the size of infected files so they don't appear to be infected. Boot sector viruses can trap attempts to read the boot sector and return forged data that makes them appear to be "clean".

* Disassembly Protection: Many newer viruses are designed using programming tricks that make them hard to disassemble (the process of interpreting the code into a form that is easier to analyze so that the virus can be combated.)

* Directory Viruses: Some viruses now seek to avoid detection by avoiding modifying the file they infect directly. Instead, they change the cluster pointer in the directory entry of the file to point to the virus instead of the actual program. The virus runs its code and then executes the target program afterwards. The virus is thus able to "infect" the program without actually modifying it.

Source: http://www.pcguide.com/care/data/virus/bgTypes-c.html

Symptoms of Virus Infection

There is usually no simple way to know when you have a virus. I should rephrase this: some viruses exhibit behavior that tell you immediately that they are on your system, but so many viruses mimic other system problems that it is most accurate to say "there is usually no way to rule out a virus as a possible cause of strange software or system behavior on your PC".

Virus writers are usually pranksters whose software is normally designed to avoid detection, and to cause mischief. Both of these mean that viruses are designed to mimic natural processes in your PC so that you don't think you have an infection. They often make your system behave in strange ways, but in strange ways that could also be the result of an application bug, driver glitch, or even a hardware problem. For example, a virus can make strange things print on the screen--but so can a driver problem, or a bad BIOS setting. A virus can make the system spontaneously reboot--but so can a bad power supply, or an operating system problem, or an overheating processor.

Since viruses are so common, and they can exhibit so many strange types of behavior, and so many of these behaviors are similar to other, real hardware and software problems, I always recommend a virus scan as the first step in troubleshooting a hardware or software problem. Until virus infection has been cleared as a potential source of problems, it doesn't make much sense to look for a real hardware or software cause. For example, many symptoms of resource conflicts are similar to the symptoms of virus infection. The following are the sorts of problems that are usually real system or component problems, but can also be a result of virus trickery (this list is not exhaustive; virus writers are very creative):

* Spontaneous system reboots.
* System crashes/hangups.
* Application crashes.
* Sound problems with the speaker or sound card.
* Seemingly random glitches on the screen.
* Corrupted hard disk data.
* Partitions that seem to "disappear".
* System slowdowns.
* Hard disks that won't boot.

There are some types of strange system behavior that hint much more strongly that a virus is around and responsible for the problem. Seeing any of the following types of behavior on your system should send you scrambling for your clean antivirus boot disks, as they are not normally caused by legitimate hardware or software problems:

* Strange Messages: If you boot your PC some day and are greeted with the message "Your PC is now Stoned!", then you can bet your booties that you have a virus. Oddball messages on the screen usually are viruses (although some real system messages are kind of strange too, such as "No ROM BASIC - System Halted").

* Odd Text Games: If you type at the command prompt in DOS and the letters start moving around on the screen in strange patterns, or each letter you type is changing to a random color, or ASCII graphics move around the screen "eating" other characters, or anything strange like that, chances are high that you have a virus.

* Music and Strange Sounds: Viruses have been known to generate music or odd tones on the system speaker.

* Changing File Sizes or Time/Date Stamps: File-infector viruses commonly increase the size of files that they infect, and some can affect date/time stamps as well. There is normally no ordinary reason for an executable file to increase in size (unless you apply a patch to the program or something similar.) Time/date stamps are more easily changed, but still normally remain static over the life of a program.

* Disappearing Files: If you used a program yesterday and now it isn't there any more, and you're sure that you didn't delete it, a virus may have deleted it for you.

Source: http://www.pcguide.com/care/data/virus/scan.htm

Viruses in Memory, and the Importance of the Clean Boot Floppy

In order for a virus scanner to have any chance at reliably detecting virus infections on a hard disk or floppy disk, it must be allowed to operate in a clean environment. The first thing that a virus scanner will normally do is to examine the system memory when it is run, looking for any viruses that may be memory-resident that could impede virus detection. Most scanners will not run if they find a virus in memory. A file-infector virus could be in memory if an infected program was run before the virus scanner; a boot sector virus will normally infect memory as soon as the PC is booted.

The best way to scan for viruses is to start the system with a clean virus-checking boot floppy before running the scanner. This ensures that if there is a hard disk boot sector virus, it is not given a chance to load into memory before you scan. In order to boot from a clean boot floppy in this manner, your system must be set to try to boot from the floppy first in its boot sequence. (If it isn't set to boot from the floppy first then you can't use a clean boot floppy in this manner, but you also have much less chance of getting a boot sector virus.)

A clean virus-checking boot floppy should be created as a bootable floppy with whatever operating system you are using. It should ideally have the virus scanning software on it, and should be write-protected to eliminate any chance of it getting infected itself. Even if the virus software is not on the disk, booting from it instead of the hard drive will bypass viruses located in the hard disk boot sector or startup files. This boot disk should be one of the boot floppy disks that you keep as part of the backups of your system.

source: http://www.pcguide.com/care/data/virus/scan.htm