A P P E N D I X C
205
205
205
205
We can differentiate viruses by
the operating system
they infect. Every
file or network virus is able to infect files of one or more operating systems:
DOS, Windows, Win95/NT, OS/2 etc. Macro viruses infect file formats used
by Word, Excel, and Office97. Boot viruses also take advantage of certain
arrangements of the system data within the boot sectors.
Grouping computer viruses by the way they work or, in computer terms, the
kind of
algorithm
they use gives the following categories:
•
resident
;
•
stealth features
;
•
self-encoding and polymorphic
;
•
using sophisticated methods
.
When a MEMORY-RESIDENT virus infects a computer, it places the
resident code into RAM, where the code intercepts system calls to the
objects to be infected and infects them. The memory-resident part of the
virus stays in RAM and continues to actively infect files until the user shuts
the machine down or restarts the infected system. NON-RESIDENT
viruses do not infect RAM and are active for only a limited time. There are
also non-resident viruses that place small resident programs into RAM.
However, unlike with the memory resident viruses, these programs do not
distribute virus copies.
Macro viruses also can be considered as memory-resident, since they stay
in RAM all the time the infected editor is running. At that, the editor
performs functions of the operating system and the notion of restarting the
operating system is interpreted as the exiting editor.
In multi-purpose operating systems the lifetime of resident DOS viruses
may be limited by the moment when a user closes the infected DOS
window, and in some operating systems the active period of boot viruses
ends when the OS disk drivers are installed.
The use of STEALTH FEATURES enables a virus to conceal itself, in part
or in full, within a system. Interception of the system read/write requests is
the most popular method of distribution of stealth-algorithms. Stealth
viruses temporarily disinfect the infected file or substitute themselves for
“healthy” data blocks. In case of macro-viruses, the most popular feature
used is the prohibition to activate the menu list of macros. One of the first
file-stealth-viruses is Frodo and the first boot-stealth-virus is called Brain.
