A virus is a program that copies itself without the knowledge of the computeruser. Typically, a virus spreads from one computer to another by adding itselfto an existing piece of executable code so that it is executed when its hostcode is run.If a virus if found, you shouldn’t panic or be in a hurry, andyou should work systematically. Don’t rush!A Viruse may be classified by it’s method of concealment (hiding). Some arecalled stealth viruses because of the way that they hide themselves, and somepolymorphic because of the way they change themselves to avoid scanners fromdetecting them.
The most common classification relates to the sort of executable code which thevirus attaches itself to. These are:Partition Viruses Boot Viruses File Viruses Overwriting VirusesAs well as replicating, a virus may carry a Damage routine.
There is also a set of programs that are related to viruses by virtue of theirintentions, appearances, or users likely reactions. For example:Droppers Failed viruses Packagers Trojans Jokes Test filesTHE DAMAGE ROUTINEDamage is defined as something that you would prefer not to have happened. It ismeasured by the amount of time it takes to reverse the damage.
Trivial damage happens when all you have to do is get rid of the virus. Theremay be some audio or visual effect; often there is no effect at all.
Minor damage occurs when you have to replace some or all of your executablefiles from clean backups, or by re-installing. Remember to run FindVirus againafterwards.
Moderate damage is done when a virus trashes the hard disk, scrambles the FAT,or low-level formats the drive. This is recoverable from your last backup. Ifyou take backups every day you lose, on average, half a day’s work.
Major damage is done by a virus that gradually corrupts data files, so that youare unaware of what is happening. When you discover the problem, these corruptedfiles are also backed up, and you might have to restore a very old backup to getvalid data.
Severe damage is done by a virus that gradually corrupts data files, but youcannot see the corruption (there is no simple way of knowing whether the data isgood or bad). And, of course, your backups have the same problem.
Unlimited damage is done by a virus that gives a third party access to yournetwork, by stealing the supervisor password. The damage is then done by thethird party, who has control of the network.
CLASSIFICATION OF VIRUSESStealth VirusesIf a stealth virus is in memory, any program attempting to read the file (orsector) containing the virus is fooled into believing that the virus is notthere, as it is hiding. The virus in memory filters out its own bytes, and onlyshows the original bytes to the program.
There are three ways to deal with this:1. Cold Boot from a clean DOS floppy, and make sure that nothing on the harddisk is executed. Run any anti-virus software from floppy disk. Unfortunately,although this method is foolproof, relatively few people are willing to do it.
2. Search for known viruses in memory. All the virus scanners do this when theprograms are run.
3. Use advanced programming techniques to probe the confusion that the viruscauses. A process known as the “Anti-Stealth Methodology” in some scanners canbe used for this.
Polymorphic VirusesA polymorphic virus is one that is encrypted, and the decryptor/loader for therest of the virus is very variable. With a polymorphic virus, two instances ofthe virus have no sequence of bytes in common. This makes it more difficult forscanners to detect them.
Many scanners use the “Fuzzy Logic” technique and a “Generic Decryption Engine”to detect these viruses.
The Partition and Partition VirusesThe partition sector is the first sector on a hard disk. It contains informationabout the disk such as the number of sectors in each partition, where the DOSpartition starts, plus a small program. The partition sector is also called the”Master Boot Record” (MBR).
When a PC starts up, it reads the partition sector and executes the code itfinds there. Viruses that use the partition sector modify this code.
Since the partition sector is not part of the normal data storage part of a disk,utilities such as DEBUG will not allow access to it. However, it is possible touse Inspect Disk to examine the partition sector. A floppy disk does not have apartition sector.
How to Remove a Partition Sector (MBR) Virus1. Cold Boot from a clean DOS diskette.
2. Run the DOS scanner.
3. Select the drive to clean and “Repair” it.
4. Follow the instructions.
The Boot Sector and Boot Sector VirusesThe boot sector is the first sector on a floppy disk. On a hard disk it is thefirst sector of a partition. It contains information about the disk or partition,such as the number of sectors, plus a small program.
When the PC starts up, it attempts to read the boot sector of a disk in drive A:.
If this fails because there is no disk, it reads the boot sector of drive C:. Aboot sector virus replaces this sector with its own code and moves the originalelsewhere on the disk.
Even a non-bootable floppy disk has executable code in its boot sector. Thisdisplays the “not bootable” message when the computer attempts to boot from thedisk. Therefore, a non-bootable floppy can still contain a virus and infect a PCif it is inserted in drive A: when the PC starts up.
File VirusesFile viruses append or insert themselves into executable files, typically .COMand .EXE programs.
A direct-action file virus infects another executable file on disk when its’host’ executable file is run.
An indirect-action (or TSR – Terminate and Stay Resident) file virus installsitself into memory when its ‘host’ is executed, and infects other files whenthey are subsequently accessed.
Overwriting VirusesOverwriting viruses overwrite all or part of the original program. As a result,the original program doesn’t run. Overwriting viruses are not, therefore, a realproblem – they are extremely obvious, and so cannot spread effectively.
APPEARANCES AND INTENTIONS OF VIRUSESDroppersDroppers are programs that have been written to perform some apparently usefuljob but, while doing so, write a virus out to the disk. In some cases, all thatthey do is install the virus (or viruses).
A typical example is a utility that formats a floppy disk, complete with Stonedvirus installed on the boot sector.
Failed VirusesSometimes a file is found that contains a ‘failed virus’. This is the result ofeither a corrupted ‘real’ virus or simply a result of bad programming on thepart of an aspiring virus writer. The virus does not work – it hangs when run,or fails to infect.
Many viruses have severe bugs that prevent their design goals – some will notreproduce successfully or will fail to perform their intended final actions(such as corrupting the hard disk). In general many virus authors are very poorprogrammers.
PackagersPackagers are programs that in some way wrap something around the originalprogram. This could be as an anti-virus precaution, or for file compression.
Packagers can mask the existence of a virus inside.
Trojans and JokesA Trojan is a program that deliberately does unpleasant things, as well as (orinstead of) its declared function. They are not capable of spreading themselvesand rely on users copying them.
A Joke is a harmless program that does amusing things, perhaps unexpectedly. Weinclude the detection of a few jokes in the Toolkit, where people have foundparticular jokes that give concern or offence.
Test filesTest files are used to test and demonstrate anti-virus software, in the contextof viruses. They are not viruses – simply small files that are recognised bythe software and cause it to simulate what would happen if it had found a virus.
This allows users to see what happens when it is triggered, without needing alive virus.
METHODS OF REMOVING VIRUSESHow to Remove a Boot Virus from a Hard Disk1. Cold Boot from a clean DOS diskette.
2. Run the scanner.
3. Select the drive to clean and “Repair” it.
An alternative method is as follows:1. Cold Boot from a clean DOS diskette.
2. Type:SYS C: at the DOS prompt. (if C drive is infected)The clean DOS diskette should be the same version of DOS that is on the harddisk.
How to Remove a Boot Virus from a Floppy1. Cold Boot from a clean DOS diskette.
2. Run the scanner.
3. Make sure to “Replace the Boot Sector” of the floppy drive.
If you find a new virus…
If you have some symptoms that you think are a virus, then:1. Format a floppy disk in the infected computer.
2. Copy any infected files to that floppy.
3. Copy your FORMAT and CHKDSK programs too.
As you can see in this essay, viruses are very appalling, and since a virusspreads from one computer to another, it gets worse! Just like a contagioushuman virus which causes more harm, as more people are infected and more need tobe treated. This same concept applies to a computer virus infecting computerscontinually. Also, in this essay, various techniques have been explained on howto remove and deal with computer viruses, of different types, inflictingdifferent components in a computer. So, next time you have suspicions that yourcomputer has been damaged by a virus, read through this essay and exercise theremedies indicated.
Category: Technology
