COMPUTER VIRUSES

Computer Virus

○ A short computer program, hidden within another, that makes copies of it and spreads them, disrupting the operation of a computer that receives one.

○ It usually does nasty things to the computer or program which it infects.

○ Its effects could be just plain annoying or extremely malicious.

Most common symptoms that indicates your computer has been infected:

1. Files and data is deleted
2. The computer takes longer to load programs/applications
3. Items and images on your screen are distorted and unusual images and text appears
4. Unusual noises come from your keyboard, hard disk.
5. Hard disk operates excessively or is inaccessible
6. Disk space and file names change for no reason
7. System tools such as Scandisk return incorrect vlaues

Common Types of Computer Viruses

○ Logic Bombs
They are not considered  viruses because they do not replicate. They are not even programs in their own right but rather camouflaged segments of other segments.

Their objective is to destroy data on the computer once certain conditions have been met. Logic bombs go undetected until launched, and the results can be destructive.

○ Stealth Viruses
Hides the modifications made to files and boot records by modifying and forging the results of calls to functions, therefore programs believe they are reading the original file and not the modified file. A good anti-virus software will probably detect a stealth virus due to the fact that a stealth virus attempts to hide itself in memory when an anti-virus software is launched.

○ Slow Virus
A difficult virus to detect due to the fact that it only modifies and infects files when they have been modified or copied. Therefore the original file will not be infected by the actual copied file. A good way to protect yourself against slow viruses is by using an integrity checker or shell.

○ Retro Viruses
Attacks the anti-virus software designed to delete it. The retro virus usually attempts to attack the anti-virus data files such as the virus signature store which disables the ability of the anti-virus software to detect and delete viruses. Otherwise the retro virus attempts to alter the operation of the anti-virus software.

○ Multipartite Viruses
 Attempts to attack and infect both the boot sector and executable files at the same time.

○ Armored Viruses
Attempts to protect itself from anti-virus software by trying to make anti-virus believe it is located somewhere else. Therefore the armored virus has made itself more difficult to trace, disassemble and understand.

○ Companion Viruses
Creates a companion file for each executable files the virus infects. Therefore a companion virus may save itself as scandisk.com and every time a user executes a scandisk.exe, the computer wil load scandisk.com and therefore infect the system.

○ Phage Viruses
A very destructive virus that re-writes an executable program with its own code, rather than just attaching itself to a file. Therefore a Phage virus will usually attempt to delete or destroy every program it infects.

○ Revisiting Viruses
 A worm virus and attempts to copy itself within the computer's memory and then copy itself to another linked computer using TCP/IP protocols. The Morris worm virus in the late 1980's was the first major virus threat to hit the internet.

○ Resident Virus
A permanent which dwells in the RAM memory. From there it can overcome and interrupt all of the operations executed by the system: corrupting files and programs that are opened, closed, copied, renamed etc.


○ Direct Action Viruses
The main purpose of this virus is to replicate and take action when it is executed. When a specific condition is met, the virus will go into action and infect files in the directory or folder that it is in and in directories that are specified in the AUTOEXEC.BAT file path. This batch file is always located in the root directory of the hard disk and carries out certain operations when the computer is booted.

○ Overwrite Viruses
Virus of this kind is characterized by the fact that it deletes the information contained in the files that it infects, rendering them partially or totally useless once they have been infected.

○ Boot Virus
Affects the boot sector of a floppy or hard disk. This is a crucial part of the disk in which information on the disk itself is stored together with a program that makes it possible to boot (start) the computer from the disk.

○ Macro Virus
Infects files that are created  using certain applications or programs that contain macros. These mini-programs make it possible to automate series of operations so that they are performed as a single action, thereby saving the user from having to carry them out one by one.

○ Directory Virus
Change the paths that indicates the location of a file. By executing a program (file with extension .EXE or .COM) which has been infected by a virus, you are unknowingly running the virus program, while the original file and program have been previously moved by the virus.

○ Polymorphic Virus
Encrypt or encode themselves in a different way (using different algorithms and encryption keys) every time they infect a system.

○ File Infectors
Infects programs or executable files. When one of this programs is run, directly or indirectly, the virus is activated, producing the damaging effects it is programmed to carry out. The majority of existing viruses belong to this category, and can be classified depending on the action sthey carry out.

○ FAT Virus
The file allocation table or FAT is the part of a disk used to connect information and is a vital part of the normal functioning of the computer. This type of virus attack can be especially dangerous, by preventing access to certain sections of the disk where important files are stored. Damage caused can result in information losses from individual files or even entire directories.

Virus Prevention

☺ Installing anti-virus software on your computer.
A good anti-virus sytem will scan your machine regularly to clean it from any infected files.

☺ Update your anti-virus software regularly.
NOTE: It is advised NOT to connect to the internet without AV protection.

☺ When in doubt, Throw it out
Always use caution and do not open, download or execute any suspicious files or email attachments.

☺ Delete chain emails and junk mail
Do not forward or reply to any of them. These types of emails are considered spam, which is unsolicited, intrusive mail that clogs up the network.

☺ Use caution when downloading files from the internet
Ensure that the source is a legitimate and reputable one. Verify that an anti-virus program checks the files on the download site. If you're uncertain, don't download file at all.