[ The PC Guide | System Care Guide | Data Loss and Virus
Prevention | Virus Detection and Protection | Background
on Viruses ]
Major Virus Types and How They Work
Computer viruses are well-named: their behavior bears a striking resemblance to how
real-life biological viruses work, and the ways of dealing with them can be quite similar
as well! A biological virus infects a host (a creature), using it as a vehicle for life.
It reproduces rapidly; one of its primary goals is to spread to other creatures and
thereby perpetuate itself. It also tends to move from person to person and eventually,
months later, comes back to reinfect the same people again.
Computer viruses work in the same way, including the way they tend to go around from PC
to PC and then occasionally return to reinfect months or years later (in fact, there are
viruses that have been circulating around since the early days of the PC that, thanks to
backward compatibility, still "run" on the latest machines). Computer viruses
however, differ from biological viruses in several ways: they are man-made for one thing,
and they are easier to get rid of. Also, biological viruses cause symptoms as a
side-effect, they do not exist to make people miserable. Most computer viruses do
exist specifically to make people miserable.
There are three major types of viruses, each very different from the other. Of course,
there are many subcategories within each group as well (and to make matters worse, there
are virus hoaxes to confuse the issue):
- Boot Sector Infectors: Also sometimes called boot record infectors, system
viruses, or boot viruses, these programs attack the vulnerable boot program that is stored on every
bootable floppy disk or hard disk. This code is executed by the system when the PC is
started up, making it a juicy target for virus writers: by installing themselves here they
guarantee that their code will be executed whenever the system is started up, giving them
full control over the system to do what they wish. They are spread most commonly through
infected bootable floppy disks.
- File Infectors: These viruses directly attack and modify program files, which are
usually .EXE or .COM files. When the program is run, the virus executes and does whatever
it wants to do. Usually it loads itself into memory and waits for a trigger to find and
infect other program files. These viruses are commonly spread through infected floppy
disks, over networks, and over the Internet.
- Macro Viruses: The newest type of virus, these clever programs make use of the
built-in programming languages in popular programs such as Microsoft Word and Microsoft
Excel. These programs allow users to create programs that automate tasks, called macros.
As the macro languages have become more powerful, virus writers have created malevolent
macros that, when opened unwittingly, duplicate themselves into other documents and spread
just like a conventional virus would. These programs can cause just as much damage as
regular viruses, despite the fact that they are very different: regular viruses are
low-level machine language programs, while macro viruses are actually high-level
interpreted BASIC programs! The most common type of macro virus right now infects
Microsoft Word documents.
As time goes on and virus writers get more clever, new strains and variations show up.
For example, there are some viruses, termed multipartite, that infect both boot
sectors and files. There are some things that are fairly universal, however: a
virus is a program, and it therefore can only exist in a form that allows it to be
executed as a program by the PC in some form. This means that, in general, viruses cannot
exist in data files. There are a lot of myths about viruses that infect graphics pictures
or email messages or recipe files. Just remember that a virus cannot do anything unless
you run it, so unless you have a PC that can execute pictures or email messages somehow,
it's doubtful that these can contain a virus. (Of course, you can have a virus in a
program that is attached to an email message. But here again, this is a program,
just in encoded form.)
There are also now viruses that target the BIOS program stored on the motherboard, on
systems that employ a flash BIOS.
These viruses can overwrite the system BIOS program and leave the PC in an unbootable
state. (Some motherboards have jumpers that you can set to disable BIOS flashing except
when you want to do it.)
Here is the general way that viruses work:
- An infected program is run. This is either a program file (in the case of a
file-infecting virus) or a boot sector program at boot time. In the case of a Microsoft
Word document the virus can be activated as soon as the document that contains it is
opened for reading within Microsoft Word. If the "NORMAL.DOT" document template
is infected (and this is the most common target of these viruses) then the virus may be
activated as soon as Microsoft Word is started up.
- The infected program has been modified so that instead of the proper code running, the
virus code runs instead. This is usually done by the virus modifying the first few
instructions to "jump" to where the virus code is stored. The virus code begins
- The virus code becomes active and takes control of the PC. There are two ways that a
virus will behave when it is run: direct-action viruses will immediately execute,
often seeking other programs to infect and/or exhibiting whatever other possibly malicious
behavior their author coded into them. Many file-infector viruses are direct-action. In
contrast, memory-resident viruses don't do anything immediately; they load
themselves into memory and wait for a triggering event that will cause them to
"act". Many file infectors and all boot infectors do this (boot infectors have
to become memory resident, because at the time they are executed the system is just
starting up and there isn't that much "interesting" for them to do immediately.)
- What exactly the virus does depends on what the virus is written to do. Their primary
goals however include replication and spreading, so viruses will generally search for new
targets that they can infect. For example, a boot sector virus will attempt to install
itself on hard disks or floppy disks that it finds in the system. File infectors may stay
in memory and look for programs being run that they can target for infection.
- "Malevolent" viruses that damage files or wreak havoc in other ways will often
act on triggers. There are viruses that will only activate on particular days of the year
(such as the infamous "Friday the 13th"), or act randomly, say, deleting a file
every 8th time they are run. Some viruses do nothing other than trying to maximize their
own infection to as many files and systems as possible.
As virus authors have become more "creative", they have devised increasingly
more sophisticated viruses that work in different ways. In particular, newer viruses get
smarter and smarter in avoiding detection. In most cases these viruses are not necessarily
more hazardous than older ones, but they are harder to detect and remove using anti-virus
software. Some of the tricks that authors use:
- Polymorphing: Some viruses are designed so that each time they infect, their
appearance and size changes. These thwart simplistic virus scanners that look for
predefined patterns and make detection much more difficult.
- Stealth: A stealth virus actively hides the changes it has made to the hard disk
so that it appears that it has not infected the system. For example, a file infector might
stay memory resident and misreport the size of infected files so they don't appear to be
infected. Boot sector viruses can trap attempts to read the boot sector and return forged
data that makes them appear to be "clean".
- Disassembly Protection: Many newer viruses are designed using programming tricks
that make them hard to disassemble (the process of interpreting the code into a form that
is easier to analyze so that the virus can be combated.)
- Directory Viruses: Some viruses now seek to avoid detection by avoiding modifying
the file they infect directly. Instead, they change the cluster pointer in the directory
entry of the file to point to the virus instead of the actual program. The virus runs its
code and then executes the target program afterwards. The virus is thus able to
"infect" the program without actually modifying it.
Next: Virus Hoaxes
Home - Search
- Topics - Up