A beginners guide to viruses (Computer Viruses)

Name: crispy

Hello doyoo user, You have to be logged in to use these functions... Login or register Close window

Send message to member

Product:	Computer Viruses
Date:	23.01.02 (464 review reads)
Rating:

Advantages: N/A

Disadvantages: N/A

Computer viruses are much the same as biological viruses – they attach themselves to hosts and replicate themselves repeatedly, however the hosts take the form of diskettes or files rather than living organisms.

Some viruses attach themselves to files and execute themselves when the file is executed, others may just sit in the computer’s RAM and infect other files as the user opens, modifies or creates them. Most viruses do need to be initialised by the user, however this need only be clicking on an icon or previewing an email in an email program. Some will be completely harmless, and just do something like display a message, whereas others can potentially wipe your computer.

There are thousands of different viruses, targeting all the popular operating systems of recent years, however they may be grouped into broad categories as follows:


Boot sector viruses
===================
The Boot Sector is an area of the first track of a floppy disk or other drive that contains the boot record. Boot sector usually refers to this sector on a floppy disk, whereas Master Boot Sector refers to the corresponding section of a hard disk. A boot sector virus places its code in the boot sector, and gets read into memory when the computer boots up. Once in memory, the virus can gain control over basic computer operations, and can spread to other drives on the system.


File viruses
============
These viruses usually attach themselves to .com or .exe files, however they may also infect .drv, .bin, .sys, .ovl and .ovy file types. File viruses can be either resident or non-resident, with the most common being resident or terminate-and-stay-resident (TSR) viruses.


Worm viruses
============
Worms are parasitic computer programs that replicate but do not infect other computer program files. They can create copies on the same computer, or they can spread to other computers over a network. Worms are o
ften spread by Internet Relay Chat.


Macro viruses
=============
A macro is a series of instructions that can be recorded within an application to simplify and speed up highly repetitive tasks, and executes when a user opens the associated file. They are essentially mini-programs and can be infected by viruses, or indeed the macro itself can be programmed to be harmful. Files with macros are probably the most common files to be infected with viruses.


Companion viruses
=================
These viruses use a feature of DOS that allows software programs to share the same file name, but with different extensions, and which operate with different priorities. Most companion viruses create a .com file, which has a higher priority and will execute before its corresponding .exe file. For example, if a companion virus detects a file called start.exe, it will create a file called start.com, which will run instead of the .exe when start is executed from the command line. The virus will often then run the .exe file so that the system appears normal.


Trojans
=======
A Trojan, or Trojan Horse, is a program that performs an unexpected function when executed. This may be anything from displaying a pop-up message to deleting files or formatting a hard disk. They tend to be malicious, but do not infect other files, and as such can easily be removed by deleting the program.


Script viruses
==============
These are created using programming scripts such as Visual Basic Script (VBS), JavaScript, and HTML. VBS and JavaScript exploit Microsoft’s Windows Script Host when they activate and infect other files. These are normally activated by executing the .vbs or .js file, which often appear as a double file extension, so you may for example receive a file called image.jpg.vbs. HTML viruses, on the other hand, use scripts that are embedded in the HTML code of web pages, and are run automatically when th
e page is opened by a browser.


Virus hoaxes
============
These are not actually viruses, but are rather deliberate messages warning the recipients about non-existent virus threats. These cause trouble by clogging email servers and panicking people, however they may also lead to computer damage. An example of this is a hoax I recently received from a former colleague, warning of the sulfnbk.exe virus. This could be ‘cured’ by simply deleting the file, which my friend had done, however this file is actually a Windows system file that is used to restore long file names, and is supposed to be on the computer.

Virus hoax emails tend to display similar characteristics. They first of all warn about a new virus that has (often implausibly) serious effects on systems it infects. They often give a techno-babble explanation of how the virus works, and provide comments from Microsoft, or CNN, or someone in authority about the danger of the virus. This is often about how it is undetected by virus scanners. Finally, the message advises recipients to send it on to everyone they know. If in doubt, check on a website before you forward it on to everyone you know! The page I use is http://www.icsalabs.com/html/communities/antivirus /hoaxes.shtml.


How to avoid viruses
====================
As with avoiding hackers (could be a whole new op!), the best way of avoiding virus infection is to never expose your computer to any media from the outside world, however this is almost completely impractical in today’s computer society.

The most important thing to do is to install a decent virus scanner. I use InoculateIT from Computer Associates, but I don’t think you can get the software anymore, just updates. Ask me nicely and I might consider emailing it to people! Over 500 new viruses are identified each month, so it is important that anti-virus software is also updated regularly. It is also a good idea to ch
eck regularly for operating system patches and updates that may rectify potential security issues.

Otherwise, exercising common sense is the best protection. You should not open email file attachments unless you know what the file is, even if it is sent from a friend, as viruses often replicate by sending themselves to a users email contacts. Attachments and downloads should always be scanned with a virus-scanner before opening – most anti-virus software packages offer real-time protection that should do this automatically. Junk emails and chain emails should be deleted, and not forwarded or replied to, and any email warning of a virus should be checked out before being sent on. In case of disaster, you should regularly back up your important files so that they can be replaced if necessary. These backups should be stored in a separate location to the originals, preferably not on the same computer.

When in doubt, you should always stay on the side of caution when dealing with file attachments or downloads, and should not execute suspicious files without checking them thoroughly first.


What to do if you get a virus
=============================
Unfortunately, sometimes even the best protection can fail, and you may end up getting a virus. Don’t panic! If your virus checker has picked it up, it should be able to sort it out. If not, update you virus scanner’s virus database and try again. Otherwise, assuming you know the name of the virus, search for it on the Internet – you should be able to find instructions on removing it. If all else fails, you made those backups for a reason, right?

Hope it’s something you never need to worry about…

Summary: