by Bob Lloyd

Created on: January 06, 2010

Almost the first thing you do with a new computer is to install antivirus protection software, such is the severity of the threat the moment you connect a machine to the internet.  The time to infection of an unprotected machine connected to the internet is measured in seconds.

A virus is simply a piece of unauthorised computer code which gets to run on your machine without your knowledge and the consequences vary from completely benign through to catastrophic.  Whenever you turn on your computer you are running hundreds of pieces of code, some of them applications such as a word-processor, and others as background processes that you don't see, but which perform vital functions.  Wherever it is possible for code to run, there is a target for the virus writer.

The overwhelming priority for virus writers is to get the code to run, but the close second is to keep it invisible both to the user, and also to antivirus software.  Users will not launch virus code willingly and so either the operating system itself must launch it, or the user must launch it without realising.  The different mechanism for launching code provide a convenient way for classifying the types of viruses we see in the wild.

Launching mechanisms
If virus code can be attached to an existing program, then anyone running that program will run the virus code as well.  That was a very common mechanism for early viruses which infected executable programs such as .exe, .com, and .bin files on Windows.  But by adding extra code, the size and the signature of the file itself is changed, which leads to easy detection.

If a system file can be replaced by one identical except that it contains virus code, then the system itself will run the code, and this provides a safer mechanism.  If the system itself accepts the file containing the virus code, it is less likely to detect it as infected.  However, this also suffers from the same problem that the signature is changed and can lead to detection.  Some virus are well-disguised to appear just like native system files.

Sometimes users download executable code without realising it.  For example, animations and controls on webpages can install components on the computer which then run additional code.  ActiveX controls, and Java components provide an additional target for the virus writers.  If the user can be persuaded to install a component which contains virus code, they will infect their own machine

• 1
• 2
• 3
• Next Page >>