How does a Computer Virus Work
There are millions of viruses present these days, and new viruses
originating every day. It is awfully tricky to provide you with a
standard explanation of how viruses function, because they all have
differences in the manner they infect or the method they spread. Hence,
in this article, I have explained it bearing in mind few broad groups
that are usually used to illustrate different types of viruses.
File Viruses or Parasitic Viruses
File viruses are pieces of code that attach themselves to executable
files, driver files or compressed files, and they are triggered when the
host program is executed. Once the file virus or parasitic virus is
activated, it may spread by attaching to new programs in the system, and
also perform out the wicked actions it was programmed for. A large
number of file/parasitic viruses spread by loading themselves in the
system memory, and they start searching for additional programs located
on the drive. If it locates one, it transforms the program’s code so
that it encloses the virus code. Then it activates the virus’s code next
time it runs. It keeps doing this yet again until it crawls all over
the system, and probably to additional systems that share the infected
program.
Besides spreading themselves, these viruses also hold various types
of destructive elements that can be activated instantly or by a specific
‘trigger’. The triggers could possibly be specific dates, or the number
of times the virus has been replicated, or anything equally small.
Examples of file/parasitic viruses are Randex, Meve and MrKlunky.
Boot Sector Viruses
A
boot sector
virus infects the boot sector of a hard drive, which is a very critical
component for the booting process. The boot sector is where all the
information concerning the drive is stored, along with a program that
makes it possible for the operating system to boot up. By introducing
the virus code into the boot sector, the virus ensures that it loads
into the system memory at each boot cycle.
A boot virus does not infect files; instead, it infects the drive on
which they are saved. Possibly this is the reason for their collapse. In
earlier days, when the programs were carried around in floppy disks,
the virus used to spread like a wild fire. However, with the upcoming of
CD drives and CD ROMs, it became impossible for the boot sector virus
to infect pre-written information on a CD, which in due course stopped
such viruses from spreading and infecting.
Although the boot sector viruses still survive in the computer world,
they are very rare compared to the new era’s malicious software. An
additional cause why boot sector viruses are not so common is that the
new age operating systems guard the boot sector, which makes it hard for
the virus to infect it.
Examples of boot sector viruses are Polyboot.B and AntiEXE.
Multipartite Viruses
Multipartite viruses are a mixture of boot sector viruses and file
viruses. These viruses enter the system through infected media and dwell
in the system memory. They then travel onto the boot sector of the hard
drive. From there, the multipartite virus infects the executable files
on the hard drive and spreads throughout the system.
There aren’t many multipartite viruses present these days, but in
their era, they were responsible for a number of vital troubles due to
their ability to combine different infection practices.
A significant example of a multipartite virus is Ywinz.
Macro Viruses
Macro viruses infect files that are formed using certain applications
or programs that include macros. Such applications comprises of
Microsoft Office documents such as Word documents, Excel spreadsheets,
PowerPoint presentations, Access databases and other related application
files such as Corel Draw, AmiPro, etc.
As macro viruses are programmed in the language of the application
and not in that of the operating system, they are recognized to be
platform-independent, i.e. they can spread across operating systems such
as Windows, Macintosh or any other systems, as long as they are running
the necessary application. With the ever rising abilities of macro
languages in applications, and the risk of hazardous infection spreading
over the networks, this macro virus has become a critical threat.
The earliest macro virus was programmed for Microsoft Word and was
exposed back in August 1995. At present, there are thousands of macro
viruses in existence.
Examples of macro viruses are Relax, Melissa.A and Bablas.
Network Viruses
A network virus is very much skilled in rapidly spreading across a
Local Area Network (LAN) or even over the internet. Generally, it
circulates through shared resources, such as shared drives and folders.
When it infects a fresh system, it hunts for possible victims by
scanning the network for other defenseless systems. When a defenseless
system is found, the network virus infects the additional systems and
thus spreads over the network.
Examples of some most dangerous viruses are Nimda and SQLStammer.
E-Mail Viruses
An e-mail virus can probably be a type of a macro virus that spreads
itself to all the contacts located in the host’s e-mail address book. If
any of the e-mail recipients open the attachment of the infected mail,
it spreads to the new host’s address book contacts, and then proceeds to
send itself to all those contacts as well. Nowadays, e-mail viruses can
infect hosts even if the infected e-mail is previewed in a mail client.
One of the most widespread and destructive e-mail viruses is the
ILOVEYOU virus.
There are many methods by which a virus can infect or stay inactive
on your computer. However, whether active or inactive, it’s dangerous to
let one free on your system, and should be dealt with instantaneously.
