New Viruses
Virus Primer
Virus Encyclopedia
Content Security
Virus Hoaxes
Glossary
 

Receive antivirus information by email:

Introduce this service to your friends (please enter your name)

(please enter your friend's email address)

Unsubscribe to  this newsletter (please enter your email address)


 

 

Virus Info Center - Virus Primer

The majority of viruses fall into five main classifications:

Boot Sector Viruses
Until the mid-1990s, boot sector viruses were the most prevalent virus type, spreading primarily in the 16-bit DOS world via floppy diskettes. Boot sector viruses infect the boot sector on a floppy disk and spread to a user's hard disk, and can also infect the master boot record (MBR) on a user's hard drive. Once the MBR or boot sector on the hard drive is infected, the virus attempts to infect the boot sector of every floppy disk that is inserted into the computer and accessed.

Boot sector viruses work by hiding on the first sector of a disk. The virus is loaded into memory before the system files are loaded. This allows it to gain complete control of DOS interrupts so that it can spread and cause damage.

These viruses often replace the original contents of the MBR or DOS boot sector with their own contents and move the sector to another area on the disk. Cleaning up a boot sector virus can be performed by booting the machine from an uninfected floppy system disk rather than from the hard drive, or by finding the original boot sector and replacing it in the correct location on the disk.

File Viruses
File infectors, also known as parasitic viruses, operate in memory and usually infect executable files with the following extensions: *.COM, *.EXE, *.DRV, *.DLL, *.BIN, *.OVL, *.SYS. They activate every time the infected file is executed by copying themselves into other executable files and can remain in memory long after the virus has activated.

Thousands of different file infecting viruses exist, but similar to boot sector viruses, the vast majority operate in a DOS 16-bit environment. Some, however, have successfully infected the Microsoft Windows, IBM OS/2, and Apple Macintosh environments.

Multipartite Viruses
Multipartite viruses have characteristics of both boot sector viruses and file infecting viruses.

Macro Viruses
Macro viruses currently account for about 80 percent of all viruses, according to the International Computer Security Association, and are the fastest spreading viruses in computer history. Unlike other virus types, macro viruses aren't specific to an operating system and spread with ease via email attachments, floppy disks, Web downloads, file transfers, and cooperative applications.

Macro viruses are, however, application-specific. They infect macro utilities that accompany such applications as Microsoft Word and Excel, which means a Word macro virus cannot infect an Excel document and vice versa. Instead, macro viruses travel between data files in the application and can eventually infect hundreds of files if left to spread.

Macro viruses are written in "every man's programming language" - Visual Basic - and are relatively easy to create. They can infect at different points during a file's use, for example, when it is opened, saved, closed, or deleted.

Script Viruses (VBScript, JavaScript, HTML)
Script viruses are written in script programming languages, such as VBScript (Visual Basic Script) and JavaScript. Viruses in these two scripts use Microsoft's Windows Scripting Host (WSH) to activate themselves and infect other files. Since WSH is available on Windows 98 and Windows 2000, the viruses can be activated simply by double-clicking an infected *.vbs or *.js file from the Windows Explorer. The "ILOVEYOU" virus is a famous example of a script virus.

HTML viruses use the scripts within HTML files to do their damage. These embedded scripts automatically come to life when the HTML page is viewed from a script-enabled browser.

Other Malicious Code
In addition to viruses, there are other forms of hostile computer code that can harm your computer. These include Trojan horses or "trojans", worms, malicious Java applets and ActiveX code. There are many "joke" programs, which do not replicate or cause any damage, but can be annoying or else contain inappropriate content.

Trojans
Trojans are not viruses because they do not replicate, but they can do just as much damage. A Trojan is a program that pretends to be something else. The term comes from the classic Greek story of the Trojan horse. (The Greeks gave a giant horse to their enemies, the Trojans, supposedly as a peace offering. After the Trojans brought the horse into their city, Greek soldiers hidden inside came out and opened the gates for their army.)

In computer terms, an example of a trojan might be a program that seems like a new game, but actually hides a program to steal your passwords and email them to another person.

Worms
Worms replicate like viruses. However, instead of spreading from file to file, they spread from computer to computer, infecting an entire system.

Worms may rely less (or not at all) upon the user's action to spread themselves. A computer worm is usually designed to copy itself from one computer to another leveraging some medium: email, TCP/IP, etc. Compared to a virus, a worm is designed to infect as many machines as possible on a network, and less concerned with spreading many copies of itself on a single computer.

Java Applets / ActiveX Controls
ActiveXÒ controls and JavaÒ appletsare basically programs that run within web browsers like Microsoft Internet Explorer®.  They add functionality to web sites and make them interactive. Though these technologies enhance the usefulness of web sites, they also increase a potential vandal’s ability to interfere with unprotected systems. Because ActiveX controls and Java applets require that certain components be downloaded to a user’s PC, activating an applet or control might actually download malicious code.

Joke Programs
These programs are the digital equivalent of the old fashioned prank.  These novelty programs are designed for humor at the expense of another user.  They neither infect other programs nor replicate, and normally do not interfere with computer systems on their own.

As with all jokes, the problem with these e-pranks is in how they are received by their victims.  Just as a joke could unexpectedly provoke a person to violence, joke programs can cause a computer user, especially a novice one, to act rashly. Like turning off the computer to stop the joke -- and in the process, losing all unsaved files in other programs.

 
  

 

| Virus | Products | Free Scan | Support | Download | Buy | Home | Corporate Users |

©Copyright 2001 Trend Micro Incorporated. All rights reserved. Terms of Use Privacy Policy