Monday, November 26, 2012
The Structure of a Virus
The Structure of a Virus
Every viable computer virus must have at least two basic parts,or subroutines, if it is even to be called a virus. Firstly, it mustcontain a search routine, which locates new files or new diskswhich are worthwhile targets for infection. This routine will determinehow well the virus reproduces, e.g., whether it does so quicklyor slowly, whether it can infect multiple disks or a single disk, andwhether it can infect every portion of a disk or just certain specificareas. As with all programs, there is a size versus functionalitytradeoff here. The more sophisticated the search routine is, the morespace it will take up. So although an efficient search routine mayhelp a virus to spread faster, it will make the virus bigger.
Secondly, every computer virus must contain a routine to copyitself into the program which the search routine locates. The copyroutine will only be sophisticated enough to do its job withoutgetting caught. The smaller it is, the better. How small it can be willdepend on how complex a virus it must copy, and what the targetis. For example, a virus which infects only COM files can get bywith a much smaller copy routine than a virus which infects EXEfiles. This is because the EXE file structure is much more complex,so the virus must do more to attach itself to an EXE file.In addition to search and copy mechanisms, computer viruses
often contain anti-detection routines, or anti-anti-virus routines.Computer Virus Basics 15
These range in complexity from something that merely keeps thedate on a file the same when a virus infects it, to complex routinesthat camouflage viruses and trick specific anti-virus programs into
believing they’re not there, or routines which turn the anti-virusthey attack into a logic bomb itself.
Both the search and copy mechanisms can be designed withanti-detection in mind, as well. For example, the search routine maybe severely limited in scope to avoid detection. A routine which
checked every file on every disk drive, without limit, would take along time and it would cause enough unusual disk activity that analert user would become suspicious.Finally, a virus may contain routines unrelated to its ability toreproduce effectively. These may be destructive routines aimed atwiping out data, or mischievous routines aimed at spreading apolitical message or making people angry, or even routines thatperform some useful function.
What is a computer virus?
What is a computer virus?
Simply put, it is a program that
reproduces. When it is executed, it simply makes one or more
copies of itself. Those copies may later be executed to create still
more copies, ad infinitum.
Typically, a computer virus attaches itself to another program,
or rides on the back of another program, in order to facilitate
reproduction. This approach sets computer viruses apart from other
self-reproducing software because it enables the virus to reproduce
without the operator’s consent. Compare this with a simple program
called “1.COM”. When run, it might create “2.COM” and
“3.COM”, etc., which would be exact copies of itself. Now, the
average computer user might run such a program once or twice at
your request, but then he’ll probably delete it and that will be the
end of it. It won’t get very far. Not so, the computer virus, because
it attaches itself to otherwise useful programs. The computer user
will execute these programs in the normal course of using the
computer, and the virus will get executed with them. In this way,
viruses have gained viability on a world-wide scale.
reproduces. When it is executed, it simply makes one or more
copies of itself. Those copies may later be executed to create still
more copies, ad infinitum.
Typically, a computer virus attaches itself to another program,
or rides on the back of another program, in order to facilitate
reproduction. This approach sets computer viruses apart from other
self-reproducing software because it enables the virus to reproduce
without the operator’s consent. Compare this with a simple program
called “1.COM”. When run, it might create “2.COM” and
“3.COM”, etc., which would be exact copies of itself. Now, the
average computer user might run such a program once or twice at
your request, but then he’ll probably delete it and that will be the
end of it. It won’t get very far. Not so, the computer virus, because
it attaches itself to otherwise useful programs. The computer user
will execute these programs in the normal course of using the
computer, and the virus will get executed with them. In this way,
viruses have gained viability on a world-wide scale.
Actually, the term computer virus is a misnomer. It was coined
by Fred Cohen in his 1985 graduate thesis,1 which discussed
self-reproducing software and its ability to compromise so-called
secure systems. Really, “virus” is an emotionally charged epithet.
The very word bodes evil and suggests something bad. Even Fred
Cohen has repented of having coined the term,2 and he now
suggests that we call these programs “living programs” instead.
Personally I prefer the more scientific term self-reproducing
automaton.3 That simply describes what such a program does
without adding the negative emotions associated with “virus” yet
also without suggesting life where there is a big question whether
we should call something truly alive. However, I know that trying
to re-educate people who have developed a bad habit is almost
impossible, so I’m not going to try to eliminate or replace the term
“virus”, bad though it may be.
In fact, a computer virus is much more like a simple one-celled
living organism than it is like a biological virus. Although it may
attach itself to other programs, those programs are not alive in any
sense. Furthermore, the living organism is not inherently bad,
though it does seem to have a measure of self-will. Just as lichens
may dig into a rock and eat it up over time, computer viruses can
certainly dig into your computer and do things you don’t want.
Some of the more destructive ones will wipe out everything stored
on your hard disk, while any of them will at least use a few CPU
cycles here and there.
Aside from the aspect of self-will, though, we should realize
that computer viruses per se are not inherently destructive. They
may take a few CPU cycles, however since a virus that gets noticed
tends to get wiped out, the only successful viruses must take only
an unnoticeable fraction of your system’s resources. Viruses that
have given the computer virus a name for being destructive generally
contain logic bombs which trigger at a certain date and then
display a message or do something annoying or nasty. Such logic
bombs, however, have nothing to do with viral self-reproduction.
They are payloads—add ons—to the self-reproducing code.
When I say that computer viruses are not inherently destructive,
of course, I do not mean that you don’t have to watch out for
them. There are some virus writers out there who have no other
goal but to destroy the data on your computer. As far as they are
concerned, they want their viruses to be memorable experiences for
you. They’re nihilists, and you’d do well to try to steer clear from
the destruction they’re trying to cause. So by all means do watch
out . . . but at the same time, consider the positive possibilities of
what self-reproducing code might be able to do that ordinary
programs may not. After all, a virus could just as well have some
good routines in it as bad ones.
link
http://downloads.ziddu.com/downloadfile/20588911/The.Giant.Black.Book.of.Computer.Viruses-FL.rar.html
http://downloads.ziddu.com/downloadfile/9927040/Visual-Basic-6-black-book.rar.html
http://downloads.ziddu.com/downloadfile/9927040/Visual-Basic-6-black-book.rar.html
Subscribe to:
Posts (Atom)