Computer Virus is a kind of malicious software written intentionally to enter a computer without the user’s permission or knowledge, with an ability to replicate itself, thus continuing to spread. Some viruses do little but replicate others can cause severe harm or adversely effect program and performance of the system. A virus should never be assumed harmless and left on a system. Most common types of viruses are mentioned below:

Resident Viruses:

This type of virus is a permanent which dwells in the RAM memory. From there it can overcome and interrupt all of the operations executed by the system: corrupting files and programs that are opened, closed, copied, renamed etc.

Examples include: Randex, CMJ, Meve, and MrKlunky.

Direct Action Viruses:

The main purpose of this virus is to replicate and take action when it is executed. When a specific condition is met, the virus will go into action and infect files in the directory or folder that it is in and in directories that are specified in the AUTOEXEC.BAT file PATH. This batch file is always located in the root directory of the hard disk and carries out certain operations when the computer is booted.

Overwrite Viruses:

Virus of this kind is characterized by the fact that it deletes the information contained in the files that it infects, rendering them partially or totally useless once they have been infected.

The only way to clean a file infected by an overwrite virus is to delete the file completely, thus losing the original content.

Examples of this virus include: Way, Trj.Reboot, Trivial.88.D.

Boot Virus:

This type of virus affects the boot sector of a floppy or hard disk. This is a crucial part of a disk, in which information on the disk itself is stored together with a program that makes it possible to boot (start) the computer from the disk.

The best way of avoiding boot viruses is to ensure that floppy disks are write-protected and never start your computer with an unknown floppy disk in the disk drive.

Examples of boot viruses include: Polyboot.B, AntiEXE.

Macro Virus:

Macro viruses infect files that are created using certain applications or programs that contain macros. These mini-programs make it possible to automate series of operations so that they are performed as a single action, thereby saving the user from having to carry them out one by one.

Examples of macro viruses: Relax, Melissa.A, Bablas, O97M/Y2K.

Directory Virus:

Directory viruses change the paths that indicate the location of a file. By executing a program (file with the extension .EXE or .COM) which has been infected by a virus, you are unknowingly running the virus program, while the original file and program have been previously moved by the virus.

Once infected it becomes impossible to locate the original files.

Polymorphic Virus:

Polymorphic viruses encrypt or encode themselves in a different way (using different algorithms and encryption keys) every time they infect a system.

This makes it impossible for anti-viruses to find them using string or signature searches (because they are different in each encryption) and also enables them to create a large number of copies of themselves.

Examples include: Elkern, Marburg, Satan Bug, and Tuareg.

File Infectors:

This type of virus infects programs or executable files (files with an .EXE or .COM extension). When one of these programs is run, directly or indirectly, the virus is activated, producing the damaging effects it is programmed to carry out. The majority of existing viruses belong to this category, and can be classified depending on the actions that they carry out.

Companion Viruses:

Companion viruses can be considered file infector viruses like resident or direct action types. They are known as companion viruses because once they get into the system they "accompany" the other files that already exist. In other words, in order to carry out their infection routines, companion viruses can wait in memory until a program is run (resident viruses) or act immediately by making copies of themselves (direct action viruses).

Some examples include: Stator, Asimov.1539, and Terrax.1069

FAT Virus:

The file allocation table or FAT is the part of a disk used to connect information and is a vital part of the normal functioning of the computer.
This type of virus attack can be especially dangerous, by preventing access to certain sections of the disk where important files are stored. Damage caused can result in information losses from individual files or even entire directories.

Worms:

A worm is a program very similar to a virus; it has the ability to self-replicate, and can lead to negative effects on your system and most importantly they are detected and eliminated by antiviruses.

Examples of worms include: PSWBugbear.B, Lovgate.F, Trile.C, Sobig.D, Mapson.

Trojans or Trojan Horses:

Another unsavory breed of malicious code are Trojans or Trojan horses, which unlike viruses do not reproduce by infecting other files, nor do they self-replicate like worms.

Logic Bombs:

They are not considered viruses because they do not replicate. They are not even programs in their own right but rather camouflaged segments of other programs.

Their objective is to destroy data on the computer once certain conditions have been met. Logic bombs go undetected until launched, and the results can be destructive.

In a computer program, a logic bomb, also called slag code, is programming code, inserted surreptitiously or intentionally, that is designed to execute (or "explode") under circumstances such as the lapse of a certain amount of time or the failure of a a program user to respond to a program command. It is in effect a delayed-action computer virus or Trojan horse. A logic bomb, when "exploded," may be designed to display or print a spurious message, delete or corrupt data, or have other undesirable effects.
Some logic bombs can be detected and eliminated before they execute through a periodic scan of all computer files, including compressed files, with an up-to-date anti-virus program. For best results, the auto-protect and e-mail screening functions of the anti-virus program should be activated by the computer user whenever the machine is online. In a network, each computer should be individually protected, in addition to whatever protection is provided by the network adminstrator. Unfortunately, even this precaution does not guarantee 100-percent system immunity.

Computer Worm Examples

Protect yourself against Computer Worms

Computer worms which spread like Trojan Horse can best be defended against by avoiding opening of attachments in your e-mail. These infected attachments are not limited to .EXE files. Microsoft Word and Excel files can contain macros which spread infection

It seems as if you can never have enough security for your computer these days.  Online scams are on the rise as attackers have found ways to manipulate email traffic, online transactions and even DNS servers.  One wrong move on the net, and your computer can be easily compromised or worst, your identity stolen.

The threat of viruses remains to be one of the biggest problems facing internet users.  These nasty infections find you via email, compromised site or perhaps from a file that appeared to be a legitimate program. Just like it's human counterpart, a computer virus has the ability to spread it's infection throughout the victim's system and distribute itself from host to host.  Without proper security, you are open to an array of attack, welcoming virtual annihilation and the physical destruction of your computer.

While a virus falls under the category of malware, which is described as piece of software attached with a malicious code, it is a classification of its own with many different variations.  One of the most common types of viruses are known as file infectors, parenting another class of it's own, many of which are categorized as directory viruses.

Attacking your Directory

As the name indicates, a directory virus functions by infecting the directory of your computer.  A directory is simply a larger file that contains information about other files and sub-directories within it.  The general information consists of the file or directory name, the starting cluster, attributes, date and time and so forth.  When a file is accessed, it scans the directory entry in search of the corresponding directory.  There it is able to locate the starting cluster which is an index to the FAT (File Allocation Table).  The FAT contains the addresses for all subsequent clusters until the last cluster is indicated by a marker like this: 0xFFF (16-bit FAT). 
A directory virus inserts a malicious code into a cluster and marks it as allocated in the FAT.  This prevents it from being allocated in the future.  The virus then saves the first cluster and forces it to target other clusters, indicating each file it wants to infect.  The malicious code typically contains an extension such as COM. (command) or EXE. (execute) which executes the virus.  

Changing Your Directory Paths

An operating systems finds files by searching for directories and files on the hard drive that form paths.  A directory virus will modify the paths that indicate location, manipulating them to execute and infect clean files, spreading itself throughout the system.  In most cases you can successfully run the file you request while simultaneously launching the infectious program with no knowledge of the activity.  After the virus has run it's course, the original files may be impossible to locate deeming many of your programs useless.  When this occurs, you generally have two options: restore the files from a backup, which may prove pointless on a compromised machine, or install an anti-virus program to relocate the misplaced files, detect the infected ones and keep other viruses out your system.

Anyone using a computer should be aware of the many dangers that come with such use. While many computer users are fully aware of viruses they are less knowledgeable about Trojans.  Find out more about why Trojans are such a danger to computer users everywhere.

Trojan Horses

Trojan horses get their name from Greek mythology. This was a wooden horse which was used by Greek soldiers to enter the city of Troy. The modern Trojan horse is a computer program which sneaks onto your computer. These applications are often included with other useful programs which you might download or the user will be tricked into downloading the Trojans by mistake.

How Trojans Work

Once a Trojan is opened it will create a secret backdoor into your computer. This allows hackers to easily access your computer. It also gives the hackers a great way to put additional viruses or software onto your computer. Many Trojans also include keyloggers so that they can find out what you've been typing. This may not seem like a huge issue at first. However, they will be able to use this to discover your credit card numbers and other private information.
Some Trojans can even turn your webcam on so that the hackers can get a good look at your face. Trojan horses are very scary pieces of software but how do these applications get onto your computer in the first place?

Method Of Infection

Most computers get infected with spyware because the user downloads something from the internet. They are either bundled with useful applications or users are tricked into downloading them. Trojans are most likely to be installed alongside freeware applications which is why it's so important to be careful whenever installing anything.

Protecting Your Computer

To protect your computer from Trojans you need to get yourself a high quality virus scanner. You should also make sure you install a firewall as this will prevent hackers from accessing your computer in the first place.
Also use your common sense and make sure you're very careful whenever you're downloading anything from the internet. Never download anything unless you trust it, and make sure that it's from a trusted source. Also avoid downloading anything illegally as these often include some nasty extras

 

The FAT, short for File Allocation Table, is a mechanism employed by Microsoft and used in most Windows operating systems.  It's job is to keep track of all the contents on a disk.  The FAT is basically a chart which contains numbers that correspond to cluster addresses on a hard drive.

FAT12, the oldest version of the File Allocation Table, uses a 12-bit binary system.  This type of system is no longer used to format a hard drive as the maximum volume size was quite limited.  If a computer running Windows 95 or higher displays the File Allocation Table as FAT12, it is likely that the hard drive is terribly corrupted and may be infected with a virus. 
A FAT virus can be rather dangerous as it infects a vital part of the computer's operational process.  It has the ability to prevent access tocertain sections on the hard drive where important files are located.  As the virus spreads it's infection, these files or even entire directories can be overwritten and permanently lost. 

The Link Virus

Computer viruses are generally classified in accordance to what they infect, and the way they spread infection.  A common threat to the File Allocation Table is the link virus.  Instead of inserting a malicious code directly into infected files, it distributes itself by manipulating the method in which files are accessed by the FAT file system.  Once an infected file is executed, a link virus typically slithers into resident memory and writes a hidden file to the disk.  Subsequently, it alters the FAT in a way that cross-links other files to a sector of the disk that contains the viral code.  As a result, the operating system jumps to the original code and launches it whenever an infected file is run, granting complete control to the virus.

How Linking Works

The technique of cross-linking can be detected when a CHKDSK program is run, though a FAT virus could employ a stealth mode to conceal changes when it resides in the memory. 
Some of these viruses do not rely on executable files to infect the FAT.  Instead they copy themselves to a wide range of folders and wait to be launched by the user.  Many virus writers give their infections names such WINSTART.BAT or INSTALL.EXE to persuade a user into launching a file that contains the malicious code. 
An FAT virus will not modify host files.  It can, however, force the operating system to execute the viral code altering specific fields in the FAT file system, which can be just as damaging.   
Link viruses and other infections that attack the File Allocation Table of a computer are complex and often difficult to identify.  Most of the time, a user will have no knowledge of its presence as the virus gradually corrupts the computer. 
If you happen to experience performance issues that indicate an FAT virus, you can refer to the map of your hard drive to learn what files should actually be in the system.  If viruses are identified, you can simply place them in the recycle bin yourself.   

It's amazing yet unsettling to know that a computer virus can infect the files on your system without altering a single byte.  In fact, this is done quite frequently in a number of different ways.  The most common method is employed by the companion virus, also known as the spawning virus or the cluster virus.  Instead of modifying the existing files in your system like most viruses, it creates new ones and sends them off to spread the malicious code

The companion virus works by seeking all files with extensions ending in EXE.  It then creates a matching file that ends in the COM. extension, which is specifically reserved for the malicious code.  Though it is possible for EXE. and COM. files to have similar names, the instance is very rare.  In most cases, this is merely an indication of this deceptive infection. When this does occur, the companion virus typically will not the modify the existing COM. file.

How the Companion Virus Works

Here is an example of how this infection operates: The companion virus is downloaded on your computer and unknowingly executed.  When the time comes to spread the infection, it searches the system and finds a file labeled MGM.EXE.  From there it creates a matching file that contains the virus and labels it MGM.EXE.  This file is typically placed in a directory with the EXE. file though it can also be inserted into any directory along a number of different paths.  When you access the MGM.EXE  file, the operating system executes the MGM.COM file instead.  The virus is then executed and proceeds to infect other files on the system. 
The companion virus is very sophisticated and may take several steps towards hiding it's presence.  At times, the infection attempts to conceal the extra files by storing them in a different directory, applying hidden attributes that are invisible to normal commands.  It can effectively conceal these files when active in system memory while distributing itself to other areas of the computer to spread the infection. 

Finding the Virus

While the companion virus is somewhat of a nuisance, it's easily detected because of the presence of the additional COM. files.  Your computer should have a map of the hard drive that enables you to ensure the integrity of these files.  By analyzing it you will be able to determine what should actually be on the hard drive.  From there you can locate the virus and safely remove it yourself. 
If analyzing the map of your hard drive sounds like too much trouble, you can elude the hassle by installing a reliable anti-virus program on your computer.  The scanner will thoroughly comb the files and directories of your system in search of companion viruses and many other security threats.  Keep in mind that an integrity checking program that only seeks out modifications in existing files and will not be able to detect such a complex virus.
Similar to most computer infections, the best defense against a companion virus is prevention.  You can protect yourself by remaining cautious of the sites you visit on the internet and never downloading the attachment of an unsolicited email.