Perhaps the most sophisticated types of threats to computer systems are presented by programs that
exploit vulnerabilities in computing systems.
Malicious software can be divided into two categories: those that need a host program, and those
that are independent.
The former are essentially fragments of programs that cannot exist independently of some actual
application program, utility, or system program. Viruses, logic bombs, and backdoors are
examples. The latter are self-contained programs that can be scheduled and run by the operating
system. Worms and zombie programs are examples.
The Nature of Viruses
A virus is a piece of software that can "infect" other programs by modifying them; the
modification includes a copy of the virus program, which can then go on to infect other programs.
A virus can do anything that other programs do. The only difference is that it attaches itself to
another program and executes secretly when the host program is run. Once a virus is executing, it
can perform any function, such as erasing files and programs.
During its lifetime, a typical virus goes through the following four phases:
Dormant phase: The virus is idle. The virus will eventually be activated by some
event, such as a date, the presence of another program or file, or the capacity of the disk exceeding
some limit. Not all viruses have this stage.
Propagation phase: The virus places an identical copy of itself into other programs or
into certain system areas on the disk. Each infected program will now contain a clone of the
virus, which will itself enter a propagation phase.
Triggering phase: The virus is activated to perform the function for which it was
intended. As with the dormant phase, the triggering phase can be caused by a variety of system
events, including a count of the number of times that this copy of the virus has made copies of
itself.
Execution phase: The function is performed. The function may be harmless, such as a
message on the screen, or damaging, such as the destruction of programs and data files.
Virus Structure
A virus can be prepended or postpended to an executable program, or it can be embedded in some
other fashion. The key to its operation is that the infected program, when invoked, will first execute
the virus code and then execute the original code of the program.
An infected program begins with the virus code and works as follows.
The first line of code is a jump to the main virus program. The second line is a special marker
that is used by the virus to determine whether or not a potential victim program has already
been infected with this virus.
When the program is invoked, control is immediately transferred to the main virus program. The
virus program first seeks out uninfected executable files and infects them. Next, the virus may
perform some action, usually detrimental to the system.
This action could be performed every time the program is invoked, or it could be a logic bomb that
triggers only under certain conditions.
