Hack Security Pro.pdf - Index of

File viruses: These viruses attack .com and .exe executable files, and more rarely .dll and .ovl files. A
programme virus attaches itself to a program file (the host) and uses various techniques to infect other
programme files. There are three basic techniques to infect an executable file: replacement, adding at
the start and adding a return.
➢ A virus based on replacement places itself at the start of the program, right at the start of the
original program code, thus damaging the program. When you try to start it, nothing happens,
however the virus infects another file. Such viruses are easily detected by users and by
technical staff, therefore they do not disseminate widely. There is very little risk a virus of this
type might find its way to your machine.
➢ A virus based on adding at the start puts its entire code at the very beginning of the original
program. When you start a program infected with this type of virus, this code is started first
and the original program is started but the size of the infected file will of course increase.
➢ A virus based on adding a return places a “return” at the start of the program code, then
places the start of the program code at the end of the file and then places itself between what
was the end of the file and the start of the file. When you try to start the program, the “return”
calls the virus, which then starts. It replaces the original start of the file in its normal position
and enables you to start the program. An increase of the size of the file is however noticeable.
We have just seen briefly how a virus attaches itself to a program file. It uses various infection
techniques. Most viruses are resident ones, meaning that they can control all actions and infect other
programs. Other file viruses infect by “direct action”, which means that they infect a program when they
have access to it.
There are many other methods, but in most cases, these place the viruses in memory. If the virus is a
resident one, it is then extremely easy for it to infect other programs, simply by waiting for these to be
started to enter them. This file is then infected (it becomes a “carrier”) and goes on to infect other
programs. Once activated, they can contaminate other executables and spread. Like executable files
in your hard drive, these viruses can be found on floppy disks, CD-ROM, attached to email, or in files
transferred while downloading. These are all possible means of infection. Unlike boot or partition
sector viruses, this type of virus is not systematically activated each time the computer is turned on.
They settle in live memory only when the user opens an infected file. However, they are disseminated
even if they are not active, as all it takes is a contaminated program to be transmitted by email or any
other medium. If the destination uses the software without submitting it beforehand to an antivirus, his
PC is then contaminated. What's more, they can infect networks.
File viruses: File viruses are thankfully very rare. This is a good thing as they are hard to eliminate.
They make use of use the mediums' management mode. They use a file which receives the physical
address of the first allocation unit of all the medium's files. When the user opens a file, the computer
looks for the corresponding address in this file. File viruses replace this address with their own one and
keep their directory updated. When a file manipulated in this way is called, the virus starts by activating
itself. It then uses its list to call the requested file and thus hide its presence.
The Hackademy DMP -43/209- SYSDREAM