Absolute PC Security and Privacy.pdf

How they infect files differs from virus to virus. In fact, there are seven different ways that
file infector viruses can infect individual files:
Parasitic Viruses Parasitic viruses are those that change the contents of the infected files, but
in a way that allows those files to remain completely or partly usable. These viruses do this by
appending themselves to the very beginning (top) or end (bottom) of a file, or inserting
themselves somewhere in the middle. In most instances, the original code is moved up or
down to make room for the virus code, with the unfortunate side effect (in some cases) of
losing any program code that doesn’t fit within the original file parameters. In the cases where
virus code is inserted into the middle of the file, the insertion is made into a “cavity”—a
currently unused area of the file. Parasitic viruses, however, typically retain a large enough
portion of the original program code to enable the program to work more or less as normal.
Overwriting Viruses An overwriting virus does just what the name implies—it overwrites
the original program code with its own code. This destroys the original code, of course, which
causes the program file to stop working properly.
Entry-Point Obscuring Viruses A particularly subtle way of infecting a file is to insert not
the virus code itself, but instead code that launches separate virus code. These viruses—called
Entry-Point Obscuring (EPO) viruses—have no distinct entry point in the host file and thus
don’t load themselves into memory when the host file is run. The instruction to run the virus
code is typically executed under specific program conditions, thus enabling the virus to
“sleep” inside a file for an extended period of time.
Companion Viruses A companion virus doesn’t alter the infected file; instead, it creates a
clone of the host file, which is then run instead of the original file. This was fairly common in
the DOS operating system, which would run a COM file instead of a similarly named EXE
file. The virus might create a clone of xcopy.exe, for example, named xcopy.com; when the
user entered the xcopy command, assuming to run the xcopy.exe file, the infected xcopy.com
file would run instead. Companion viruses can also work by renaming the target file and
assigning the original file name to the infected clone, or by altering the DOS path to find the
infected file before the original file.
Worms A worm is a special type of companion virus that is not connected to any preexisting
file. Instead, a worm copies its code to a completely new file, in the hope that the user will
accidentally execute the new file. To that end, worm files typically have semi-familiar names
that invite an action, such as install.exe or run.bat. Worms can also insert the command to run
the infected file into BAT files, or into the Windows Startup folder.
Note This type of worm, more technically called a file worm, is distinct from the category of
network worms, which use network and Internet protocols to proliferate. To learn more
about worms, turn to Chapter 6, “Trojan Horses and Worms.”
Link Viruses A link virus, like a companion virus, does not change the physical
contents of a host file. Instead, when the host file is run, the operating system is forced
to execute the virus code. The virus does this by modifying the first cluster of the host
file to point to a different cluster, which actually contains the virus code. Thus, when the
host program is launched, the virus is launched simultaneously—as if it were included
in the host file itself.