Absolute PC Security and Privacy.pdf

Common File Infector Viruses
File infectors are among the most common forms of computer viruses. Any time you receive
an executable file (EXE, COM, etc.) from another user (or from the Internet), it’s possible that
that file carries a file infector virus.
Because of this, there are a large number of potentially destructive file infector viruses
circulating in the wild. The most common of these viruses are listed here.
CASPER CASPER is an encrypting file infector virus from the early 1990s. It infects COM
files, including command.com. On April 1, when an infected file is executed, CASPER
overwrites the first track of the drive where the infected file is stored. When the drive is
subsequently accessed, Sector not found errors occur.
Chernobyl This virus, also known as W95/CIH, is named after the nuclear plant accident of
the same name—and is programmed to trigger on the same day of the month as the Chernobyl
accident. On the 26th of each month, the Chernobyl virus attempts to overwrite the host
computer’s flash BIOS, which will then prevent the computer from booting. At the same time,
the virus overwrites the entire hard disk with garbage files. (Some variations of this virus
trigger only once a year, on April 26—the anniversary of the Chernobyl nuclear accident.)
The Chernobyl virus was extremely destructive in late 1998 and on into 1999, but has since
been fairly effectively defended against by all major antivirus programs.
CRUNCHER CRUNCHER infects COM files—although not command.com. It compresses
the files that it infects; as a result, all infected files are decreased in size.
Die-Hard 2 This virus, alias DH2, is a symbiotic, memory-resident file infector. It’s very
stealthy and infects both COM and EXE files. Infected files increase in size by 4000 bytes,
while system memory decreases by 4000 bytes.
Fun Love The Fun Love virus infects all EXE, SCR, and OCX files in both Windows 9x and
Windows NT. It searches for shared network folders with write access and then infects the
files within; it can also infect files in the Program folder (and subfolders) on the host machine.
One unique feature of this virus is that it infected several file downloads (called Hotfixes) on
Microsoft’s technical support Web site; users downloading these Hotfixes found their systems
infected. (Fortunately, this particular problem has since been caught and dealt with.)
Jerusalem Jerusalem is a notorious virus from the late 1980s, still active today, whose bark
was worse than its bite. There have been many variants of this virus over the years, under
many pseudonyms. The virus infects COM, EXE, SYS, BIN, PIF, and OVL files—and can
reinfect the same file multiple times. A half hour after the first infection, the infected system
will slow down by a factor of ten. It typically executes on a Friday the 13th, and then deletes
any program you try to run.
Junkie Junkie (also known as Junkie-Boot) is a multipartite virus, which infects COM and
EXE files, corrupts COM files, and infects the boot sector on floppy disks and the MBR on
hard disks.