Absolute PC Security and Privacy.pdf

program files from the Internet, don’t open e-mail attachments, and don’t accept program files
from other computer users, you lower your risk of infection. If you engage in any or all of
these activities, you increase your risk.
Detecting a File Infector Virus
The easiest way to detect a file infector virus is through file size. Since these viruses insert
themselves into the code of the host file, comparing the current size of the host file against a
historical file size will alert you to any potential infection. You typically do this by comparing
the current version of the file against a version made during an earlier backup operation. If an
executable file suddenly increases in size—even by just a few bits—something had to cause
the change in file size, and that something was probably a file infector virus.
Antivirus programs also have other ways to identify file infector viruses. Some of these
programs search the source code looking for telltale text strings contained within the more
common viruses. Other programs monitor access to executable files; EXE and COM files
typically are read-only, so any writing done to any of these programs is suspicious behavior.
How to Remove a File Infector Virus
If an executable file is infected by a well-written file infector virus, it’s fairly easy to separate
the virus code from the original program code. When the virus code is extracted, the original
file is restored to a pristine state. A poorly written virus, however, can damage the host file
during infection, making it harder to restore the file to its original condition.
The procedure to remove a file infector virus is as follows:
1. Turn off your computer.
2. Boot your computer from an uninfected, write-protected, bootable floppy disk.
3. Use a floppy-based version of your antivirus program to scan and clean the files on
your hard disk.
4. Remove the floppy and reboot your machine as normal, from the hard disk.
To be safe, you can perform a second scan with the full version of your antivirus program
after you’ve rebooted from your hard disk.
How to Protect Against a File Infector Attack
You can protect against file infector viruses by not downloading or transferring executable
files to your computer—and not running any of these files you may have previously
downloaded. File infector viruses don’t activate until the host program is run, so as long as
you don’t open any infected programs, your system is relatively safe from infection.
It also helps to run a regular scan of your system with an antivirus software program. In
particular, the antivirus program should search for known file infector viruses, and compare
the size of your program files to the size of the program’s backup copies.
Summing Up