virus

File VirusesViruses infecting compiler libraries, object modules and source codeare exotic enough and not widely spread. There is a total of about ten ofthem. Those infecting OBJ and LIB files merge their code into modules orlibraries in the format of an object module or library. Therefore infected filesare not executable and can not continue spreading the virus further in itscurrent state. Its the COM or EXE file, created as a result of linking theinfected OBJ/LIB file with other object modules and libraries, that carries thevirus. Therefore, the spreading of the virus goes in two stages: during thefirst one the OBJ/LIB files are infected, during the second stage thereemerges a viable virus.Infecting the source code of the programs is a logical continuation ofthe previous method of multiplication. Here the virus adds its source code tothe source code in the original target file (in this case the virus has to containit inside its body) or its own hex dump (which is technically easier to do). Theinfected file is capable of spreading the virus further only upon completion ofcompiling and linking (see for example the "SrcVir" and "Urphin" viruses).1.2 Operating Algorithm of a File VirusHaving received control, the virus does the following (here goes a listof the most common actions of the virus during its execution; for eachparticular virus this list may be added to, or items may change order andbroaden):A memory resident virus checks RAM for presence of the copy of thisvirus in it, and infects RAM if no copy has been found. Non-TSR virus looksfor uninfected files in the current and (or) the root directory, in thedirectories of the PATH, scans the directory tree of logical drives, and theninfects the found files;7