programming-for-dummies

634
Stopping Malware
With so much money at stake, it’s no surprise that one of the hottest fields of
computer science is now computer security. Computer security is more than
just locking doors and guarding computer rooms. Today, computer security
is stopping threats, repairing damage, and hunting the criminals by using
nothing more than programming skills.
Stopping Malware
One of the earliest and most prominent threats to computers is malicious
software, often called malware. Malware is any program designed specifically
to damage another computer, such as by erasing all its files. What makes malware
particularly dangerous is that it’s so common and capable of spreading
without the intervention of the original programmer. The four common types
of malware include
✦ Viruses
✦ Worms
✦ Trojan horses
✦ Spyware
Viruses
Computer viruses are nothing more than programs that attach themselves
onto another file, such as a program or a word processor document. The
virus spreads when you copy an infected file to another computer.
When a computer virus infects a file, it sometimes damages that file. What’s
worse is that most viruses also carry a payload. This payload can range from
the harmless (such as displaying a humorous message on the screen) to the
malicious (such as erasing every file stored on a hard disk). The most effective
way to stop viruses is to capture one and dissect it to see how it works.
To dissect a virus (or any program), you need to use a disassembler, which
essentially converts, or reverse engineers, a program into assembly language
source code. By studying the assembly language code of a virus, you can
understand how it works and, more importantly, how to identify the virus,
essentially capturing that virus’s digital fingerprint.
Capturing the digital fingerprint of a virus is crucial because that’s how most
antivirus programs work. Antivirus programs scan all the files on a hard disk
for known signs of specific viruses. Because new variations of viruses appear
every day, the database of an antivirus program must be updated constantly.