WHAT IS  COMPUTER  VIRUS

 Let  us  start with what is a computer  virus , a computer virus is nothing  but  a small program written by  someone  to corrupt or damage the information stored in the computer system, and  to replicate itself from one computer system to another.

The term virus is used  for  this  type  of  program as the biological virus spread  disease from one  person  to another, these virus programs  also spread  from  one  computer to another.

 These viruses spread when  someone copies a virus infected program from one  computer and runs it on some  other computer. This  infects  the  new  computer system. Again, when  someone copies from  this  newly infected  system, the  virus will again spread and the   spreading of the  virus  continues.

 

A virus  cannot  spread  by using  any  data file such as text file, image  file, sound file etc.

A virus  needs  some  kind of  executable  program such as, .EXE, .COM, .SYS, Window macro etc. to become  active, infect a system and to spread.

Base  on its working principle and  the spreading method used, a virus can be divided into different types.

types of  computer  virus

worm

             worms were  one of the first computer viruses. A program written as worm virus normally do not do any destructive  work, a worm’s main work is to  replicate itself, i.e. to keep  on copying itself to new system, or in the network copying to new system , and keep spreading.

The original  worm programs were made as experiment programs in computer labs to test if  a program can be made to replicate itself.

Most of current viruses contain a worm program in them to manage the replication part of the virus.

To spread, these worms stay resident in the computer’s memory and keep a watch on disk access activates. Whenever a new disk is put in the drive and a disk access command such as dir is given, these programs immediately copy themselves to  some. Exe, .com etc. executable program on the new disk.

Later when this infected disk is taken on some other machine and infected program is executed, the  virus becomes active in the new computer’s memory, again waiting for some disk to copy itself.

These virus  also spread by  copying themselves to the boot sector of the floppy, after this when the infected floppy is used  to book on some machine these virus become active.

If the  machine,  where the virus becomes active contains a hard disk drive, then the virus also copies itself to the hard disk drive be writing itself to the MBR (master book record), DBR(dos book record) or  the executable programs on the  hard disk drive.

Trojan

 

              Trojan is a name given to those programs that appear as some useful utility, but they contain some hidden destructive parts. A virus that has infected  a useful .COM  or .EXE program makes that executable program a Trojan because the moment someone executes them, the virus will become active and starts doing its job.

For example, your word processing program WS.exe may become infected by some virus and when  you  are doing some typing work in the WS, the virus active in memory, may be destroying some data on your hard disk drive.

Therefore , hiding some destructive program in a legitimate appearing program is  called Trojan program. A pure Trojan virus does not replicate itself, but currently is called Trojan program. A pure Trojan virus does not replicate itself, but currently most of the virus contain a Trojan, as well as worm, so a useful looking itself, but currently most of the virus contain a Trojan as, well  as  worm, so a useful looking program can destroy the data as well as can replicate itself.

Bomb

             Another type of virus programs is known as bombs. These are programs that waits for some specific event to occur and when that particular event occurs the bomb becomes  active destroying or corrupting the information inside the computer.

The event  could  be anything by the programmer writing this type of programs. it could be a particular date, a particular day coming on some specific date such as Friday coming on 13th, it could be some event  such  as after virus had made 10 copies of itself it may format the hard disk drive, some programmer may write  a bomb program to delete the complete FAT table, if his name is removed from the payroll file.

A virus may contain bomb,  worm and the Trojan horse all the three parts, to effectively replicate and destroy data.

MBR (partition table) infector

             Other than their working method, a virus can also be classified based on the area infected by a virus. A MBR or  partition table infector viruses infects the master book record(MBR) of the hard disk drive, (floppy disk does not contain any MBR).

These viruses become active every time the machine is booted from the hard disk drive, because during booting, first thing the BIOS does is to execute the program located in the MBR.

Removing  a MBR virus is very, easy as one needs to just overwrite the infected MBR code with a good MBR code, taking care that partition table information is not overwritten and become corrupted.