Internet Security

Common Computer Virus Basics 104-2

Encryption

Among the most difficult to detect, encrypted viruses use a brief encryption loop at the start of the program to make the rest of the program unintelligible. This means that scanners relying on signature files have only a few bytes to look for. The encryption key also changes each time a polymorphic virus replicates.

Executable Code

This represents instructions which are 'executable' by the computer. This includes COM, EXE, DLL and similar files. In a broader sense, executable code includes the code found in disk boot sectors, batch files and even macros used by some applications.

False Positive

A false positive occurs when a scanner identifies a file as infected when in fact it is not.

File Stealth Virus

In addition to redirection for the boot information, these viruses attack .COM and .EXE files when opened or copied and hides the file size changes from the DIR command. The major problem arises when an attempt is made to use CHKDSK/F and there appears to be a difference in the reported files size and the apparent size. CHKDSK assumes this is the result of some cross-linked files and attempts to repair the damage. The result is the destruction of the files involved. The FRODO or 4096 virus is famous for this kind of damage. View also Stealth Virus, and Full Stealth Virus.

Full Stealth Virus

In this case, ALL normal calls to file locations are cached while the virus subtracts its own length so that it appears clean. View also Stealth Virus, and File Stealth Virus.

Heuristics

A rule-based method of identifying or spyware scanning for new viruses. This method of scanning does not rely on specific virus signatures. The advantage of the heuristic scan is that it is not fooled by a new variant of an existing virus. However, it might occasionally report suspicious code in normal programs.

Integrity Checker

A program which checks for changes to files. Integrity checkers, when used correctly, can provide an excellent second line of defense against new viruses or variants.

You will find much more on this topic at WorldsLargestNetwork.com