Lider Autocratico

Jealeen Diane Rodríguez Falú
Prof. Yannira Rodríguez
Sofi 3025 Word Processing
March 10, 2011
Computer Viruses: Delivery, Infection, and Avoidance
Like the common cold, virtually countless variations of computer viruses exist. Unlike the biological viruses that cause the common cold, people create computer viruses. To create a virus, an unscrupulous programmer must code and then test thevirus code to ensure the virus can replicate itself, conceal itself, monitor for certain events, and then deliver its payload — the destructive event or prank the virus was created to deliver. Despite the many variations of viruses, most have two phases to their execution: infection and delivery.
To start the infection phase, the virus must be activated. Today, the most common way viruses spread isby people running infected programs disguised as e-mail attachments. During the infection phase, viruses typically perform three actions:
First, a virus replicates by attaching itself to program files. A macro virus hides in the macro language of a program, such as Word. A boot sector virus targets the master boot record and executes when the computer starts. A file virus attaches itself toprogram files. The file virus, Win32.Hatred, for example, replicates by first infecting Windows executable files for the Calculator, Notepad, Help, and other programs on the hard disk. The virus then scans the computer to locate .exe files on other drives and stores this information in the system registry. The next time an infected file is run; the virus reads the registry and continues infectinganother drive.
Viruses also conceal themselves to avoid detection. A stealth virus disguises itself by hiding in fake code sections, which it inserts within working code in a file. A polymorphic virus actually changes its code as it infects computers. The Win32.Hatred virus uses both concealment techniques. The virus writes itself to the last file section, while modifying the file header to hide theincreased file size. It also scrambles and encrypts the virus code as it infects files. Desde el primer virus informático se ha encontrado, los métodos clásicos de detección que dependen de la extracción de firmas de virus se ha utilizado. (Samy).
Finally, viruses watch for a certain condition or event and activate when that condition or event occurs. The event might be starting the computer orreaching a date on the system clock. A logic bomb activates when it detects a specific condition (say, a name deleted from the employee list). A time bomb is a logic bomb that activates on a particular date or time. Win32.Hatred, for instance, unleashes its destruction when the computer clock hits the seventh day of any month. If the triggering condition does not exist, the virus simply replicates.During the delivery phase, the virus unleashes its payload, which might be a harmless prank that displays a meaningless message — or it might be destructive, corrupting or deleting data and files. When the Win32. Hatred virus triggers, it displays the author’s message and then covers the screen with black dots. The virus also deletes several antivirus files as it infects the system. The mostdangerous viruses do not have an obvious payload; instead they quietly modify files. A virus, for example, could change numbers randomly in an inventory program or introduce delays to slow a computer. One way antivirus software detects computer viruses is by monitoring files for unknown changes, particularly in file size. Because many computer viruses alter system and data files — files that shouldnot change in size — changes in file sizes often are a key indication of an infection. Other kinds of electronic annoyances exist in addition to viruses. While often called viruses, worms, Trojan horse programs, and rootkits actually are part of a broader category called malicious-logic programs or malware. This recent increase of malware collaboration is very worrying and poses an active threat...