2.1 Computer Viruses
105
2.1.3 Classification of Computer Viruses
Some common standard classification of viruses does not exist, but experts usually
classify all the numerous types of viruses by the following main features:
– Destructive capabilities;
– Method of target object infection;
– Habitat of a virus;
– Features of the implementation algorithm.
In turn, according to the “destructive effect,” all computer viruses can be divided
into three main categories.
Benign viruses. They do not interfere with the operation of a computer (electronic
system) but can significantly reduce the amount of free RAM of the system and
memory on hard disks; the actions of such viruses usually manifest themselves in
some graphic or sound effects.
Dangerous viruses. This category includes viruses that can actually lead to certain
(previously planned by the attacker) failures in the operation of either the entire
operating system or some programs chosen by the attacker.
Very dangerous viruses. These viruses can completely destroy some or all data
on a hard disk, can change the system information, disable the operating system,
replace the true information in the system with false one, etc.
Based on the “mode of infection,” all viruses can be divided into two groups—
so-called resident and non-resident viruses. This is a very conditional division.
Resident viruses. Most often, these viruses are one of the types of file and boot
viruses, and their most dangerous variety.
Such a resident virus during infection of the attacked computer leaves in its RAM
the so-called resident part, which then automatically intercepts any operation of the
operating system to the objects of infection (files, boot sectors of disks, etc.) and
is embedded in them. These resident viruses then “take up residence” in computer
(system) memory and are active until they are turned off by the attacker’s command
or when the computer is restarted.
Non-resident viruses, having almost similar capabilities, differ only in that they
do not infect computer memory and are active only for a limited amount of time that
an attacker wishes to set.
By “environment,” all viruses can be divided into four main groups (excluding
their combinations): file, boot, micro, and file viruses.
File viruses. Before the advent of the Internet, these very viruses were the
most common ones. Today, we know malicious programs that infect all types of
executable objects of any operating system (for Windows, executable files (.exe,
.com), command files (.bat), drivers (.sys), dynamic libraries (.dll), etc.).
Target object infection is as follows. The virus writes its code to the victim file,
and the infected file is modified in a special way. As a result, when the operating
system gains access to it (triggering by the user, call from another program, etc.),
control is automatic and without the user’s knowledge it delegates first to the virus
105
2.1.3 Classification of Computer Viruses
Some common standard classification of viruses does not exist, but experts usually
classify all the numerous types of viruses by the following main features:
– Destructive capabilities;
– Method of target object infection;
– Habitat of a virus;
– Features of the implementation algorithm.
In turn, according to the “destructive effect,” all computer viruses can be divided
into three main categories.
Benign viruses. They do not interfere with the operation of a computer (electronic
system) but can significantly reduce the amount of free RAM of the system and
memory on hard disks; the actions of such viruses usually manifest themselves in
some graphic or sound effects.
Dangerous viruses. This category includes viruses that can actually lead to certain
(previously planned by the attacker) failures in the operation of either the entire
operating system or some programs chosen by the attacker.
Very dangerous viruses. These viruses can completely destroy some or all data
on a hard disk, can change the system information, disable the operating system,
replace the true information in the system with false one, etc.
Based on the “mode of infection,” all viruses can be divided into two groups—
so-called resident and non-resident viruses. This is a very conditional division.
Resident viruses. Most often, these viruses are one of the types of file and boot
viruses, and their most dangerous variety.
Such a resident virus during infection of the attacked computer leaves in its RAM
the so-called resident part, which then automatically intercepts any operation of the
operating system to the objects of infection (files, boot sectors of disks, etc.) and
is embedded in them. These resident viruses then “take up residence” in computer
(system) memory and are active until they are turned off by the attacker’s command
or when the computer is restarted.
Non-resident viruses, having almost similar capabilities, differ only in that they
do not infect computer memory and are active only for a limited amount of time that
an attacker wishes to set.
By “environment,” all viruses can be divided into four main groups (excluding
their combinations): file, boot, micro, and file viruses.
File viruses. Before the advent of the Internet, these very viruses were the
most common ones. Today, we know malicious programs that infect all types of
executable objects of any operating system (for Windows, executable files (.exe,
.com), command files (.bat), drivers (.sys), dynamic libraries (.dll), etc.).
Target object infection is as follows. The virus writes its code to the victim file,
and the infected file is modified in a special way. As a result, when the operating
system gains access to it (triggering by the user, call from another program, etc.),
control is automatic and without the user’s knowledge it delegates first to the virus