2.1 Computer Viruses
107
that it is not enough just to remove the virus from the files, it is necessary to decrypt
the information encrypted by it.
Macro viruses. These viruses are programs that are created in languages embedded
in various software systems. Most often, the victims are files created by various
components of Microsoft Office (Word, Excel, etc.). Built in these software products,
Visual Basic is great for writing macro viruses.
The principle of their operation is very simple—the virus writes itself into a DOT
file that contains all global macros, some of which it replaces with itself. After that,
all files saved in this program will contain a macro virus. However, it can perform
many different destructive actions—up to the removal of all documents or changes
in their contents.
Macro viruses infect documents executed in some application programs that have
the means to execute macros. Such documents include files created with the Microsoft
Office software package, which supports the creation of macros in the Visual Basic
for Application programming language. It is very useful to open an unfamiliar file
created in such programs as Word or Excel to make sure that macro support is
disabled (Tools—Options—Macro Security). Or, for the version of Microsoft Word,
in the “Program Security” section, check whether the mode of protected file view
and prevention of data execution is enabled.
However, it can be said that a modern virus can often be attributed to several
groups of viruses at once. Such combinations are, for example, file boot viruses or
file computer worms. An example of the latter is a network macro virus that not only
infects documents created in Word or Excel, but also sends its copies via e-mail.
Network viruses. The main feature of these viruses is the ability to operate with
various network protocols. This means that they can write their code on a remote
computer in various ways. The most widespread are the so-called Internet worms.
These viruses most often use e-mail for their operation, “sticking” to a letter. At the
same time, they either are automatically executed on a new computer or push the
user to launch it in various ways.
Network viruses, which are also called network worms, have a local area network
as their primary place of residence and operation. A network virus, getting to a
user’s computer, copies itself on its own and spreads through other computers that
are included in the network. It uses e-mail, instant messaging systems (for example,
ICQ), data exchange networks for its distribution, as well as deficiencies in the
network configuration and errors in the operation of network protocols.
Another classification feature is the type of operating system, since any virus is
focused on infecting files or performing unauthorized actions on a specific operating
system.
By operation algorithms, viruses are divided into resident viruses and viruses
using stealth algorithms or polymorphicity.
By “features of algorithms,” viruses are difficult to clearly classify due to their
great diversity, but computer security specialists usually use the following basic
gradations (terms).
Primitive viruses are so-called parasitic viruses; they change the contents of files
and disk sectors and can be detected and destroyed quite easily. Here, one may note
107
that it is not enough just to remove the virus from the files, it is necessary to decrypt
the information encrypted by it.
Macro viruses. These viruses are programs that are created in languages embedded
in various software systems. Most often, the victims are files created by various
components of Microsoft Office (Word, Excel, etc.). Built in these software products,
Visual Basic is great for writing macro viruses.
The principle of their operation is very simple—the virus writes itself into a DOT
file that contains all global macros, some of which it replaces with itself. After that,
all files saved in this program will contain a macro virus. However, it can perform
many different destructive actions—up to the removal of all documents or changes
in their contents.
Macro viruses infect documents executed in some application programs that have
the means to execute macros. Such documents include files created with the Microsoft
Office software package, which supports the creation of macros in the Visual Basic
for Application programming language. It is very useful to open an unfamiliar file
created in such programs as Word or Excel to make sure that macro support is
disabled (Tools—Options—Macro Security). Or, for the version of Microsoft Word,
in the “Program Security” section, check whether the mode of protected file view
and prevention of data execution is enabled.
However, it can be said that a modern virus can often be attributed to several
groups of viruses at once. Such combinations are, for example, file boot viruses or
file computer worms. An example of the latter is a network macro virus that not only
infects documents created in Word or Excel, but also sends its copies via e-mail.
Network viruses. The main feature of these viruses is the ability to operate with
various network protocols. This means that they can write their code on a remote
computer in various ways. The most widespread are the so-called Internet worms.
These viruses most often use e-mail for their operation, “sticking” to a letter. At the
same time, they either are automatically executed on a new computer or push the
user to launch it in various ways.
Network viruses, which are also called network worms, have a local area network
as their primary place of residence and operation. A network virus, getting to a
user’s computer, copies itself on its own and spreads through other computers that
are included in the network. It uses e-mail, instant messaging systems (for example,
ICQ), data exchange networks for its distribution, as well as deficiencies in the
network configuration and errors in the operation of network protocols.
Another classification feature is the type of operating system, since any virus is
focused on infecting files or performing unauthorized actions on a specific operating
system.
By operation algorithms, viruses are divided into resident viruses and viruses
using stealth algorithms or polymorphicity.
By “features of algorithms,” viruses are difficult to clearly classify due to their
great diversity, but computer security specialists usually use the following basic
gradations (terms).
Primitive viruses are so-called parasitic viruses; they change the contents of files
and disk sectors and can be detected and destroyed quite easily. Here, one may note