112
2 Computer Viruses, Malicious Logic, and Spyware
Detection programs allow you to detect files infected with one of several known
viruses. These programs check whether there is a byte combination specific for the
virus in files on the user-specified disk. If it is found in any file, a corresponding
message is displayed on the screen.
Many detectors have modes of treatment or destruction of infected files.
It should be highlighted that detection programs can only detect those viruses that
are “known” to it. Scan program by McAfee Associates and Aidstest D. N. Lozinski
can detect about 1000 viruses, but there are more than five thousand of them! Some
detector programs, such as Norton AntiVirus or Dialog-MGU’s AVSP, can set for
new types of viruses; the byte combinations inherent in these viruses should only
be specified for them. Nevertheless, it is impossible to develop such a program that
could detect any previously unknown virus.
Computer User Action During Virus Infection
When a computer is infected with a virus (or if it is suspected), it is important to
follow the four simplest rules.
(1) First of all, there is no need to be in a hurry and make rash decisions. Unreasonable actions can lead not only to the loss of some files, but also to re-infection
of the computer.
(2) You should immediately turn off the computer so that the virus does not continue
its destructive actions.
(3) All actions to detect the type of infection and to cure the computer should be
performed when the computer is booted from a write-protected floppy with the
OS (a mandatory rule).
(4) If you do not have enough knowledge and experience to cure your computer,
ask for help from more experienced colleagues.
Disk inspectors have two operational stages. First, they remember information
about the status of programs and system areas of disks (boot sector and sector with
a hard disk partitioning table). It is assumed that at this moment the programs and
system areas of disks are not infected. After that, with the help of the disk inspector,
you can at any time compare the status of programs and system disk areas with the
original one. The discrepancies found are reported to the user.
Doctor inspectors are programs that not only detect changes in files and system
disk areas, but can automatically return them to their original state in case of changes.
Such programs can be much more versatile than doctor programs, since while curing
they use previously saved information about the state of files and disk areas. This
allows them to cure files, even from those viruses that were not created at the time
of writing the program.
They cannot cure all viruses, but only those that use the “standard” ones, known
at the time of writing the file infection mechanism program.
There are also filter programs that are resident in the computer’s RAM, intercept
those messages to the operating system that are used by viruses for reproduction and
harm, and report them to the user. The user can enable or disable the execution of
the corresponding operation.
2 Computer Viruses, Malicious Logic, and Spyware
Detection programs allow you to detect files infected with one of several known
viruses. These programs check whether there is a byte combination specific for the
virus in files on the user-specified disk. If it is found in any file, a corresponding
message is displayed on the screen.
Many detectors have modes of treatment or destruction of infected files.
It should be highlighted that detection programs can only detect those viruses that
are “known” to it. Scan program by McAfee Associates and Aidstest D. N. Lozinski
can detect about 1000 viruses, but there are more than five thousand of them! Some
detector programs, such as Norton AntiVirus or Dialog-MGU’s AVSP, can set for
new types of viruses; the byte combinations inherent in these viruses should only
be specified for them. Nevertheless, it is impossible to develop such a program that
could detect any previously unknown virus.
Computer User Action During Virus Infection
When a computer is infected with a virus (or if it is suspected), it is important to
follow the four simplest rules.
(1) First of all, there is no need to be in a hurry and make rash decisions. Unreasonable actions can lead not only to the loss of some files, but also to re-infection
of the computer.
(2) You should immediately turn off the computer so that the virus does not continue
its destructive actions.
(3) All actions to detect the type of infection and to cure the computer should be
performed when the computer is booted from a write-protected floppy with the
OS (a mandatory rule).
(4) If you do not have enough knowledge and experience to cure your computer,
ask for help from more experienced colleagues.
Disk inspectors have two operational stages. First, they remember information
about the status of programs and system areas of disks (boot sector and sector with
a hard disk partitioning table). It is assumed that at this moment the programs and
system areas of disks are not infected. After that, with the help of the disk inspector,
you can at any time compare the status of programs and system disk areas with the
original one. The discrepancies found are reported to the user.
Doctor inspectors are programs that not only detect changes in files and system
disk areas, but can automatically return them to their original state in case of changes.
Such programs can be much more versatile than doctor programs, since while curing
they use previously saved information about the state of files and disk areas. This
allows them to cure files, even from those viruses that were not created at the time
of writing the program.
They cannot cure all viruses, but only those that use the “standard” ones, known
at the time of writing the file infection mechanism program.
There are also filter programs that are resident in the computer’s RAM, intercept
those messages to the operating system that are used by viruses for reproduction and
harm, and report them to the user. The user can enable or disable the execution of
the corresponding operation.