Anti-Virus Labs Tutorial

Portions of the following have been excerpted from the Frequently Asked Questions document compiled and made available by the Virus-L mailing list and the comp.virus news group.

Q: What exactly are computer viruses?

Q: What is a worm?

Q: What is a Trojan Horse?

Q: What are the main types of PC viruses?

Q: What is a stealth virus?

Q: What is a polymorphic virus?

Q: What are fast and slow infectors?

Q: What is a sparse infector?

Q: What is a companion virus?

Q: What is an armored virus?

Q: What is a macro virus?

Q: What is a virus hoax?

Q: Related glossary

Q: What exactly are computer viruses?

A: According to Fred Cohen's well-known definition, a computer virus is a computer program that can infect other computer programs by modifying them in such a way as to include a (possibly evolved) copy of itself. Note that a program does not have to perform outright damage (such as deleting or corrupting files) in order to be called a "virus". However, Cohen uses the terms within his definition (e.g. "program" and "modify") a bit differently from the way most anti-virus researchers use them, and classifies as viruses some things which most of us would not consider viruses.

Many people use the term loosely to cover any sort of program that tries to hide its (malicious) function and tries to spread onto as many computers as possible. (See the definition of "Trojan".) Be aware that what constitutes a "program" for a virus to infect may include a lot more than is at first obvious - don't assume too much about what a virus can or can't do!

These software "pranks" are very serious; they are spreading faster than they are being stopped, and even the least harmful of viruses could be fatal. For example, a virus that stops your computer and displays a message, in the context of a hospital life-support computer, could be fatal. Even those who created the viruses could not stop them if they wanted to; it requires a concerted effort from computer users to be "virus-aware", rather than the ignorance and ambivalence that have allowed them to grow to such a problem.

Q: What is a worm?

A computer worm is a self-contained program (or set of programs), that is able to spread functional copies of itself or its segments to other computer systems (usually via network connections). Note that unlike viruses, worms do not need to attach themselves to a host program. There are two types of worms--host computer worms and network worms.

Host computer worms are entirely contained in the computer they run on and use network connections only to copy themselves to other computers. Host computer worms where the original terminates itself after launching a copy on another host (so there is only one copy of the worm running somewhere on the network at any given moment), are sometimes called "rabbits."

Network worms consist of multiple parts (called "segments"), each running on different machines (and possibly performing different actions) and using the network for several communication purposes. Propagating a segment from one machine to another is only one of those purposes. Network worms that have one main segment which coordinates the work of the other segments are sometimes called "octopuses."

Q: What is a Trojan Horse?

A: A Trojan Horse is a program that does something undocumented which the programmer intended, but that the user would not approve of if he knew about it. According to some people, a virus is a particular case of a Trojan Horse, namely one that is able to spread to other programs (i.e., it turns them into Trojans too). According to others, a virus that does not do any deliberate damage (other than merely replicating) is not a Trojan. Finally, despite the definitions, many people use the term "Trojan" to refer only to a *non-replicating* malicious program, so that the set of Trojans and the set of viruses are disjoint.

Q: What are the main types of PC viruses?

A: Generally, there are two main classes of viruses. The first class consists of the file infectors which attach themselves to ordinary program files. These usually infect arbitrary .COM and/or .EXE programs, though some can infect any program for which execution is requested, such as .SYS, .OVL, .PRG, & .MNU files.

File infectors can be either direct action or resident. A direct- action virus selects one or more other programs to infect each time the program that contains it is executed. A resident virus hides itself somewhere in memory the first time an infected program is executed, and thereafter infects other programs when *they* are executed (as in the case of the Jerusalem) or when certain other conditions are fulfilled. The Vienna is an example of a direct-action virus. Most other viruses are resident.

The second category is system or boot-record infectors: those viruses that infect executable code found in certain system areas on a disk which are not ordinary files. On DOS systems, there are ordinary boot-sector viruses, which infect only the DOS boot sector, and MBR viruses which infect the Master Boot Record on fixed disks and the DOS boot sector on diskettes. Examples include Brain, Stoned, Empire, Azusa, and Michelangelo. Such viruses are always resident viruses.

Finally, a few viruses are able to infect both (the Tequila virus is one example). These are often called "multi-partite" viruses, though there has been criticism of this name; another name is "boot-and-file" virus.

File system or cluster viruses (e.g. Dir-II) are those that modify directory table entries so that the virus is loaded and executed before the desired program is. Note that the program itself is not physically altered, only the directory entry is. Some consider these infectors to be a third category of viruses, while others consider them to be a sub-category of the file infectors.

Q: What is a stealth virus?

A: A stealth virus is one that hides the modifications it has made in the file or boot record, usually by monitoring the system functions used by programs to read files or physical blocks from storage media, and forging the results of such system functions so that programs which try to read these areas see the original uninfected form of the file instead of the actual infected form. Thus the viral modifications go undetected by anti-viral programs. However, in order to do this, the virus must be resident in memory when the anti-viral program is executed.

Example: The very first DOS virus, Brain, a boot-sector infector, monitors physical disk I/O and re-directs any attempt to read a Brain-infected boot sector to the disk area where the original boot sector is stored. The next viruses to use this technique were the file infectors Number of the Beast and Frodo.

Countermeasures: A "clean" system is needed so that no virus is present to distort the results. Thus the system should be built from a trusted, clean master copy before any virus-checking is attempted; this is "The Golden Rule of the Trade." With DOS, (1) boot from original DOS diskettes (i.e. DOS Startup/Program diskettes from a major vendor that have been write-protected since their creation); (2) use only tools from original diskettes until virus-checking has completed.

Q: What is a polymorphic virus?

A: A polymorphic virus is one that produces varied (yet fully operational) copies of itself, in the hope that virus scanners will not be able to detect all instances of the virus.

One method to evade signature-driven virus scanners is self-encryption with a variable key; however these viruses (e.g. Cascade) are not termed "polymorphic," as their decryption code is always the same and thus can be used as a virus signature even by the simplest, signature- driven virus scanners (unless another virus or program uses the identical decryption routine).

One method to make a polymorphic virus is to choose among a variety of different encryption schemes requiring different decryption routines: only one of these routines would be plainly visible in any instance of the virus (e.g. the Whale virus). A signature-driven virus scanner would have to exploit several signatures (one for each possible encryption method) to reliably identify a virus of this kind.

A more sophisticated polymorphic virus (e.g. V2P6) will vary the sequence of instructions in its copies by interspersing it with "noise" instructions (e.g. a No Operation instruction, or an instruction to load a currently unused register with an arbitrary value), by interchanging mutually independent instructions, or even by using various instruction sequences with identical net effects (e.g. Subtract A from A, and Move 0 to A). A simple-minded, signature-based virus scanner would not be able to reliably identify this sort of virus; rather, a sophisticated "scanning engine" has to be constructed after thorough research into the particular virus.

The most sophisticated form of polymorphism discovered so far is the MtE "Mutation Engine" written by the Bulgarian virus writer who calls himself the "Dark Avenger". It comes in the form of an object module. Any virus can be made polymorphic by adding certain calls to the assembler source code and linking to the mutation-engine and random-number-generator modules.

The advent of polymorphic viruses has rendered virus-scanning an ever more difficult and expensive endeavor; adding more and more search strings to simple scanners will not adequately deal with these viruses.

Q: What are fast and slow infectors?

A: A typical file infector (such as the Jerusalem) copies itself to memory when a program infected by it is executed, and then infects other programs when they are executed.

A fast infector is a virus which, when it is active in memory, infects not only programs which are executed, but even those which are merely opened. The result is that if such a virus is in memory, running a scanner or integrity checker can result in all (or at least many) programs becoming infected all at once. Examples are the Dark Avenger and the Frodo viruses.

The term "slow infector" is sometimes used for a virus that, if it is active in memory, infects only files as they are modified (or created). The purpose is to fool people who use integrity checkers into thinking that the modification reported by the integrity checker is due solely to legitimate reasons. An example is the Darth Vader virus.

Q: What is a sparse infector?

A: The term "sparse infector" is sometimes given to a virus that infects only occasionally, e.g. every 10th executed file, or only files whose lengths fall within a narrow range, etc. By infecting less often, such viruses try to minimize the probability of being discovered by the user.

Q: What is a companion virus?

A: A companion virus is one that, instead of modifying an existing file, creates a new program which (unknown to the user) gets executed by the command-line interpreter instead of the intended program. (On exit, the new program executes the original program so things will appear normal.) The only way this has been done so far is by creating an infected .COM file with the same name as an existing .EXE file. Note that those integrity checkers which look only for *modifications* in *existing* files will fail to detect such viruses.

(Note that not all researchers consider this type of malicious code to be a virus, since it does not modify existing files.)

Q: What is an armored virus?

A: An armored virus is one that uses special tricks to make the tracing, disassembling and understanding of their code more difficult. A good example is the Whale virus.

Q: What is a macro virus?

A: Many applications allow you to create macros.  A macro is a series of commands to perform an application-specific task.  Those commands can be stored as a series of keystrokes, or in a special macro language. 

A macro virus is a virus that propagates through only one type of program, usually either Microsoft Word or Microsoft Excel.  It can do this because these types of programs contain auto open macros, which are automatically run when you open a document or a spreadsheet.  Along with infecting  auto open macros, the macro virus infects the global macro template, which is executed anytime you run the program. Thus, once your global macro template is infected, any file you open after that becomes infected and the virus spreads. 

Q: What is a virus hoax?

A: As if viruses weren't enough to deal with, there are people out there with so much time on their hands that they create virus hoaxes.  A virus hoax generally appears as an email message that describes a particular virus that does not exist.  These emails almost always carry the same basic story:  that if you download an email with a particular subject line, your hard drive will be erased (an impossibility because the text of an email cannot harbor a virus). 

Such messages are designed to panic computer users.  The writer or writers email the warning and include a plea for the reader to forward it to others.  The message then acts much like a chain letter, propagating throughout the Internet as individuals receive it and then innocently forward it.  An example of a virus hoax is the "Good Times" virus -- which was written by a couple of people in 1994 and since then has circled the globe many times over.  The best thing to do when you receive such an email is to ignore and delete it, and to depend on your anti-virus software, and good computing habits, to protect yourself.

Q: Related glossary

Boot Sector Virus = A virus that takes control when the computer attempts to boot (as opposed to a file infector).   Boot sector viruses can infect the boot records of both hard disks and diskettes.  They do so by replacing the existing boot record with their own code.  The virus is executed when the system is booted from the hard disk or diskette, and installs its own code in the system's memory so that it can infect other hard disks or diskettes later.

CMOS = Complementary Metal Oxide Semiconductor: A memory area that is used in AT and higher class PCs for storage of system information. CMOS is battery backed RAM (see below), originally used to maintain date and time information while the PC was turned off. CMOS memory is not in the normal CPU address space and cannot be executed. While a virus may place data in the CMOS or may corrupt it, a virus cannot hide there.

DBS = DOS Boot Sector: the first sector of a logical DOS partition on a hard disk or the first absolute sector of a diskette.  This sector contains the startup code that actually loads DOS.  Some boot sector viruses infect the DBS rather than the MBR when infecting hard disks.

DOS = Disk Operating System. We use the term "DOS" to mean any of the MS-DOS, PC-DOS, or DR DOS systems for PCs and compatibles, even though there are operating systems called "DOS" on other (unrelated) machines.

File Infecting Virus = A virus that infects executable files.   The virus will get control when the program is first executed.

MBR = Master Boot Record: the first Absolute sector (track 0, head 0, sector 1) on a PC hard disk, that usually contains the partition table (but on some PCs may simply contain a boot sector). This is not the same as the first DOS sector (Logical sector 0).

Multipartite = A virus that infects both boot records and files.   Sometimes called bimodal or bipartite.

Polymorphic = A virus that attempts to hide from anti-virus programs by by keeping most its its own code garbled in some way, and changing the garbling each time it spreads.

RAM = Random Access Memory: the place programs are loaded into in order to execute; the significance for viruses is that, to be active, they must grab some of this for themselves. However, some virus scanners may declare that a virus is active simply when it is found in RAM, even though it might be simply left over in a buffer area of RAM rather than truly being active.

Scan String = A sequence of bytes (characters) that occur in a known virus but (one hopes) not in legitimate programs.  "Signature" is sometimes used for Scan String. Authors of virus scanners reduce the likelihood of false positives by carefully selecting their scan strings.

TOM = Top Of Memory: the end of conventional memory, an architectural design limit at the 640K mark on most PCs. Some early PCs may not be fully populated, but the amount of memory is always a multiple of 64K. A boot-record virus on a PC typically resides just below this mark and changes the value which will be reported for the TOM to the location of the beginning of the virus so that it won't get overwritten. Checking this value for changes can help detect a virus, but there are also legitimate reasons why it may change.  A very few PCs with unusual memory managers/settings may report in excess of 640K.

TSR = Terminate but Stay Resident: these are PC programs that stay in memory while you continue to use the computer for other purposes; they include pop-up utilities, network software, and the great majority of viruses.  Resident viruses wait in the memory for some external event such as copying a file or inserting a diskette to infect another program.