A P P E N D I X C
of infection, use stealth and polymorphic features, etc. Another example of
the combination virus is the
network-macro-virus
that infects edited docu-
ments and broadcast its copies with e-mail messages.
We can differentiate viruses by
the operating system
they infect. Every
file or network virus is able to infect files of one or more operating systems:
DOS, Windows, Win95/NT, OS/2 etc. Macro viruses infect file formats used
by Word, Excel, and Office97. Boot viruses also take advantage of certain
arrangements of the system data within the boot sectors.
Grouping computer viruses by the way they work or, in computer terms, the
kind of
algorithm
they use gives the following categories:
•
resident
;
•
stealth features
;
•
self-encoding and polymorphic
;
•
using sophisticated methods
.
When a MEMORY-RESIDENT virus infects a computer, it places the resi-
dent code into RAM, where the code intercepts system calls to the objects
to be infected and infects them. The memory-resident part of the virus
stays in RAM and continues to actively infect files until the user shuts the
machine down or restarts the infected system. NON-RESIDENT viruses do
not infect RAM and are active for only a limited time. There are also non-
resident viruses that place small resident programs into RAM. However,
unlike with the memory resident viruses, these programs do not distribute
virus copies.
Macro viruses also can be considered as memory-resident, since they stay
in RAM all the time the infected editor is running. At that, the editor per-
forms functions of the operating system and the notion of restarting the op-
erating system is interpreted as the exiting editor.
In multi-purpose operating systems the lifetime of resident DOS viruses
may be limited by the moment when a user closes the infected DOS win-
dow, and in some operating systems the active period of boot viruses ends
when the OS disk drivers are installed.
The use of STEALTH FEATURES enables a virus to conceal itself, in part
or in full, within a system. Interception of the system read/write requests is
the most popular method of distribution of stealth-algorithms. Stealth vi-
285
