COMPUTER VIRUSES

CLASS 11
INFORMATICS
PRACTICES
 ON GOING THROUGH THE FOLLOWING
PRESENTATION WE CAN :
• DEFINE THE TERM "VIRUS"
• DEFINE THE PARTS AND FUNCTIONS OF A COMPUTER VIRUS
• EXPLAIN THE PHASES IN WHICH A VIRUS OPERATES
• NAME THE VARIOUS TYPES OF COMPUTER VIRUSES
• EXPLAIN THE STEALTH TECHNIQUES USED BY COMPUTER VIRUSES
• DIFFERENTIATE BETWEEN POLYMORPHIC VIRUSES
 VIRUSES

A computer virus is a
type of computer
When this replication
program that, when
succeeds, the affected
executed, replicates
areas are then said to be
itself by modifying
"infected" with a computer
other computer
virus.
programs and
inserting its own code.
Computer viruses currently
Motives for creating viruses
cause billions of dollars' worth
can include seeking profit
of economic damage each
(e.g., with ransomware), desire
year,due to causing system
to send a political message,
failure, wasting computer
personal amusement, to
resources, corrupting data,
demonstrate that a
increasing maintenance costs,
vulnerability exists in
stealing personal information
software.
etc.
VIRUS : FIRST SIGHTINGS

In 1982, a program called "Elk

Creeper was an experimental
self-replicating program
written by Bob Thomas at BBN
Technologies in 1971.
Cloner" was the first personal
computer virus to appear "in
the wild"—that is, outside the
single computer or [computer]
lab where it was created.

The first computer virus for

MS-DOS was “Brain” and was
released in 1986. It would
overwrite the boot sector on
the floppy disk and prevent
the computer from booting
VIRUS PARTS AND FUNCTIONS

• A COMPUTER VIRUS HAS VARIOUS PARTS

MENTIONED BELOW:-
• 1. Infection mechanism
• 2.TRIGGER
• 3.PAYLOAD
 VIRUS: PARTS EXPLANATION
Infection mechanism (also called
'infection vector'), is how the virus
spreads or propagates. A virus
typically has a search routine, which
locates new files or new disks for
infection.
The trigger, which is also known as a
logic bomb, is the compiled version
that could be activated any time
within an executable file when the
virus is run that determines the event
or condition for the malicious
"payload" to be activated or delivered
such as a particular date.

The "payload" is the actual body or

data that performs the actual
malicious purpose of the virus.
Payload activity might be noticeable
(e.g., because it causes the system to
slow down or "freeze"), as most of the
time the "payload" itself is the
harmful activity.
 VIRUS : PHASES
1. DORMANT PHASE
2.PROPOGATION PHASE
3.TRIGGER PHASE
4.EXECUTION PHASE
VARIOUS PHASES OF COMPUTER VIRUS
1. The virus program is idle during this
stage. The virus program has managed to
access the target user's computer or
software, but during this stage, the virus
does not take any action. The virus will
eventually be activated by the "trigger"
which states which event will execute the
virus. Not all viruses have this stage.
3.A dormant virus moves into this phase
when it is activated, and will now perform
the function for which it was intended. The
triggering phase can be caused by a variety
of system events, including a count of the
number of times that this copy of the virus
has made copies of itself.
2.The virus starts propagating, that is
multiplying and replicating itself. The virus
places a copy of itself into other programs
or into certain system areas on the disk. The
copy may not be identical to the
propagating version. Each infected program
will now contain a clone of the virus, which
will itself enter a propagation phase.
4.This is the actual work of the virus, where
the "payload" will be released. It can be
destructive such as deleting files on disk,
crashing the system, or corrupting files or
relatively harmless such as popping up
humorous messages on screen.
TYPES OF COMPUTER VIRUSES

1. RESIDENT AND
2.MACRO 3.BOOT SECTOR
NON-RESIDENT
VIRUSES VIRUSES
VIRUSES

4.EMAIL VIRUSES
STEALTH TECHNIQUES USED BY COMPUTER
VIRUSES
1. In order to avoid detection by users, some viruses employ
different kinds of deception. Some old viruses, especially on the DOS
platform, make sure that the "last modified" date of a host file stays
the same when the file is infected by the virus.
2.Some viruses can infect files without increasing their sizes or
damaging the files.
3.Some viruses try to avoid detection by killing the tasks associated
with antivirus software before it can detect them .
POLYMORPHIC AND METAMORPHIC CODES OF
VIRUSES
• POLYMORPHIC CODE
• Polymorphic code was the first
technique that posed a serious
threat to virus scanners. Just
like regular encrypted viruses,
a polymorphic virus infects
files with an encrypted copy of
itself, which is decoded by a
decryption module.
• METAMORPHIC CODE
• To avoid being detected by
emulation, some viruses
rewrite themselves completely
each time they are to infect
new executables. Viruses that
utilize this technique are said
to be in metamorphic code.
 THANK YOU
PRESENTATION BY
S.AMBHARISH
XI-C