21 - EN - CK - Malwares.pptVIP

[Title of the course] * Copyright ? 2004-2005 NameOfTheOrganization. All rights reserved. * [Title of the course] * Copyright ? 2004-2005 NameOfTheOrganization. All rights reserved. * [Title of the course] * Copyright ? 2004-2005 NameOfTheOrganization. All rights reserved. * Operation mode Self-replication Most virus operate in two phases: Infection phase Attack phase Virus Infection Phase Self-replication Infection Phase Virus developers decide when to infect host system’s programs Some infect each time they are run and executed completely Ex : Direct viruses Some virus codes infect only when users trigger them which include a day, time, or a particular event Ex : TSR viruses which get loaded into memory and infect at later stages Viruses Classification Self-replication Viruses classification : Virus are classified based on the following criteria: What they infect How they infect What they infect Self-replication What do they infect ? System sector or bot virus: Infects disk boot sectors and records File virus: Infects executables in OS file system Macro virus: Infects documents, spreadsheets and databases such as word, excel and access Source code virus: Overwrites or appends host code by adding Trojan code in it Network virus: Spreads itself via email by using command and protocols of computer network How do they infect ? Self-replication How does a virus infect ? Stealth virus: Can hide from anti-virus programs Polymorphic virus: Can change their characteristics with each infection Cavity virus: Maintains same file size while infecting Tunneling virus: They hide themselves under anti-virus while infecting Camouflage virus: Disguise themselves as genuine applications of user Storage Pattern (1) Self-replication Storage pattern of a viruses : Shell virus: Virus code forms a shell around the target host program’s code, making itself the original program and host code as its sub-routine Add-on virus: Appends its code at the beginning of the host code withou