FAQ – Virus actions

  • Description of  the following  virus code actions :
    • replication
    • camouflage
    • watching
    • delivery

I thought it was a good time to revisit this, Apple computers have recently been hit with a malware problem. As I said in class a well written virus is designed to avoid detection for as long as possible.

Replication is the ability of the virus to copy itself. The aim of a modern virus is to spread as quickly and quietly as possible before activation.

Camouflage is how it avoids detection. It can change its signature to avoid scanners, it can disguise itself as a system process, it can use stealth to hide inside legitimate applications. Some malware can even hide from the operating system itself.

Watching is the trigger the virus uses to begin operating. This trigger may be a date, a number of times a document is opened, an instruction from a preprogrammed website, etc

Delivery is how the virus got on the system in the first place. a copy of the virus code is placed on the computer in a verity of ways; copied from an infected fashion drive, downloaded from a compromised server, via email or even by a disgruntled employee

Anti Virus software uses a number of mechanisms to find and remove viruses.

  •  Checksum
  •  Signature
  •  Heuristic
  •  Memory monitoring