Virus classification
There a lot of virus kinds. They have different ways of distribution and various features. To date there is no unified classification of viruses.
Conventionally viruses are divided as to:
- infected objects (file, boot, script, macro viruses and viruses infecting program source code);
- operating systems and platforms (DOS, MS Windows, Unix and Linux);
- language virus in written in (assembler, script, high-level programming language);
- technologies used by viruses (polymorphic viruses, stealth viruses and rootkits);
- additional harmful functions (keyloggers, backdoors, spyware and bots).
Virus environment classification:
- boot
They are activated from an external medium when the operating system starts.
- file
These viruses are built into program executive files changing its functionality. It is the most common virus type.
- network
They are spread via various network protocols and channels.
- document (macro viruses)
They infect Office software files.
- boot file
These ones have combined functions of file and boot viruses.
As to the method of existence viruses can be:
- resident
Such viruses stay in the computer memory even after the program infected by them stopped functioning. They also preserve ability to infect other open source applications.
-nonresident
These viruses are a part of infected program and are active only when it is running.
As to the function principle viruses are divided into:
1. Trojans They masquerade their files as those of useful programs, create data with similar parameters and names, change registry entries and modify program links. Trojans can delete user's data, send spam and spy on users. They are not able to self-replicate.
2. Worm (self-replicating virus) These ones are capable of reproducing themselves extremely quickly using all available channels and ways. Very often they carry on other types of viruses.
3. Stealth viruses They use complicated masquerading algorithms replacing non-infected program code with their own code in the process of scanning. The viruses can destabilize useful programs hiding their processes.
4. Parasitic viruses These ones damage program files making them useless in the future.
5. Self-encrypting viruses This type of viruses preserves its code and is spread encrypted.
6. Mutating viruses They constantly change their code in the process of reproducing and propagating.
7. "Resting" viruses
They are able to spread without any traces. These viruses are activated under certain conditions and may cause even epidemics.
There are various methods of virus penetrating into system passing through anti-virus software.
For example:
- the majority of Trojans and worms are packed and encrypted in a certain way created especially for this reason;
- changing the Trojan program code by adding unnecessary instructions. This doesn't influence the program functionality though it changes its interface;
- masquerading own presence by intercepting and replacing system functions, which results in file failure to be detected either by antivirus or by the operating system;
- search and disabling the anti-virus software, changing/deleting their databases, update blocking, etc.
- transforming infected webpages so that in case of request a non-infected program is downloaded from a antivirus site; otherwise a Trojan is downloaded.
- appearance and spreading a great number of new viruses in the Internet during a short period of time. Much time is needed to analyze all of them, which in its turn raises chance of Trojans penetrating into computers.
Malware programs are usually named according to the following scheme: Behavior.Platform.Name[.Variant].
Behavior is responsible for distinctive behavior of the malware object (its functions, aim, way of spreading).
Platform it is the very environment where a virus is functioning. It can be either program or hardware-based.
Name represents the virus' name.
Variant shows possible object modifications. They may be absent though.
- innocuous viruses
These viruses don't do any harm to computers and can reduce disk space for their self-reproducing.
- nonhazardous viruses
They also reduce available memory as well as perform some graphic, text or sound effects.
- dangerous viruses
These ones cause system failures.
- very dangerous
These ones are able to wipe out all data, destroy programs, change system settings, etc.
Today thousands of various viruses are known. Their number is increasing with every passing day.