Viruses Distribution Scheme
Today there are great many of viruses (some tens of thousands). Obviously, different viruses have different distribution schemes and it's very difficult to describe the only principle of their activity.
However, there should be noted, that each average virus passes 3 stages in its development:
- Infection
- Replication
- Attack
Some viruses can do without replication and some of them skip the attack stage (e.g. Trojan). There are also viruses that have a masking stage (polymorphous viruses).
Let's look closer at each stage of the computer virus development.
Infection
The stage begins with the run of infected program. This may happen when the user makes use of any drive that has a malicious code in its system tray. First, this code usually gets into computer memory, and then it is copied to other memory devices.
Replication
This stage can be called the series of sequential infections: first the virus gets into the main memory (where it turns into a permanent program), and then the other files are infected from there (when the user runs them). Primarily the system files are infected (and the more often this mechanism is activated, the more files become infected).
When we deal with a boot virus, it travels to the computer main memory after the system has started. Then it is copied to service sectors of the drives that are being written on the computer (e.g. CDs).
Attack
This is the last stage of the virus development. At this stage it reveals itself and performs some harm activity to the computer. At the two previous stages the virus doesn't reveal itself to be able to make enough own copies to harm the system. It goes without saying, that if the virus shows itself after getting in the computer and starts to attack it immediately, all the viruses have long been destroyed (the destructive virus dies itself after it's destroyed everything on the computer). That's why the attack is started only after the virus has made enough own copies.
The mechanism of virus attack can be started in several ways: by remote command (if the computer is online), by opening documents or files, by an hour (the attack is launched at the specific time), by the copy counter (the attack starts after the virus has created a particular number of own copies).