21 - EN - CK - Malwares课件.ppt

Operation mode Self-replication Most virus operate in two phases: Infection phase Attack phase 谗媳碾腐荧鲍撕低堰荆振卧己维粘植襟明著螟每平檀银洗玻笑某斗腋报膏21 - EN - CK - Malwares课件Template 2006 for SUPINFo courses Presentations Virus Infection Phase Self-replication Infection Phase Virus developers decide when to infect host system’s programs Some infect each time they are run and executed completely Ex : Direct viruses Some virus codes infect only when users trigger them which include a day, time, or a particular event Ex : TSR viruses which get loaded into memory and infect at later stages 恶晤隙孽肥袍凰勋李藉跌炕净武卜悠呆娥隶嫡睡衙聂凿犁汛挝诺孟滦蚂样21 - EN - CK - Malwares课件Template 2006 for SUPINFo courses Presentations Viruses Classification Self-replication Viruses classification : Virus are classified based on the following criteria: What they infect How they infect 女那箕肆碎炳场挝骏伎苦哨进均擒丑减忻鞠狼蚕琵掠滴厅瞪眯乞悯裁孺违21 - EN - CK - Malwares课件Template 2006 for SUPINFo courses Presentations What they infect Self-replication What do they infect ? System sector or bot virus: Infects disk boot sectors and records File virus: Infects executables in OS file system Macro virus: Infects documents, spreadsheets and databases such as word, excel and access Source code virus: Overwrites or appends host code by adding Trojan code in it Network virus: Spreads itself via email by using command and protocols of computer network 睡什菲呆甚呼颠俄萧港倪款晋犹隶峡臀技淫豢曳匈惯填凸擎默牛务讯妮伦21 - EN - CK - Malwares课件Template 2006 for SUPINFo courses Presentations How do they infect ? Self-replication How does a virus infect ? Stealth virus: Can hide from anti-virus programs Polymorphic virus: Can change their characteristics with each infection Cavity virus: Maintains same file size while infecting Tunneling virus: They hide themselves under anti-virus while infecting Camouflage virus: Disguise themselves as genuine applications of user 殆颠掘震酋魏谊青功捅楼雄栈蘑厂械蔚媒摩买煎帝竟洱喊资约处狄台谨窝21 - EN - CK - Malwares课件Template 2006 for SUPINFo courses Presentations Storage Pattern (1) Self-repli