Tipes of viruses

1. BOOT VIRUS (Загрузочный вирус).

An infector that uses disk boot sectors to propagate itself. Floppy disks have only one object, boot sector, that can be infected, whereas hard disks have two objects, boot sector of a logical partition and master boot record (MBR) of the physical disk.

2. FILE VIRUS (Файловый вирус).

An infector that attaches to files to propagate itself.

3. FILE-BOOT VIRUS (Файлово-загрузочный вирус).

An infector that combines features of file and boot viruses.

4. COMPANION VIRUS (Вирус-компаньен или спутник).

An infector that uses the following contamination technique. For an executable file (say, EXE file) a virus creates a “twin” file (say, COM file) which is launched instead of the original file. Satellite viruses take advantage of the priority the operating system uses when it starts executable files with the same name: if found, BAT file is launched first, then, if found, COM is launched, and then, if found, EXE file is launched.

5. Network virus (Сетевой вирус).

An infector that spreads over computer networks. Some viruses travel across local networks (Novell NetWare), other spread through the Internet. All known network viruses take advantage of the bugs in network software. Although these bugs have been removed by now, there can be no guarantee that the network software is absolutely free of other errors.

6. Encrypted virus (Шифрованный вирус).

An infector that uses special algorithms to encrypt its code and impede its disassembling and analysis. An encrypted virus always contains a decryptor section that is not encrypted or encrypted only partially. In the latter case, the decryptor code is decrypted when virus is active. There exist viruses with a variable encryption key. They can produce descendants encrypted by different methods (for instance, through reversible XOR with different values). Encrypted viruses with a variable encryption key is an intermediate stage to polymorphous viruses.

7. WORM VIRUS (Вирус-червь).

An infector that doesn’t use other files to propagate itself. Worms spread on their own, although they may take advantage of bugs in other programs (as was the case with Morris virus).

8. STEALTH VIRUS (Стелс-вирус, вирус-“невидимка”)

Some viruses use special tricks to hide themselves in order to avoid detection. To this end, they distort information about infected objects by controlling the access to these objects. Masking viruses are often referred to as stealth viruses. Stealth viruses are a hard nut to crack for many anti-virus programs. However, this not the case with ADinf that can immediately detect them.

9. POLYMORPHOUS VIRUS (Полиморфные вируса, непохожие на своих родителей).

The ability of some viruses to produce descendants that are partially or totally different from their parent is called polymorphism. There are a few levels of virus polymorphism.

10. TROJAN PROGRAM (“Троянский”-вирус).

A program that is called to implement a required and valid function, however this program contains a code that might cause harm.

11. MACRO (Макрос, Макро-команда).

A program written in a special language (such as Word Basic or Visual Basic) supported by some advanced word processors and spreadsheets.

12. MACRO VIRUS (Макро-вирус).

An infector written in a language that is used in modern word processors and spreadsheets. Particularly wide-spread are macro viruses for Microsoft Word; there are viruses for Microsoft Excel, Microsoft Access, Microsoft PowerPoint, and Microsoft Windows Help. These viruses are written in Word Basic and Visual Basic. There also exist a virus for AmiPro.