CIS 442: Chapter 2 Viruses
Malewares Maleware classifications and types Viruses Logical and time bombs Trojan horses and backdoors Worms Spam Spyware
Operating systems tasks Booting and resetting Managing volumes and files Managing executable programs and processes Managing memory Handling interrupts
Viruses Definition and history Viruses for mainframe and PCs Propagation or infection Payload or damage Trigger Replication Virus polymorphism
Virus writers Reasons for writing, using or distributing viruses General profile
Virus propagation From file to file and from computer to another. Looking for executable, and similar files Memory resident viruses Infected software, attachement
Macro viruses Differences from typical viruses Document files
Virus classification methods By Infection By Damage By trigger By Platform
Classification File infector viruses Shell viruses Non-overwriting viruses Overwriting viruses Intrusive viruses Boot sector viruses Multipartitie viruses
Memory resident viruses BSI Boot sector viruses Differences between BSI and file infectors Bootstrap loader and virus hiding methods
File infector viruses infection methods Shell viruses Overwriting Non-overwriting Intrusive File attributes: Size, CRC(hash), MAC, code inside, access permissions
Companion-multipartitie Viruses File association DOS execution sequence (com, bat, exe). Multi-File infector and BSI viruses: advantages and challenges
Macro and Script Viruses Macros programs, examples Examples and characteristics of Macro Viruses Protection against Macro viruses.
Infected images and acrobat Buffer overflow problems
Virus life cycle Signature Infection Damage Trigger or Activation: Bombs
Virus Payloads Types and levels of payloads
Virus organization Infection marker Infector Trigger check Manipulation
Virus naming Based on type Based on creator Macro viruses Based on environment
Virus hiding methods Hiding methods Stealth techniques
Interrupts and viruses Relation between interrupts and viruses – trigger and activation Trapdoors