Introduction to Viruses

What is a virus?:

It is a program that can enter a computer in many different ways. These programs, or viruses, are special programs in that they can cause unwanted or damaging effects or take advantage of exploits and operating system weakness to cause damage, system instability, or even allow other programs or users to access your network or data files. When a virus enters a computer or network, it will often try to situate itself in a place where it can be activated and distributed, unintentionally, by the user. A virus will not act until it has been run or until certain pre-established conditions have been met, called the "trigger" condition (a specific date, an operation carried out by the user, etc.). In many cases, the effects produced by a virus, called the "virus payload", will not be seen until some time after it has infected the computer. A typical characteristic of viruses is their capacity to reproduce and spread to other files or programs.

Why are they called "viruses"?:
Computer viruses are called viruses due to their similarities with biological viruses. In the same way as biological viruses enter the body and infect the cells, computer viruses get into the into the computer and infect files. In addition, both types of virus can reproduce themselves and spread, passing the infection from one infected system to others.

The effects produced by a virus can range from catostrophic to simply annoying: they can damage or delete data stored in a computer, cause the infected computer to crash, display on-screen messages, etc.

In addition to propagation and infection techniques, many viruses will also use "evasion" techniques. This means that the virus has techniques or a defense system that makes it difficult to detect it and helps it avoid any action taken against it.

How do I know if I have got a virus?:
It may appear that you have a virus in your computer, but you cannot be sure that this is the case until it is detected using an antivirus tool (programs that detect and eliminate viruses). Some actions that can be carried out by a virus are obvious enough to be recognized and could include: messages displayed on-screen, operations slowing down, the properties of some files change, files and/or folders disappear, the computer will not start, the content of the infected disk is lost, etc.

Viruses are increasingly sent via e-mail, therefore it is important to delete all suspicious and/or unsolicited messages. However, messages known as hoaxes are e-mail messages that inform you about the existence of a possible virus, but are NOT viruses. If you have any doubt about an email or attachment, DO NOT open it.

What do viruses infect?:
The main target of viruses are files located in storage devices such as hard and floppy disks. They target program files, although other types of files and documents can also be infected. A program is simply a file with an .EXE or .COM extension, which can be run to perform specific operations.

As we have already mentioned, there are viruses designed to infect files that are not programs. However, these documents contain elements known as macros. Macros are small programs that the user can include in certain types of files.

Other elements prone to virus attack are the storage devices themselves. By attacking the places in which files are stored, the damage produced by the virus will affect all of the information they contain.

How did viruses arise?:
In the 60s, some scientists developed a game for programmers called CoreWar. The objective of the game was to introduce some programs in memory that made the other programs run certain instructions. The aim was to saturate the memory and for each program to act independently, carrying out certain actions.

Now, however, it is not a game. Some experts believe that over 1,000 new viruses, trojans, exploits and hoaxes are created and released in the world every year. Many of these are simple programs that are easily stopped by most good anti-virus software. These are typically written by amatuer programmers and released as a prank or joke, but have spread further than imagined. A growing number of these, however, are highly sophisticated and cleverly designed programs created by professional "hackers" and are released with the intention to create widespread damage or havoc.

The problem with many of these viruses is that effective prevention, detection and disinfection is often impossible until it has been active for awhile. The "Melissa" virus is a perfect example of how a cleverly written virus can become widespread before effective defensive can be created and distributed.



Common Virus Entry Points

The first question that people often ask themselves is: How did this virus get into my computer, or attack it? Knowing the answer to this question can often prevent infection by protecting the possible virus entry points.
Here are the most common entry points used by viruses:

Removable disk drives
Computer networks
Internet

Removable Disk Drives: Disk drives are storage devices on which data is stored in the form of files or documents. These disk drives enable documents to be created on one computer and then used on another. Among these types of storage devices are: floppy disks, CD-ROMs, and Zip and Jaz disks. The last two types are simply special disks with a larger capacity than floppy disks. If any of these are infected, the other computers on which they are used will be infected. E-mail messages can also be stored in these storage devices, which may also be infected.
Floppy disks (or other extractable disks) can store programs, files, Web pages (HTML), e-mail messages with attached files, compressed files, etc. Any of these elements could be infected. Similarly, what is known as the boot sector of the disk could also be infected with a boot virus. Although it still happens, infections produced from floppy disks have decreased significantly to 10%. This means of spreading viruses has given way to much quicker means of propagation, such as e-mail.
Although in general CD-ROM drives can only read the content of a disk but cannot write on them, nowadays it is possible to read and write (record) on a CD-ROM. This, along with the large quantity of information that they can store has led to a large number of infections. In addition, many computers can be booted from a CD-ROM. This option can also lead to an increase in the number of infections.


Computer Networks: A network is a group of interconnected computers that makes it easier for groups of people to work together. Each computer that forms part of the network can connect to all other networked machines. Through this system it is possible to transfer information from one computer to another and/or access the information stored in one of them from the rest. If the information (programs, files, documents, etc.) that is accessed or transferred from one computer to another areinfected, the computers that accessed this computer, or those involved in the transfer, could also be infected.
The network connections can be local and/or remote, allowing computers and laptops to connect via cable, an Intranet, modem, etc. In short, this means that the network can be accessed from several points. You only need to consider a single computer and the means through which a virus can enter it, then multiply this by the computers in the network and mobile machines (such as laptops) that can connect to this network in order to get an idea of the myriad ways through which viruses can enter a network.

Internet: The Internet is becoming an increasingly popular means of obtaining information, sending and receiving files, sending and receiving news, or downloading files. All of these operations are based on transferring information and the interconnection of millions of computers all over the world. This means that as well as data, you may well be receiving a hidden virus. This simple fact alone has allowed virus attacks to grow at an unprecedented rate and has currently made The Internet the biggest virus entry point. Infection via Internet may be produced through a number of different means, including the following:

E-mail
Web pages
File transfers (FTP)
Downloads
Newsgroups

E-mail: Documents and files can be sent and received via e-mail in the form of attachments. These files could be infected. When an e-mail message is opened and the file it contains is run or opened, the computer that has received the message will become infected. The most important characteristics of infection via e-mail are as follows:

Increased replication and propagation capacity. The virus can spread to thousands of computers throughout the world in just a few minutes.

Storage of messages. Messages are stored in a special database (for example, PST files), which are difficult to scan using an antivirus program that is not designed specifically for e-mail systems.

Increased connection capacity. It is possible to send and receive messages between any types of computers/platforms.

Every day, millions and millions of e-mail messages are exchanged throughout the world. The time that it takes to reach the recipient is minimal. In addition, an e-mail message can be sent to a large number of recipients at the same time. This makes e-mail particularly popular with virus authors: It is an extremely fast way of spreading and reaching a large number of recipients. In addition, viruses can nowadays produce an infection and have the capacity to send themselves to other computers without the affected user realizing. In this case, the recipients of the virus could be all of the people included in the e-mail Address Book of the infected computer.
In most cases, infections transmitted via e-mail are not carried out when the message is opened, but on opening or running an infected file included in it. There are exceptions, however. Some viruses, the minority, can carry out their infection when the mail message is opened (without the attached file needing to be executed).
In order to avoid infection via e-mail, the following advice should be considered:

Install an antivirus product that is designed to scan e-mail.

Do not open suspicious files, messages from unknown senders, messages which contain strange texts, etc.

Do not run or open files included in suspicious mail messages.

If you think a message may be infected, delete it and inform the sender.


Web Pages: The majority of pages visited in Internet are text files or images written in a language known as HTML. However, they may also contain programs known as ActiveX controls and Java Applets. These may be infected and therefore infect the visitor to that page. If one of these pages includes a virus in HTML code that includes sections of dynamic code (which executes programs, or carries out certain operations), you could become infected simply by visiting the page.
When browsing Web pages, any flaws in your browser can be exploited through ActiveX Controls, Java Applets, HTML code and/or JavaScript, as well as through other methods. All of these can enable viruses to 'sneak' into a computer.

File Transfers (FTP): The term FTP stands for File Transfer Protocol. Through this protocol it is possible to place documents (upload) on any computer in the world or copy files from any computer to your own (download). When a file is downloaded, it is copied directly from a certain place to your computer. The downloaded files could, of course, contain a virus that would infect your computer.
Some of the most common operations carried out by users on the Internet are downloading programs (shareware), documents, etc.; in addition to downloading software from specific sites. For this reason, it is very important that you only download files from sites that offer guarantees.

Downloads: although downloading files from Internet is similar to file transfer (FTP), it is not the same. Through FTP you can upload as well as download files, whereas through downloads you can only obtain files (which will be copied from a website to your computer). Although in general, these downloads are safe and virus free, it is possible that the downloaded file could be infected. There are some sites that are specially prepared for downloading software or IT utilities.

News or Newsgroups: Through this service it is possible to debate a topic with anyone in the world or receive e-mails featuring the latest information on a topic of your choice. These newsgroups work in a similar way to a notice board. Users post their comments, doubts, or notes about certain topics and other users can respond, give their opinion, clear up doubts, etc. These messages could contain an infected document that could install a virus in your system.
With newsgroups you run the same risk of virus infection as you do with e-mail. When you connect to a newsgroup, files containing the recent articles are downloaded (in the same way as e-mail). These files could also be infected.



Where Do Viruses Hide?

Viruses make use of a number of different places in order to 'hide' from antivirus products and use different techniques to do so. These hiding places include the following:

Main memory: In this case the virus is automatically placed in the main memory (RAM memory) where it waits for a program to be run (a file with an EXE or COM extension) in order to infect it. This type of virus is known as a resident virus.


Documents containing macros: In general, non-program files are not infected by any type of virus. However, there are certain types of documents (files) that users can create or use in their day-to-day activities that contain what are known as macros. A macro is a set of instructions or operations that another program can carry out. These macros form part of documents (text, spreadsheet or database documents), and as they are programs they can be infected by viruses (Macro viruses).


Boot sector (Boot and Master Boot): The boot sector of a floppy or hard disk contains information on the characteristics and contents of the disk. When we refer to the boot sector of a floppy disk, we use the term BOOT, whereas the term MASTER BOOT (MBR - Master Boot Record) is used to refer to the same section of a hard disk. This section of a disk may also contain a program that makes it possible to boot (start) the computer. Some viruses, known as Boot viruses, infect this program, thereby ensuring that they are run every time the computer is booted from the infected disk.


Files attached to e-mail messages: E-mail is being used on an ever-increasing scale as a way of exchange files. These files (attached files or attachments) accompany the text message that is sent and could be infected. Users generally do not suspect that these files could contain a virus, but on opening the message and the attached file they could get a nasty surprise.


Internet Web Pages: Web pages that are visited while browsing the Internet are files that in theory should not be infected, as they are text documents (containing text, images and sound). However, they may contain other components known as Java Applets or ActiveX Controls, which are programs that give the web page a more dynamic appearance, better services and features. Like all other programs, they may be infected and thereby infect users that visit pages containing these components.



Symptoms of Infection

This section will classify and describe each of the symptoms that may be noticed when a virus, worm or Trojan carries out its infection or is activated in a computer.

We are going to start by establishing criteria for classifying the level of damage that viruses could carry out in your computer:


No damage. In this case, viruses do not carry out any action after infecting the computer. The objective of these viruses is usually to propagate and infect other elements and/or computers (they send themselves by e-mail, IRC or through a network).


Minimum damage. They only carry out actions that annoy the user, without affecting data integrity or other areas of the computer (display messages on screen, animations, etc).


Moderate/slight damage. In this case, there may be slight changes to files or loss of data, but the actions will never be totally destructive (some files or part of their content may disappear). The actions carried out by the virus will be repairable.

Serious damage. Loss of large quantities of data and/or files. However, it will be possible to recover part of the data, although the process may be rather complicated and tedious.


Very serious damage/irreparable. In this case, all of the data that the infected disk drives contain may be lost (including network drives). The structure of each disk drive may also be lost (at least the structure of the main drive), because a virus has reformatted it. This damage is very difficult to repair and is in some cases irreparable. In addition, other memory systems will also be attacked such as the RAM, CMOS and BIOS, as well as boot systems and system files.


Unpredictable damage. This damage is usually caused by Trojans. Trojans are programs that can be handled remotely (from another computer) by the person that is launching the attack (attacker or hacker). This type of program is becoming more and more complex and has more attack utilities and functions. Through the client program -in the attacker's computer-, the server program -in the victim's computer- and a connection through the communications port of the victim's computer, the attacker can carry out any action in the victim's computer.


Some of the symptoms or effects that could be observed in a computer, when a virus has carried out its infection or when it has been activated (depending on the trigger conditions), are as follows:

Note: it is important to bear in mind that the symptoms described below may be due to causes other than viruses.


Slow down. The computer operates much more slowly than usual. It takes a lot longer to open applications or programs. Even the operating system takes longer to carry out simple operations that do not usually take so long.


Run /Open. When you try to start a certain program or open a specific file, it will not run or open.


Disappearance of files and folders. The files stored in certain directories (usually those which belong to the operating system or certain applications), have disappeared because the virus has deleted them. Entire directories and folders may also disappear.

A Trojan called Backdoor/Acid.1.0 pretends to delete files from the Windows folder

Impossible to access the content of files When a file is opened an error message may be displayed or it may simply be impossible to open it. A virus could have modified the File Allocation Table resulting in the loss of the addresses which are the starting point for locating files.

Unexpected or unusual error messages. Dialog boxes display absurd, humorous, spiteful or aggressive messages, which do not appear under normal circumstances.

A message displayed by a worm called W32/Music

Decrease in memory and hard disk space The free space on the hard disk significantly decreases. This could indicate that a virus has infected a large number of files and that it is spreading throughout the computer. When a program is run, a message appears indicating that there is not sufficient memory to do so (although this is not true and there are few programs open).

Defective Sectors. A message informs you that there are errors on part of the disk that you are working with and a file cannot be saved or it is not possible to perform a certain operation.


Change in the file properties The virus modifies some or all of the characteristics of the file that it infects. As a result, you will notice that the date/time associated with the file (when it was created or last modified) is incorrect, its properties have been modified, the size has changed (when this should not have happened), etc.


Operating System errorsWhen certain operations are carried out -normal and supported by the operating system in other situations - error messages are displayed, other unsolicited actions are carried out or nothing happens.


Duplicate filesIf there is a file with an EXE extension and another with the same name but with a COM extension (also a program), the file with the COM extension will be a virus. Viruses do this because if there are two files with the same name the operating system will always run the file with the COM extension first.


Renamed files. A virus will have changed the names of the files that it has infected and/or other specific files.


Problems starting the computer. The computer will not start, or does not start up in the usual way. It is advisable to start the computer using a system or boot disk and scan all areas of the computer using an antivirus in command-line.


Computer blocks. In situations in which there are few programs open (or none) and there is not a heavy load on the system, the system blocks (it 'crashes') and prevents you from working. It is necessary to use the key combination CTRL+ALT+SUPR in order to remove the task that has blocked or to restart the computer.


The computer shuts down/restarts. Whilst you are working with the computer as usual and without carrying out any strange operations, the computer automatically shuts down and restarts. Obviously everything that has not been saved will be irretrievably lost.


The program shuts down. Whilst you are working with an application or program it shuts down even though you have not performed any unexpected operations or done anything that could produce this action.


The CD-ROM tray opens and closes. The tray of the CD-ROM drive opens and closes without user intervention. This action is very typical of Trojans.


The keyboard and/or mouse do not work correctly When you use the keyboard, it does not write what you want or it carries out operations that do not correspond to the keys that you have pressed. In addition the mouse pointer moves around the screen independently, without you moving it (or when you do, it carries out unusual activities).


Sections of windows disappear.Certain sections (buttons, menu options, texts, etc.) that should appear in a particular window have disappeared and are not displayed. In addition, in windows in which nothing should appear, strange icons or unusual content appears (for example in the Windows taskbar, next to the system clock).

Icono displayed on the task bar by a worm called W32/Navidad.DB

If you have noticed any of these symptoms in your computer, it is advisable to scan it using a good antivirus solution that is completely up to date. You can download either of the two antivirus solutions from the links below:

Panda Antivirus Titanium
Panda Antivirus Platinum What is a Virus?
Entry Points
Where Do Viruses Hide?
Types of Virus
Symptoms of Infection
Techniques Used By Viruses
Antivirus Techniques

Start

Techniques used by Viruses

Each one of the many thousands of existing viruses uses different techniques both to carry out their infection routine and to conceal their presence from the eyes of users. These techniques change and evolve over time, as do the techniques used by antivirus programs to detect them. This section focuses on the most common mechanisms used by viruses:

Stealth
Tunneling
Self-encryption
Polymorphism
Armoring

Stealth: Viruses that use this method in order to conceal their presence from the eyes of users in order not to raise suspicion and to trick them into believing that nothing untoward has happened. This technique is mostly used by resident viruses, although it may also be used by other types. In addition, there are several types of stealth techniques; 'stealth' is a generic term for this kind of technique. However, antivirus programs also use special anti-stealth techniques in order to detect this type of virus.


When a virus infects a file, it leaves a series of tell-tale signs such as an increase in the size of the infected file, changes in the file's date and time stamps, sections of file code marked as being defective, reduction of available memory, etc. This type of virus makes sure that these traces cannot be seen by the user. To do this, it checks all requests made by the operating system for information related to these characteristics, intercepting them and offering false information instead of the real data. The viruses that use stealth techniques usually carry out certain actions so that their effects are not evident. These actions include the following:



The size of the file will increase when it is infected, as the virus is inserted inside it. However, this type of virus prevents the new file size from being displayed in order not to arouse suspicion.

When they infect a file, they do not modify the date or the time. This means that they will not assign the file to show the date and time the file was last modified (when the infection was carried out).

If they go memory resident, they usually place themselves over the first 640 Kbytes.

If the viruses are capable of over-writing write-protected sections of a disk, they prevent write-protect error messages from appearing.


Tunneling: This is a technique specifically designed to prevent the correct use of the permanent (resident) antivirus protection installed on a computer. While the permanent antivirus protection works to detect the presence of viruses in the system, this type of virus works against it. The antivirus analyzes all file operations performed on the computer by intercepting the actions the operating system carries out. However, if the virus intercepts these requests first, the antivirus will not detect the presence of the malicious code. Fortunately, antivirus techniques have been developed that permit the detection of viruses that use this technique.

The tunneling system is quite complicated, as the microprocessor must be put in step-by-step mode and work with interrupts. In addition, this type of virus is capable of obtaining the memory address in which the operating system services are originally located. This allows it to use these types of services without intercepting those used by other programs.


Self-encryption: antivirus programs search for strings of characters (known as the virus signatures) which all viruses have. Viruses therefore use a technique known as self-encryption, which enables them to take on a different appearance each time they infect (polymorphic). This means that the virus will use a specific string to carry out one infection and a different one in the next. In addition, they encode or encrypt their strings to make it more difficult for the antivirus program to detect them. However, the viruses that use this technique always use the same encryption routine (or algorithm), which makes it possible for antivirus programs to detect them.


To summarize, using an encryption key and a series of mathematical operations, the virus can encrypt itself. This makes it difficult for the virus to be decrypted in order to be scanned and/or detected. The virus can also decrypt itself. In general they use the same key for encryption and decryption.



Polymorphism: Based on the self-encryption technique, polymorphic viruses encrypt their code in a different way with each infection they carry out (their signature changes from one infection to the next). If this were the only thing they were capable of, we would be referring to viruses that use encryption. However, these viruses also encrypt the way (routine or algorithm) in which their signature is encrypted. This means that a polymorphic virus is capable of creating different variants of itself from one infection to the next, changing its "shape" with each infection. The encryption operations are usually carried out through XOR (OR-Exclusive) operations, where a XOR b = a'b+ab'.


In order to detect this type of virus, antivirus programs use decryption simulation techniques. The antivirus programs try to locate the viruses by searching for their signature or pattern (string of characters unique to each virus). If the virus is encrypted and its encryption changes every time it infects, it will be very difficult to detect.

However, the virus cannot completely encrypt itself, as it needs to keep part of its code (not encrypted) in order to decrypt itself. This section is used by antivirus programs to detect polymorphic viruses. In order to do this, the antivirus program will try to locate the routine or algorithm that allows the virus to automatically decrypt itself.



Armoring: Through this technique, viruses prevent their code from being examined. In order to find out more about a virus, analysts look into files using special programs called Debugger, which allow them to examine each line of the virus code in the original language it was written in. Viruses that use the 'Armoring' technique make it impossible for their code to be read.

To sum up, a virus prevents its code from being examined, by making it impossible to disassemble or trace it. This is where the name 'armoring' comes from. However, there are antivirus programs that use heuristic techniques to detect this type of virus.
What is a Virus?
Entry Points
Where Do Viruses Hide?
Types of Virus
Symptoms of Infection
Techniques Used By Viruses
Antivirus Techniques

Start

Antivirus Techniques

As the techniques used by viruses evolve and are studied in depth in virus labs all around the world, antivirus programs are incorporating increasingly advanced technology that makes it possible to detect viruses and protect users against these menaces. The following are the most used:

String search
Deductive search
Exceptions
Heuristic scan
Permanent protection (Resident)
Vaccination
Research


Strings search: Every virus contains a string of characters that uniquely and unequivocally identifies them (as if it were their fingerprint). This is known as the virus signature. Antivirus programs include a file known as the Virus Signature File, which contains all of the strings that correspond to each virus that they can detect. This means that when an antivirus scans in search of viruses, what it is doing is looking for these strings in the files it has been instructed to scan. If a file does not contain any of these strings, then it is considered to be virus-free, whereas if the antivirus detects one of the strings in a file it informs the user that it may be infected.

This means that the antivirus programs must search for these strings in small specific sections of the file. They must also be aware that there may be two variants of the same virus with the same string or that new viruses may appear and whose strings are still not known. This makes it important for antivirus programs to combine the 'string search' technique, with other more accurate techniques.


Deductive search: As at times the string search mentioned above may not be completely reliable, antivirus programs also use other techniques. One of them, which is very similar to the string search, is the deductive search. This involves observing certain properties in each file that is scanned. There are certain properties that infected files will always have. When the deductive search detects one of them, it will confirm that the file is infected. This type of search takes the internal structure of the files that it scans into account, the date, the time and the attributes of the file (read-only, write, system, hidden, etc.).


Exceptions: An alternative to the string search and the deductive search method is to search for exceptions. When a virus uses a different string (signature) from one infection to another it becomes difficult to detect by means of the string search method. If this happens, the antivirus program will search for a specific virus.


Heuristic scan: When there is no information available to permit the detection of a new or unknown virus, the Heuristic technique is used. This consists of scanning files and gathering a series of data from them (size, date and time of creation, etc.). This information is studied by the antivirus program which, depending on the results obtained, concludes whether a file may harbor a potential virus or not.


Due to its large scanning capabilities and suspicion of strange situations, this type of antivirus technique could result in false alarms that refer to possible viruses, when they do not actually exist. This is due to the fact that this technique examines sections of the file that have unusual characteristics or carry out unusual functions.

Some antivirus programs include the option to carry out a scan using this technique if the user requires it. If this is the case, the antivirus program will carry out its usual scans and will then apply the heuristic scan in the following way:



It accesses the code of the program to be scanned.

It runs it step-by-step. In other words, it runs each line of code, one by one.

It detects possible activity that, in theory, the program being scanned should not carry out, or modifications that the file being scanned should not have.

If it detects suspicious activity, it alerts the user. It informs the user that it could contain a virus or that there are significant or unusual changes to the file being scanned.


To sum up, this type of scan can detect both known and unknown viruses. This is because the scan is not based on the characteristics of a particular virus but on the characteristics that all viruses have in common (all viruses use similar groups of techniques that can be detected).

It is advisable to be cautious with the results of the heuristic scan. This means that you should consider what you are going to do as a consequence. There are some antivirus applications (such as Panda Antivirus Titanium) that allow you to send suspicious files to be examined by experts (Virus Laboratory). If a heuristic scan detects a suspicious file, through Panda Antivirus Titanium you can send it to Panda Software, so that it can be examined. You will quickly receive a reply and the corresponding solution if necessary.


Permanent protection (Resident): Although it is not a technique as such, the majority of antivirus programs offer this feature. Whilst the computer is switched on, the antivirus program will scan all of the files involved in all of the operations carried out (in the system and via Internet). The antivirus places its scan program in memory, and when files are opened, closed or run etc, the program will scan them. When a virus is detected, a warning is displayed and you are offered the possibility of disinfecting the virus. If nothing out of the ordinary is found, the scan process continues.


Therefore, it could be said that the permanent protection constantly observes everything, without user intervention. This significantly reduces the risk of infection, as the antivirus program constantly scans any area of the computer which is carrying out operations and prevents infected files or programs from being run.

Although it is always advisable to have the permanent protection enabled, there are antivirus programs that give the user the option of enabling or disabling it. In addition, the characteristics of this protection can also be configured (elements to be scanned, action to be taken if a virus is detected, elements that should not be scanned, the antivirus alerts, etc).



Vaccination: By means of this technique, the antivirus program stores information on the characteristics of each files that has been scanned (the files are vaccinated). If in subsequent scans a difference is detected between the information stored and the current file information, the antivirus program will inform the user of this difference. This technique helps the file to be reconstructed, if it has been infected.



There are two types of vaccine:
Internal (inoculation). The information is stored within the file itself, which means that when it is executed it automatically checks for any changes.

External. Information is stored in a specially created file, which the program uses to check against the information obtained in the current scan.



Research: There are viruses that may get into the memory of the computer (RAM) and activate themselves. These viruses may not be detected by the normal memory scan. The research mechanism consists of 'provoking' the virus into attempting to carry out an infection. Through this mechanism, new viruses can be discovered and the tricks that they use to carry out their infection can be identified. Therefore, the virus can be detected. If a virus is detected, the antivirus program will have to consider what actions it should carry out and how it should do it.


What is a Virus?
Entry Points
Where Do Viruses Hide?
Types of Virus
Symptoms of Infection
Techniques Used By Viruses
Antivirus Techniques





Antivirus Techniques

As the techniques used by viruses evolve and are studied in depth in virus labs all around the world, antivirus programs are incorporating increasingly advanced technology that makes it possible to detect viruses and protect users against these menaces. The following are the most used:

String search
Deductive search
Exceptions
Heuristic scan
Permanent protection (Resident)
Vaccination
Research


Strings search: Every virus contains a string of characters that uniquely and unequivocally identifies them (as if it were their fingerprint). This is known as the virus signature. Antivirus programs include a file known as the Virus Signature File, which contains all of the strings that correspond to each virus that they can detect. This means that when an antivirus scans in search of viruses, what it is doing is looking for these strings in the files it has been instructed to scan. If a file does not contain any of these strings, then it is considered to be virus-free, whereas if the antivirus detects one of the strings in a file it informs the user that it may be infected.

This means that the antivirus programs must search for these strings in small specific sections of the file. They must also be aware that there may be two variants of the same virus with the same string or that new viruses may appear and whose strings are still not known. This makes it important for antivirus programs to combine the 'string search' technique, with other more accurate techniques.


Deductive search: As at times the string search mentioned above may not be completely reliable, antivirus programs also use other techniques. One of them, which is very similar to the string search, is the deductive search. This involves observing certain properties in each file that is scanned. There are certain properties that infected files will always have. When the deductive search detects one of them, it will confirm that the file is infected. This type of search takes the internal structure of the files that it scans into account, the date, the time and the attributes of the file (read-only, write, system, hidden, etc.).


Exceptions: An alternative to the string search and the deductive search method is to search for exceptions. When a virus uses a different string (signature) from one infection to another it becomes difficult to detect by means of the string search method. If this happens, the antivirus program will search for a specific virus.


Heuristic scan: When there is no information available to permit the detection of a new or unknown virus, the Heuristic technique is used. This consists of scanning files and gathering a series of data from them (size, date and time of creation, etc.). This information is studied by the antivirus program which, depending on the results obtained, concludes whether a file may harbor a potential virus or not.