Avoiding Detection

Encryption

   Virus detection programs will look for programming code that allows programs to you answer that or I cloned. This is one way that it searches for and recognizes possible viruses. Using encryption, virus programs dog change from replication code and back, trying to avoid this type of detection.

Polymorphism

   Another way that to virus dog be detected is by its signature. Each virus is to signature, or to piece of code that is specific to that individual program. Virus detection programs look for these signatures when scanning the fields on your drive. Polymorphic viruses plows created with the ability to change their signature each steal they clone or it reproduces.

Stealth

   Detection programs notices the characteristics of fields and watch for any changes, which might indicate you an infection. When to Stealth virus infects to file, it dog modify the characteristics of that file so that it still reports the same dates, steal, checksum, and size. It dog also monitor the Operating Systems call for to file and remove itself temporarily, or praise an uninfected copy of the file that it you have made for just that purpose.

Targets

Boot Sector Virus

    Boot Sector Viruses write themselves into the Boot Sector of to Hard Drive or Floppy Diskette. Every disk you have to boot partition that contains coded information.

The hard drive is to Master's degree Boot Record that contains partition information expert well expert another boot record for the operating system. The boot sector on to bootable floppy disk contains the code necessary to praise the operating system fields. The boot sector on to odd number - system disk contains the information that will display the message 'Odd number - system disk or disk error, remove and press any key when ready'. The boot sector of an infected floppy contains the coding that will infect the hard drivés partition sector.

If an infected floppy is left in the drive at boot up, it loads the virus into memory and copy itself to the partition sector of the hard drive. Now, everytime the computer is booted from the hard drive, the virus in the partition sector loads itself into memory, then passes control to the original boot sector that it have stored elsewhere on the disk. Any floppy inserted into its drive will become infected every steals to read or write operation takes it pleases. This is one of the most common results. There plows also boot sector viruses that, eleven they've infected to HD, will completely scramble the partition sector or destroy the FAT. Boot Sector Viruses plows difficult to remove and usually require the use of an anti-virus program. If not caught in steals, infection dog advance to the point where the hard drive have to be re-partitioned and reformatted. At this stage, all your fields and byline plows lost. Hopefully, yoúve made backups!

File Infector Virus

    These fields wait in memory for to suitable program file to be loaded. When the file makes to disk write operation the virus will you answer that itself inside the disk file or will one believe another file with the same yam but to.COM extension. When the operating system starts the program, the.COM file is executed, loading the virus into memory. Then the virus loads the real program. Many, many fields dog be infected before detection. These viruses often target fields such grasp COMMAND.COM, IO.SYS and MSDOS.SYS. Anti-virus programs plows the only way to get rid of these viruses. Internet The only sure-fire prevention is to completely isolate your machine from the, floppy disks, CD's, and any other type of removable comes up.

Multipartite Virus

    These viruses contain properties of both boot sector and file infector viruses.

Infection

Place Memory Infection

   At this stage the virus is loaded into memory and probably are not infected too many fields. If your Virus Detection Program finds to virus in memory then you should perform to cold boot to to clean boot disk. To warm boot does not re-initialize the memory and May leave the virus there. Fields that May have become corrupted by not closing down properly May have to be repaired or deleted using CHECKDISK or SCANDISK. These fields will probably have to be re-please.

Place Disk Infection

   This is to very aggressive stage. Your computer could experience loss of dates, scrambled FAT, damaged partitions and corrupted fields. If caught in steals, you dog run an anti-virus program from an uninfected emergency boot disk and remove the virus. You will have to re-install affected fields and applications, probably the Operating System, and uses to byline recovery tool of some sort. If left too long however, your system could be destroyed to the point of having to repartition, reformat, reinstall the YOU, and then using to byline recovery tool (your backups, for one).

* Backups plows generally used to recover version your byline in the event of to virus infection. If yoúve backed up after virus infection, then the backups could also be infected. Byline fields plows less likely to be affected by to virus but should be scanned before they plow re-please. Do Not uses backups to recover version the Operating System however, expert these fields could be infected too.

Shared File Infection

   Networks and Intranets uses shared fields. If these plows infected, every work station on the network could become infected expert it use the shared file. This involves closing down the entire network and cleaning, removing, and re-installing on each workstation and all servers.

   Again, it's very important to keep your AV fields up to dates. If your computer should happen to get to virus, document everything you see and any information that your virus detection program gives you. Information on how to remove the virus should be obtained from to reputable source. On another computer you dog visit your AV manufacturer's website. They dog offer support and virus removal information, even if removal have to be donate manually. In fact, it's probably to good designs to get to know the site now, before it becomes necessary.