Types of Computer Viruses

There are many different types of computer viruses. Over time, computer viruses have evolved in order to adapt to increasingly sophisticated anti-virus software and computer users. For each of the following virus types I will demonstrate the idea behind the concept with a small and easy to follow batch code. Don't worry there is no danger from this code. You can even run it on your computer and nothing will happen. I want this blog to encourage people to conceptually understand viruses so that it will be easier for them to take counter measures. First of all, I want to highlight that, generally, viruses do not evolve by themselves. Usually, a computer programmer will come across a new idea and will create a virus implementing it. When I say that viruses have evolved I am really talking about the people who program these malicious items.

Types of computer viruses:

Encrypted Viruses:

Perhaps the first measure virus authors took, in order to make their viruses harder to detect, was to encrypt the part of the code that the anti-virus software recognizes as a virus. Most viruses are programmed in a programming language that allows them to encrypt certain sections of the code.To illustrate this concept let's look at the following depiction:

Decryption Code
XXXXXXXXXX
XVirus CodeX
XXXXXXXXXX

The area marked with the X's would be encrypted. So if a anti virus software scans this file it will only scan the Decryption code, which will not be recognized as a virus. Lets look at this idea applied in a batch code:

set h=1
set e=2
set l=3
set o=4
set w=5
set r=6
set d=7
cls
echo %1%%2%%3%%3%%4% %5%%4%%6%3%%7%
pause

If executed, the code would prompt a message stating 'hello world'. Of course, the part that contains the message could be a virus code. A anti-virus scanner would not be able to tell the difference.

Marcro Viruses:

These viruses are a rather moder phenomenon. They use commonly used programs like Microsoft Word, or Excel and embed themselves in these files. Once a user executes, these files the virus will activate itself and run the malicious code. The pinnacle of the macro virus era was when the infamous Melissa Virus went around the world. This particular virus was embedded in a Word file and would spread very rapidly utilizing a bug in Microsoft Outlook. Unfortunately, batch is not applicable to such an idea, as the virus has to be part of the program it exploits.

Polymorphic Viruses:

These viruses have posed a great threat to internet security, given that it was practically impossible to detect them at the time. They consistently change the body of their code making detection very difficult. Even today, many viruses include poly engines - snippets of code that change the code around. The simplest manner to understand this idea is to look at the following code (modified batch code):

replace XX in code with Randomnumber
set h=XX1
set e=XX2
set l=XX3
set o=XX4
set w=XX5
set r=XX6
set d=XX7
cls
echo %XX1%%XX2%%XX3%%XX3%%XX4% %XX5%%XX4%%XX6%XX3%%XX7%
pause

We see that each time the code is executed the XX part of the code will be replaced with a random number. After it is executed once, it will search for a particular random number and replace it with another random number ect. Hence, it is very difficult to write a code that will be able to detect this type of virus. Certainty, it is possible to make the code much more complex as the one above. Here, it only severs as an example.

Stealth Viruses:

Viruses of this breed attempt to hide themselves from a virus scanner by employing known exploits in the OS or other commonly used programs. Let's for instance assume that it is know that a anti virus scanner does not check files that are located in the directory of the anti virus software. Hence, a virus could copy itself to this particular location and be undetected by the virus scanner. There is also memory stealth viruses but these viruses have been outdated and are no longer of concern.

It is safe to assume that as long as there are virus writers there will be new methods they will exploit. However, the current trend is to use multiple methods, new and old, in oder not to be detected. Once people have an idea of the main methods at use, they can better prepare themselves for a virus attack.