What is a boot sector?
All disks and hard drives are divided into small sectors. The first sector is called the boot sector and contains the Master Boot Record (MBR).The MBR contains the information concerning the location of partitions on the drive and reading of the bootable operating system partition. During the bootup sequence on a DOS-based PC, the BIOS searches for certain system files, IO.SYS and MS-DOS.SYS. When those files have been located, the BIOS then searches for the first sector on that disk or drive and loads the needed Master Boot Record information into memory. The BIOS passes control to a program in the MBR which in turn loads IO.SYS. This latter file is responsible for loading the remainder of the operating system.
What is a boot sector virus?
A boot sector virus is one that infects the first sector, i.e. the boot sector, of a floppy disk or hard drive. Boot sector viruses can also infect the MBR. The first PC virus in the wild was Brain, a boot sector virus that exhibited stealth techniques to avoid detection. Brain also changed the volume label of the disk drive.
How to avoid boot sector viruses.
Commonly, infected floppies and subsequent boot sector infections result from "shared" diskettes and pirated software applications. It is relatively easy to avoid boot sector viruses. Most are spread when users inadvertently leave floppy disks in the drive - which happen to be infected with a boot sector virus. The next time they boot up their PC, the virus infects the local drive. Most systems allow users to change the boot sequence so that the system always attempts to boot first from the local hard drive (C:\) or CD-ROM drive.
Disinfecting boot sector viruses.
Boot sector repair is best accomplished by the use of antivirus software. Because some boot sector viruses encrypt the MBR, improper removal can result in a drive that is inaccessible. However, if you are certain the virus has only affected the boot sector and is not an encrypting virus, the DOS SYS command can be used to restore the first sector. Additionally, the DOS LABEL command can be used to restore a damaged volume label and FDISK /MBR will replace the MBR. None of these methods is recommended, however. Antivirus software remains the best tool for cleanly and accuarately removing boot sector viruses with minimal threat to data and files.
Creating a system disk.
When disinfecting a boot sector virus, the system should always be booted from a known clean system disk. On a DOS-based PC, a bootable system disk can be created on a clean system running the exact same version of DOS as the infected PC. From a DOS prompt, type:
SYS C:\ A:\
and press enter. This will copy the system files from the local hard drive (C:\) to the floppy drive (A:\).
If the disk has not been formatted, the use of FORMAT /S will format the disk and transfer the necessary system files. On Windows 3.1x systems, the disk should be created as described above for DOS-based PC's. On Windows 95/98/NT systems, click Start Settings Control Panel Add/Remove Programs and choose the Startup Disk tab. Then click on "Create Disk". Windows 2000 users should insert the Windows 2000 CD-ROM into the CD-ROM drive, click Start Run and type the name of the drive followed by bootdisk\makeboot a: and then click OK. For example:
d:\bootdisk\makeboot a:
Follow the screen prompts to finish creating the bootable system disk. In all cases, after the creation of the bootable system disk, the disk should be write protected to avoid infection.
Showing posts with label virus. Show all posts
Showing posts with label virus. Show all posts
2/10/2007
What is a virus?
In 1983, Fred Cohen coined the term “computer virus”, postulating a virus was "a program that can 'infect' other programs by modifying them to include a possibly evolved copy of itself.” Mr. Cohen expanded his definition a year later in his 1984 paper, “A Computer Virus”, noting that “a virus can spread throughout a computer system or network using the authorizations of every user using it to infect their programs. Every program that gets infected may also act as a virus and thus the infection grows.”
Using that explanation, we can see that viruses infect program files. However, viruses can also infect certain types of data files, specifically those types of data files that support executable content, for example, files created in Microsoft Office programs that rely on macros. Compounding the definition difficulty, viruses also exist that demonstrate a similar ability to infect data files that don't typically support executable content - for example, Adobe PDF files, widely used for document sharing, and .JPG image files. However, in both cases, the respective virus has a dependency on an outside executable and thus neither virus can be considered more than a simple ‘proof of concept’. In other cases, the data files themselves may not be infectable, but can allow for the introduction of viral code. Specifically, vulnerabilities in certain products can allow data files to be manipulated in such a way that it will cause the host program to become unstable, after which malicious code can be introduced to the system. These examples are given simply to note that viruses no longer relegate themselves to simply infecting program files, as was the case when Mr. Cohen first defined the term. Thus, to simplify and modernize, it can be safely stated that a virus infects other files, whether program or data.
In contrast to viruses, computer worms are malicious programs that copy themselves from system to system, rather than infiltrating legitimate files. For example, a mass-mailing email worm is a worm that sends copies of itself via email. A network worm makes copies of itself throughout a network, an Internet worm sends copies of itself via vulnerable computers on the Internet, and so on.
Trojans, another form of malware, are generally agreed upon as doing something other than the user expected, with that “something” defined as malicious. Most often, Trojans are associated with remote access programs that perform illicit operations such as password-stealing or which allow compromised machines to be used for targeted denial of service attacks. One of the more basic forms of a denial of service (DoS) attack involves flooding a target system with so much data, traffic, or commands that it can no longer perform its core functions. When multiple machines are gathered together to launch such an attack, it is known as a distributed denial of service attack, or DDoS.
While purists draw a firm distinction between viruses, worms, and Trojans, others argue that it is merely a matter of semantics and give the virus moniker to all viruses, worms, and Trojans. The term malware, a.k.a. malicious software, can most easily be used to describe viruses, worms and Trojans while satisfying both arguments.
Malware is an even more appropriate term when one considers spyware, adware, and and browser hijacking techniques that may not fit in any of the aforementioned virus, worm, or Trojan classifications. Thus, malware can be defined as any program, file, or code that performs malicious actions on the target system without the user’s express consent. This is in contrast to Sneakyware, which can best be described as any program, file, or code that the user agrees to run or install without realizing the full implications of that choice. One of the best examples of Sneakyware was Friendly Greetings, a greeting-card trick that exploited users’ willingness to say Yes without reading the licensing agreement. By doing so, they were blindly agreeing to allow the same email to be sent to all contacts listed in their address book.
To recap:
Using that explanation, we can see that viruses infect program files. However, viruses can also infect certain types of data files, specifically those types of data files that support executable content, for example, files created in Microsoft Office programs that rely on macros. Compounding the definition difficulty, viruses also exist that demonstrate a similar ability to infect data files that don't typically support executable content - for example, Adobe PDF files, widely used for document sharing, and .JPG image files. However, in both cases, the respective virus has a dependency on an outside executable and thus neither virus can be considered more than a simple ‘proof of concept’. In other cases, the data files themselves may not be infectable, but can allow for the introduction of viral code. Specifically, vulnerabilities in certain products can allow data files to be manipulated in such a way that it will cause the host program to become unstable, after which malicious code can be introduced to the system. These examples are given simply to note that viruses no longer relegate themselves to simply infecting program files, as was the case when Mr. Cohen first defined the term. Thus, to simplify and modernize, it can be safely stated that a virus infects other files, whether program or data.
In contrast to viruses, computer worms are malicious programs that copy themselves from system to system, rather than infiltrating legitimate files. For example, a mass-mailing email worm is a worm that sends copies of itself via email. A network worm makes copies of itself throughout a network, an Internet worm sends copies of itself via vulnerable computers on the Internet, and so on.
Trojans, another form of malware, are generally agreed upon as doing something other than the user expected, with that “something” defined as malicious. Most often, Trojans are associated with remote access programs that perform illicit operations such as password-stealing or which allow compromised machines to be used for targeted denial of service attacks. One of the more basic forms of a denial of service (DoS) attack involves flooding a target system with so much data, traffic, or commands that it can no longer perform its core functions. When multiple machines are gathered together to launch such an attack, it is known as a distributed denial of service attack, or DDoS.
While purists draw a firm distinction between viruses, worms, and Trojans, others argue that it is merely a matter of semantics and give the virus moniker to all viruses, worms, and Trojans. The term malware, a.k.a. malicious software, can most easily be used to describe viruses, worms and Trojans while satisfying both arguments.
Malware is an even more appropriate term when one considers spyware, adware, and and browser hijacking techniques that may not fit in any of the aforementioned virus, worm, or Trojan classifications. Thus, malware can be defined as any program, file, or code that performs malicious actions on the target system without the user’s express consent. This is in contrast to Sneakyware, which can best be described as any program, file, or code that the user agrees to run or install without realizing the full implications of that choice. One of the best examples of Sneakyware was Friendly Greetings, a greeting-card trick that exploited users’ willingness to say Yes without reading the licensing agreement. By doing so, they were blindly agreeing to allow the same email to be sent to all contacts listed in their address book.
To recap:
- Viruses infect other files;
- Worms make copies of themselves;
- Trojans perform malicious actions but do not spread;
- Malware is an all-encompassing term that describes any malicious software program or file operating without the users explicit consent.
Subscribe to:
Posts (Atom)