A quick & dirty guide to malware (part 2: viruses)

A dialogue screen shown by Virus:W32/Duts.A

This is the second posting in a three-part series covering common threats a user may encounter.

This series serves as a rough and ready guide, highlighting key features and trends relevant to most users.

The One That Left

Last week I spoke of Trojans, Viruses and Worms as The Big Three. I lied a bit, though. Viruses – as a distinct malware type – probably shouldn’t be on that list any more.

Viruses have always loomed large in users’ minds as the poster child of malicious programs – heck, we even call it the anti-virus industry. In the last 10 years or so however, the number of virus infections has nosedived; our Labs, which once dealt with viruses routinely, now sees a proper virus infection about once or twice a month. Today when people talk of ‘viruses’, more often than not what they’re describing is technically a trojan or a worm, and they’re using the term in a general, ‘any malware will do’ kind of way.

That’s not to say viruses are extinct; we still receive a small, if persistent, number of queries about viruses. This may be because many businesses, households and users (both in developed countries and in recently connected developing ones) still use old, out-dated, unpatched machines or programs, or haven’t yet developed a security-conscious habits.

Whatever the case, virus infections will probably still cling on to life for a weary day after, so let’s take a look at them.

Highlights of a virus

Definition of a virus given by Merriam-Webster online dictionary

The Merriam-Webster online dictionary’s bare-bones definition of a computer virus touches on important elements most users should know, so I’ll just elaborate a bit more on some key concepts:

“usually hidden within another seemingly innocuous program”

Last week I compared a virus to a parasite, because not only does it ‘hide’ in another program, but also depends on its host to function. For the virus to run, the unsuspecting user must actively launch the infected program, which in turn launches the virus.

For this reason, virus writers usually create viruses that infect executable files (especially popular programs such as word processors or media files), which have a higher chance of being run; programs with files that get passed around a lot are extra attractive, since they can affect even more potential victims.

A good example is the Microsoft Office suite which, with their huge community of business and personal users, used to be a popular target for macro viruses. We still see queries related to this virus type, though thankfully far less than previously.

“Produces copies of itself and inserts them into other programs”

If you think of the common cold virus spreading from one person to another, you’ll have a pretty good idea of why this behavior can be so damaging. When a infected file is executed, it searches for and infects new files; if the newly infected files are launched, they find and infect new files in turn, like some evil Multi-Level Marketing operation. At worst, this pattern can lead to every targeted file on the system being infected.

“Usually performs a malicious action”

The damage a virus can do by replicating and infecting new files is bad enough; its payload, a completely separate set of nasty actions, can be worse. The range of actions a virus can take is huge – connecting to a remote site, changing the desktop wallpaper, displaying silly notification messages, deleting data files…it really just depends on the virus author’s imagination and programming skills.

If you’re lucky, they’re not that good and you get failed viruses like Virus:W32/Stardust; if they’re good, then you get really nasty beasts like Virus:W32/Virut or Virus:W32/Sality.AA (one of the few viruses we still find regularly active).

Appending, prepending, cavity…who cares?

A dialogue screen shown by Virus:W32/ZMK

With thousands of unique viruses out in the wild, antivirus companies find it necessary to divide them into sub-types. Unlike trojans though, viruses don’t fall into neat categories reflecting their actions; instead, they naturally fall into groupings based on technical differences in the way they infect a file – which is  basically gobbledeegook to a user not interested in detailed analysis.

Gnerally, viruses can be divided into two groups – system infectors and file infectors. The majority of viruses are the latter and infect programs or data files. System infectors on the other hand write their malicious code to specific, critical sections of the hard disk containing the operating system, so that while the OS is running its normal routines, it’s also unintentionally executing the virus code.

Fortunately, for most users a virus’s classification is largely academic. For better or for worse, the sheer variety of possible effects each unique virus can have on a file or system makes it more practical to take each virus on a case by case basis.

Back to what’s important – why should the user  care?

So let’s go back to the original question that sparked off this series: do you really need to know if it’s a virus – as opposed to, say, a trojan or worm – infecting your computer?

Well, it helps to know because the two malware types tend affect your data and computer in different ways. As a (very) general rule, trojan infections is more about data theft and loss of control over the computer; virus infections tend to result in software disruptions or damage.

Trojans may copy and steal your data, but they don’t usually destroy the data file itself; they may stop programs from running but they don’t destroy the program. A virus on the other hand, insert its own code into a program or data file, and depending on how it does so, may either leave the host completely unharmed and functional, slightly disrupted, or completely non-functional.

Another difference between trojans and viruses that really affects the user involves disinfection. For one thing, a trojan is usually a single, discrete program – getting rid of it tends to be fairly simple, a matter of removing the malicious file and its residuals (registry keys, processes, icons, etc). Removing the trojan also generally doesn’t affect the integrity of other files on the computer.

Viruses are far more nebulous by design – they can be present in multiple files, in different locations. Identifying a virus-infected file may require scanning the entire computer to be sure every affected file is caught. Removing malicious code from an infected file or – if it can’t be saved, deleting the infected file entirely – can also be problematic if the damaged data is important or the program is a critical system component.

And this doesn’t even take into account the virus’s payload, which can produce a whole other set of worries.

If you’re still interested

Still, there is a ray of hope. If current malware trends persist, we may soon see adware or backdoors promoted to being the newest member of The Big Three, and viruses – as a distinct malware type – can finally be relegated to joining 3½” floppy disks in Computer Hell.

In the meantime, here’s some links to other, more in-depth resources on viruses:

Or partially available on Google Books:

  • “Elements of Computer Security” by David Salomon
  • “Cybercrimes: A Multidisciplinary Analysis” by Sumit Ghosh

Next

Coming soon – Worms!

More posts from this topic

F-Secure employee wins Inventor of the Year

20 Patents in 14 Years: How An Award-Winning Inventor Finds His Groove

We wouldn't be F-Secure without the talented and passionate researchers in our Labs. And today we'd like you to meet one whose inquisitive nature has driven him to become an inventor - and a prolific one at that. In his 14-year career with F-Secure, Jarno Niemelä has racked up an impressive 20 patents to his name and has filed 100 patent applications in total. His achievements recently won the title of "Salaried Inventor of 2014" from a group of Finnish inventors' organizations. I sat down to chat with Jarno about where he gets his ideas, and his advice for others. What area do your inventions focus on? I mostly focus on methods to help detect malware on a system, or methods of preventing malware from entering the system in the first place. How do your ideas come about? Inventions mostly happen in the evening when I'm not at work, and not even trying to think about it. I'll be working on some problem at work, and usually a day or two later, when I'm doing something totally unrelated on my own time, it hits me. I understand the problem and come up with a solution. The gym is a really good place for inventions. What motivates you to keep on inventing new solutions?   Inventions just happen, pretty much. Whenever I'm able to define a problem, I'm usually always able to come up with a solution. I am lucky to be researching in areas with problems that others have not yet solved. I'll be honest, I don't really like patents that much personally. The fact is though, that companies without patents would pretty much be at the mercy of the competitors. So in my view, patents are basically company self defense. Patents keep things in balance. Were you curious about things growing up? I've always kind of been inventive. You cannot learn to become an inventor, it's either something that's in your nature or it's not. And then you need to hone the talent and learn how to work within the patent framework. Another thing that is very important is good basic education and knowledge about the field. I owe a lot to Metropolia University of Applied Sciences where I studied for my engineering degree. Do you have any advice for people who have this inventive nature and are interested in filing patents? It all starts from defining and understanding the problem. Without a thorough understanding of the problem, you can't come up with a solution. Also, when it comes to patents, it's important to know what has previously been done in your area, and be clear in exactly how your invention is different from those. Otherwise your patent can be easily rejected by the patent examiner. And finally, patents are a long process so you need patience. It can take three to five years to get a patent approved. So this is not for hasty people. What is that rock you're holding? It's my trophy, a piece of Finnish bedrock! Inventors are the bedrock of new products. Do you have any certain goals for your inventions? Before I retire I would like to have at least 50 patents to my name. - Well, he's off to a great start. Congratulations, Jarno! Follow Jarno on Twitter  

Nov 12, 2014
BY 
Free public wi-fi Coffee Shop

Should you use a VPN?

The EFF has put together a handy guide on choosing the right VPN -- virtual private network -- that explains in simple terms why you'd want to use this type of software.   "It enables a computer to send and receive data across shared or public networks as if it is directly connected to the private network—benefiting from the functionality, security, and management policies of the private network," the guide explains. It goes on to clarify the three reasons people typically encrypt their data. Most people already using a VPN do so for the two reasons: They connect to a corporate network remotely or are attempting avoid Internet censorship in countries like China and Iran. But even if you're not using a VPN for business or digital freedom, there is a simple reason why you'd want to use a VPN. "You can also use a commercial VPN to encrypt your data as it travels over a public network, such as the Wi-Fi in an Internet café or a hotel," the EFF writes. I put together this flow chart that explains whether you're a candidate for this third reason to use a VPN: “A good number of open wi-fi providers take the time to tell you in their T&C that there are inherent risks with wireless communications and suggest using a VPN,” F-Secure Security Advisor Sean Sullivan said after we conducted a public Wi-Fi experiment. “So if you don’t take it from me, take it from them.” And even if you aren't on a public network, you may want a VPN to protect you from ubiquitous tracking elements like a perma-cookie. You can try our super simple Freedome VPN solution -- which also includes tracking protection and the ability to set up virtual locations -- free. [Image via Trevor Cummings | Flickr]

Nov 10, 2014
BY