COMPUTER VIRUS - RECOVERY METHODS

RECOVERY METHODS:
Once a computer has been compromised by a virus, it is usually unsafe to continue using the same computer without completely reinstalling the operating system. However, there are a number of recovery options that exist after a computer has a virus. These actions depend on a severity of the type of virus.

1.VIRUS REMOVAL:
one possibility on Windows Me, Windows XP, Windows Vista and Windows 7 is a tool known as a system Restore, which restores the registry and critical system files to a previous check point. Often a virus will cause a system restore point from the same day corrupt. Restore points from previous days should work provided the virus is not designed to corrupt the restore files of also exists in previous restore points. Some viruses, however, disable system restore and other important tools such as Task Manager and Command Prompt. An example of a virus that does this is CiaDoor. However, a CiaDoor can be routed, if the user turns on their computer, opens in safe mode and then tries to open the necessary tools such as system Restore.
Administrators have the option to disable such tools from limited users for various reasons. The virus modifies the registry to do the same, except, when the Administrator is controlling the computer, it blocks all users from accessing the tools. When an infected tool activates, it gives the message "Task Manager has been disabled by your administrator.", even if the user trying to open the program is the administrator.
Users running a Microsoft operating system can access Microsoft's website to run a free scan, provided they have their 20 digit registration number.

2.OPERATING SYSTEM RE INSTALLATION:
Re installing the operating system is another approach to virus removal. It involves simply reformatting the computer's hard drive and installing the OS from its original media, or restoring the partition with a clean backup image.
This method has the benefit of being simple to do, being faster that running multiple anti virus scans, and is guaranteed to remove any malware. Downsides include having to re install all other software, reconfiguring restoring user preferences. User data can be backed up by booting off of a Live CD or putting the hard drive into another computer and booting from the other computer's operating system.
Care must be taken when restoring anything from an infected system to avoid transferring the virus to the new computer along with the restored data.

COMPUTER - VIRUS: HOW TO AVOID 2

STEALTH

Some viruses try to trick anti virus software by intercepting its request to the operating system. A virus can hide itself by intercepting the anti - virus software's request to read the file and passing the request to the virus, instead of the OS. The virus can then return an uninfected version of the file to the anti virus software, so that it seems that the file is "clean". Modern anti virus software employs various techniques to counter stealth mechanisms of viruses. The only completely reliable method to avoid stealth is to boot from a medium that is known to be clean.

1. Self - Modification:
Most modern anti virus programs try to find virus - patterns inside ordinary programs by scanning them for so - called virus signatures. A signature is a characteristic byte-pattern that is part of a certain virus or family of viruses. If a virus scanner finds such a pattern in a file, it notifies the user that the file is infected. The user can then delete, or heal the infected file. Some viruses employ techniques that make detection by means of signatures difficult but probably not impossible. These viruses modify their code on each infection. That is each infected file contains a different variant of the virus.

2. Encryption with a variable key:
A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different keys for each infected file, the only part of the virus that remains constant is the decrypting module, which would be appended to the end. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible. Since these would by symmetric keys, stored on the infected host, it is in fact entirely possible to decrypt the final virus, but this is probably not required, since self - modifying code is such a rarity that it may be reason for virus scanners to at least flag the file as suspicious.
An old, but compact, encryption involves XORing each byte in a virus with a constant, so that the exclusive - or operation had only to be operated for decryption. It is suspicious for a code to modify itself, so the code to do the encryption / decryption may be part of the signature in many virus definitions.

3.Polymorphic code:
Polymorphic code was the first technique that posed a serious threat to virus scanners. Just like regular encrypted viruses, a polymorphic virus infects files with an encrypted copy of itself, which is decoded by a decryption module. In the case of polymorphic viruses, however, this decryption module is also modified on each infection. A well written polymorphic virus therefore has no parts which remain identical between infections, making it very difficult to detect directly using signature. Anti virus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine somewhere in its encrypted body. See polymorphic code for technical detail on how such engines operate.
Some viruses employ polymorphic code in a way that constrains the mutation rate of the virus significantly. For example, a virus can be programmed to mutate only slightly over time, or it can be programmed to refrain from mutating when it infects a file on a computer that already contains copies of the virus. The advantage of using such slow polymorphic code is that it makes it more difficult for anti virus professionals to obtain bait files that are infected in one run will typically contain identical or similar samples of the virus. This will make it more likely that the detection by the virus scanner will be unreliable, and that some instances of the virus may be able to avoid detection.

4. Metamorphic Code:
To avoid being detected by emulation, some viruses rewrite themselves completely each time they are toinfect new executable. Viruses that utilize this technique are said to be metamorphic. To enable metamorphism, a metamorphic engine is needed. A metamorphic virus is usually very large and complex. For example W32/simile consisted of over 14000 lines of Assembly language code, 90 % of which is part of the metamorphic engine.

COMPUTER VIRUS - HOW TO AVOID 1

In order to avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the MS - DOS platform, make sure that the "last modified" date of a host file stays the same when the file is infected by the virus. This approach does not fool anti - virus software, however, especially those which maintain and date cyclic redundancy checks on file changes.

Some viruses can infect files without increasing their sizes or damaging the files. They accomplish this by overwriting unused areas of executable files. These are called cavity viruses. For example, the CIH virus, or chernoby1 virus, infects portable Executable files. Because those files have many empty gaps, the virus, which was 1 KB in length, did not add to the size of the file.

Some viruses try to avoid detection by killing the tasks associated with antivirus software with anti virus software before it can detect them.

As computers and operating systems grow larger and more complex, old hiding techniques need to be updated or replaced. Defending a computer against viruses many demand that a file system migrate towards detailed and explicit permission for every kind of files access.

4.1 Avoiding bait files and other undesirable hosts:

A virus needs to infect hosts in order to spread further. In some cases, it might be a bad idea to infect a host program. For example, many anti - virus programs perform an integrity check of their own code. Infecting such programs will therefore increase the likelihood that the virus is detected. For this reason, some viruses are programmed not to infect programs that are known to be part of anti - virus software. Another type of host that viruses sometimes avoid is bait files. Bait files are files that are specially created by anti - virus software, or by anti - virus professionals themselves, to be infected by a virus. These files can be created for various reasons, all of which are related to the detection of the virus:

Anti - virus professionals can use bait files to take a sample of a virus. It is more practical to store and exchange a small, infected bait files, than to exchange a large application program that has been infected by the virus.
Anti - virus professionals can use bait files to study the behavior of a virus and evaluate detection methods. This is especially useful when the virus is polymorphic. In this case, the virus can be made to infect a large number of bait files. the infected files can be used to test whether a virus scanner detects all versions of the virus.
Some Anti - virus software employs bait files that are accessed regularly. When these files are modified, the anti - virus software warns the user that a virus is probably active on the system.
Since bait files are used to detect the virus, or to make detection possible, a virus can benefit from not infecting them. Viruses typically do this by avoiding suspicious programs, such as small program files or programs that contain certain patterns of 'garbage instructions'.

A related strategy to make baiting difficult is sparse infection. Sometimes, spares infectors do not infect a host file that would be a suitable candidate for infection in other circumstances. For example, a virus can decide on a random basis whether to infect a file or not, or a virus can only infect host files on particular days of the week.

COMPUTER VIRUS - INFECTION STRATEGIES

In order to replicate itself, a virus must be permitted to execute code and write to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs. If a user attempts to launch an infected program, the virus' code may be executed simultaneously. viruses can be divided into two types based on their behavior when they are executed. Non resident viruses immediately search for other hosts that can be infected, infect those targets, and finally transfer control to the application program they infected. Resident viruses don't search for hosts when they are started. Instead, a resident virus loads itself into memory on execution and transfers control to the host program. The virus stays active in the background and infects new hosts when those files are accessed by other programs or the operation system itself.

1. Non - Resident Viruses

Non Resident viruses can be thought of as consisting of a finder module and a replication module. The finder module is responsible for finding new files to infect. For each new executable file the finder module encounters, it calls the replication module to infect that file.

2. Resident Viruses

Resident viruses contain a replication module that is similar to the one that is employed by non resident viruses. This module, however, is not called by a finder module. The virus loads the replication module into memory when it is executed instead and ensures that this module is executed each time the operating system is called to perform a certain operation. The replication module can be called, for example, each time the operating system executes a file. In this case the virus infects every suitable program that is executed on the computer.

Resident viruses are sometimes sub divided into a category of fast infectors and a category of slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file that is accessed. This poses a special problem when using anti - virus software, since a virus scanner will access every potential host file on a computer when it performs a system - wide scan. If the virus scanner fails to notice that such a virus is present in memory the virus can " piggy - back" on the virus scanner and in this way infect all files that are scanned. Fast infectors rely on their fast infection rate to spread. The dis advantage of this method is that infecting many files may make detection more likely, because the virus may slow down a computer or perform many suspicious actions that can be noticed by anti - virus software . Slow infectors, on the other hand, are designed to infect hosts infrequently. Some slow infectors, for instance, only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions; they are less likely to slow down a computer noticeably and will, at most, infrequently trigger anti - virus software that detects suspicious behavior by programs. The slow infector approach, how ever, does not seem very successful.