Definition Viruses and Worms

Viruses and worms can be used to infect a system and modify a system to allow a hacker to gain access. Many viruses and worms carry Trojans and backdoors. In this way a virus or worm is a carrier and allows malicious code such as Trojans and backdoors to be transferred from system to system much in the way that contact between people allows germs to spread.

Understand the Difference between a Virus and a Worm

A virus and a worm are similar in that they’re both forms of malicious software (malware). A virus infects another executable and uses this carrier program to spread itself. The virus code is injected into the previously benign program and is spread when the program is run. Examples of virus carrier programs are macros, games, e-mail attachments, Visual Basic scripts, games, and animations.

A worm is a type of virus, but it’s self-replicating. A worm spreads from system to system automatically, but a virus needs another program in order to spread. Viruses and worms both execute without the knowledge or desire of the end user.

Understand the Types of Viruses

Viruses are classified according to two factors: what they infect and how they infect. A virus can infect the following components of a system:

System sectors
Files
Macros (such as Microsoft Word macros)
Companion files (supporting system files like DLL and INI files)
Disk clusters
Batch files (BAT files)
Source code

How a Virus Spreads and Infects the System

A virus infects through interaction with an outside system. Viruses are categorized according to their infection technique, as follows:

Polymorphic viruses: These viruses encrypt the code in a different way with each infection and can change to different forms to try to evade detection.
Stealth viruses: These hide the normal virus characteristics, such as modifying the original time and date stamp of the file so as to prevent the virus from being noticed as a new file on the system.
Fast and slow infectors: These can evade detection by infecting very quickly or very slowly.
Sparse infectors: These viruses infect only a few systems or applications.
Armored viruses: These are encrypted to prevent detection.
Multipartite viruses: These advanced viruses create multiple infections.
Cavity (space-filler) viruses: These viruses attach to empty areas of files.
Tunneling viruses: These are sent via a different protocol or encrypted to prevent detection or allow it to pass through a firewall.
Camouflage viruses: These viruses appear to be another program.
NTFS and Active Directory viruses: These specifically attack the NT file system or Active Directory on Windows systems.