Noncryptographic Security Issues - Codes: The Guide to Secrecy from Ancient to Modern Times - page 398

If the virus program encounters a v-marker, it does not replicate there since it
knows that the program is already infected. Then it seeks uninfected executable
files (those without v-markers) and infects them. If a virus begins by infecting
a program, then each time that program is run, it seeks out uninfected files.
Often the virus is embedded in a game, or utility.
Once a virus program determines that there are no more files to infect, it may
begin to damage the computer and its data. The virus program may corrupt
program or data files so that they either work erratically or not at all. They
might destroy all the files on the computer or alter the system files needed to
reboot, or any other of a number of damaging actions.
Now we look at the evolution of a given virus from its initial infection to its
end goal attacks.
Stages of a Virus
1. Infection Stage : The virus infects some area of the computer as discussed
earlier. Some viruses then remain dormant until a “trigger” sets it in
motion while others go to stage 2 immediately.
2. Replication Stage : In this stage, the virus reproduces itself onto other
programs using the initial infected program to do so. Then each new
infected program will undergo the same replication stage.
3. Activation Stage : The virus is triggered to perform its end goal. The
trigger may be any number of events from the time of day, the date, or
any other event such as the number of times the program is executed.
4. Execution Stage : The virus performs its end goal, which may range from
erasure of the computer's hard drive to the merely annoying, including
simply slowing down the performance of the computer.
Types of Viruses
1. Boot- (System-) Sector Viruses : These kinds of viruses infect the
master boot record (MBR). 10.24 When a computer is rebooted, the virus
spreads its infection.
2. File Viruses : File-infecting viruses attach themselves to executable pro-
gram files. Once the program is loaded, the infected program is executed
and seeks out uninfected e xecutable files.
10.24 The master boot record , also called the partition sector , is the first sector of a computer's
hard disk, which indicates the location of the OS and the methodology for finding it. This is
necessary for the booting of the OS into the computer's RAM. The MBR is also called the
master partition table since it contains a table that houses data on each of the hard disk's
partitions. The MBR also contains a program whose function it is to read the boot sector
record of that partition that contains the OS to be booted into RAM.