73 lines
3.7 KiB
Plaintext
73 lines
3.7 KiB
Plaintext
Elusive New Viruses Can Avoid Detection
|
||
|
||
By Dennis Flanders
|
||
|
||
While computer users nationwide took time to download anti- virus
|
||
software to detect the latest viral strains, someone was busy creating
|
||
the electronic version of the stealth bomber. The "stealth" viruses are
|
||
the deadliest infection to date.
|
||
|
||
At one time the message "126 files scanned - No viruses detected"
|
||
would cause a sigh or relief. Now it may mean "126 files scanned -
|
||
126 files infected." Not only do these evasive new bugs elude
|
||
detection, they can turn your favorite scan program into a "typhoid
|
||
Mary."
|
||
|
||
Most viruses announce their presence by doing such obvious things as
|
||
consuming system resources, destroying files or causing distinctly
|
||
abnormal actions on the screen. The stealth virus, on the other hand,
|
||
quietly sits in the computer's memory doing nasty things to your
|
||
system over a long period.
|
||
|
||
The 4096 virus is destructive to both data and executable files.
|
||
Because the virus slowly cross-links files on the system's disk, it gives
|
||
little indication of its presence. The cross-linking occurs so slowly that
|
||
it appears there is a hardware problem when it is the result of the
|
||
virus manipulating the FATs and changing the number of available
|
||
sectors.
|
||
|
||
Masquerading as hardware failures, stealth viruses can cause much
|
||
time and money to be wasted chasing the wrong problem and repairing
|
||
good equipment. After finally discovering the virus the infected PC's
|
||
data and programs may be beyond recovery. Often several generations
|
||
of backups will contain files contaminated or destroyed by the virus.
|
||
|
||
Currently 4096 and Joshi-B are the most prevalent of the stealth
|
||
viruses. Once installed in memory, a typical stealth virus will
|
||
insinuate itself between DOS and the user. It will protect itself by
|
||
filtering information passed between DOS and programs.
|
||
|
||
Whenever DOS opens a file, the virus will intercept the call and
|
||
manipulate the file. If the opened file is not infected, it will become
|
||
infected. If the file is infected the virus will make it appear to be
|
||
"clean" by removing itself. Thus anti-viral scanners are unable to
|
||
detect its presence.
|
||
|
||
If the anti-viral software does not scan memory, the stealth virus will
|
||
go completely undetected. In fact anti-viral programs will lie and
|
||
report that the PC is "clean" even as it becomes the primary vehicle for
|
||
infection. Commonly used programs often become the primary source
|
||
for contamination. For instance, typing COPY or XCOPY will cause the
|
||
virus to infect both the original and the new files. Viruses always
|
||
add code to the programs they infect. For instance the 4096 virus will
|
||
increase the size of an infected file by 4096 bytes. Stealth viruses also
|
||
manipulate commands such as DIR that report file lengths. They will
|
||
subtract the length of the viral code from the file size before passing it
|
||
on to the requesting program, making it appear normal.
|
||
|
||
Programs that depend on CRC checks to validate the existence of a
|
||
virus are not effective. They perform their calculations on a "sanitized"
|
||
version of an infected program. This causes the CRC to be correct.
|
||
|
||
The only sure protection is prevention. In the past genuine hardware
|
||
problems have been blamed on viruses. We may now have come full
|
||
circle. Genuine virus problems may be blamed on hardware glitches,
|
||
according to David Stang, chairman of the National Computer Security
|
||
Association. Stang went on to say that the association's BBS (see
|
||
insert) has software and clear instructions for dealing with stealth
|
||
viruses.
|
||
|
||
Insert:
|
||
The National Computer Security Association 4401-A Connecticut Ave.
|
||
NW, Suite 309 Washington, DC 20008 202-364-8252 (Voice)
|
||
202-364-1304 (Data) |