What are the types of computer viruses?

Classification according to the attributes of computer viruses. Computer viruses can be classified according to the following attributes.

1. Classification according to the media in which viruses exist:

1. Network viruses - spread through computer networks and infect executable files in the network.

2. File virus - infects files in the computer (such as COM, EXE, DOC, etc.).

3. Boot virus - infects the boot sector (Boot) and the system boot sector (MBR) of the hard disk.

2. Divide according to virus infection channels:

1. Resident virus - after this virus infects the computer, it places its own memory-resident part in the memory (RAM) , this part of the program hooks up to the system call and merges it into the operating system. It remains active until shutdown or restart

2. Non-resident virus - this virus gets an opportunity It does not infect computer memory when activated. Some viruses leave a small part in the memory, but do not infect through this part. Such viruses are also classified as non-resident viruses.

3. Classification based on destructive capabilities:

1. Harmless type - except for reducing the available space of the disk during infection, it has no other impact on the system.

2. Non-dangerous type - this type of virus only reduces memory, displays images, makes sounds and similar effects.

3. Dangerous type - this type of virus causes serious errors in computer system operation.

4. Very dangerous type - this type of virus deletes programs, destroys data, and clears important information in the system memory area and operating system.

4. Classification based on algorithm:

1. Companion virus - this type of virus does not change the file itself. They generate a companion of the EXE file based on the algorithm, with the same name. and different extensions (COM), for example: the companion of XCOPY.EXE is XCOPY-COM. The virus writes itself into the COM file and does not change the EXE file. When DOS loads the file, the companion is executed first, and then the companion loads and executes the original EXE file.

2. "Worm" type virus - spreads through the computer network, does not change files and data information, uses the network to spread from the memory of one machine to the memory of other machines, and the computer transmits its own virus through the network send. Sometimes they exist in the system and generally occupy no other resources except memory.

3. Parasitic viruses - Except for companion and "worm" types, other viruses can be called parasitic viruses. They are attached to the boot sector or files of the system and spread through the functions of the system. , can also be subdivided into the following categories according to its different algorithms.

4. Practice virus. The virus itself contains errors and cannot spread well. For example, some viruses are in the debugging stage.

5. Mysterious viruses generally do not directly modify DOS interrupts and sector data, but modify the inside of DOS through device technology and file buffers. It is not easy to see resources and use more advanced ones. technology. Use the free data area of ??DOS to work.

6. Variant viruses (also known as ghost viruses). This type of virus uses a complex algorithm to make each copy it spreads have different content and length. Their general approach is a decoding algorithm mixed with irrelevant instructions and a modified virus body.

5. Destructiveness

1. Benign viruses

2. Malignant viruses

3. Extremely malignant viruses

6. Infection methods

1. Boot sector viruses mainly spread in the operating system through floppy disks, infect the boot sector, spread to the hard disk, and can infect the "main computer" in the hard disk. boot record".

2. File-type viruses are file infectors, also known as "parasitic viruses." It runs in computer memory and usually infects files with extensions such as COM, EXE, SYS, etc.

3. Hybrid viruses have the characteristics of both boot sector viruses and file viruses.

4. Macro viruses refer to macro codes stored in Office documents by virus programs written in BASIC language. Macro viruses affect various operations on documents.

7. Connection method

1. Source code viruses attack source programs written in high-level languages. They are inserted into the source program before compilation, and are compiled and linked together with the source program into an executable form. document. Source code viruses are rare and difficult to write.

2. Intrusive viruses can use themselves to replace some modules or stack areas in normal programs. Therefore, this type of virus only attacks certain specific programs and is highly targeted. It is generally difficult to find and difficult to remove.

3. Operating system viruses can use their own parts to join or replace some functions of the operating system. Because they directly infect the operating system, this type of virus is also more harmful.

4. Shell viruses usually attach themselves to the beginning or end of normal programs, which is equivalent to adding a shell to normal programs. Most file-based viruses fall into this category.

Extended information:

In order to replicate itself, the virus must be able to run code and write to memory. For this reason, many viruses attach themselves to legitimate executable files. If the user attempts to run the executable file, the virus has a chance to run. Viruses can be divided into two categories based on the behavior they exhibit when running.

Non-resident viruses will immediately look for other hosts and wait for opportunities to infect them, and then transfer control to the infected application. Resident viruses do not search for other hosts when they are run. In contrast, a resident virus loads itself into memory and hands control over to the host. The virus runs in the background and opportunistically infects other targets.

Resident viruses contain a replication module whose role is similar to that of non-resident viruses. The replication module is not called by the search module in resident viruses. The virus loads the replication module into memory when it is run and ensures that the replication module is called when the operating system performs certain actions.

For example, the copy module is called when the operating system runs other files. In this example, all files that can be run will be infected. Resident viruses are sometimes divided into fast and slow infectors. Rapid infectors will try to infect as many files as possible.

Baidu Encyclopedia Computer Virus