Computer Shopper 87

home *** CD-ROM | disk | FTP | other *** search

/ Computer Shopper 87 / Issue 087 - May 1995 - 0595.iso / virus / glossary.doc < prev next >

Wrap

Text File | 1994-04-17 | 14.5 KB | 313 lines

╔═══════════════════════════════════════════════╗ │ GLOSSARY of TERMS and DEFINITIONS │ ╚▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒╝ Quickies ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ DOS - stands for (D)isk (O)perating (S)ystem, and means specifically that the computer's main operating instructions are all delivered from a disk. In the very first versions of DOS computers, the only way to boot (start up) the machine was from a floppy disk which had to be in the A: drive. From XT styled computers on, it has been possible to store the boot instructions on the hard disk drive instead. All DOS compatible computers can still be started from a floppy disk in the A: drive, if or when necessary, usually necessary when removing a virus infection from the computer. BOOTING the computer - starting up the computer and loading the DOS operating system. With most computers nowadays this is done from the Hard Drive when the machine is turned on. HARD BOOT - specifically re-booting the computer by turning it OFF, then back ON. SOFT BOOT - re-booting the computer by using either the RESET button, or pressing keys <CTRL-ALT-DEL> simultaneously. WARM BOOT - same as Soft Boot. DOS disk, or BOOT disk - a floppy disk on which a version of the DOS operating system exists which in the A: drive boots the computer. WRITE protected BOOT disk - DOS disk which has been WRITE protected, either with a small tab (if a 5¼" disk), or a small slide (if a 3½" cookie disk). Viruses cannot infect disks which are write protected. You should ALWAYS have on hand a clean write protected boot disk, meaning that you "" KNOW "" not `think' that the disk is free of viruses. Use this disk to re-boot the computer when getting ready to remove a virus. RAM - the computer's (R)andom (A)ccess (M)emory bank, usually just called `memory', and consisting of memory (RAM) chips. BOOT RECORD - all floppy disks and hard disk partitions contain another data structure called the Boot Record, or DOS Volume Boot Record, created by FORMAT.COM. This is another critical data structure. On a Hard Drive, the data on the DOS Volume Boot Record should match exactly the data found in the Partition Table (also called Master Boot Record). Like the Partition, the Boot Record is exactly one sector long (512 bytes). DOS uses the information in this record to figure out where the FAT and root directory are stored and what is the capacity of the disk. Without this important data structure, DOS cannot access the media. MBR - the (M)aster (B)oot (R)ecord is also called the PARTITION TABLE. (See Partition Table.) FAT - the (F)ile (A)llocation (T)able is the way DOS keeps track of the files. Each file exists on the disk as fragments in individual cells that are not necessarily contiguous. The File Allocation Table is this part of DOS that maintains a record of where on the disk all the parts of a file are stored. There are two exact copies of the FAT on each hard disk or floppy disk. PARTITION TABLE - the Partition Table (Master Boot Record) exists only on Hard Drive, not on floppies. The Partition Table tells the BIOS (Basic Input Output System) which operating system to use at boot up, and where it is located on your hard drive. It is because of this "Partition Table" that it is possible to have more than one operating system on the same hard disk, or to get on the same physical hard disk two or more separate logical drives (e.g. C:, D:, E:). The Partition Table indicates where each part starts and stops, and which part contains the operating system to use at boot up. Before you can even format a hard drive and put an operating system on it, FDISK writes on the first physical sector of the Hard disk (Cyl.0, Side 0, Sector 1) all the information needed by the BIOS (Basic Input Output System) to be able to figure out how the Hard Drive is divided in terms of data structure. The Master Boot Record basically identifies the different divisions on the hard drive, also called partitions. It is 512 bytes long, exactly one sector. SWITCH Dos prompt to A: - some users work so constantly through a word processor or X-Tree, that switching drives is always done automatically by the program. Thus the instruction 'Switch to the A: prompt' has little or no meaning to users of those programs. It means specifically, exiting the program until a Dos prompt is on screen, usually C:, then typing: A: , then pressing the Enter key and seeing the Dos prompt switch to A:, which means that the A: floppy disk drive is now ready to read the disk inserted in it. HYPERDOC - word coined by us to refer to a special menu which lists all of ALERT's pop-ups, quick previews, and help documents as options, and from which you can select any one by pressing the appropriate key. LOG REPORT - for any virus Scan or Clean run, a report of that run is automatically SAVED as an ordinary text file, so it can be viewed at leisure if needed. The Report file is normally saved to the C: drive as a file called: C:\ALERT.LOG All ALERT menus have an option for viewing the report directly from the menu. You can also use any text editor or word processor. FALSE POSITIVES - are viruses which show up in SCAN checks, but are not actually present. How to recognize a 'False Positive' and what to do about one, is discussed near the beginning of the 'Advanced Readers Doc', option (R) in the Help menu. PACKED - packed (or compressed) files are program files which have been compressed by space savers but still run as an executable program. Virus ALERT does not scan inside packed files since the original virus codes can't operate. But ALERT does scan compressed files of themselves, because a virus can attach to a compressed file, no problem. ZIPPED - zipped (also called compressed not to confuse anyone) are files which have been compressed collectively into clumps for storage, or transmission along expensive phone lines. Alert does not scan inside zipped files because there is nothing to scan except the one big clump, which it scans anyway. However, a virus which was in a file before the compression, will be active again as soon as the zipped file is unzipped. So obviously, always scan a newly unzipped set of files before attempting to use them. Say what? Always scan a newly unzipped set of files before attempting to use them. Say what? Always scan... Longies ▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒ ░░ BOOT SECTOR VIRUSES VERSUS FILE INFECTING VIRUSES ░░ Boot Sector viruses - Any hard drive (disk) and all floppy disks have a boot sector. This is the special start up area of the disk which Dos reads in order to gain access to the disk in order to work with it. Boot sector viruses target just this boot sector area of the disk, leaving the data area alone. Boot sector viruses can infect any disk, whether the disk is specifically for booting the computer or not - it makes no difference. Many Boot sector viruses also target the Partition table. Some viruses can get into the FAT table but this is very rare. If an infected floppy disk is used to boot the computer from the A: drive (even if by accident, like leaving the disk in the A: drive overnight so it is still present in the A: drive when the computer is next booted), the virus will infect the boot sector of the computer's hard drive. If the hard drive is infected, the virus moves into Ram every time the computer is booted from the hard drive (in most computers, this means every time you turn it on). The virus is then able to jump to the boot sector of any floppy disk which is accessed during the day, for example when copying to the disk from the hard drive. ░░ FILE (program) INFECTING VIRUSES File infecting viruses infect executable files, i.e. programs. When you execute an infected program, the virus puts itself into Ram, and then proceeds to copy itself into every program which is loaded during the day, or in some cases even just looked at by Dos, as when checking a directory. Some of the nastier viruses have double hooks, meaning they are both a boot sector virus and a file infecting virus. ░░ The difference between a signature code based antivirus and the so called heuristic approach: Most antivirus scanners identify viruses strictly by the virus's signature code, strictly on a one to one basis of exact match with each known variation. Therefore most antiviruses cannot detect new viruses, or even new variations of old ones. The reason for this 'no leeway' approach to scan matching is that the scanner has to determine the exact name of the virus in order for the cleaner to know exactly what steps to take to remove it, and to reverse its effects. But Virus ALERT uses a unique 'completely heuristic' method of virus removal, in which the cleaner effectively disassembles and emulates the infected file, and then uses this analysis to reconstruct the original file and remove the unwanted virus codes. It doesn't care in the slightest what the signature code of the virus is, and it cares even less about the original uninfected state of the file. Therefore, the generic cleaner has the ability to clean both known and unknown viruses with equal aplomb. But that takes the pressure completely off the scanner to have to plow through a long list of exact virus signature variations looking for exact matches. And so Virus ALERT has been freed to use both a generic 'family' signature code basis for scanning, combined with a heuristic method. Thus instead of scanning for a specific code for every variation of a given virus family, Virus ALERT has only to scan for the simple distinct identifiers which mark any given variation as a member of the specific family. Similarly, Virus ALERT might also look at the first jump of a program file. If the jump goes to an instruction to format the hard drive, and the file was 'not' the Dos 'FORMAT.COM' utility for formatting disks, then the scanner can pretty much conclude the instruction is part of a virus. (Not an actual case, but a neat example.) The result is a scanner which has blinding speed and unerring accuracy. For example, in a recent test, the Virus ALERT scanner scanned a very large test hard drive in 3 minutes and 40 seconds. Whereas the world's currently most popular antivirus took 29 minutes and 9 seconds. Plus Virus ALERT found 95.5% of all viruses in a recent test, while the other found only 91.5%. Plus, for example, Virus ALERT will detect (say) all 100+ current mutants of the Jerusalem virus, plus any new ones, whereas the other will only detect about 30 or 40 variations, and no new ones unless specially configured. Since time is money, the value of this speed and accuracy on a big site cannot be overestimated. The actual mechanisms ALERT uses for heuristic scanning and cleaning are detailed in the 'Advanced Readers Doc', option (R) in the Help menu. FINISHED press ESC to exit