0

I've been always curious about understanding about how virus carry out their activities. For that reason, I've read a lot of books and articles about different types of viruses and the way they operate in a system. One thing that I have never found anywhere and I am really curious about is this:

For instance, let's say I have successfully developed a virus and I've made it penetrate into a system. At this moment, what is the point, how that specific virus can start up its job. Do they automatically launch themselves without the user being involved ? I mean an event requires to be triggered to fire an action, if the virus is copied in the hard drive, what makes it run and carry out its evil duty ? I mean without being double clicked.

I found that in linux it can be done by writing certain scripts but when it comes to windows, I think the os doesn't have such feature. So I would appreciate you if you satisfy my curiosity.

6
  • 2
    You might get better answers over at Information Security - as it is, this question may be considered not on-topic here. If you want, you can flag your own question for the mods to migrate it - do not cross-post, please.
    – Bob
    Sep 7, 2013 at 13:09
  • @Bob: I will move the question, thanks for letting me know.
    – First Last
    Sep 7, 2013 at 13:10
  • And, no, nothing can execute by itself. Generally, you rely on exploiting some service on the machine listening for connections (e.g. a webserver), or you rely on something on the machine (e.g. the user) somehow obtaining your executable and running it, possibly bypassing something meant to prevent execution (e.g. a browser, and plugin code, e.g. Java/Flash).
    – Bob
    Sep 7, 2013 at 13:11
  • The virus does not necessarily have to be an executable. Yes it requires an event triggered before virus can launch itself into action, but that event can be hidden into something as simple as opening a PDF file using Adobe Reader. Or if you want something that uses event trigger that requires no user intervention.. check Duqu worm (True-Type font parse engine abuse) that allows the virus/worm to inject themselves in without any user intervention, but simply visiting an infected website.
    – Darius
    Sep 7, 2013 at 13:14
  • @FirstLast, of course Windows has scripts. And to answer your question, yes, something has to run the program whether it is the user or some kind of automatic execution. Due to this requirement, exploits have become quite popular for malware. This question asks the same basic thing as what you have always wondered.
    – Synetech
    Sep 7, 2013 at 14:30

1 Answer 1

1

There are many different types of viruses.

They are normally designed in such a way that they exploit weak security points in systems, applications and users' knowledge. Some of them are executed through user events, such as opening your Outlook e-mail reader and clicking on a link that loads a webpage that executes evil JavaScript (this JavaScript evil software is typically associated with scams or low profile commercial practices).

Some others exploit operating system user rights to write a hidden binary file to a directory where it will be executed from later on by exploiting another vulnerability at the application layer. Most viruses exploit more than one vulnerability to do their job and sometimes can be hidden in your system for a long time, awaiting a secondary event to take place and allow them to be executed.

1
  • > some others exploit operating system user rights to write a hidden binary file to a directory where it will executed later on for this to happen, malicious code must have already been executed - probably through one of the other attack vectors. (Please consider separating into more paragraphs, and maybe using bullet points to highlight the distinct attack vectors; maybe even expand on them a bit. That could make this an easier to read and even better answer!)
    – Bob
    Sep 7, 2013 at 13:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .