I was looking at the tripartite structure of a virus, and it seems to check to see if a computer is infected before infecting it with the virus. Would this be an attempt to use files that are already present to infect, instead of transferring another copy of the virus onto the machine?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
|
|
The goal of most malware is to remain active as long as possible. The longer it can collect keystrokes, participate in DDoS attacks, redirect search results, send spam emails, shows popup ads, etc., the more profitable it is for the creator. To reach this goal, it has to be undetected. If a piece of malware infects a machine twice, it may leave the machine in an undefined state, or cause conflicts. It may also eat up more resources than normal. This can lead to detection through a variety of operations:
The less resources used and the less disturbance caused, the less likely the user is to notice something is wrong. Once a user notices something isn't working properly, they'll try to fix it, which might result in the malware being removed. As such, it's better for the malware creator to prevent these problems and remain covert. |
|||||
|
|
It's partially a business reason rather than a technical reason. I was once reading a blog post that was detailing a sales pitch, and it was heavily stressed by the person selling access to infected machines (for the purposes of spam relaying, stealing credit card info, DDoS, etc) that he wouldn't load multiple binaries onto each bot. The more individual infections a machine has, the more likely it is to be noticed by the user, and the more likely it'll be cleaned. It pays to fly under the radar. |
|||||||||
|
|
The first Internet worm, back in 1988, killed off the Internet (for a little while only, of course) because it did not check properly for its presence before installing itself again. It included a heuristic method which did not work as the author believed it would. All the copies clogged the networks and choked the machines, which was hardly inconspicuous. A virus will want to check for its presence before infecting for the same reasons: to avoid drowning its host under multiple copies of itself. To spread efficiently, the virus must not kill its host too fast (and the same applies to biological viruses, by the way). There is nonetheless a subtlety. There are a few simplistic viruses who damage the files they infect, by writing themselves over whatever instructions were at that emplacement. Such a virus could write and rewrite itself over the same file with no additional ill effect. However, since the original file is damaged, it does not work properly anymore, which makes the virus less invisible, and may prompt the user to do some cleaning. Therefore, efficient viruses copy the instructions around in the infected files, so that they get executed anyway. The infected file is necessarily enlarged in the process. If the virus infects a file repeatedly, then the file might grow without any limit, finally filling up the hard disk, in true 1988 fashion. |
|||
|
|
|
I would add as well, in addition to other answers, that there's can be more than just checking to see if I am infecting the machine twice. I would, if in that field, check to make sure the machine isn't infected with OTHER stuff as well as MY stuff. The more stuff that's installed, the more likely the machine will crash, run slow or something will cause notice to the owner. Preemptive removal of competitors products, as well as verification of no prior version of my product, would help keep the system mine. As mentioned, the goal would be to keep the CPU "mine". That means lay low and don't attract notice. |
|||
|
|
|
The machine may become slow, to the point where it's unusable. For example if a virus continually sends out e-mails other programs would run slower and the network would become saturated and the internet would slow down. |
|||
|
