Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've always been curious about understanding how virus carry out their activities. For that reason, I've read a lot of books and articles about different types of viruses and the way they operate in a system. One thing that I have never found anywhere and I am really curious about is this:

For instance, let's say I have successfully developed a virus and I've made it penetrate into a system. At this moment, how that specific virus can start its job. Do they automatically launch themselves without the user being involved ? I mean an event requires to be triggered to fire an action if the virus is copied in the hard drive .What makes it run and carry out its evil duty without even being double clicked (started explicitly).

I found that in Linux it can be done by writing certain scripts but when it comes to Windows, you can't do this. An insight on the above would be appreciated.

share|improve this question
    
If your virus already managed to penetrate into a system, it should have infected all executables it could reach, read contacts and mail addresses and then spread the word to everyone it could. –  ott-- Sep 8 '13 at 17:27
add comment

3 Answers

up vote 1 down vote accepted

(This is a very non-technical description of the whole process. Feel free to comment and ask)

The mechanism in practice is the same in all systems and it has much to do with why these things are called viruses instead of, say, bacteria.

A virus is not "alive" in that it lacks essential machinery. What it does is hijack the machinery of a more complex entity such as a cell, and make it do its bidding -- the virus may be no more than a hijacking mechanism with the "bidding" list as payload.

A computer virus is very similar to this simple structure.

How does the hijacking work?

A computer system has to have a boot sequence - first you do this, then you do that, further instructions are here, then... - and an action sequence (which is used to launch programs).

For example when you try to run an executable file, the system opens the file, finds out what it needs (and complains if it can't fulfill those needs - "missing library" for example), finds out how to place all the components packed in the .exe file in memory, determines where to do it, updates the components with information about each other so that they can communicate, unpacks the components and places them in the prepared places in memory, and finally releases a measure of control to the component marked "first".

The virus hijacks this process by (two examples):

  • locate the list of places where executable code is going to be activated (MBR, boot sector, OS loader, OS stub, auto-executing scripts, boot processes, ...)
  • inject itself into this list, so that the system has one more thing to do when it starts, and that thing is breathing life into the virus chrysalis. This can be done by modifying the OS's list of things to do, or by placing itself in some convenient place such as the auto-run folder or Run registry branch in Windows. Anything placed there will be run at startup.
  • or it can replace one of the components, saving it somewhere else. When the system activates the component believing it to be legit, the virus does its thing, then it also retrieves the hibernated component and activates it as if it was the system. So in effect the sequence is again one step longer, but "officially", from outside, the number of steps is unchanged.

The virus may also write itself inside the diagnostic routines of the OS so that they report nothing out of the ordinary. This process may be run very close to the hardware, so that the infection is very difficult to detect.

To infect executables the virus does the same in a slightly different way. It can modify the internal "manifest" of the file so that the system will actually run the virus. The virus will then extract from its bloated "body" the carcass of the original process, and activate it in turn. The user will see the desired process running and not notice the slight delay in activation.

Disinfection requires knowledge of the virus so that the original file can be extracted from the infected object, and used to replace it altogether.

More sophisticated ways of hiding exist: many executable files have internal areas that are mostly zeroes, used as temporary storage of one kind or another. The virus hides there, and only does a slight modification to the file so that the "first component" to be activated isn't the original one but the empty area where the virus now resides. Being "inside" the file, the file size is now unchanged. The virus, upon receiving control, will move itself to some other place, again zeroing back the area (in memory) where it was hiding, and pass control to the old "first component", which will then notice nothing amiss.

share|improve this answer
    
@Iserni: What you explained is very right and logical but I mean how the first action which can range from locating the file in the vulnerable location or injection into another file, how is that first action triggered, especially when the virus is in an offline source like a USB drive where the autorun.inf is fully disabled. (win7 and higher version) and without formatting the drive in U3 form or forcing it to appear a hard drive. –  First Last Sep 7 '13 at 13:35
    
In that case, the virus should have been effectively rendered inert. With no autorun, nothing will ever "wake" the virus. There is still the possibility of an exploit loader, though, if (for example) the OS reads some information from the drive, such as the icon, whose format has been corrupted in such a way as to trigger a vulnerability in the OS itself. I'm not aware of such a vulnerability with code-running properties, though. –  lserni Sep 7 '13 at 13:42
    
Social engineering is also possible, though. Consider a USB key with an infected document or executable, labeled 'Confidential Economic Plan' or 'Kinky Pictures', or maybe "Unlock". It has been demonstrated as an effective vector (Schneier: schneier.com/blog/archives/2012/07/dropped_usb_sti.html ) –  lserni Sep 7 '13 at 13:45
    
A possibility, however, is to thwart your assumptions. Maybe that thing is not an USB key at all even if it looks and behaves like one. See for example pentest.netragard.com/2011/06/24/… –  lserni Sep 7 '13 at 13:52
add comment

Every program is a process in the system, and virus is no exception. any process should start by a parent process(in Linux there is just one first process called init and no process can run before it). so a virus should start running by the user(like starting a malcious program) or by another program in the system(for example if someone can put code in a place where the system checks to find any executable and run it like cron in Linux).

share|improve this answer
    
Thanks for your answer Amir, I know about how to do it linux, but I was curious how virus specially those which penetrate to a system in off-line mode like usb drives, how do they exploit windows services ? I mean how the system gets infected once the usb is inserted for example ? –  First Last Sep 7 '13 at 13:26
    
I'm not a virus pro, I just wanted to tell you that viruses can not start by themself, not in Linux nor Windows. –  Soosh Sep 7 '13 at 13:30
    
:) Thank you Amir for your help anyway. –  First Last Sep 7 '13 at 13:31
    
welcome, remember: a robot can not wake himself up and remember the rule of causality. :) –  Soosh Sep 7 '13 at 13:50
add comment

This can happen multiple ways, but generally it happens when the infected code gets executed.

In the case of an infected executable file, the virus will be activated when this executable runs, either because the user clicked it or because the program was added to one of the many places in e.g. Windows that can cause programs to run on startup. If it's a macro virus in a Word document, the virus activates when someone opens the document. Another very common possibility is boot sector viruses. These may infect either the MBR (Master Boot Record) of the disk or the boot sector of the operating system partition itself. Both boot sectors carry a small amount of code that is executed as part of the system booting. The virus can insert itself there (usually the main body of the virus code will be somewhere else on the disk, so it is only the loader that is inserted here) so it is loaded as part of system startup. Since the next step will typically be to load the o/s (like Windows, Linux) it needs to set things up so that it can still be active within the o/s-world, there's many ways to do this but it's outside the scope of the question.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.