Lifecycles of a computer virus

Question

According to what I read there are four phases: - Dormant phase - Propagation phase - Triggering phase - Execution phase

I however am having trouble finding a chronological order in how these events occur and a scenario.

1. The user downloads or acquires an infected .exe file
   • Would this be considered the dormant phase? The virus is idle not doing anything.
2. The user executes the infected .exe file
   • Now that the virus is activated it starts to replicate itself into other programs etc.. Is this the propagation period?
3. The user triggers the virus via a system event.
   • This I am guessing is the triggering phase?
4. The virus is now executing it's payload.
   • Finally once the virus has been triggered the payload is obviously executed, this could be harmless or damaging such as displaying text to the user, spamming the network, destroying the hard drive, you-name-it. I am to believe this is the final phase, the execution phase?

Is this how a typical virus works? Or am I lost.

Answer 1

Your chronological order is correct. Viruses can also cycle through this order. From the Computer Security course by Dr. Indrajit Ray at Colorado State:

Dormant phase: The virus is idle. The virus will eventually be activated by some event,

• A date
• The presence of another program or file
• The capacity of the disk exceeding some limit.

Propagation phase: The virus places an identical copy of itself into other programs or into certain system areas on the disk. Each infected program will now contain a clone of the virus, which will itself enter a propagation phase.

• A virus will typically not propagate to another infected program

Triggering phase: The virus is activated to perform the function for which it was intended. Can be caused by a variety of system events

Execution phase: The goal of the virus software is performed

• Harmless - e.g. display message on screen
• Malevolent - e.g. deletion of program or data files

There is an annotated piece of code on slide 8 that shows a virus structure. There are also atypical viruses that deviate from this cycle.

Answer 2

Is this how a typical virus works?

This is how a typical executable infector virus worked. These viruses were common starting in the early 1980s, but were effectively extinct by 2000 or so.

Executable infector viruses spread when users traded executable files which were infected with viruses -- typically by exchanging disks, sometimes through file-sharing BBSes. This sort of file exchange was common in the pre-Internet era, and was in fact the primary way that many users of early home computers would obtain new software.

For this sort of virus, a "latent period" before triggering was essential for the virus to spread. Many viruses would identify themselves to the user or render the computer unusable when they were triggered, so they would be unlikely to spread further after triggering. (No reasonable user would trade a friend a software disk that they knew contained a virus, after all.) A latent period was critical to allow unwitting users to spread the virus.

As most modern software is downloaded from the Internet from an authoritative source, rather than being traded from one user to another, executable infectors are essentially extinct today. The closest modern equivalent is network "worms" -- since these viruses spread themselves, rather than depending on user action, they have no need for a latent period. For example, the Melissa macro virus, which was created in 1999, spread itself by emailing infected documents to the user's contacts. A latent period would only have slowed its spread and allowed users to prepare defenses.