Direct Action File (Transient) viruses


The trigger can be made to set off at a particular time, event, certain number of times a program is used, the physical condition of the disk (e.g. when it is becoming full), or almost anything depending on the fancy of the author. Once this condition is met, the trigger goes off, the virus becomes active and starts replicating. It is at this stage or at an optional final-stage that it causes the damage it is programmed to do.

Keep in mind, however, that many of the PC viruses do not contain the pre-trigger phase and hence become active as soon as the infected program is run.

Categories of Viruses

Viruses are generally classified by what they infect. By this classification, they fall into two basic categories: partition table/boot sector and file viruses. Some prefer to classify partition table viruses and boot sector viruses separately, but since partition table viruses infect the boot sector of the floppies, we chose not to categorize them separately. Among file viruses, there can be a number of demarcations and boundaries. Some viruses only infect COM files, others infect only system files, and others behave differently in memory but we believe such distinctions are academic.

Those viruses that terminate their execution along with the termination of execution of the infected program are termed as Direct Action File Viruses (DAFV). It is simpler to write such viruses as no memory management has to be done because the activities of the DAFV cease when the program execution ends. In a general case, the action would be as follows:


<< First   < Prev     Next >   Last >>