In the last lecture we saw on the virus, the working of virus.
So now once you know how the virus performs in this lecture, you will see the different types of viruses.
But before that, we will see indications of virus attacks.
So what are the indications of a virus attack?
Well, computer beeps with noticeably then try will automatically changes are the most common is a constant
pop up window appears on your screen.
Well, if the system acts in an unprecedented manner, you can suspect virus attack.
However, not all glitches can be attributed to virus attacks due to misconfiguration or the hardware
failure when the system can act abnormally.
But that does not mean that every abnormal behavior type is a virus.
Well, suspicious hard drive activity or freezing of browser window suddenly can also be an indication
providers could.
As a security expert, you must be able to tell why this is causing a virus attack.
What are the implications of that?
Suppose a victim comes to you and tells you that this is this is happening.
You should be able to identify which attack is going on, which type of virus has been affected.
That victim's computer lack of storage space can also be an indication of virus attack.
Since the virus replicates itself, it eats up a lot of space on your hard drive.
How does a computer get infected by a virus?
What is the type of the propagation of a virus when?
Well, when a user accepts files and downloads without checking properly from the source.
Security experts always tell you to check the hashes or download the files only from the legitimate
source, then opening infected email attachments that is phishing or installing pirated software.
This is one of the most important way of propagating a virus.
Never download pirates off the list.
Security experts always tell the new lonas that it is always better to pay the price for the software
rather than paying thousands of dollars to recover the data.
They're not updating and not installing new versions of plugins using portable medias, clicking malicious
online ads.
Connecting to untoasted networks are some of the ways in which a computer can get infected by viruses.
Now let us see one by one what other types of viruses.
Make sure you closely listen to this video, because as a certified professional or as a cybersecurity
enthusiast, you must be able to tell the difference between two viruses.
Because if anyone comes at you telling the cause or what is happening, you can just simply say that
it's a virus.
You have to be specific.
Such questions are asked during interviews because clearing these fundamental is more important than
running the tools.
Anyone can run the tools, but it is more important to know the concepts behind these tools.
So let us start with the first type of virus that is system and is music to various moves.
And B.R. that is master would record to another location on the hard drive and copy itself to the particular
location of the master would record.
This is known as the system or the board Securus.
So what it does is this word is copy's the NBA to some random location and NBA location is very important
for a system.
And what this world does is that these this word is copies itself into the mean mood location so that
it gets to replicate itself.
This is the main function of a board Securus.
The next is the fireworks file, whereas in infect files which are executed or interpreted in the system
such as Comm, ETECSA, ASIC or OPG Emeny and backfills file viruses can either be direct action or
memory loss.
The next step is the multipotent and macro viruses.
Multipotent viruses infect the system, butel sector and executable files at the same time.
So seehofer.
Destructible viruses are macro viruses, infect the files, created a Microsoft Word or Excel.
So whenever an Excel file is corrupt or if you observe that Excel files behaving abnormally, you can
guess that it may be Makarova else.
Most macro viruses are written using macro language that is visual basic for applications.
VVA macro viruses infect templates or convert infected documents into template files while maintaining
the appearance of ordinary document files.
The next is cluster and stealth viruses.
Cluster viruses modify directly table increase so that points users or system processes to the virus
could.
Instead of the actual program, cluster viruses will launch itself first when any program in the computer
system is started.
Still, tourists are also known as bundling letters, donating letters this year.
The antivirus software, but intercepting its request to the operating system.
This virus can hide itself by intercepting the antivirus software.
The request to read the file and passing the request to the virus instead of the operating system.
The next is the encryption virus.
This type of virus uses simple encryption to answer for the call, the virus is encrypted with a different
key for each infected file polymorphic virus, a polymorphic core, is a code that mutates while keeping
the original algorithm intact.
So a well-written polymorphic virus, therefore, has no part that is that stay the same on the same
infection so you can see this virus and replicated over and over the time.
So you can see how dangerous it is.
The next is metamorphic virus.
I haven't listed the morphic viruses, but I would like to give a short description.
Metamorphic viruses rewrite themselves completely each time they are to infect a new executable.
So from the description itself, these viruses are dangerous.
You mean viruses are the types of viruses which are commonly found into e-mail attachments that infect
PCs?
File extension viruses are the viruses which are inside the file extension, for example.
There is a file known as File Dot, BHP dot.
The original file is a BHP file, but it is a hide or hidden inside would be defined.
So this is how these viruses play an important role.
And as a security student, you must be able to distinguish between these viruses if you have interest.
We have provided some links so that you can go to those links or then you can go on Google and search
for these types of viruses.
What are the virus detection methods now?
In order to identify which virus is has been affecting the system, it is important to detect those
viruses.
There are five steps in detecting notice.
The first is scanning.
Once the virus has been detected, it is possible to write scanning programs that look for signature
screen characteristics, the virus, the nexted integrity, checking integrity, checking products,
work by reading the entire disk.
Recording Integrity Data then acts as a signature.
Next is Interception The Intercept to monitors the operating system requests that are written to the
disk code execution or code emulation encoding techniques.
The antivirus executes the malicious code inside a virtual machine to simulate the CPU and memory activities.
Therefore, from this, the antivirus software on the company was launched.
The antivirus can get an idea of how the virus works.
Basically the reverse engineering task.
The last one is juristic analysis.
Juristic analysis can be static or dynamic in static analysis.
The antivirus analyzes the file format and chord structure to determine if the code is worded in the
next lecture, which is going to be the last lecture of malware that we will see how to defend against
these attacks.