Lecture # 45
Types of Viruses
•Partition Table Virus
•Boot Sector Virus
•File Viruses
How Partition Table Virus Works
•The Partition Table Code is executed at boot time to choose the Active Partition.
•Partition Table Viruses embed themselves in the Partition Table of the disk.
•If the Virus Code is large and cannot be accommodated in the Code Part of 512-
bytes Partition Table block then it may also use other Physically Addressed Blocks
to reside itself.
•Hence at Boot time when Partition Table is to be executed to select the Active
Partition, the virus executes. The Virus when executed loads itself in the Memory,
where it can not be reached by the OS and then executes the original Partition Table
Code (stored in some other blocks after infection) so that the system may be booted
properly.
•When the system boots the Virus will be resident in memory and will typically
intercept 13H (the disk interrupt).
•Whenever a disk operation occurs int 13H occurs. The Virus on occurrence of 13H
checks if removable media has been accessed through int 13H. If so then it will copy
its code properly to the disk first Physical Block (and other blocks depending upon
size of Virus Code). The removable disk is now infected.
•If the disk is now removed and is then used in some other system, the Hard Drive
of this system will not be infected unless the system is booted from this disk. Because
only on booting from this removable disk its first physical block will get the chance
to be executed.
docsity.com
