Stealth Virii
- Stealth virii hide the modifications they make to your files or boot records.
- They hide this by monitoring the system functions of the OS used to read the files or sectors and by forging calls to such functions.
- Therefore programs that try to read the files or sectors see the original uninfected version.
- This helps hide it from Anti-Virus, another way a stealth virus does this is to sit in memory while you run the AV.
- The first DOS virus, Brain, was a stealth virus .
- This boot sector virus monitors physical disc I/O operations and redirects the OS every time it tries to read an infected sector.
- Stealth virii usually have either size stealth or read stealth properties.
- Size stealth virii are the file infectors, the virus attaches itself to an executable and then replicates which makes the file grow, so the virus shows a copy of the uninfected size which is the first thing it looks at upon infection (after checking for itself).
- Read stealth virii are of the Brain variety.
|