{"id":881,"date":"2013-03-01T20:31:24","date_gmt":"2013-03-02T04:31:24","guid":{"rendered":"http:\/\/e-olio.com\/cknow\/cms\/?p=881"},"modified":"2013-04-01T20:42:06","modified_gmt":"2013-04-02T03:42:06","slug":"files","status":"publish","type":"post","link":"https:\/\/www.cknow.com\/cms\/vtutor\/files.html","title":{"rendered":"Files"},"content":{"rendered":"

While more in number, file infectors are not the most commonly found. They infect in a variety of ways and can be found in a large number of file types.<\/strong><\/p>\n<\/div>In terms of sheer number of viruses, these were the most numerous for some time. However, because of bugs in the virus code, they have not been the most widely spread.<\/p>\n

The simplest file viruses work by locating a type of file they know how to infect (usually a file name ending in .COM or .EXE) and overwriting part of the program they are infecting. When this program is executed, the virus code executes and infects more files. These overwriting viruses do not tend to be very successful since the overwritten program rarely continues to function correctly and the virus is almost immediately discovered.<\/p>\n

The more sophisticated file viruses save (rather than overwrite) the original instructions when they insert their code into the program. This allows them to execute the original program after the virus finishes so that everything appears normal.<\/p>\n

Just as system sector viruses can remain resident in memory and use stealth techniques to hide their presence, file viruses can also hide this way. If you do a directory listing, you will not see any increase in the length of the file and if you attempt to read the file, the virus will intercept the request and return your original uninfected program to you.<\/p>\n

Some file viruses (such as 4096) also infect overlay files as well as the more usual *.COM and *.EXE files. Overlay files have various extensions, but .OVR and .OVL are common (overlay files are almost never used today; they are something you found in the MS-DOS days). Files with the extension .DLL are also capable of being infected (but generally are not; typically they are only libraries of functions). Indeed, as operating systems become more advanced, typically more files become able to contain executable code and thus be vulnerable to infection. (See the file extension list<\/a> for a more complete summary.)<\/p>\n

Summary<\/h4>\n