B. The major difference between viruses and worms is that worms are self-replicating whereas

Other security packages, such as the popular Tripwire data integrity assurance package, also provide a secondary antivirus functionality. Tripwire is designed to alert administrators of unauthorized file modifications. It’s often used to detect web server defacements and similar attacks, but it also may provide some warning of virus infections if critical system executable files, such as COMMAND.COM, are modified unexpectedly. These systems work by maintaining a database of hash values for all files stored on the system see Chapter 9, “Cryptography and Pri- vate Key Algorithms,” for a full discussion of the hash functions used to create these values. These archived hash values are then compared to current computed values to detect any files that were modified between the two periods. Virus Technologies As virus detection and eradication technology rises to meet new threats programmed by malicious developers, new kinds of viruses designed to defeat those systems emerge. The following sections examine four specific types of viruses that use sneaky techniques in an attempt to escape detec- tion—multipartite viruses, stealth viruses, polymorphic viruses, and encrypted viruses. Multipartite Viruses Multipartite viruses use more than one propagation technique in an attempt to penetrate sys- tems that defend against only one method or the other. For example, the Marzia virus discov- ered in 1993 infects critical .COM and .EXE files, most notably the COMMAND.COM system file, by adding 2,048 bytes of malicious code to each file. This characteristic qualifies it as a file infector virus. In addition, two hours after it infects a system, it writes malicious code to the system’s Master Boot Record, qualifying it as a boot sector virus. Stealth Viruses Stealth viruses hide themselves by actually tampering with the operating system to fool antivirus packages into thinking that everything is functioning normally. For example, a stealth boot sec- tor virus might overwrite the system’s Master Boot Record with malicious code but then also modify the operating system’s file access functionality to cover its tracks. When the antivirus package requests a copy of the MBR, the modified operating system code provides it with exactly what the antivirus package expects to see—a clean version of the MBR free of any virus signatures. However, when the system boots, it reads the infected MBR and loads the virus into memory. Polymorphic Viruses Polymorphic viruses actually modify their own code as they travel from system to system. The virus’s propagation and destruction techniques remain exactly the same, but the signature of the virus is somewhat different each time it infects a new system. It is the hope of polymorphic virus creators that this constantly changing signature will render signature-based antivirus packages useless. However, antivirus vendors have “cracked the code” of many polymorphism tech- niques and current versions of antivirus software are able to detect known polymorphic viruses. The only concern that remains is that it takes vendors longer to generate the necessary signature files to stop a polymorphic virus in its tracks, resulting in a lengthened period that the virus can run free on the Internet.