16 What are "fast" and "slow" infectors? (Computer virus)
Description
This article is from the Computer Viruses FAQ, by Nick FitzGerald n.fitzgerald@csc.canterbury.ac.nz with numerous contributions by others.
16 What are "fast" and "slow" infectors? (Computer virus)
A typical file infector (such as the Jerusalem) copies itself to memory
when a program infected by it is executed, and then infects other
programs when they are executed.
A FAST infector is a virus that, when it is active in memory, infects
not only programs which are executed, but even those that are merely
opened. The result is that if such a virus is in memory, running a
scanner or integrity checker can result in all (or at least many)
programs becoming infected. Examples are the Dark Avenger and the Frodo
viruses.
The term "SLOW infector" is sometimes used to refer to a virus that only
infect files as they are modified or as they are created. The purpose
is to fool people who use integrity checkers into thinking that
modifications reported by their integrity checker are due solely to
legitimate reasons. An example is the Darth Vader virus.
Continue to:
My Books
