System information

18 Kaspersky Internet Security 2009
other computers can occur only if the virus adds itself to a file stored in a shared
folder or on a CD, or if the user forwards an e-mail message with an infected
attachment.
The code of a classic virus is usually specialized to penetrate a particular area of
a computer, operating system or application. Based on the environment, there is
a distinction between file, boot, script and macro viruses.
Viruses can infect files using various methods. Overwriting viruses write their
own code to replace the code of the infected file, destroying the original contents
of the file. The infected file stops working and cannot be disinfected. Parasitic
viruses modify files leaving them fully or partially operating. Companion viruses
do not modify files but duplicate them, so that when the infected file is opened, its
duplicate, that is the virus, will run instead. Other types of viruses include link
viruses, OBJ viruses that infect object modules, LIB viruses that infect compiler
libraries, and viruses that infect original text of programs.
Worm
After it penetrates the system, a network worm, similarly to the classic virus,
becomes activated and performs its malicious action. The network worm is
named for its ability to tunnel secretly from one computer to another, to
propagate itself through various information channels.
Worms are categorized by their primary method of proliferation, which are listed
in the table below:
Table 1. Worms categorized by the method of proliferation
TYPE
NAME
DESCRIPTION
IM-
Worm
IM worms
These worms propagate through IM (instant
messaging) clients, such as ICQ, MSN
Messenger, AOL Instant Messenger, Yahoo
Pager and Skype.
Usually these worms use contact lists to send
messages containing a link to a worm file on a
website. When a user downloads and opens the
file, the worm is activated.