LESSON 6 MALWARE part I

Table of Contents

6.0 Introduction
6.1 Viruses (Virii)
6.1.1 Introduction
6.1.2 Description
6.1.2.1 Boot Sector Viruses
6.1.2.2 The Executable File Virus

6.1.2.3 The Terminate and Stay Resident (TSR) Virus

6.1.2.4 The Polymorphic Virus
6.1.2.5 The Macro Virus

6.2 Worms

6.2.1 Introduction

6.2.2 Description

6.3 Trojans and Spyware

6.3.1 Introduction

6.3.2 Description

6.4 Rootkits and Backdoors
6.4.1 Introduction

6.4.2 Description

6.5 Logicbombs and Timebombs

6.5.1 Introduction

6.5.2 Description
6.6 Countermeasures

6.6.1 Introduction
6.6.2 Anti-Virus

6.6.3 NIDS

6.6.4 HIDS

6.6.5 Firewalls

6.6.6 Sandboxes
6.7 Good Safety Advice

Further Reading

 

目录

6.0 本节内容介绍

6.1 病毒

6.1.1 简介

6.1.2 描述

6.1.2.1 开机型病毒

6.1.2.2 可执行文档病毒

6.1.2.3 终止后常驻病毒

6.1.2.4 多变体病毒

6.1.2.5 宏病毒

6.2 蠕虫

6.2.1 简介

6.2.2 描述

6.3 特洛伊木马和间谍程序

6.3.1 简介

6.3.2 描述

6.4 隐匿程序和后门程序

6.4.1 简介

6.4.2 描述

6.5 逻辑炸弹和时间炸弹

6.5.1 简介

6.5.2 描述

6.6 应对策略

6.6.1 简介

6.6.2 防病毒软件

6.6.3 网络入侵检测系统

6.6.4 主机入侵检测系统

6.6.5 防火墙

6.6.6 沙盒

6.7 安全建议

深入阅读

 

6.0 Introduction
“Malware” are programs or parts of programs that have a malicious ( “Mal” ) or unpleasant
effect on your computer security. This covers many different terms that you may have heard
before, such as “Virus”, “Worm” and “Trojan” and possibly a few that you haven't like
“Rootkit”, “Logicbomb” and “Spyware”. This lesson will introduce, define and explain each of
these subdivisions of malware, will give you examples, and will explain some of the
countermeasures that can be put into place to restrict the problems caused by malware.

 

6.0 本节内容介绍

“恶意程序”能对电脑安全产生恶意影响的程序。和它相关的有很多的术语，你可能已经听说过，譬如“病毒”，

“蠕虫”和“木马”，也有些你可能不知道：“隐匿程序”，“逻辑炸弹”和“间谍软件”。这节课将介绍，定义和

解释这些恶意软件的分类，给出相关例子，并给出一些防范措施。

 

6.1 Viruses (Virii)

6.1.1 Introduction

Virus – this is the most common type of malware that people will be aware of. The reason that
it is known as a virus, rather than anything else, is historical. The press ran the stories of the first
computer virus at the same time as articles concerning the spread of AIDS. At the time, there
were simple parallels that could be easily drawn between the two, propagation through
interaction with a contaminated party, the reliance on a host and the ultimate “death” of
anything infected. This resulted, and still does occasionally, in concerns that people could
become “infected” with a computer virus.

 

6.1 病毒

6.1.1 简介

病毒-这是大家最熟悉的恶意程序了。之所以这种程序被称为“病毒”而不是其它什么，是有历史意义的（好大的词啊）。

当新闻界在报纸上介绍电脑病毒时，报纸上也有很多的文章在大肆报道艾滋病。在那个时候，这两者之间有一个相似点很

容易的将这两者联系起来，即寄生主体不断繁殖，一旦感染便无药可医。这种通性使人们很担心会感染上电脑病毒。

 

6.1.2 Description
Viruses or virii are self-replicating pieces of software that, similar to a biological virus, attach
themselves to another program, or, in the case of “macro viruses”, to another file. The virus is
only run when the program or the file is run or opened. It is this which differentiates viruses from
worms. If the program or file is not accessed in any way, then the virus will not run and will not
copy itself further.
There are a number of types of viruses, although, significantly, the most common form today is
the macro virus, and others, such as the boot sector virus are now only found “in captivity”.

 

6.1.2 描述

病毒是软件的自我复制，和生物病毒类似，将自己寄生在另外一个程序上。有一种特别的病毒“宏病毒”，将自己寄生

在另外一个文本上。只有当该程序运行或者文件打开时病毒才会进行复制。这种特点是蠕虫不具备的。如果该程序或者

文件不能打开或者运行，那么病毒就永远不能运行，进行复制。

有很多种病毒，但现在最常见的是宏病毒。而像“开机病毒”的病毒已经基本上灭绝了。