Malicious Mobile Code

Types of DOS Viruses

DOS computer viruses (we are purposely ignoring macro viruses for now) can be classified in the following major categories:

• Boot or file infector

• Memory-Resident or nonresident

• Appending or overwriting or companion

• .COM or .EXE infector

Boot Viruses

In order for a pure boot virus to infect a hard drive, the PC must have attempted to boot with an infected floppy diskette. I run into people all the time with PCs that are infected with boot viruses and are convinced they did not boot, even accidentally, with a floppy diskette. But it had to have happened! What these people mean is they did not intentionally mean to boot with a floppy diskette. Often they don’t understand that a boot virus can be present on any diskette. It doesn’t have to be bootable. Every DOS-formatted diskette contains a limited boot sector containing error messages and other miscellaneous code. And a virus can hide in there without the disk having the necessary operating system files needed to boot a PC.

Most of the time, a friend or coworker gives someone an infected floppy diskette to transfer some datafiles to his computer. After he retrieves datafiles from the diskette, he forgets to remove it from the floppy drive and shuts down his PC. The next morning he turns on his PC, gets the familiar, “Nonsystem disk or disk error. Replace and strike any key when ready...” error message. He spends a few seconds trying to figure out why his system isn’t starting as expected, then realizes the mistake, ...