Operating system vulnerability to viruses

Not much different from the human body which sometimes susceptible to disease due to no body's defense against attack. This is of special concern in the 1990s, when Microsoft gain market dominance in desktop operating systems and office suites. Users of Microsoft software (especially networking software such as Microsoft Outlook and Internet Explorer) is vulnerable to the spread of the virus. Microsoft software is targeted by virus writers because of their desktop dominance, and is often criticized for including many errors and holes for virus writers to exploit. Integrated and non-integrated Microsoft applications (like Microsoft Office) and applications with scripting languages with access to the system files (such as Visual Basic Script (VBS), and applications with networking features) are also very vulnerable. 

Although Windows is by far the most popular operating system is the target for virus writers, viruses also exist on other platforms. Any operating system that allows third parties to run the program can theoretically run viruses. Some operating systems more secure than others. Unix-based operating system (and NTFS-aware applications on Windows NT-based platforms) only allow users to run executables within their own protected memory space. 

Internet-based experiments revealed that there are cases when people are willing to press a certain button to download a virus. Security analyst Didier Stevens ran a half-year campaign on Google AdWords ads that say "Is your PC virus-free Get it? Infected in here!". The result is 409 clicks. 

In 2006, there were relatively few security exploits targeting Mac OS X (with Unix-based file system and kernel). Total viruses for Apple's operating system older, known as Mac OS Classic, varies from source to source, with Apple stating that there are only four known viruses, and independent sources stating there were 63 viruses. Many Mac OS Classic viruses targeted HyperCard authoring environment. Virus susceptibility difference between Mac and Windows is a chief selling point, one of which Apple used in their Get a Mac ad. In January 2009, Symantec announced the discovery of a trojan that targets the Mac. This discovery does not get the coverage that is until April 2009. 

Meanwhile, Linux, and Unix in general, always native blocked normal users from having access to make changes to the operating system environment, Windows users generally do not. These differences continue in part because of the widespread use of an administrator account in contemporary versions like XP. In 1997, when a virus for Linux was released - known as "Bliss" - leading antivirus vendors issued warnings that Unix-like system can be a victim of the same viruses as Windows. Bliss virus may be considered characteristic of viruses - as opposed to worms - on Unix systems. Bliss requires that the user run it explicitly, and can only infect programs that the user has access to modify. Unlike Windows users, most Unix users do not login as an administrator user except to install or configure software; as a result, even if the user ran the virus, it could not harm their operating system. Bliss virus never became widespread, and remains mainly curiosity research. Its creator later posted the source code to Usenet, enabling the researchers to see how it works.

Computer Virus Infection Strategy

In copies of itself to grow in your computer, the virus should be possible to execute code and write code into memory. For this reason, many viruses attach to executable files that can be part of legitimate programs. If a user tries to launch a program that is infected, the virus code can be run simultaneously. Viruses can be divided into two types according to their behavior when they run. non-resident viruses immediately search for other computers that may be infected, infect these targets, then transfer control to the program an infected application. Resident viruses do not search for hosts when they started. Instead, you load the memory resident virus in the execution and transfer control to host program. The virus remains active in the background and infects new hosts when files are accessed from another program or operating system itself. 

Non-resident viruses 
Non-resident viruses can be considered as composed of modules and module finder replication. Finder module is responsible for finding new files to infect. For each new executable file finder module meeting, she calls the replication module to infect files. 


Resident viruses
Resident viruses contain a replication module which is similar to what is used by the virus overseas. This module, however, is called a finder module. The cost in the form of virus replication in memory when running, however, and ensuring that this module runs every time you call the operating system to perform certain operations.Replication module can be called, for example, each time the operating system executing file. In this case, the virus infects all the right programs running on your computer. 


Resident viruses are sometimes divided into the category of fast infectors and a category slow infectors. Fast infectors are designed to infect as many files as possible. A fast infector, for instance, can infect every potential host file that is accessed. This poses a particular problem when using anti-virus software as a virus scanner will have access to all files that have the potential to accommodate the computer when you run the analysis at the system level. If the virus does not realize that this virus is present in memory, the virus can "piggy-back" on the virus scanner and in this way infect all files that were analyzed. Fast infectors rely on fasting levels of the spread of infection. 


The disadvantage of this method is that infecting many files may make detection more likely, because the virus can slow down your computer or perform many suspicious actions that can be seen from anti-virus software. Slow infectors, on the other hand, are designed to infect hosts infrequently. Some slow infectious agent, for example, only infect files when they are copied. Slow infectors are designed to avoid detection by limiting their actions: this is less likely to reduce significantly the computer and at best, often trigger anti-virus software that detects suspicious behavior in the program. Slow infector approach, however, does not seem right.

ref: wikipedia.org