Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am looking for an architecture diagram of a computer virus.

Does anyone have a link to a good example?

Edit

Looks like I am getting hammered with downvotes. I agree that there is no single architecture for a virus. But somethings must be included for a program to be a virus.

Example for components in the SAD:

  • Replication method
  • Trigger
  • Payload
  • Hosts targeted
  • Vulnerabilities targeted
  • Anti detection method

Edit 2

Found a good example here: http://static.northpole.fi/download/1318959037124281/w32_duqu_the_precursor_to_the_next_stuxnet.pdf

share|improve this question
    
There are many differente viruses with many different architectures. Was there something specific you had in mind? A trojan, worm, rootkit, backdoor,...? –  FrustratedWithFormsDesigner Jun 20 '11 at 19:11
    
Every computer virus is different, almost by definition (if they were the same, after one was protected against then no others would work either.) Be more specific. –  jhocking Jun 20 '11 at 19:14
    
Planning on being mischievous in the near future? –  Bernard Jun 20 '11 at 19:21
7  
I imagine that most skript kiddies don't give the first thought to architecture in their virus "design". –  Crazy Eddie Jun 20 '11 at 19:24
1  
@eddie Maybe not but I am sure that there are some security researchers that have generated one for them. And do not confuse a virus programmer with the script jockeys that deploy them. –  Chad Jun 20 '11 at 19:53
show 1 more comment

2 Answers

up vote 8 down vote accepted

There is no canonical virus architecture.

Every computer virus starts with an exploit to get some code controlled by the virus writer to execute on your computer. The manner in which that is accomplished is completely arbitrary, and once the virus succeeds in breaching your security, everything it does after that is completely arbitrary.

share|improve this answer
add comment

My old biology prof used to call real viruses "bad news in a pretty package," the same could be said of computer viruses. Speaking broadly, they must contain at least two things: code that does something bad (if it were good, it wouldn't be a virus but a feature) and whatever analogue of the protein capsule gets the crud onto your system.

Neither is particularly hard to write or design: creating havoc is always easier than making something useful. Learned that one in thermodynamics.

share|improve this answer
    
I'm not so sure that "creating havoc" is always eaiser than "making something useful". Those are both value judgements. Aerodynamic drag is "bad" in the context of "how do I make this airplane faster and more efficient". Aerodynamic drag is "good" in the context of "how do I make this parachute land slower". Which is easier? Which involves creating havoc? –  Bruce Ediger Jul 18 '11 at 12:37
    
The one that increases the net entropy of a system without providing a utility creates "havoc" and is "not good." This is how we can apply a value judgement to a natural phenomenon like aerodynamic drag---when it causes havoc on the surface of the wing, it is bad. Now it is just as easy to design a wing with drag as it is to design a parachute without it (hint: cut a hole in the top) designing a wing that minimized drag, or a parachute that maximizes it, however, is more of a challenge. –  Dmitri Jul 18 '11 at 16:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.