B4) What is a stealth virus?

A STEALTH virus is one which hides the modifications it has made in
the file or boot record, usually by monitoring the system functions
used by programs to read files or physical blocks from storage media,
and forging the results of such system functions so that programs
which try to read these areas see the original uninfected form of the
file instead of the actual infected form. Thus the viral modifications
go undetected by anti-viral programs.  However, in order to do this,
the virus must be resident in memory when the anti-viral program is
executed.

Example: The very first DOS virus, Brain, a boot-sector infector,
monitors physical disk I/O and re-directs any attempt to read a
Brain-infected boot sector to the disk area where the original boot
sector is stored.  The next viruses to use this technique were the
file infectors Number of the Beast and Frodo (= 4096 = 4K).

Countermeasures: A "clean" system is needed so that no virus is
present to distort the results.  Thus the system should be built from
a trusted, clean master copy before any virus-checking is attempted;
this is "The Golden Rule of the Trade."  With DOS, (1) boot from
original DOS diskettes (i.e. DOS Startup/Program diskettes from a
major vendor that have been write-protected since their creation);
(2) use only tools from original diskettes until virus-checking has
completed.


.