C1) What are the symptoms and indications of a virus infection?

Viruses try to spread as much as possible before they deliver their
"payload", but there can be symptoms of virus infection before this,
and it is important to use this opportunity to spot and eradicate the
virus before any destruction.

There are various kinds of symptoms which some virus authors have
written into their programs, such as messages, music and graphical
displays.  However, the main indications are changes in file sizes and
contents, changing of interrupt vectors or the reassignment of other
system resources.  The unaccounted use of RAM or a reduction in the
amount known to be in the machine are important indicators.  The
examination of the code is valuable to the trained eye, but even the
novice can often spot the gross differences between a valid boot
sector and an infected one.  However, these symptoms, along with
longer disk activity and strange behavior from the hardware, can also
be caused by genuine software, by harmless "prank" programs, or by
hardware faults.

The only foolproof way to determine that a virus is present is for an
expert to analyze the assembly code contained in all programs and
system areas, but this is usually impracticable.  Virus scanners go
some way towards that by looking in that code for known viruses; some
will even try to use heuristic means to spot viral code, but this is
not always reliable.  It is wise to arm yourself with the latest
anti-viral software, but also to pay close attention to your system;
look particularly for any change in the memory map or configuration as
soon as you start the computer.  For users of DOS 5.0, the MEM program
with the /C switch is very handy for this.  If you have DRDOS, use MEM
with the /A switch; if you have an earlier version, use CHKDSK or the
commonly-available PMAP or MAPMEM utilities.  You don't have to know
what all the numbers mean, only that they change.  Mac users have
"info" options that give some indication of memory use, but may need
ResEdit for more detail.


.