計算機專業(yè)畢業(yè)設(shè)計（論文）外文翻譯計算機病毒

1、 中英文翻譯資料(2005屆)學 號： 200104060317姓 名： 指導教師： 輔導教師： 專業(yè)名稱： 計算機科學與技術(shù) 河北理工大學計算機與自動控制學院計算機病毒計算機病毒的發(fā)展歷史悠久,從80年代中后期廣泛傳播開來.時至今日,據(jù)統(tǒng)計世界上已存在的計算機病毒有上萬余種,并且每天以平均幾十種的速度增加.計算機病毒的發(fā)展一定程度上影響了反病毒產(chǎn)品的發(fā)展,原有的反病毒技術(shù)在新型病毒面前顯得陳舊而無能為力.病毒檢測產(chǎn)品是以病毒的特征碼為基礎(chǔ)的針對具體病毒的判斷技術(shù),因此,病毒的變種以及未知病毒給檢測軟件帶來較大的困難.病毒的清除是建立在病毒檢測的基礎(chǔ)上,目前病毒的清除實際上是針對已知病毒.這種

2、被動式的方法使反病毒技術(shù)總是落后于病毒技術(shù),雖然這類反病毒產(chǎn)品對病毒的抑制是不容忽視的,但它所暴露出來的漏洞卻越來越多.新一代的開放式反病毒技術(shù)應(yīng)運而生,這種開放式反病毒技術(shù)將病毒的結(jié)構(gòu)用一個統(tǒng)一的數(shù)據(jù)結(jié)構(gòu)加以描述，用戶可以根據(jù)自身對病毒進行分析,并具有更加靈活的升級優(yōu)勢,對于新一代具有反跟蹤,加密技術(shù)的多維變異病毒，這種方法顯示出其靈活及高效的特色,這種廣譜型的查毒殺毒系統(tǒng)將逐漸成為反病毒產(chǎn)品的發(fā)展趨勢. “計算機病毒”一詞最早是由美國計算機病毒研究專家f-cohen博士提出的。 “病毒”一詞是借用生物學中的病毒。通過分析、研究計算機病毒，人們發(fā)現(xiàn)它在很多方面與生物病毒有著相似之處。要做反計

3、算機病毒技術(shù)的研究，首先應(yīng)搞清楚計算機病毒的特點和行為機理，為防范和清除計算機病毒提供充實可靠的依據(jù)。 再生機制是生物病毒的一個重要特征。通過傳染，病毒從一個生物體擴散到另一個生物體。在適宜的條件下，它得到大量繁殖，并進而使被感染的生物體表現(xiàn)出病癥甚至死亡。同樣地，計算機病毒也會通過各種渠道從已被感染的計算機擴散到未被感染的計算機，在某些情況下造成被感染的計算機工作失常甚至癱瘓。這就是計算機病毒最重要的特征傳染和破壞。與生物病毒不同的是，計算機病毒是一段人為編制的計算機程序代碼，這段程序代碼一旦進入計算機并得以執(zhí)行，就與系統(tǒng)中的程序連接在一起，并不斷地去傳染(或連接、或覆蓋)其它未被感染的程序

4、。具有這種特殊功能的程序代碼被稱為計算機病毒。攜帶有這種程序代碼的計算機程序被稱為計算機病毒載體或被感染程序。是否具有傳染性是判別一個程序是否為計算機病毒的最重要條件。正常的計算機程序是不會將自身的代碼強行連接到其它程序之上的。比如dos的format程序決不會將其程序代碼連接到別的程序中去。在系統(tǒng)生成過程中有些系統(tǒng)的安裝程序會修改相關(guān)程序的參數(shù)配置，如mswindows系統(tǒng)。有些程序通過自身的設(shè)置功能，按用戶要求會修改自己的參數(shù)設(shè)置，如borland公司的sidekick。還有些程序出于加密防拷貝或某些其它目的，在運行時動態(tài)改變自身的程序代碼，如xcom通信程序。在這幾種情況下，那些被修改的

5、程序內(nèi)部的確發(fā)生了變化，但這些變化只局限于各自應(yīng)用系統(tǒng)的內(nèi)部，不會發(fā)生將自身代碼連接到毫不相干的程序之上的情形。計算機病毒的再生機制，即它的傳染機制卻是使病毒代碼強行傳染到一切未受到傳染的程序之上，迅速地在一臺計算機內(nèi)，甚至在一群計算機之間進行傳染、擴散。每一臺被感染了計算機病毒的計算機，本身既是一個受害者，又是一個新的計算機病毒的傳染源。被感染的計算機往往在一定程度上喪失了正常工作的能力，運行速度降低，功能失常，文件和數(shù)據(jù)丟失，同時計算機病毒通過各種可能的渠道，如軟盤、計算機網(wǎng)絡(luò)去傳染其它的計算機。當你在一臺機器上發(fā)現(xiàn)了病毒時，往往曾在這臺計算機上用過的軟盤已感染上了病毒;而與這臺機器相鄰的

6、其它幾臺計算機也許早已被該病毒侵染上了。通過數(shù)據(jù)共享的途徑，計算機病毒會非常迅速地蔓延開，若不加控制，就會在短時間內(nèi)傳播到世界各個角落里去?？梢姺从嬎銠C病毒的問題是一個全球范圍的問題。在我國發(fā)現(xiàn)的首例計算機病毒就是國外稱為意大利病毒的小球病毒。在我國首先發(fā)現(xiàn)的traveller病毒隨著國際間的交往，也擴散到國外，其大名出現(xiàn)在國外殺病毒軟件的病毒黑名單中。與生物病毒不同，所有的計算機病毒都是人為編寫的計算機程序代碼，是人為制造出來的而不是天生的。這些著意編寫的計算機程序代碼，其原始形式可以是c語言，可以是basic程序，可以是匯編語言程序，也可以是批命令程序，還可以是機器指令程序。其共同特點就是

7、具有傳染性和破壞性。 計算機病毒的另一個特點是只有當它在計算機內(nèi)得以運行時，才具有傳染性和破壞性等活性。也就是說計算機cpu的控制權(quán)是關(guān)鍵問題。若計算機在正常程序控制下運行，而不運行帶病毒的程序，則這臺計算機總是可靠的。在這臺計算機上可以查看病毒文件的名字，查看計算機病毒的代碼，打印病毒的代碼，甚至拷貝病毒程序，卻都不會感染上病毒。反病毒技術(shù)人員整天就是在這樣的環(huán)境下工作。他們的計算機雖也存有各種計算機病毒的代碼，但已置這些病毒于控制之下，計算機不會運行病毒程序，整個系統(tǒng)是安全的。相反，計算機病毒一經(jīng)在計算機上運行，絕大多數(shù)病毒首先要做初始化工作，在內(nèi)存中找一片安身之處，隨后將自身與系統(tǒng)軟件掛

8、起鉤來，然后再執(zhí)行原來被感染程序。這一系列的操作中，最重要的是病毒與系統(tǒng)軟件掛起鉤來，只要系統(tǒng)不癱瘓，系統(tǒng)每執(zhí)行一次操作，病毒就有機會得以運行，去危害那些未曾被感染的程序。病毒程序與正常系統(tǒng)程序，或某種病毒與其它病毒程序，在同一臺計算機內(nèi)爭奪系統(tǒng)控制權(quán)時往往會造成系統(tǒng)崩潰，導致計算機癱瘓。反病毒技術(shù)也就是要提前取得計算機系統(tǒng)的控制權(quán)，識別出計算機病毒的代碼和行為，阻止其取得系統(tǒng)控制權(quán)。反病毒技術(shù)的優(yōu)劣就是體現(xiàn)在這一點上。一個好的抗病毒系統(tǒng)應(yīng)該不僅能可靠地識別出已知計算機病毒的代碼，阻止其運行或旁路掉其對系統(tǒng)的控制權(quán)(實現(xiàn)安全帶毒運行被感染程序)，還應(yīng)該識別出未知計算機病毒在系統(tǒng)內(nèi)的行為，阻止其

9、傳染和破壞系統(tǒng)的行動。而低性能的抗病毒系統(tǒng)只能完成對抗已知病毒的任務(wù)，對未知病毒則束手無策，任其在系統(tǒng)內(nèi)擴散與破壞。所謂未知病毒是指新出現(xiàn)的，以前未曾分析過的計算機病毒。在1992年初，dir病毒對我國廣大pc機用戶來說就是一種未知病毒。與未曾相識的敵手對陣不是件容易的事。dir病毒采用嵌入dos系統(tǒng)的設(shè)備驅(qū)動程序鏈的方法攻擊ibmpc及其兼容機，是一種與以往病毒工作機制不同的新型計算機病毒。由于其奪取pc機系統(tǒng)控制權(quán)的方法很特別，在它的攻勢下，大批抗病毒系統(tǒng)敗下陣來。從這個例子可以看到，對付計算機病毒，目前尚無完滿通用的解決方案，反病毒技術(shù)需要不斷發(fā)展，以對抗各種新病毒。 不經(jīng)過程序代碼分析

10、或計算機病毒代碼掃描，病毒程序與正常程序是不容易區(qū)別開來的。在沒有防護措施的情況下，計算機病毒程序經(jīng)運行取得系統(tǒng)控制權(quán)后，可以在不到1秒鐘的時間里傳染幾百個程序，而且在屏幕上沒有任何異常顯示。傳染操作完成后，計算機系統(tǒng)仍能運行，被感染的程序仍能執(zhí)行，好像不曾在計算機內(nèi)發(fā)生過什么。這種現(xiàn)象就是計算機病毒傳染的隱蔽性。正是由于這隱蔽性，計算機病毒得以在用戶沒有察覺的情況下游蕩于世界上百萬臺計算機中。讓我們設(shè)想，如果計算機病毒每當感染一個新的程序時都在屏幕上顯示一條信息“我是病毒程序，我要干壞事了”，那么計算機病毒早就被控制住了。確實有些病毒非?！坝掠诒┞蹲约骸保瑫r不時在屏幕上顯示一些圖案或信息，或

11、演奏一段樂曲。往往此時那臺計算機內(nèi)已有許多病毒的拷貝了。許多計算機用戶對計算機病毒沒有任何概念，更不用說心理上的警惕了。他們見到這些新奇的屏幕顯示和音響效果，還以為是來自計算機系統(tǒng)，而沒有意識到這些病毒正在損害計算機系統(tǒng)，正在制造災(zāi)難。如磁盤殺手(diskkiller)病毒，當它破壞磁盤數(shù)據(jù)時，屏幕上顯示如下信息:“diskkillerversion1.00byogresoftware，april1，1989.dontturnoffthepowerorremovethediskettewhileprocessing.”這兩句話中，第一句的含義是:“磁盤殺手1.00版ogresoftware公司

12、1989年4月1日出版?！钡诙涞暮x是:“在處理過程中請不要關(guān)機或取出磁盤?！苯又聊簧巷@示出“processing”意思是“正在處理”這時diskkiller病毒鎖定鍵盤，對磁盤上的數(shù)據(jù)做加密變換處理。計算機的處理速度是很快的，當你在屏幕上見到上述顯示信息時，已經(jīng)有很多數(shù)據(jù)被病毒破壞掉了。計算機病毒的第二個隱蔽性在于，被病毒感染的計算機在多數(shù)情況下仍能維持其部分功能，不會由于一感染上病毒，整臺計算機就不能啟動了，或者某個程序一旦被病毒所感染，就被損壞得不能運行了。如果出現(xiàn)這種情況，病毒也就不能流傳于世了。計算機病毒設(shè)計的精巧之處也在這里。正常程序被計算機病毒感染后，其原有功能基本上不受影響

13、，病毒代碼附于其上而得以存活，得以不斷地得到運行的機會，去傳染出更多的復制體，與正常程序爭奪系統(tǒng)的控制權(quán)和磁盤空間，不斷地破壞系統(tǒng)，導致整個系統(tǒng)的癱瘓。病毒的代碼設(shè)計得非常精巧而又短小。典型的是tiny家族。這個家族的病毒都很短小，最小的病毒代碼長度只有133字節(jié)。一般pc機對dos文件的存取速度可達每秒100kb以上，所以病毒將這短短的幾百字節(jié)感染到正常程序之中所花的時間只是轉(zhuǎn)瞬之間，非常不易被察覺。 與隱蔽性相關(guān)聯(lián)的是計算機病毒的潛伏性。潛伏性的第一種表現(xiàn)是指，病毒程序不用專用檢測程序是檢查不出來的，因此病毒可以靜靜地躲在磁盤或磁帶里呆上幾天，甚至幾年，一旦時機成熟，得到運行機會，就又要四

14、處繁殖、擴散，繼續(xù)為害。潛伏性的第二種表現(xiàn)是指，計算機病毒的內(nèi)部往往有一種觸發(fā)機制，不滿足觸發(fā)條件時，計算機病毒除了傳染外不做什么破壞。觸發(fā)條件一旦得到滿足，有的在屏幕上顯示信息、圖形或特殊標識，有的則執(zhí)行破壞系統(tǒng)的操作，如格式化磁盤、刪除磁盤文件、對數(shù)據(jù)文件做加密、封鎖鍵盤以及使系統(tǒng)死鎖等。計算機病毒使用的觸發(fā)條件主要有以下三種。(1)利用計算機內(nèi)的實時時鐘提供的時間作為觸發(fā)器這種觸發(fā)條件被許多病毒所采用，觸發(fā)的時間有的精確到百分之幾秒，有的則只區(qū)分年份。表11列出了一些病毒觸發(fā)的時間，可以供防范計算機病毒時參考。(2)利用病毒體內(nèi)自帶的計數(shù)器作為觸發(fā)器計算機病毒利用計數(shù)器記錄某種事件發(fā)生的

15、次數(shù)，一旦計數(shù)器達到某一設(shè)定的值，就執(zhí)行破壞操作。這些事件可以是計算機開機的次數(shù)，可以是病毒程序被運行的次數(shù)，還可以是從開機起被運行過的總的程序個數(shù)等。(3)利用計算機內(nèi)執(zhí)行的某些特定操作作為觸發(fā)器特定操作可以是用戶按下某種特定的鍵組合，可以是執(zhí)行格式化命令，也可以是讀寫磁盤的某些扇區(qū)等。表11計算機病毒觸發(fā)時間一覽表被計算機病毒使用的觸發(fā)條件是多種多樣的，而且往往不只是使用上面所述的某一條件，而是使用由多個條件組合起來的觸發(fā)條件。大多數(shù)病毒的組合觸發(fā)條件是基于時間的，再輔以讀、寫盤操作，按鍵操作以及其它條件。如在我國廣為流傳的小球病毒，每當系統(tǒng)時鐘為整點或半點時，系統(tǒng)又正在進行讀盤操作，而該

16、盤是未被感染的，等等，一旦這些條件得到滿足時，小球病毒的屏幕顯示部分便被激活，一個小球彈跳在屏幕上。若顯示器是cga類型的，又正在使用漢字系統(tǒng)，則整個屏幕顯示會不停地上下翻滾，使操作根本無法進行。小球病毒的觸發(fā)條件在各種觸發(fā)條件中是很典型的，既有時間的條件，又有功能操作的條件，而且條件之間還存在著邏輯“與”和邏輯“或”的關(guān)系。利用這種觸發(fā)條件，計算機病毒不是隨時隨地表現(xiàn)自己，而是在適當?shù)臅r機條件滿足時才向你示威，輕則只是在屏幕上顯示些信息，重則要銷毀數(shù)據(jù)，弄垮整個系統(tǒng)。計算機病毒的破壞作用是多種多樣的。有一種分類方法是將病毒分為惡性病毒和良性病毒。惡性病毒就是指在其代碼中包含有損傷和破壞計算機

17、系統(tǒng)的操作，在其傳染或發(fā)作時會對系統(tǒng)產(chǎn)生直接的破壞作用。這類病毒是很多的，如米開朗琪羅病毒。當米氏病毒發(fā)作時，硬盤的前17個扇區(qū)將被徹底破壞，使整個硬盤上的數(shù)據(jù)無法被恢復，造成的損失是無法挽回的。有的病毒還會對硬盤做格式化等破壞。這些操作代碼都是刻意編寫進病毒的，這是其本性之一。因此這類惡性病毒是很危險的，應(yīng)當注意防范。所幸防病毒系統(tǒng)可以通過監(jiān)控系統(tǒng)內(nèi)的這類異常動作識別出計算機病毒的存在與否，或至少發(fā)出警報提醒用戶注意。良性病毒是指其不包含有立即對計算機系統(tǒng)產(chǎn)生直接破壞作用的代碼。這類病毒為了表現(xiàn)其存在，只是不停地進行擴散，從一臺計算機傳染到另一臺，并不破壞計算機內(nèi)的數(shù)據(jù)。有些人對這類計算機病

18、毒的傳染不以為然，認為這只是惡作劇，沒什么關(guān)系。其實良性、惡性都是相對而言的。良性病毒取得系統(tǒng)控制權(quán)后，會導致整個系統(tǒng)運行效率降低，系統(tǒng)可用內(nèi)存總數(shù)減少，使某些應(yīng)用程序不能運行。它還與操作系統(tǒng)和應(yīng)用程序爭搶cpu的控制權(quán)，時時導致整個系統(tǒng)死鎖，給正常操作帶來麻煩。有時系統(tǒng)內(nèi)還會出現(xiàn)幾種病毒交叉感染的現(xiàn)象，一個文件不停地反復被幾種病毒所感染。例如原來只有10kb的文件變成約90kb，就是被幾種病毒反復感染了數(shù)十次。這不僅消耗掉大量寶貴的磁盤存儲空間，而且整個計算機系統(tǒng)也由于多種病毒寄生于其中而無法正常工作。因此也不能輕視所謂良性病毒對計算機系統(tǒng)造成的損害。計算機病毒的實現(xiàn)方法是千差萬別的，加上許

19、多病毒采用加密處理技術(shù)，使得被感染的程序恢復原形的工作，即殺毒工作很困難。目前還沒有通用的、能可靠自動清病毒的方法。很多研究人員在這方面作了很多努力，一些國外商品軟件也具有免疫功能(immunize)，但都存在缺陷，不盡如人意。某些病毒對系統(tǒng)的感染所造成的損失是不可挽回的，要修復被感染的文件是不可能的。當被新病毒感染后，要清除這些病毒，不僅需要耗費大量時間和精力去仔細地分析病毒代碼，而且還需要對病毒和計算機系統(tǒng)有全面的了解。因此抗計算機病毒工作最重要的就是防御病毒，不讓病毒侵入系統(tǒng)。一旦遭到破壞，做修復工作就很麻煩了，甚至是不可能的。 computer viruscomputer virus

20、development history is glorious,widely disseminates from the 80s mid and late partsat this point,according to the statistical world in the computer virus which exists had the up to ten thousand -odd kinds,and every day by average several dozens kind of speeds increase.in computer virus development c

21、ertain degree has affected the counter- viral product development,the original counter- viral technology appears obsoletely in front of the new virus but is helpless.the viral examination product is take viruss condition code as the foundation in view of the concrete viruss judgment technology,there

22、fore,viruss variety as well as the unknown virus for examine the software to bring the major difficulty.viruss elimination is the establishment in the viral examination foundation,at present viruss elimination is in fact aims at the known virus.this passive form method causes the counter- viral tech

23、nology always to fall behind the viral technology,although this kind of counter- viral product to viruss suppression is not allow to neglect,but it exposes the loophole more and more. are actually manythe new generation of open style counter- viral technology arises at the historic moment,this kind

24、of open style counter- viral technology performs viruss structure with a unified construction of data to describe,the user may act according to oneself to carry on the analysis to the virus,and has the more nimble promotion superiority,has the counter- track regarding the new generation,encryption t

25、echnology multi-dimensional variation virus,this method demonstrates its nimble and the highly effective characteristic,this kind of guang puxing will look up kills by poison the poisonous system gradually to become the counter- viral product the development tendency.the computer virus a word is mos

26、t early studies expert dr. f-cohen by the us computer virus to propose.the virus a word is borrows in the biology the virus. through analysis, research computer virus,the people discovered it has similarly in very many aspects and the biological virus place.must make the counter- computer virus tech

27、nology the research,first should make clear computer virus characteristic and the behavior mechanism,in order to guard against and the elimination computer virus provides the enrichment reliable basis.the regeneration mechanism is a biological viruss important characteristic. through infection,the v

28、irus proliferates from an organism to another organism.in is suitable under condition,it obtains the massive reproductions,and then causes the biological body surface which infects to appear illness even to die.similarly,the computer virus also can from the computer which infects proliferate through

29、 each kind of channel to not the computer which infects,creates abnormally the computer work which infects in certain situations is even been paralysed. this is the computer virus most important characteristic infection and the destruction.is different what with the biological virus,the computer vir

30、us are section of artificial establishments computer program codes,this section of procedure code once enters the computer and can carry out,on with the system in procedure connects in together,and infects (or connection unceasingly, or cover) other not the procedure which infects. has this kind of

31、special function the procedure code to be called the computer virus.carries has this kind of procedure code the computer program to be called the computer virus carrier or is infected the procedure.whether has the infection distinguishes a procedure whether for computer virus most important conditio

32、n.the normal computer program is cannot connect forcefully own code to other procedures above.for instance the dos format procedure can connect in no way its procedure code to other procedure in.some systems the installation procedure in the system production process to be able to revise the correla

33、tion procedure the parameter disposition,like mswindows system.some procedures through own establishment function,can revise own according to the user request parameter establishment,like borland corporations sidekick.also has a procedure to guard against the copy or certain other goals stemming fro

34、m the encryption,when movement dynamic change own procedure code,like xcom signal procedure.in these kind of situations,these the procedure interior which revised has been indeed occurred the change,but these changes only limits to respective application system in,cannot occur own code connects to a

35、bove the procedure situation which has nothing to do with. computer virus regeneration mechanism,namely its infection mechanism is actually causes the viral code to infect forcefully to all has not received the infection above the procedure,rapidly in a computer,even carries on the infection, the pr

36、oliferation between crowd of computers. each was infected computer virus computer,itself not only is a victim,also is a new computer virus origin of infection. the computer which infects in the certain degree has been often lost the normal work ability,the running rate reduces,the function is abnorm

37、al,document and data missing,at the same time the computer virus pass each kind of possibility the channel,like the floppy disk, the computer network infects other computers. when you have discovered the virus when a machine,often once has used on this computer the floppy disk infected on the virus;

38、but already is perhaps invaded with this machine neighboring other several computers by this virus catches. through data sharing way,the computer virus can extremely rapidly spread open,if does not control,can disseminate in the short time to world each quoin in.obviously the counter- computer virus

39、 question is a global scope question.the first example computer virus discovered which in our country are overseas are called the italian virus the pellet virus.traveller virus first discovered which in our country along with international contact,also proliferates to overseas,its given name appears

40、 overseas in kills the viral software in the viral blacklist. is different with the biological virus,all computer virus all are the artificial compilation computer program code,is artificial makes but is not inborn.these planned compiles computer program code,its primitive form may be the c language

41、,may be the basic procedure,may be the assembly language procedure,also may approves the order procedure,also may be the machine instruction procedure. its common characteristic is has the infection and destructiveness.computer virus another characteristic is only then when it can move when the comp

42、uter,only then has activeness and so on infection and destructiveness.in other words the computer cpu domination is the key question.if the computer moves under the normal procedure control,but does not move the belt viruss procedure,then this computer always reliable.may examine the viral document

43、on this computer the name,examines the computer virus the code,printing viruss code,even copy virus procedure,all cannot infect the virus actually. the counter- virus technical personnel is all day works under such environment.their computer although also has each kind of computer virus the code,but

44、 has set at these virus under the control,the computer cannot move the viral procedure,the overall system is safe. on the contrary,the computer virus as soon as pass through on the computer move,the overwhelming majority virus first must do the initialization work,looks for a piece in the memory to

45、find a place to live place,afterwards hangs up oneself with the system software the hook to come,then carries out again is infected originally the procedure.in this a series of operations,most importantly the virus and the system software hang up the hook to come,so long as the system is not paralys

46、ed,the system carries out a time of operation every time,the virus has the opportunity to be able to move,harms these not the procedure which infects. viral procedure and normal system program,or some kind of viral and other viral procedures,temporarily captures the systems control in the identical

47、taiwan computer often to be able to create the system collapse,causes the computer paralysis.the counter- viral technology also is needs to obtain the computer system ahead of time the domination,distinguishes the computer virus the code and the behavior,prevents it to obtain the system domination.t

48、he counter- viral technology fit and unfit quality are manifest on this. a good anti- viral system should not only be able reliably to distinguish the known computer virus the code,prevents its movement or the bypass falls it (to realize safety belt poisonous movement to the system domination to inf

49、ect procedure),also should distinguish the unknown computer virus in system behavior,prevents its infection and the destruction system motion.but the low performance anti- viral system only can complete the resistance known virus the duty,to unknown virus then is at a loss,no matter what it in syste

50、m proliferation and destruction.the so-called unknown virus is refers appears newly,before not has analyzed computer virus.in at the beginning of 1992,the dirii virus to our country general pc machine user said is one kind of unknown virus. with the rival which not is acquainted with one another con

51、fronts is not an easy matter.the virus uses inserts the dos system the equipment driver chain method to attack ibmpc and its the compatible machine,is one kind with the former viral work mechanism different new computer virus. because it captures the pc machine system domination the method to be ver

52、y special,under its offensive,large quantities of anti- viral system was defeated. may see from this example to,copes with the computer virus,at present still did not have the perfect general solution,the counter- virus technical requirement develops unceasingly,by resists each kind of new virus.doe

53、s not pass through the procedure code analysis or the computer virus code scanning,the viral procedure and the normal procedure are is not easy to distinguish.in in protective measure situation,the computer virus procedure obtains the system domination after the movement,may in not infect several hu

54、ndred procedures to 1 second time in,moreover any exceptionally had not demonstrated on the screen.after the infection operation completes,the computer system still could move,the procedure which infects can still carry out,resembled not once has had any in the computer.this kind of phenomenon is co

55、mputer virus infection 隱蔽性. is precisely as a result of this 隱蔽性,the computer virus can loaf in the situation which the user had not realized in the world in million computers. let us conceive,if the computer virus whenever infect time a new procedure all on the screen demonstrated an information i

56、am the viral procedure,i had to do the misdemeanor ,then the computer virus are already controlled. some virus are truly unusual dare to expose oneself,demonstrates some designs or the information once for a while on the screen,or plays section of musics. often this time in that computer had many vi

57、ral the copies.many computer users to computer virus not any concept,say nothing of in the psychology was vigilant.they see these novel screen demonstrations and the acoustics,also thought is comes from the computer system,but has not realized these virus to harm the computer system,is making the di

58、saster.like floppy disk murderer (diskkiller) virus,when it destroys the floppy disk data,on the screen demonstrates the following information:“diskkillerversion1.00byogresoftware，april1，1989.dontturnoffthepowerorremovethediskettewhileprocessing.”in these two speeches,the first meaning is:floppy dis

59、k murderer 1.00 edition ogresoftware corporation on april 1, 1989 published.the second meaning is:please do not have 關(guān)機 in the treating processes or to take out the floppy disk.then on the screen demonstrated processing the meaning was is processing by now the diskkiller virus locking keyboard,makes encryption transformation processing to on the floppy disk data. the computer processing speed is very quic