# Life Cycle of Computer Viruses

### Definition

A computer virus is a malicious piece of executable code that propagates typically by attaching itself to a host 
document that will generally be an executable file. 

Typical hosts for computer viruses are:
- Boot sectors on disks and other storage media
- Executable files for system administration, such as the batch files in Windows machines, shell script files in Unix, etc.
- Documents that are allowed to contain macros (such as PDF files, Microsoft Word documents, Excel spreadsheets, Access
database files, etc.)

Any operating system that allows third-party programs to run can support viruses
- Because of the way permissions work in Unix/Linux systems, it is more diﬃcult for a virus to wreak havoc in such machines.

When a virus embedded itself into one of your script files, its code will execute only with the permissions that
are assigned to you. 
- For example, if you do not have the permission to read or modify a certain system file, the virus
code will be constrained by the same restriction.
- Privilege escalation .... 

## Virus Life Cycle

![](Resources/virus_lifecycle.png)

Image and text source: _A Report on Hazards of Computer Viruses_, International Journal of Advanced Research in Science, 
Communication and Technology (IJARSCT), Volume 4, Issue 3, June 2024 (https://ijarsct.co.in/Paper18916.pdf). 
All credits go to the Authors.

The life cycle of a computer virus encompasses several critical stages, from its inception and spread to its eventual
detection and eradication, each playing a vital role in the impact and persistence of the malware, which is as follows :

### 1. Creation

- A programmer or hacker writes the virus using a programming language, often with a specific intent such as theft, 
espionage, disruption, or simply causing chaos. 

- The creator designs the virus to exploit specific vulnerabilities, spread in certain ways, and execute a predefined payload.
- This stage involves considerable planning and coding, ensuring the virus can evade detection and achieve its goals.

### 2. Replication
Once the virus is created, it enters the replication phase. 
- The virus begins to reproduce itself, either **immediately or
when triggered by certain conditions**. 
- Replication involves the virus attaching itself to executable files, or documents, or
spreading through network connections and removable media like USB drives. 
- The virus might also exploit network protocols to move between systems without user interaction. 
- The goal of replication is to maximize the number of infected systems, increasing the virus's reach and potential impact.

### 3. Infection

The next stage is infection, where the virus infiltrates a host system. 
- It embeds itself into files or memory, becoming part of the system's regular operations. 
- This can involve modifying or overwriting files, exploiting system vulnerabilities, or **executing malicious code 
when an infected file is opened**. 
- During this stage, the virus can remain dormant or active, depending on its design. 
- Infection allows the virus to establish a foothold in the system, setting the stage for further actions.

### 4. Activation

In the activation stage, the virus's payload—the part of the virus that performs the malicious action—is triggered.
- Activation can be based on specific events, such as a particular date, user actions (**like opening an infected file**), or
reaching a certain number of infections. 
- For example, some viruses are designed to activate on April 1st, while others might activate after infecting 100 systems. 
- This stage is crucial as it determines when and how the virus will execute its malicious activities.

### 5. Execution

Once activated, the virus enters the execution stage, carrying out its malicious payload. 
- This can include a wide range of harmful activities, such as corrupting or deleting data, stealing information 
(like passwords or credit card numbers), creating backdoors for unauthorized access, displaying unwanted messages, 
or disrupting system operations. 
- The effects of these actions can vary from minor annoyances to severe damage and data loss, depending on the virus's
design and intent.

### 6. Detection
Eventually, the virus is detected in the detection stage. 
- Security software or IT professionals identify the presence of the virus, typically through antivirus scans, unusual 
system behavior, or network monitoring. 
- Detection can also occur through user reports of strange activities or system performance issues. Modern antivirus 
programs use signature-based detection, heuristic analysis, and behavioral monitoring to identify viruses. 
- Once detected, the focus shifts to containment and eradication.

### 7. Removal
Upon detection, the system enters the removal stage, where efforts are made to eliminate the virus. 
- This can involve using antivirus software to scan and remove infected files, manual removal procedures for more stubborn
infections, system restoration from backups, or, in severe cases, reinstalling the operating system to ensure complete eradication.
- Effective removal is critical to restoring system functionality and preventing further spread of the virus.
