memory resident?

[Ryan Nyquist]

I have seen alot of virus listings that say either memory resident or non-resident. What does memory resident mean and is it a bad or good thing?

[Ryan Nyquist]

I have seen alot of virus listings that say either memory resident or non-resident. What does memory resident mean and is it a bad or good thing?

[{P²P}Apocalypse]

Without getting into a long drawn out deal. It's a bad thing. You can kill the program and delete it from you whatever directory. But it writes itself to memory and on reboot runs itself again. Usualy moving itself to another directory or giving itself another name. Many variations of this abound, but thats it in a nutshell. Also this type likes to write itself to the MBR at times. Go here for a basic detail:
http://pcvirus2000.web.cern.ch/pcvir...%20viruses.htm

[{P²P}Apocalypse]

Without getting into a long drawn out deal. It's a bad thing. You can kill the program and delete it from you whatever directory. But it writes itself to memory and on reboot runs itself again. Usualy moving itself to another directory or giving itself another name. Many variations of this abound, but thats it in a nutshell. Also this type likes to write itself to the MBR at times. Go here for a basic detail:
http://pcvirus2000.web.cern.ch/pcvir...%20viruses.htm

[xmaddness]

Well.. The way I would figure is this.

Once a program is containing a virus is copied to your PC, the virus can spread only when the infected file is opened. The first thing that happens is the program is loaded into memory. Viruses hidden in a program can then be executed from memory. A virus can either be a Memory-resident virus and stay in memory, still doing its thing, even after the host program is killed, or a non-memory-resident virus, which means its killed when the host program is closed.

After a virus is loaded into the memory it looks for other programs loaded in the memory. When it finds one it will copy itself there and into that same program file on your harddrive. The longer it stays loaded the more destructive it will be, because you will open more programs. The way to kill a memory-resident virus is to turn off your computer (hard-boot) and that will wipe out the memory. I think thats how it works.

EDIT:But chances are that when you restart it will have a reg entry that will load it on boot anyway.


EDIT2:I think this could make a perfect idea for my next tut. BUS lines are so boring anyway.

[xmaddness]

Well.. The way I would figure is this.

Once a program is containing a virus is copied to your PC, the virus can spread only when the infected file is opened. The first thing that happens is the program is loaded into memory. Viruses hidden in a program can then be executed from memory. A virus can either be a Memory-resident virus and stay in memory, still doing its thing, even after the host program is killed, or a non-memory-resident virus, which means its killed when the host program is closed.

After a virus is loaded into the memory it looks for other programs loaded in the memory. When it finds one it will copy itself there and into that same program file on your harddrive. The longer it stays loaded the more destructive it will be, because you will open more programs. The way to kill a memory-resident virus is to turn off your computer (hard-boot) and that will wipe out the memory. I think thats how it works.

EDIT:But chances are that when you restart it will have a reg entry that will load it on boot anyway.


EDIT2:I think this could make a perfect idea for my next tut. BUS lines are so boring anyway.

[zaggy]

Thanks for the answers, I didn't know that either. I love this site, get answers to questions you didn't even know you needed!

[zaggy]

Thanks for the answers, I didn't know that either. I love this site, get answers to questions you didn't even know you needed!

[Vorlin]

It's very similar to the way exploits on the *NIX environment are generally run.

Example:

Someone has a trojaned 'ls' command or something and they see user X has . in their PATH
statement before everything else (through various methods of finding out).

This nefarious someone puts the trojaned ls somewhere simple, like /tmp and says 'hey dude, I'm having problems with a file in /tmp name blahblahfoo, can you go look at it? I think the permissions are screwed up' (or something to this effect).

User X (let's say it's root) says 'Why yes, I can help fix your problems!' and goes to /tmp to look at blahblahfoo and does *gasp* ls.

Now, at this point, the first thing this trojaned ls will do is delete itself (if nefarious 'someone' was smart). This will still keep it working though because it's in memory (memory resident). It calls the real 'ls' to reveal the directory listings and whatnot, along with any command line options, while it does something else nefarious (such as...copying the shadow password file to nefarious someone's /home directory as 'report.txt' so that they can run crack on it elsewhere or whatnot).

This is a low-level example of a simple 'memory resident' exploit.

[Ryan Nyquist]

thanks. I figured it had something to do with creating extra values (copies of itself) in different places but I didn't know that a non-memory resident virus stops working when the infected program stops working.