Member Avatar for killer88

When a system is spread with viruses. . . what the virus first attack in system ?. . system files ? or data stored in hard disk etc ?

  • 8 Contributors
  • 9 Replies
  • 308 Views
  • 4 Months Discussion Span
  • Latest Post Latest Post by Deep Modi

Dani AI

Generated

Short answer: there is no single universal “first” target. Modern malware follows stages — entry, execution, persistence, propagation and payload — and the earliest actions are chosen to support the attacker’s objective. A program written to stay hidden will usually establish persistence and concealment first; a destructive or ransomware strain may move quickly to find and damage or encrypt user data once running.

Expanding on points made by and , those stages map to distinct components often seen in samples: a dropper/loader that gets code onto the machine; persistence mechanisms (multiple layers such as startup entries, scheduled tasks, services/drivers, signed modules, or even UEFI/firmware implants); propagation or replication code; and the eventual payload (data theft, encryption, destruction, or command-and-control). Different families emphasize different stages: worms prioritize fast spreading, RATs prioritize stealthy persistence and exfiltration, and ransomware often scans for and targets user files once persistence is established.

Practical containment and triage (high‑level checklist): isolate the host from networks, preserve a full disk image for analysis, scan the image from a known‑clean environment or bootable rescue media, verify offline backups before any restore, and check persistence points and scheduled tasks from a clean OS. Imaging first preserves evidence and makes recovery safer; ad hoc file deletion or in-place cleaning can break backups or hide indicators needed to fully remove more advanced threats.

Cautions and mitigation: firmware/boot‑level compromises require specialist handling and sometimes hardware reflash or replacement. When persistence layers are present, a clean OS reinstall and restore from verified, offline backups is often the most reliable cure. Long‑term hardening includes up‑to‑date patches, least‑privilege accounts, disabled autorun for removable media, endpoint protection with periodic offline scans, and frequent offline backups. This expands on the earlier replies and grounds the “what attacks first” question in attacker goals and practical response.

Recommended Answers

All 9 Replies

Member Avatar for caperjack

Im no virus expert but i do know that would all depend on what the virus was built to do !

Member Avatar for Reverend Jim

The virus could be introduced into your system in a number of ways. Some of them are

  • you opened an email attachment with an executable that contained the virus
  • you downloaded and installed a program that contained the virus
  • you visited a rogue web site that installed the virus
  • you plugged in an infected external device with AutoPlay enabled
  • you gave someone physical access to your computer and he/she installed the virus
  • your system was not protected with a firewall and someone hacked in

This list is far from complete.

Member Avatar for caperjack

question was what does the virus attack first ,just saying

Edited by caperjack
Member Avatar for TheApex

Good viruses usually start by placing themself on the startup (by creating a registry value) and after that they begin to modify / infect system files to make sure they're harder to remove: some of them try to write their own driver, register themself as legitimate dlls for different processes or simply place hooks in different processes (injecting their own code).

Most of the time viruses won't target personal data if their "installation" isn't complete.

// replied kinda late, but hope it helps

Edited by TheApex
Member Avatar for killer88

thanks . . but . . "Most of the time viruses won't target personal data if their "installation" isn't complete." What does the "installation" mean?

Member Avatar for gerbil

I assume by installation not being complete, Apex means the virus's installation.
The main job of a virus is to self-replicate; once present it will copy itself into whatever file types it is written to invade. In doing so it may destroy them [pretty silly from its own point of view], or, most likely, add itself to the code so that if the file is used in another computer it can replicate there. That is its job, by design. Whatever other actions it takes via its payload is up to the writer eg. redirect, destroy files, earn some money...

Edited by gerbil
Member Avatar for DM Galaxy

ok nice question.
But the Actually you can also create a virus it's so easy to create Virus.
But it depend on you what type of virus you want to create?

Actually now a days there is the list of viruses with all different ways.
Like: Trojan horse, win32 etc...

• Virus may blocked your app.
• They may delete some most needed files for operating your PC.
• I will like to say that the Programs/application that delete the files without the permission of your is the virus.
• now a time you can see the Patch, They are also virus if they delete the activation folder without permission. (But this is not cosidered by antivirus as it take your permission and de3lete the file that you want)
• I think Virus are mostly made by the Antivirus company. (I think so.., nt every antivirus), they 1st create the virus and share it then create the antivirus on which that type of virus can be detected on their antivirus only...
The most imp. thing is we should use the best antivirus that can detect each and every type of virus...

Thank you

Member Avatar for Deep Modi

I agree with the DM
you must specify the Virus.
Virus may be start with the Hard disk/ system
there may be some virus that delet the main file that start windows and so when you shutdown/restart your PC then you may not able to start your PC...
While some Viruses are stayed on the specific drive/installation drive which also create the shortcut...
so when you delete them and then refresh the list you will get it back so and so...
while some viruses just create a copy of it for some names and if the file is similar then they mail to themselves without your permission at this time when you try to delet the file it says file is in use while it not so

for more info: Please google out so or search on wikipedia

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.