Technically Speaking: The Computer Virus
(Written by guest contributor Jared Newgent)
We have all heard of them, and we all know how important it is to keep our computers free from viruses. But what exactly is a computer virus and how does it work?
A computer virus is a program with malicious intent that replicates itself and can only infect another computer or program via some form of executable code (called host) transferred to the program or new computer over the Internet, internal network, or even removable media such as a flash drive. A virus will not spread until executed by human action.
For a virus to replicate it must be permitted to execute code and write to the computer’s memory. Viruses will often be attached to executable files that typically are part of a larger “legitimate” program. When the user launches an infected program, that user may also be unwittingly executing the virus. Some hosts that viruses target are:
• Binary executable files (such as COM-files and EXE-files in MS-DOS, Portable Executable files in Microsoft Windows, and ELF files in Linux)
• Boot sectors of floppy disks and hard disk partitions
• The Master Boot Record of a hard disk
• General purpose script files (such as batch files in MS-DOS and Microsoft Windows, and shell script files on UNIX platforms)
• Application-specific script files (such as Telix-scripts)
• Documents that can contain macros (such as Microsoft Word documents, Microsoft Excel spreadsheets, AmiPro documents, Microsoft Office files, and Microsoft Access database files)
The word “virus” is often used as a general term to include programs such as spyware, adware, worms, rootkits, or Trojans, to name a few. However, “malware” is a more effective generalization. Other malware, such as Trojans, technically are not viruses due to the fact that they cannot replicate. A Trojan is full of as much trickery as the mythological Trojan Horse it was named after. A Trojan, though seemingly useful, will actually do damage once installed or run on your computer. Users on the receiving end of a Trojan are usually duped into opening them because they appear to be receiving legitimate software from a legitimate source. When a Trojan is activated on your computer, the results can vary. Some Trojans are designed to be more annoying than malicious or they can cause serious damage by deleting files and destroying information on your system. Trojans are also known to create a backdoor on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.
Worms
Another form of malware, called a worm, is similar to a virus (and often times worse), because it, too, attempts to replicate and spread. The difference, though, is that the worm will use existing loopholes or exploits to spread across networks and between systems, without any user interaction. Due to the copying nature of a worm, and its ability to travel across networks, the end result in most cases is that the worm consumes too much system memory (or network bandwidth), causing web servers, network servers, and individual computers to stop responding.
You may remember the ILOVEYOU worm; a worm that successfully attacked tens of millions of Windows computers in 2000 when it was sent as an attachment to an email message with the text “ILOVEYOU” in the subject line. Upon opening the attachment, the worm overwrote important files – music files, multimedia files, and more – with a copy of itself. It also sent the worm to everyone on the user’s contact list.
How to protect your files
Many users install anti-virus software that can detect and eliminate known viruses after the computer downloads or runs the executable. Some anti-viruses can also warn a user if a file is likely to contain a virus based on the file type. Others can examine the contents of the computer’s memory (its RAM, and boot sector) and the files stored on fixed or removable drives (hard drives, floppy drives), and comparing those files against a database of known virus “signatures.” Some anti-virus programs are able to scan opened files in addition to sent and received emails “on the fly” in a similar manner. This practice is known as “on-access scanning.” Anti-virus software does not change the underlying capability of host software to transmit viruses. Users must update their software regularly to patch security holes. Anti-virus software also needs to be updated in order to gain knowledge about the latest threats and hoaxes.
Just as genetic diversity in a people decreases the chance of a single disease wiping out all of us, the diversity of software systems on a network similarly limits the destructive potential of viruses.
Due to their market dominance, Microsoft software is often targeted by virus writers. Although Windows is by far the most popular operating system for virus writers, some viruses also exist on other platforms. Any operating system that allows third-party programs to run can theoretically run viruses. Some operating systems are less secure than others. Unix-based OS’s (and NTFS-aware applications on Windows NT based platforms) only allow their users to run executables within their own protected memory space.
Interesting Facts:
A program called “Rother J” was the first computer virus. Written in 1981 by Richard Skrenta, it attacked Apple DOS 3.3 operating system and spread via floppy disk.
The first PC virus was a boot sector virus dubbed (c)Brain[9], created in 1986 by the Farooq Alvi Brothers in Lahore, Pakistan.
