Anatomy of Viruses

What is a computer Virus and how do they work?

Viruses can create a technological holocaust for millions of computers around the world. Businesses fret over the potential for a catastrophic meltdown of networks. Individual consumers worry about zapping their computer's hard drive simply by clicking the wrong e-mail attachment. Experts say such worries are well-founded, but emphasize that a combination of the latest anti-virus software and common sense will drastically reduce the odds of being infected. The cost of not taking such precautions can be high.

How they work, and what to look for.

Dreaded computer viruses, you hear all about these nasty nasties, but do you really know what they are and what havoc they can wreak? The mere thought conjures up devastation and turmoil and can get your imagination rolling. Tall tales, such as the Good Times Virus and other hoaxes, have made it hard for most of us non-anti-virus researchers to determine fact from fiction.

The following description seeks to get to the bottom of just what viruses are, how to avoid infestation, how to determine if you've caught one, and what to do if you have.

In the simplest of terms, a virus is a computer program that reproduces itself and attaches that copy to other computer programs. It does so in such a way that its instructions (viral code) are carried forward when the infected program is launched or when an infected disk is left in the disk drive and allowed to boot. The most troubling part about this is that it is done without the consent or knowledge of the computer user.

Viruses can be as benign as a minor case of acne, such as those that display pleasant or annoying messages, or as malignant as a full spread disease, such as those that destroy your data files and system.

Rest assured, only a small percentage of viruses are of the latter type. In fact, there are nearly 20,000 known viruses for the PC (There are a lot less Mac viruses.) of which only 500 are currently "in the wild" (circulating on unsuspecting computers). Of that, only 20-50 are known to cause serious damage. For more information on the prevalence of viruses, visit http://www.virusbtn.com/WildLists.

All viruses follow pretty much the same course of action. When the virus code is run it reproduces and infects other programs. When it starts to spread is usually a characteristic of that particular virus. Some infect each time they are run. Other more tricky ones infect when triggered by a certain time, date, function, or other external event.

Then some have an attack phase, otherwise known as a "payload," associated with them. A payload is the damaging effect of the virus that runs the gamut from deleting files or randomly changing data on your disk to playing music or creating messages or animations on your screen. When the virus inflicts its damage is also characteristic of the particular virus.

But most delay doing so only until after they've had time to spread. Some are written to spread only which is bothersome as well because they take up space and slow down your system.

A graduate student at MIT, as part of a controlled experiment he was conducting, wrote the first virus in 1986. A year later, hackers caught on and began writing and spreading viruses. By 1990-1991 the number of viruses found in the wild started to flourish. There are several types of viruses: Boot Sector, File, Macro, Polymorphic, Stealth and Resident viruses. Some viruses can possess characteristics of more than one of these types.

"Many people will get a virus at one point or another, and some of them will be harmed by it," said Bruce Peters, a anti-virus and data recovery expert. "Some will lose data, some will suffer no damage other than the time, effort, and stress it takes to remove the virus. Some will spread the virus to others and damage the most valuable thing: their reputations."

Anatomy of a Virus

Though most computer users have learned to fear viruses, few really know what they are. Viruses are programs that replicate themselves inside a computer. The malicious bug cannot do its damage when a user simply surfs the Web or opens a plain text message such as an e-mail. However, viruses are unleashed when they are hidden in attachments to e-mail messages and someone opens that attachment. After viruses replicate, many carry out damaging instructions that have been programmed into them.

The Melissa virus from March 1999 is a good example of how viruses inflict damage. Melissa lurked inside an e-mail Microsoft Word attachment. The person who received the message had no reason to suspect anything dangerous; in fact, the e-mail's subject line appeared to be from someone the recipient recognized.

However, once the recipient clicked on the attachment, Melissa fused itself to a Word object and began rifling through the poor victim's address book. Soon, Melissa was e-mailing tainted attachments to the first 50 names in the recipients address book.

"Some viruses do nothing except replicate," Peters said. "Some will do damage, but not intentionally. Then again, there are those that attempt - and sometimes succeed - in destroying all files on the computer, or subtly altering data in documents, or whatever nasty thing you can conceive that a computer program is capable of doing."

To make matters worse, those who create viruses continually add new twists to their method of attack. Late in June, the Stages virus struck. Before Stages, computer users were assured that viruses could not be spread through text files. So, when Microsoft Outlook users saw an attachment that appeared as "LIFE_STAGES.TXT," many figured it was safe to open. When they did so, a humorous test file about dating appeared.

What users didn't realize was that the attachment was not a text file but had a hidden .SHS extension, which meant it contained infected computer code. Soon, the virus was on the loose and e-mailing itself to everyone in the recipient's address book.

Peters hopes the recent wave of high-profile viruses will cause lawmakers to treat the problem as the potentially serious crime that it is. However, he said the war on this scourge requires vigilance.

"Yes, we'll become more successful overall," he said. "But yes, things will get worse, too: my prediction is that while more viruses will be prevented on a percentage basis, there will always be a few high profile successes by the virus writers.

"Those successes, however, will be short-lived, because anti-virus companies will be quick to create a solution to each new threat."

How Computer Virus Works?

Strange as it may sound, the computer virus is something of an Information Age marvel. On one hand, viruses show us how vulnerable we are -- a properly engineered virus can have a devastating effect, disrupting productivity and doing billions of dollars in damages. On the other hand, they show us how sophisticated and interconnected human beings have become.
For example, experts estimate that the Mydoom worm infected approximately a quarter-million computers in a single day in January 2004. Back in March 1999, the Melissa virus was so powerful that it forced Microsoft and a number of other very large companies to completely turn off their e-mail systems until the virus could be contained. TheILOVEYOU virus in 2000 had a similarly devastating effect. In January 2007, a worm called Storm appeared -- by October, experts believed up to 50 million computers were infected. That's pretty impressive when you consider that many viruses are incredibly simple.
When you listen to the news, you hear about many different forms of electronic infection. The most common are:

• Viruses - A virus is a small piece of software that piggybacks on real programs. For example, a virus might attach itself to a program such as a spreadsheet program. Each time the spreadsheet program runs, the virus runs, too, and it has the chance to reproduce (by attaching to other programs) or wreak havoc.
• E-mail viruses - An e-mail virus travels as an attachment toe-mail messages, and usually replicates itself by automatically mailing itself to dozens of people in the victim's e-mail address book. Some e-mail viruses don't even require a double-click -- they launch when you view the infected message in the preview pane of your e-mail software [source:Johnson].
• Trojan horses - A Trojan horse is simply a computer program. The program claims to do one thing (it may claim to be a game) but instead does damage when you run it (it may erase your hard disk). Trojan horses have no way to replicate automatically.
• Worms - A worm is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well.

In this article, we will discuss viruses -- both "traditional" viruses and e-mail viruses -- so that you can learn how they work and understand how to protect yourself.