Encyclopedia of Computer Science and Technology

computer virus 111programmed into a virus is to reproduce itself, a virus programcan spread rapidly. Viruses are generally programmedto seek out program files that are likely to be executed inthe near future, such as those used by the operating systemduring the startup process. The result is a copy that canin turn generate an additional copy, and so on. (A virusdisguised as an innocuous program is sometimes calleda Trojan, short for “Trojan horse.” A distinction is sometimesmade between viruses and worms. A worm generallyuses flaws in a networking system to send copies to othermachines, without needing to insert code into a program.)Appearing in the 1980s, the first computer viruses weregenerally spread by infecting programs on floppy disks,which were often passed between users. Today, viruses generallyhave instructions that enable them to gain access tonetwork facilities (such as e-mail) to facilitate their spreadingto other systems on a local network or on the Internet.The spread of viruses is complicated by the fact that operatingsystems (particularly Microsoft Windows) and applications(such as Microsoft Office) have the ability to runscripts or “macros” that are attached to documents. Thisfacility can be useful for tasks such as sophisticated documentformatting or form-handling, but it also means thatviruses can attach themselves to scripts or macros and runwhenever a document containing them is opened. Sincemodern e-mail programs have the ability to include documentsas attachments to messages, this means that theunsuspecting recipient of a message can trigger a virus simplyby opening a message attachment.In today’s Web-centric world, viruses are often spreadusing links in e-mail that either entices or frightens thereader into clicking on a link to a Web site, which canbe made to closely resemble that of a legitimate institutionsuch as a bank or e-commerce site (see phishing andspoofing). Once connected to the site, the user’s computercan be infected with a virus or with some other form of“malware” (see spyware and adware). This route of infectionis particularly dangerous because normal antivirusprograms scan e-mail but not data being downloaded froma Web site, and firewalls are generally set to allow normalWeb requests.Once installed, a virus can be used for a variety of purposesaccording to the “payload” of instructions that areset to execute. Sensitive information such as credit carddetails can be stolen (see identity theft). Sometimes theinfected computer can appear to be unaffected, but has hada stealthy “bot” (robot) program inserted. Thousands ofbots can be linked into a “botnet” and later commanded totrigger large-scale “distributed denial of service” (DDOS)attacks to flood targeted Web sites with requests, crashingor disabling the site.Viruses can be further disguised by programming themto remain dormant until a certain date, time, or other conditionis reached. (Such a virus is sometimes called a logicbomb.) For example, a disgruntled programmer who isabout to be dismissed might insert a virus that will wipeout payroll data at the beginning of the next month. Afamous example of the time-triggered virus was the Michelangelovirus, so named because it was triggered to run onthe artist’s birthday, March 6, 1992. (See computer crimeand security.)Viruses can be overtly destructive (such as by reformattinga computer’s hard drive, wiping out its data). Otherviruses can simply tie up system resources. The most infamousexample of this was the “Internet Worm” introducedonto the network on November 2, 1988, by Robert Morris,Jr. This program was intended to reproduce slowly, plantingits “segments” on networked computers by exploiting aflaw in the UNIX sendmail program. Unfortunately, Morrismade an error that caused the worm to spread much morerapidly. Before the coordinated efforts of system administratorsat affected sites came up with countermeasures, theworm had cost somewhere in the hundreds of thousands ofdollars in lost computer and programmer time.CountermeasuresThe only certain defense of a computer system from viruseswould be through abstaining from contact between it andany other computers, either directly through a network orindirectly through exchange of programs on floppy disksor other removable media. In today’s highly networkedworld, this is usually impractical. A more practical defenseis to install antivirus software. Antivirus programs workby comparing the contents of files (either those already onthe disk or entering via the Internet) with “signatures” orpatterns of data found in known viruses. More sophisticatedantivirus programs include the ability to recognizeprogram code that is similar to that found in known virusesor that attempts suspicious operations (such as attempts toreformat a disk or bypass the operating system and writedirectly to disk). If an antivirus program recognizes a virus,it warns the user and can be told to actually remove thevirus. Because dozens of new viruses are identified eachweek, virus programs must be updated frequently with newvirus signature files in order to remain effective. Many antivirusprograms can update themselves by periodically linkingto a Web site containing the update files.Modern operating systems (such as Microsoft WindowsVista) have attempted to make it harder for unauthorizedprograms to access critical system files, such as by limitingdefault access permissions or prompting the user toapprove various activities. Such operating systems alsoinclude an updating feature that can automatically downloadand install security “patches”—a vital task, as can beseen from the volume and variety of such updates that seemto appear every month. Indeed the use of “blended” threats(including more than one potential infection mechanism)and the development of new “exploits” for hundreds of differentdata file formats make system protection an ongoingchallenge.Reducing user temptation and enhancing user awarenessis also important. Since unsolicited e-mail (see spam)is often a source of potentially malicious links and attachments,running a spam-blocking program can help protectthe computer. There are also programs that can detectand block “phishing” messages and their related Web sites.Since none of these programs can completely keep up withthe rapid appearance of new threats, caution and common