What is a Computer Virus?

A Computer Virus is a program (a block of executable code) which attaches itself to, overwrites or otherwise replaces another program in order to reproduce itself without the knowledge of the PC user.

In other words, a computer virus is a code fragment (not an independent program) that reproduces by attaching to another program. It may damage data directly, or it may degrade system performance by taking over system resources, which are then not available to authorized users.

Most viruses are comparatively harmless, and may be present for years with no noticeable effect; some, however, may cause random damage to data files (sometimes insidiously, over a long period) or attempt to destroy files and disks. Others cause unintended damage. Even benign viruses (apparently non-destructive viruses) cause significant damage by occupying disk space and/or main memory, by using up CPU processing time and by the time and expense wasted in detecting and removing them.

[Top]

What is a Trojan Horse program?

A type of program that is often confused with viruses is a 'Trojan horse' program. This is not a virus, but simply a program (often harmful) that pretends to be something else. For example, you might download what you think is a new game; but when you run it, it deletes files on your hard drive. Or the third time you start the game, the program E-mails your saved passwords to another person.

For example, DLoader-L arrives in an email attachement and claims to be an urgent update from Microsoft for Windows XP. If you run it, it downloads a program that uses your computer to connect to certain websites, in an attempt to overload them (this is called a denial of service attack).

Note: simply downloading a file to your computer won't activate a virus or Trojan horse; you have to execute the code in the file to trigger it. This could mean running a program file, or opening a Word/Excel document in a program (such as Word or Excel) that can execute any macros in the document.

[Top]

What is a Computer Worm?

A worm is a self-replicating program that does not alter files but resides in active memory and duplicates itself by means of computer networks.

Worms are very similar to viruses in that they are computer programs that replicate themselves and that often, but not always, contain some functionality that will interfere with the normal use of a computer or a program. But unlike a virus, it does not attach itself to a host program.

[Top]

A brief History

1950s Bell Labs develop an experimental game in which players use malicious programs to attack each other’s computers.

1975 Sci-fi author John Brunner imagines a computer “worm” spreading across networks.

1984 Fred Cohen introduces the term “computer virus” in a thesis on such programs.

1986 The first computer virus, Brain, is allegedly written by two brothers in Pakistan.

1987 The Christmas tree worm paralyses the IBM worldwide network.

1988 The Internet worm spreads through the US DARPA internet.

1992 There is worldwide panic about the Michelangelo virus, although very few computers are infected.

1994 Good Times, the first major virus hoax, appears.

1995 The first document virus, Concept, appears.

1998 CIH or Chernobyl becomes the first virus to paralyse computer hardware.

1999 Melissa, a virus that forwards itself by email, spreads worldwide. Bubbleboy, the first virus to infect a computer when email is viewed, appears.

2000 Love Bug becomes the most successful email virus yet. The first virus appears for the Palm operating system, although no users are infected.

2001 A virus claiming to contain pictures of tennis player Anna Kournikova infects hundreds of thousands of computers worldwide.

2002 David L Smith, the author of Melissa, is sentenced to 20 months in prison by US courts.

2003 The Blaster worm spreads itself across the internet via a security weakness in Microsoft software. Together with the Sobig email virus, it makes August 2003 the worst month ever for virus incidents.

2004 The creators of the Netsky and Beagle series of worms compete to see which can have the greater impact.

[Top]

What kinds of files can be infected by viruses?

Viruses can attach themselves to any code that runs on your computer: programs, documents, or the files that start up the operating system.

Programs: Some viruses infect programs. When you start the infected program, the virus is launched first. This type of virus appeared early in virus history but still poses a threat, as the internet makes it easy to distribute programs.

Documents: Word processing or spreadsheet applications often use “macros” to automate tasks. Some viruses take the form of a macro that can spread from one document to another. If you open a document that contains the virus, it copies itself into the application’s startup files and infects other documents you open with that application.

Boot sectors: When you switch on your computer, it accesses a part of the disk called the “boot sector”and runs a program that starts the operating system. The earliest viruses replaced this boot sector with their own, modified version. If the user started up their computer from an infected disk, the virus became active.

Since virus code must be executed to have any effect, files that the computer treats as pure data are safe. This includes graphics and sound files such as .gif, .jpg, .mp3, .wav, etc., as well as plain text in .txt files.

[Top]

How do viruses spread?

Viruses can reach your computer via all the routes shown here. You can read more details on the pages that follow.

Programs and Documents: Programs and documents can be infected with viruses. When you share them with other users, by putting them on your network or intranet, or by sending them out, the infection can spread.

Email: Email can include infected attachments. If you doubleclick on an infected attachment, you risk infecting your machine. Some emails even include malicious scripts that run as soon as you preview the mail or read the body text.

The Internet: You may download programs or documents that are infected. Security vulnerabilities in your operating system can network or intranet, also allow viruses to or by sending them infect your computer via the internet connection, without your having to do anything at all.

CDs and Floppies: Floppy disks can have a virus in the boot sector. They can also hold infected programs or documents. CDs may also hold infected items.

[Top]

What can viruses do?

Slow down Email: Viruses that spread by email, such as Sobig, can generate so much email traffic that servers