E-mail viruses:
These viruses migrate by means of e-mail messages and/or attachments.
They spread by e-mailing themselves to every address found in the
address book in the computer. Given the sheer volume of e-mail traffic
on a global basis, this allows these viruses to spread very rapidly,
and the volume created has forced e-mail server shutdowns on a number
of occasions.
Worms:
These are small pieces of software that makes use of computer networks
and security holes found in them to replicate and spread. Most worms
are written to detect and exploit a specific security hole or flaw.
Once a computer on a network is discovered with the appropriate
weakness, it gets attacked and infected by the worm. The worm then
scans the network looking for another computer with the same hole
and the process repeats. Now there are two computers for it to replicate
from. The process continually repeats itself, but with the speed
of today’s computers and networks, a network of say 50 computers
and a properly engineered worm can easily infect all 50 computers
in the network in under an hour. Perhaps the most famous worm of
recent times was Code Red. In July of 2001 it replicated itself
over 250,000 times in just nine hours.
Trojans
(Trojan Horses):
Simply stated, a Trojan is a program. The program claims to do one
thing, but when run, it does damage to the computer running it (for
example, it may be designed to erase your hard drive). Fortunately,
a straight Trojan Horse has no way of replicating itself.
Now for some background and history
regarding viruses:
Executable viruses:
Early viruses were pieces of code
attached to a common program like a popular game or a popular word
processor. A person might download an infected game from a bulletin
board and run it. A virus like this is a small piece of code embedded
in a larger, legitimate program. Any virus is designed to run first
when the legitimate program gets executed. The virus loads itself
into memory and looks around to see if it can find any other programs
on the disk. If it can find one, it modifies it to add the virus's
code to the unsuspecting program. Then the virus launches the "real
program." The user really has no way to know that the virus
ever ran. Unfortunately, the virus has now reproduced itself, so
two programs are infected. The next time either of those programs
gets executed, they infect other programs, and the cycle continues.
If one of the infected programs is given to another person on a
floppy disk, or if it is uploaded to a bulletin board, then other
programs get infected. This is how the virus spreads. The spreading
part is the infection phase of the virus. Viruses wouldn't be so
violently despised if all they did was replicate themselves. Unfortunately,
most viruses also have some sort of destructive attack phase where
they do some damage. Some sort of trigger will activate the attack
phase, and the virus will then "do something" -- anything
from printing a silly message on the screen to erasing all of your
data. The trigger might be a specific date, or the number of times
the virus has been replicated, or something similar.
Boot Sector Viruses:
As virus creators got more sophisticated, they learned new tricks.
One important trick was the ability to load viruses into memory
so they could keep running in the background as long as the computer
remained on. This gave viruses a much more effective way to replicate
themselves. Another trick was the ability to infect the boot sector
on floppy disks and hard disks. The boot sector is a small program
that is the first part of the operating system that the computer
loads. The boot sector contains a tiny program that tells the computer
how to load the rest of the operating system. By putting its code
in the boot sector, a virus can guarantee it gets executed. It can
load itself into memory immediately, and it is able to run whenever
the computer is on. Boot sector viruses can infect the boot sector
of any floppy disk inserted in the machine, and on college campuses
where lots of people share machines they spread like wildfire.
In general, both executable and
boot sector viruses are not very threatening any more. The first
reason for the decline has been the huge size of today's programs.
Nearly every program you buy today comes on a compact disc. Compact
discs cannot be modified, and that makes viral infection of a CD
impossible. The programs are so big that the only easy way to move
them around is to buy the CD. People certainly can't carry applications
around on a floppy disk like they did in the 1980s, when floppies
full of programs were traded like baseball cards. Boot sector viruses
have also declined because operating systems now protect the boot
sector.
Both boot sector viruses and executable viruses are still possible,
but they are a lot harder now and they don't spread nearly as quickly
as they once could. Call it "shrinking habitat," if you
want to use a biological analogy. The environment of floppy disks,
small programs and weak operating systems made these viruses possible
in the 1980s, but huge executables, unchangeable CDs and better
operating system safeguards have largely eliminated that environmental
niche.
E-mail viruses:
The latest thing in the world of
computer viruses is the e-mail virus, and the Melissa virus in March
1999 was spectacular. Melissa spread in Microsoft Word documents
sent via e-mail, and it worked like this:
Someone created the virus as a Word
document uploaded to an Internet newsgroup. Anyone who downloaded
the document and opened it would trigger the virus. The virus would
then send the document (and therefore itself) in an e-mail message
to the first 50 people in the person's address book. The e-mail
message contained a friendly note that included the person's name,
so the recipient would open the document thinking it was harmless.
The virus would then create 50 new messages from the recipient's
machine. As a result, the Melissa virus was the fastest-spreading
virus ever seen! As mentioned earlier, it forced a number of large
companies to shut down their e-mail systems.
The ILOVEYOU virus, which appeared
on May 4, 2000, was even simpler. It contained a piece of code as
an attachment. People who double clicked on the attachment allowed
the code to execute. The code sent copies of itself to everyone
in the victim's address book and then started corrupting files on
the victim's machine. This is as simple as a virus can get. It is
really more of a Trojan horse distributed by e-mail than it is a
virus.
The Melissa virus took advantage
of the programming language built into Microsoft Word called VBA,
or Visual Basic for Applications. It is a complete programming language
and it can be programmed to do things like modify files and send
e-mail messages. It also has a useful but dangerous auto-execute
feature. A programmer can insert a program into a document that
runs instantly whenever the document is opened. This is how the
Melissa virus was programmed. Anyone who opened a document infected
with Melissa would immediately activate the virus. It would send
the 50 e-mails, and then infect a central file called NORMAL.DOT
so that any file saved later would also contain the virus! It created
a huge mess.
Microsoft applications have a feature
called Macro Virus Protection built into them to prevent this sort
of thing. With Macro Virus Protection turned on (the default option
is ON), the auto-execute feature is disabled. So when a document
tries to auto-execute viral code, a dialog pops up warning the user.
Unfortunately, many people don't know what macros or macro viruses
are, and when they see the dialog they ignore it, so the virus runs
anyway. Many other people turn off the protection mechanism. So
the Melissa virus spread despite the safeguards in place to prevent
it.
In the case of the ILOVEYOU virus,
the whole thing was human-powered. If a person double-clicked on
the program that came as an attachment, then the program ran and
did its thing. What fueled this virus was the human willingness
to double-click on the executable.
One thing is certain. Although viruses are not as prevalent and
dominant as they once were, they are here to stay. The main danger
from them is the damage caused. The more skilled writers of the
new millennium are also finding ways to ‘package’ viruses,
which means include them inside other forms of malware in order
to ensure successful spreading and damage on a large scale. These
same writers are turning out more complex and difficult to detect
and remove code as time marches on.
The bottom line is this. If you
intend to connect a computer to the Internet, a good anti-virus
program is a must for your computer. The bigger the database it
draws from, and the more automatic its operation, the better.