Computer viruses

Viruses are programs that "migrate" through networks and operating systems and attach themselves to different programs and databases. Viruses typically find their way into microcomputers through copied floppy disks or programs downloaded from electronic bulletin boards.

Birth of the virus

"Core wars" were kept on University computers, until the publication of how a virus worked in "Scientific American", and consequently the birth of the virus.

Terms

Multipartite virus
- Infect both executable files and boot sectors.
Polymorphic viruses
- Alter their appearance with each infection, making it harder to detect them.
Stealth viruses
- Hide the changes they make to the operating system, directory structures and file sizes so nothing appears to have been tampered with.
Macro virus
- (First appeared 1995) hide in documents (MS-Word, or MS-Excel), activated when the document is opened.
Trojan horse
- Cannot replicate themselves within a system, and as such are not true viruses.

Ted Turner Virus, Colourises your monochrome monitor!!!

Ref [41]NZ PC World Jun 94

Examples

Pakistane

Two brothers distributing commercial software, wanted to "punish" users, who were illegally copying it, so added a virus to the code.

Marijuana

Sometimes called New Zealand Virus.

Halts the computer and places "This machine is stoned" - legalise marijuana" on the screen. The original version was modified from a "nuisance" virus to a destructive virus destroying the disks FAT (file allocation table).

swvirlm0.jpg (114762 bytes)

Printout from Nortons utilities showing Sector 0 code. The Hex code at left (machine code), at right is an attempt to translate the machine code into text. The "Legalise Marijuana" comment clearly shows. It is rumoured that this virus was created in Wellington New Zealand.

Macro

First appeared 1995. Hide in document files - or files that can contain embedded macros.

Winword.concept (left) causes Word to save files as templates and infects all new Word documents and existing templates when you save your file.

Others:

Colours - randomly changes text colours.

Nuclear - adds two lines
"and finally I would like to say:
Stop all French nuclear testing in the Pacific"

Hot - sets a date 14 days from infection, at which point causes random document erasure.

(Wright, H. 1996, Mar)

Measures to reduce threat - Security Controls

Anti-virus software

swvirmaf.gif (4248 bytes)
A MS-Word "Macro" virus. 1999

Because viruses can be so serious - certain disk-killer viruses can destroy all the information on a system - computer users are advised to:

Know and trust your sources of data and programs
Ban employees bringing in outside disks - or implement a policy for "foreign disks".
Scan disks with virus checkers, ie treat all disks as infected until proven otherwise
Make regular backups
Monitor all programs/documents "downloaded" from public systems such as Internet.
Have a memory resident virus monitor that scans for viruses.
Regularly check disks for viruses.
Frequently update your virus checker.