Computer Viruses

A computer virus is a potentially damaging computer program designed to affect, or infect, your
computer negatively by altering the way it works without your knowledge or permission. More
specifically, a computer virus is a segment of program code that implants itself in a computer file
and spreads systematically from one file to another. Viruses can spread to your computer if an
infected floppy disk is in the disk drive when you boot the computer, if you run an infected
program, or if you open an infected data file in a program.
Computer viruses, however, do not generate by chance. Creators, or programmers, of computer
virus programs write them for a specific purpose usually to cause a certain type of symptom or
damage. Some viruses are harmless pranks that simply freeze a computer temporarily or display
sounds or messages. When the Music Bug virus is triggered, for example, it instructs the
computer to play a few chords of music. Other viruses, by contrast, are designed to destroy or
corrupt data stored on the infected computer. Thus, the symptom or damage caused by a virus
can be harmless or cause significant damage, as planned by its creator.
Viruses have become a serious problem in recent years. Currently, more than 45,000 known virus
programs exist and an estimated six new virus programs are discovered each day. The increased
use of networks, the Internet, and e-mail has accelerated the spread of computer viruses, by
allowing individuals to share files and any related viruses more easily than ever.
Types of Viruses
Although numerous variations are known, four main types of viruses exist: boot sector viruses,
file viruses, Trojan horse viruses, and macro viruses. A boot sector virus replaces the boot
program used to start a computer with a modified, infected version of the boot program. When
the computer runs the infected boot program, the computer loads the virus into its memory. Once
the virus is in memory, it spreads to any disk inserted into the computer. A file virus attaches
itself to or replaces program files; the virus then spreads to any file that accesses the infected
program. A Trojan horse virus (named after the Greek myth) is a virus that hides within or is
designed to look like a legitimate program. A macro virus uses the macro language of an
application, such as word processing or spreadsheet, to hide virus code. When you open a
document that contains an infected macro, the macro virus loads into memory. Certain actions,
such as opening the document, activate the virus. The creators of macro viruses often hide them
in templates so they will infect any document created using the template.
Depending on the virus, certain actions can trigger the virus. Many viruses activate as soon as a
computer accesses or runs an infected file or program. Other viruses, called logic bombs or time
bombs, activate based on specific criteria. A logic bomb is a computer virus that activates when it
detects a certain condition. One disgruntled worker, for example, planted a logic bomb that
began destroying files when his name appeared on a list of terminated employees. A time bomb
is a type of logic bomb that activates on a particular date. A well-known time bomb is the
Michelangelo virus, which destroys data on a hard disk on March 6, Michelangelos birthday.

Another type of malicious program is a worm. Although often it is called a virus, a worm, unlike
a virus, does not attach itself to another program. Instead, a worm program copies itself
repeatedly in memory or on a disk drive until no memory or disk space remains. When no
memory or disk space remains, the computer stops working. Some worm programs even copy
themselves to other computers on a network.
Virus Detection and Removal
No completely effective methods exist to ensure that a computer or network is safe from
computer viruses. You can take precautions, however, to protect your home and work computers
from virus infections. These precautions are discussed in the following paragraphs.
An antivirus program protects a computer against viruses by identifying and removing any
computer viruses found in memory, on storage media, or on incoming files. Most antivirus
programs also protect against malicious ActiveX code and Java applets that might be included in
files you download from the Web. An antivirus program scans for programs that attempt to
modify the boot program, the operating system, and other programs that normally are read from
but not modified.
Antivirus programs also identify a virus by looking for specific patterns of known virus code,
called a virus signature, which they compare to a virus signature file. You should update your
antivirus programs virus signature files frequently so they include the virus signatures for newly
discovered viruses and can protect against viruses written after the antivirus program was
released.
Even with an updated virus signature file, however, antivirus programs can have difficulty
detecting some viruses. One such virus is a polymorphic virus, which modifies its program code
each time it attaches itself to another program or file. Because its code never looks the same, an
antivirus program cannot detect a polymorphic virus by its virus signature.
Another technique that antivirus programs use to detect viruses is to inoculate existing program
files. To inoculate a program file, the antivirus program records information such as the file size
and file creation date in a separate inoculation file. The antivirus program then can use this
information to detect if a computer virus tampers with the inoculated program file. Some
sophisticated viruses, however, take steps to avoid detection. Such a virus, called a stealth virus,
can infect a program file, but still report the size and creation date of the original, uninfected
program.
Once an antivirus program identifies an infected file, it can remove the virus or quarantine the
infected file. When a file is quarantined, the antivirus program places the infected file in a
separate area of your computer until you can remove the virus, thus insuring that other files will
not become infected.
In addition to detecting and inoculating against viruses, most antivirus programs also have
utilities to remove or repair infected programs and files. If the virus has infected the boot
program, however, the antivirus program first will require you to restart the computer with a
floppy disk called a rescue disk. The rescue disk, or emergency disk, is a disk that contains an

uninfected copy of key operating system commands and startup information that enables the
computer to restart correctly. Once you have restarted the computer using a rescue disk, you can
run repair and removal programs to remove infected files and repair damaged files. If the
program cannot repair the damaged files, you may have to replace, or restore, them with
uninfected backup copies of the file.
Works Cited
Shelley, Gary B., Thomas J. Cashman, Misty E. Vermaat, and Tim J. Walker. Discovering
Computers 2001: Concepts for a Connected World. Cambridge: Course Technology, 2000.