Understanding viruses

Everyone knows what a virus is. It doesn't take too many encounters with the likes of Melissa and I Love You to forge an indelible memory. However, most people don't really know the nature of a virus. Everyone has heard of the type of problems that can befall their systems, but they can't clearly differentiate a virus from a worm, or explain why a virus works.

Not every attack against computers is a virus, but because of the frequency at which viruses appear, many users have begun to assume that every problem they have is virus-related. A virus is a program that copies itself into other programs -- similar to the way biological viruses invade the host's cells -- and becomes active when a program is run (e.g., clicked on). From there, a virus infects other files.

What exactly is a virus, and how is it different from other forms of attack? Do viruses preferentially or exclusively attack Windows systems? Can they be subverted and used for altruistic purposes?

One reason for the confusion is that experts don't necessarily define a virus in precisely the same way. Some experts, like Bruce Schneier and Elizabeth Zwicky, claim a virus consists of two parts: a propagation mechanism and a payload. Others describe a virus as just the transport mechanism. In any case, when a virus infects a system, there are generally two components at work: one that handles the replication and one that does the damage.

Some authors further distinguish between propagation (local replication) and migration (getting from one system to another). Clearly, there's plenty of reason for the average man on the street (or in the next cubicle) to be confused. Consider the Melissa virus, which struck in March 1999 and was one of the first viruses to receive popular attention. Described as a virus, Melissa was said by some to be both a virus and a worm. The worm component allowed Melissa to move from system to system; the virus part managed the replication on the local system. If we consider a virus to be the transport mechanism only, we will likely see payloads that we would identify as time and logic bombs, buffer overflow exploits, and Trojan horses.

Important definitions concerning viruses include:

• Propagation/migration: how a virus replicates locally and over a network
• Payload: mechanism through which a virus causes damage or has an effect
• Signature: pattern with which a virus is detected by antiviral software
• Detection avoidance: method by which a virus attempts to hide itself
• Trigger: action through which a virus comes to life

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine