|
Computer viruses are called
viruses because they share some of the traits of
biological viruses. A computer virus passes from
computer to computer like a biological virus passes
from person to person.
Early viruses were pieces of
code attached to a common program like a popular
game or a popular word processor.
A person might download an infected game from a bulletin
board and run it. A virus like this is a small piece
of code embedded in a larger, legitimate program. Any
virus is designed to run first when the legitimate
program gets executed. The virus loads itself into
memory and looks around to see if it can find any other
programs on the disk. If it can find one, it modifies
it to add the virus's code to the unsuspecting program.
Then the virus launches the "real program." The
user really has no way to know that the virus ever
ran. Unfortunately, the virus has now reproduced itself,
so two programs are infected. The next time either
of those programs gets executed, they infect other
programs, and the cycle continues.
If one of the infected programs is given to another
person on a floppy disk, or if it is uploaded to a
bulletin board, then other programs get infected. This
is how the virus spreads.
The spreading part is the infection
phase of the virus. Viruses wouldn't be so violently
despised if all they
did was replicate themselves. Unfortunately, most viruses
also have some sort of destructive attack phase where
they do some damage. Some sort of trigger will activate
the attack phase, and the virus will then "do
something" -- anything from printing a silly message
on the screen to erasing all of your data. The trigger
might be a specific date, or the number of times the
virus has been replicated, or something similar.
As virus creators got more sophisticated, they learned
new tricks. One important trick was the ability to
load viruses into memory so they could keep running
in the background as long as the computer remained
on. This gave viruses a much more effective way to
replicate themselves. Another trick was the ability
to infect the boot sector on floppy disks and hard
disks. The boot sector is a small program that is the
first part of the operating system that the computer
loads. The boot sector contains a tiny program that
tells the computer how to load the rest of the operating
system. By putting its code in the boot sector, a virus
can guarantee it gets executed. It can load itself
into memory immediately, and it is able to run whenever
the computer is on. Boot sector viruses can infect
the boot sector of any floppy disk inserted in the
machine, and on college campuses where lots of people
share machines they spread like wildfire.
In general, both executable and boot sector viruses
are not very threatening any more. The first reason
for the decline has been the huge size of today's programs.
Nearly every program you buy today comes on a compact
disc. Compact discs cannot be modified, and that makes
viral infection of a CD impossible. The programs are
so big that the only easy way to move them around is
to buy the CD. People certainly can't carry applications
around on a floppy disk like they did in the 1980s,
when floppies full of programs were traded like baseball
cards. Boot sector viruses have also declined because
operating systems now protect the boot sector.
Both boot sector viruses and
executable viruses are still possible, but they are
a lot harder now and they
don't spread nearly as quickly as they once could.
Call it "shrinking habitat," if you want
to use a biological analogy. The environment of floppy
disks, small programs and weak operating systems made
these viruses possible in the 1980s, but that environmental
niche has been largely eliminated by huge executables,
unchangeable CDs and better operating system safeguards.
|