Computer The Symptoms Of Virus Infection?Viruses remain

Computer The Symptoms Of Virus Infection?Viruses remain

Computer Viruses: Past, Present And FutureIn our health-conscious society, viruses of any type are an enemy. Computerviruses are especially pernicious. They can and do strike any unprotectedcomputer system, with results that range from merely annoying to the disastrous,time-consuming and expensive loss of software and data. And with corporationsincreasingly using computers for enterprise-wide, business-critical computing,the costs of virus-induced down-time are growing along with the threat fromviruses themselves.

Concern is justified – but unbridled paranoia is not. Justas proper diet, exercise and preventative health care can add years to your life,prudent and cost-effective anti-virus strategies can minimize your exposure tocomputer viruses.A history of computer virusesWho writes viruses – and how they can reach youThe early warning symptoms of virus infectionThe real numbers behind the growth of viruses and their costsHow viruses work – and how virus protection can stop themWhat, Exactly, Is A Computer Virus?A computer virus is a program designed to replicate and spread, generally withthe victim being oblivious to its existence. Computer viruses spread byattaching themselves to other programs (e.g., word processors or spreadsheetsapplication files) or to the boot sector of a disk. When an infected file isactivated – or executed – or when the computer is started from an infected disk,the virus itself is also executed.

Often, it lurks in computer memory, waitingto infect the next program that is activated, or the next disk that is accessed.What makes viruses dangerous is their ability to perform an event. While someevents are harmless (e.g. displaying a message on a certain date) and othersannoying (e.g.

, slowing performance or altering the screen display), someviruses can be catastrophic by damaging files, destroying data and crashingsystems.How Do Infections Spread?Viruses come from a variety of sources. Because a virus is software code, it canbe transmitted along with any legitimate software that enters your environment:In a 1991 study of major U.

S. and Canadian computer users by the marketresearch firm Dataquest for the National Computer Security Association, mostusers blamed an infected diskette (87 percent). Forty-three percent of thediskettes responsible for introducing a virus into a corporate computingenvironment were brought from home.Nearly three-quarters (71 percent) of infections occurred in a networkedenvironment, making rapid spread a serious risk. With networking, enterprisecomputing and inter-organizational communications on the increase, infectionduring telecommunicating and networking is growing.

Seven percent said they had acquired their virus while downloading softwarefrom an electronic bulletin board service.Other sources of infected diskettes included demo disks, diagnostic disks usedby service technicians and shrink-wrapped software disks – contributing sixpercent of reported infections.What Damage Can Viruses Do To My System?As mentioned earlier, some viruses are merely annoying, others are disastrous.At the very least, viruses expand file size and slow real-time interaction,hindering performance of your machine. Many virus writers seek only to infectsystems, not to damage them – so their viruses do not inflict intentional harm.However, because viruses are often flawed, even benign viruses can inadvertentlyinteract with other software or hardware and slow or stop the system.

Otherviruses are more dangerous. They can continually modify or destroy data,intercept input/output devices, overwrite files and reformat hard disks.What Are The Symptoms Of Virus Infection?Viruses remain free to proliferate only as long as they exist undetected.Accordingly, the most common viruses give off no symptoms of their infection.Anti-virus tools are necessary to identify these infections. However, manyviruses are flawed and do provide some tip-offs to their infection. Here aresome indications to watch for:Changes in the length of programsChanges in the file date or time stampLonger program load timesSlower system operationReduced memory or disk spaceBad sectors on your floppyUnusual error messagesUnusual screen activityFailed program executionFailed system bootups when booting or accidentally booting from the A: drive.

Unexpected writes to a drive.The Virus Threat: Common – And GrowingHow real is the threat from computer viruses? Every large corporation andorganization has experienced a virus infection – most experience them monthly.According to data from IBM’s High Integrity Computing Laboratory, corporationswith 1,000 PCs or more now experience a virus attack every two to three months -and that frequency will likely double in a year.The market research firm Dataquest concludes that virus infection is growingexponentially. It found nearly two thirds (63%) of survey respondents hadexperienced a virus incident (affecting 25 or fewer machines) at least once,with nine percent reporting a disaster affecting more than 25 PCs.

The 1994Computer Crime Survey by Creative Strategies Research International and BBSSystems of San Francisco found 76 percent of U.S. respondents had experiencedinfection in 1993 alone.If you have only recently become conscious of the computer virus epidemic, youare not alone. Virus infections became a noticeable problem to computer usersonly around 1990 – but it has grown rapidly since then. According to a study byCertus International of 2,500 large U.S.

sites with 400 or more PCs, the rate ofinfection grew by 600 percent from 1994 to 1995.More Viruses Mean More InfectionsVirus infections are a growing problem, in part, because there are more strainsof viruses than ever before. In 1986, there were just four PC viruses. Newviruses were a rarity, with a virus strain created once every three months. By1989, a new virus appeared every week. By 1990, the rate rose to once every twodays.

Now, more than three viruses are created every day – for an average 110new viruses created in a typical month. From those modest four viruses in 1986,today’s computer users face thousands of virus strains.Number Of Unique VirusesHere is the frightening part: Most infections today are caused by viruses thatare at least six years old. That is, the infections are caused by virusescreated no later than 1990, when there were approximately 300 known viruses.

Today, there are thousands of viruses. If that pattern of incubation holds, theexplosion of new viruses over the past few years could result in anotherexplosion in total infections over the next few years.The History Of Viruses: How It All BeganToday, the existence of viruses and the need to protect against them areinevitable realities. But it wasn’t always so.

As recently as the middle 1980s,computer viruses didn’t exist. The first viruses were created in university labs- to demonstrate the”potential” threat that such software code could provide. By1987, viruses began showing up at several universities around the world.

Threeof the most common of today’s viruses – Stoned, Cascade and Friday the 13th -first appeared that year.Serious outbreaks of some of these viruses began to appear over the next twoyears. The Datacrime and Friday the 13th viruses became major media events,presaging the concern that would later surround the Michelangelo virus. Perhapssurprisingly, tiny Bulgaria became known as the world’s Virus Factory in 1990because of the high number of viruses created there. The NCSA found thatBulgaria, home of the notorious Dark Avenger, originated 76 viruses that year,making it the world’s single largest virus contributor.

Analysts attributeBulgaria’s prolific virus output to an abundance of trained but unemployedprogrammers; with nothing to do, these people tried their hands at virusproduction, with unfortunately successful results.This growing activity convinced the computer industry that viruses were seriousthreats requiring defensive action. IBM created its High Integrity ComputingLaboratory to lead Big Blue’s anti-virus research effort. Symantec beganoffering Symantec Anti-Virus, one of the first commercially available virusdefenses. These responses came none too soon.

By 1991, the first polymorphicviruses – that can, like the AIDS virus in humans, change their shape to eludedetection – began to spread and attack in significant numbers. That year too,the total number of viruses began to swell, topping 1,000 for the first time.Virus creation proliferated, and continues to accelerate, because of the growingpopulation of intelligent, computer-literate young people who appreciate thechallenge – but not the ethics – of writing and releasing new viruses. Culturalfactors also play a role. The U.S. – with its large and growing population ofcomputer-literate young people – is the second largest source of infection.

Elsewhere, Germany and Taiwan are the other major contributors of new viruses.Another reason for the rapid rise of new viruses is that virus creation isgetting easier. The same technology that makes it easier to create legitimatesoftware – Windows-based development tools, for example – is, unfortunately,being applied to virus creation.

The so-called Mutation Engine appeared in 1992,facilitating the development of polymorphic viruses. In 1992, the Virus CreationLaboratory, featuring on-line help and pull-down menus, brought virus creationwithin the reach of even non-sophisticated computer users.More PCs And Networks Mean More Infections, TooThe growing number of PCs, PC-based networks and businesses relying on PCs areanother set of reasons for rising infections: there are more potential victims.

For example, in the decade since the invention and popularization of the PC, theinstalled base of active PCs grew to 54 million by 1990. But that number hasalready more than doubled (to 112 million PCs in 1993) and climbed to 154million in 1994.Not only are PCs becoming more common – they are taking over a rising share ofcorporate computing duties. A range of networking technologies – includingNovell NetWare, Microsoft Windows NT and LAN Manager, LAN Server, OS/2 andBanyan VINES – are allowing companies to downsize from mainframe-based computersystems to PC-based LANs and, now, client-server systems.

These systems are morecost-effective and they are being deployed more broadly within organizations fora growing range of mission-critical applications, from finance and sales data toinventory control, purchasing and manufacturing process control.The current, rapid adoption of client-server computing by business gives virusesfertile new ground for infection. These server-based solutions are precisely thetype of computers that are susceptible – if unprotected – to most computerviruses.

And because data exchange is the very reason for using client-serversolutions, a virus on one PC in the enterprise is far more likely to communicatewith – and infect – more PCs and servers than would have been true a few yearsago.Moreover, client-server computing is putting PCs in the hands of many first-timeor relatively inexperienced computer users, who are less likely to understandthe virus problem. The increased use of portable PCs, remote link-ups to serversand inter-organization-and inter-network e-mail all add to the risk ofinfections, too.

Once a virus infects a single networked computer, the averagetime required to infect another workstation is from 10 to 20 minutes – meaning avirus can paralyze an entire enterprise in a few hours.What Is Ahead?The industry’s latest buzz-phrase is “data superhighway” and, although mostpeople haven’t thought about those superhighways in the context of virusinfections, they should. Any technology that increases communication amongcomputers also increases the likelihood of infection.

And the data superhighwaypromises to expand on today’s Internet links with high-bandwidth transmission ofdense digital video, voice and data traffic at increasingly cost-effective rates.Corporations, universities, government agencies, non-profit organizations andconsumers will be exchanging far more data than ever before. That makes virusprotection more important, as well.In addition to more opportunities for infection, there’ll be more and more-damaging strains of virus to do the infecting.

Regardless of the exact number ofviruses that appear in the next few years, the Mutation Engine, Virus CreationLaboratory and other virus construction kits are sure to boost the viruspopulation. Viruses that combine the worst features of several virus types -such as polymorphic boot sector viruses – are appearing and will become morecommon. Already, Windows-specific viruses have appeared. Virus writers, andtheir creations, are getting smarter. In response to the explosion in virustypes and opportunities for transmission, virus protection will have to expand,too.Computer anti-virus program manufacturers had a speed bump in which many used toprofit: 32-bit applications.

DOS and Windows 3.1 used a 16-bit architecture,and other 32-bit platforms such as Windows NT, UNIX, and a variety of otherserver operating systems had anti-virus programs already made. McAfee andSymantec, two giants in the anti-virus industry, prepared for the release of anew 32-bit home operating system. In August, Microsoft released Windows 95 forresale and it stormed across the nation. A large number of virus problemssurfaced in the short months after the release. This was due to the neglect ofa readily-available 32-bit anti-virus for the home user, and the fact that old16-bit anti-virus programs could not detect 32-bit viruses.

McAfee introducedVirus Scan 95 and Symantec released Norton Antivirus 95 shortly after theWindows 95 release. As the future progresses and the data architectureincreases, anti-virus programs will have to be upgraded to handle the newprogram structure.The Costs Of Virus InfectionComputer viruses have cost companies worldwide nearly two billion dollars since1990, with those costs accelerating, according to an analysis of survey datafrom IBM’s High Integrity Computing Laboratory and Dataquest. Global viral costsare clmbed another 1.

9 billion dollars in 1994 alone, but has been at a moresteady rate as anti-virus programs have been improved significantly.The costs are so high because of the direct labor expense of cleanup for allinfected hard disks and floppies in a typical incident. The indirect expense oflost productivity – an enormous sum – is higher, still. In a typical infectionat a large corporate site, technical support personnel will have to inspect all1,000 PCs.

Since each PC user has an average 35 diskettes, about 35,000diskettes will have to be scanned, too.Recovery Time For A Virus Disaster (25 PCs)On average, it took North American respondents to the 1991 Dataquest study fourdays to recover from a virus episode – and some MIS managers needed fully 30days to recover. Even more ominously, their efforts were not wholly effective; asingle infected floppy disk taken home during cleanup and later returned to theoffice can trigger a relapse.

Some 25 percent of those experiencing a virusattack later suffered such a re-infection by the same virus within 30 days.That cleanup is costing each of these corporations an average $177,000 in 1993 -and that sum will grow to more than $254,000 in 1994. If you’re in an enterprisewith 1,000 or more PCs, you can use these figures to estimate your own virus-fighting costs. Take the cost-per-PC ($177 in 1993, $254 in 1994) and multiplyit by the number of PCs in your organization.At a briefing before the U.S.

Congress in 1993, NYNEX, one of North America’slargest telecommunications companies, described its experience with virusinfectionsSince late 1989, the company had nearly 50 reported virus incidents – andbelieves it experienced another 50 unreported incidents.The single user, single PC virus incident is the exception. More typicalincidents involved 17 PCs and 50 disks at a time.

In the case of a 3Comnetwork, the visible signs of infection did not materialize until after17 PCs were infected. The LAN was down for a week while the cleanup wasconducted.Even the costs of dealing with a so-called benign virus are high. Arelatively innocuous Jerusalem-B virus had infected 10 executable files ona single system.

Because the computer was connected to a token ring network,all computers in that domain had to be scanned for the virus. Four LANadministrators spent two days plus overtime, one technician spent ninehours, a security specialist spent five hours, and most of the 200 PC onthe LAN had to endure 15-minute interruptions throughout a two-dayperiod.In the October 1993 issue of Virus Bulletin, Micki Krause, Program Manager forInformation Security at Rockwell International, outlined the cost of a recentvirus outbreak at her corporation:In late April 1993, the Hi virus was discovered at a large division ofRockwell located in the U.

S. The division is heavily networked with nine fileservers and 630 client PCs. The site is also connected to 64 other sites aroundthe world (more than half of which are outside the U.S.). The virus had enteredthe division on program disks from a legitimate European business partner. Oneday after the disks arrived, the Hi virus was found by technicians on fileservers, PCs and floppy disks.

Despite eradication efforts, the virus continuedto infect the network throughout the entire month of May. 160 hours were spentby internal PC and LAN support personnel to identify and contain the infections.At $45.

00 per hour, their efforts cost Rockwell $7,200. Rockwell also hired anexternal consultant to assist Rockwell employees in the cleanup. 200 hours werespent by the consultant, resulting in a cost of $8,000.

One file server wasdisconnected from the LAN to prevent the virus from further propagating acrossthe network. The server, used by approximately 100 employees, was down for anentire day. Rockwell estimated the cost of the downtime at $9,000 (100 users @$45/hr for 8 hours, with users accessing the server, on average, 25% of thenormal workday).

While some anti-virus software was in use, Rockwell purchasedadditional software for use on both the servers and the client PCs for anadditional $19,800. Total Cost of the virus incident at Rockwell was $44,000.Technical OverviewComputer Viruses And How They WorkViruses are small software programs. At the very least, to be a virus, theseprograms must replicate themselves. They do this by exploiting computer code,already on the host system.

The virus can infect, or become resident in almostany software component, including an application, operating system, system bootcode or device driver. Viruses gain control over their host in various ways.Here is a closer look at the major virus types, how they function, and how youcan fight them.File VirusesMost of the thousands of viruses known to exist are file viruses, including theFriday the 13th virus. They infect files by attaching themselves to a file,generally an executable file – the .EXE and .

COM files that control applicationsand programs. The virus can insert its own code in any part of the file,provided it changes the hosts code, somewhere along the way, misdirecting properprogram execution so that it executes the virus code first, rather than to thelegitimate program. When the file is executed, the virus is executed first.Most file viruses store themselves in memory.

There, they can easily monitoraccess calls to infect other programs as they’re executed. A simple file viruswill overwrite and destroy a host file, immediately alerting the user to aproblem because the software will not run. Because these viruses are immediatelyfelt, they have less opportunity to spread.

More pernicious file viruses causemore subtle or delayed damage – and spread considerably before being detected.As users move to increasingly networked and client-server environments, fileviruses are becoming more common. The challenge for users is to detect and cleanthis virus from memory, without having to reboot from a clean diskette. Thattask is complicated because file viruses can quickly infect a range of softwarecomponents throughout a user’s system. Also, the scan technique used to detectviruses can cause further infections; scans open files and file viruses caninfect a file during that operation.

File viruses such as the Hundred Yearsvirus can infect data files too.Boot Sector/partition table virusesWhile there are only about 200 different boot sector viruses, they make up 75percent of all virus infections. Boot sector viruses include Stoned, the mostcommon virus of all time, and Michelangelo, perhaps the most notorious. Theseviruses are so prevalent because they are harder to detect, as they do notchange a files size or slow performance, and are fairly invisible until theirtrigger event occurs – such as the reformatting of a hard disk.

They also spreadrapidly. The boot sector virus infects floppy disks and hard disks by insertingitself into the boot sector of the disk, which contains code that’s executedduring the system boot process. Booting from an infected floppy allows the virusto jump to the computer’s hard disk.

The virus executes first and gains controlof the system boot even before MS-DOS is loaded. Because the virus executesbefore the operating system is loaded, it is not MS-DOS-specific and can infectany PC operating system platform – MS-DOS, Windows, OS/2, PC-NFS, or Windows NT.The virus goes into RAM, and infects every disk that is accessed until thecomputer is rebooted and the virus is removed from memory. Because these virusesare memory resident, they can be detected by running CHKDSK to view the amountof RAM and observe if the expected total has declined by a few kilobytes.Partition table viruses attack the hard disk partition table by moving it to adifferent sector and replacing the original partition table with its owninfectious code.

These viruses spread from the partition table to the bootsector of floppy disks as floppies are accessed.Multi-Partite VirusesThese viruses combine the ugliest features of both file and bootsector/partition table viruses. They can infect any of these host softwarecomponents. And while traditional boot sector viruses spread only from infectedfloppy boot disks, multi-partite viruses can spread with the ease of a filevirus – but still insert an infection into a boot sector or partition table.

This makes them particularly difficult to eradicate. Tequila is an example of amulti-partite virus.Trojan HorsesLike its classical namesake, the Trojan Horse virus typically masquerades assomething desirable – e.g., a legitimate software program.

The Trojan Horsegenerally does not replicate (although researchers have discovered replicatingTrojan Horses). It waits until its trigger event and then displays a message ordestroys files or disks. Because it generally does not replicate, someresearchers do not classify Trojan Horses as viruses – but that is of littlecomfort to the victims of these malicious stains of software.File OverwritersThese viruses infect files by linking themselves to a program, keeping theoriginal code intact and adding themselves to as many files as possible.Innocuous versions of file overwriters may not be intended to do anything morethan replicate but, even then, they take up space and slow performance. Andsince file overwriters, like most other viruses, are often flawed, they candamage or destroy files inadvertently. The worst file overwriters remain hiddenonly until their trigger events.

Then, they can deliberately destroy files anddisks.Polymorphic virusesMore and more of today’s viruses are polymorphic in nature. The recentlyreleased Mutation Engine – which makes it easy for virus creators to transformsimple viruses into polymorphic ones – ensures that polymorphic viruses willonly proliferate over the next few years. Like the human AIDS virus that mutatesfrequently to escape detection by the body’s defenses, the polymorphic computervirus likewise mutates to escape detection by anti-virus software that comparesit to an inventory of known viruses. Code within the virus includes anencryption routine to help the virus hide from detection, plus a decryptionroutine to restore the virus to its original state when it executes.

Polymorphicviruses can infect any type of host software; although polymorphic file virusesare most common, polymorphic boot sector viruses have already been discovered.Some polymorphic viruses have a relatively limited number of variants ordisguises, making them easier to identify. The Whale virus, for example, has 32forms. Anti-virus tools can detect these viruses by comparing them to aninventory of virus descriptions that allows for wildcard variations – much as PCusers can search for half-remembered files in a directory by typing the firstfew letters plus an asterisk symbol. Polymorphic viruses derived from tools suchas the Mutation Engine are tougher to identify, because they can take any offour billion forms.Stealth VirusesStealth aircraft have special engineering that enables them to elude detectionby normal radar. Stealth viruses have special engineering that enables them toelude detection by traditional anti-virus tools. The stealth virus adds itselfto a file or boot sector but, when you examine the host software, it appearsnormal and unchanged. The stealth virus performs this trickery by lurking inmemory when it’s executed. There, it monitors and intercepts your system’s MS-DOS calls. When the system seeks to open an infected file, the stealth virusraces ahead, uninfects the file and allows MS-DOS to open it – all appearsnormal. When MS-DOS closes the file, the virus reverses these actions,reinfecting the file.Boot sector stealth viruses insinuate themselves in the system’s boot sector andrelocate the legitimate boot sector code to another part of the disk. When thesystem is booted, they retrieve the legitimate code and pass it along toaccomplish the boot. When you examine the boot sector, it appears normal – butyou are not seeing the boot sector in its normal location. Stealth viruses takeup space, slow system performance, and can inadvertently or deliberately destroydata and files. Some anti-virus scanners, using traditional anti-virustechniques, can actually spread the virus. That is because they open and closefiles to scan them – and those acts give the virus additional chances topropagate. These same scanners will also fail to detect stealth viruses, becausethe act of opening the file for the scan causes the virus to temporarilydisinfect the file, making it appear normal.Anti-Virus Tools And TechniquesAnti-virus software tools can use any of a growing arsenal of weapons to detectand fight viruses, including active signature-based scanning, residentmonitoring, checksum comparisons and generic expert systems. Each of these toolshas its specific strengths and weaknesses. An anti-virus strategy that uses onlyone or two of the following techniques can leave you vulnerable to virusesdesigned to elude specific defenses. An anti-virus strategy that uses all ofthese techniques provides a comprehensive shield and the best possible defenseagainst infection.Signature-Based ScannersScanners – which, when activated, examine every file on a specified drive – canuse any of a variety of anti-virus techniques. The most common is signature-based analysis. Signatures are the fingerprints of computer viruses – distinctstrands of code that are unique to a single virus, much as DNA strands would beunique to a biological virus. Viruses, therefore, can be identified by theirsignatures. Virus researchers and anti-virus product developers catalog knownviruses and their signatures, and signature-based scanners use these catalogs tosearch for viruses on a user’s system. The best scanners have an exhaustiveinventory of all viruses now known to exist. The signature-based scannerexamines all possible locations for infection – boot sectors, system memory,partition tables and files – looking for strings of code that match the virussignatures stored in its memory. When the scanner identifies a signature match,it can identify the virus by name and indicate where on the hard disk or floppydisk the infection is located. Because the signature-based scanner offers aprecise identification of known viruses, it can offer the best method foreffective and complete removal. The scanner can also detect the virus before ithas had a chance to run, reducing the chance that the infection will spreadbefore detection. Against these benefits, the signature-based scanner haslimitations. At best, it can only detect viruses for which it is programmed witha signature. It cannot detect so-called unknown viruses – those that have notbeen previously discovered, analyzed and recorded in the files of anti-virussoftware. Polymorphic viruses elude detection by altering the code string thatthe scanner is searching for; to identify these viruses, you need anothertechnique.There is more than this… but it won’t fit. PLease, let me email you the copyso I can have the password.