Computer virus

Computer virus

From Wikipedia, the free encyclopedia

Jump to: navigation, search

Not to be confused with Malware.

A computer virus is a computer program that can replicate itself[1] and spread from one computer to another. The term "virus" is also commonly, but erroneously, used to refer to other types of malware, including but not limited to adware and spyware programs that do not have a reproductive ability.

Malware includes computer viruses, computer worms, Trojan horses, most rootkits, spyware, dishonest adware and other malicious or unwanted software, including true viruses. Viruses are sometimes confused with worms and Trojan horses, which are technically different. A worm can exploit security vulnerabilities to spread itself automatically to other computers through networks, while a Trojan horse is a program that appears harmless but hides malicious functions. Worms and Trojan horses, like viruses, may harm a computer system's data or performance. Some viruses and other malware have symptoms noticeable to the computer user, but many are surreptitious or simply do nothing to call attention to themselves. Some viruses do nothing beyond reproducing themselves.

An example of a virus which is not a malware, but is putatively benevolent, is Fred Cohen's theoretical compression virus.[2] However, antivirus professionals do not accept the concept of benevolent viruses, as any desired function can be implemented without involving a virus (automatic compression, for instance, is available under the Windows operating system at the choice of the user). Any virus will by definition make unauthorised changes to a computer, which is undesirable even if no damage is done or intended. On page one of Dr Solomon's Virus Encyclopaedia, the undesirability of viruses, even those that do nothing but reproduce, is thoroughly explained.[1]

Contents

[hide]

• 1 History

o 1.1 Academic work

o 1.2 Science fiction

o 1.3 Virus programs

• 2 Classification

o 2.1 Nonresident viruses

o 2.2 Resident viruses

• 3 Vectors and hosts

• 4 Infection strategies

o 4.1 Stealth

 4.1.1 Read request intercepts

 4.1.2 Self-modification

 4.1.3 Encryption with a variable key

 4.1.4 Polymorphic code

 4.1.5 Metamorphic code

o 4.2 Avoiding bait files and other undesirable hosts

• 5 Vulnerability and countermeasures

o 5.1 The vulnerability of operating systems to viruses

o 5.2 The role of software development

o 5.3 Antivirus software and other preventive measures

o 5.4 Recovery methods

 5.4.1 Virus removal

 5.4.2 Operating system reinstallation

• 6 See also

• 7 References

• 8 Further reading

• 9 External links

History

See also: Timeline of notable computer viruses and worms

Academic work

The first academic work on the theory of computer viruses (although the term "computer virus" was not used at that time) was done in 1949 by John von Neumann who gave lectures at the University of Illinois about the "Theory and Organization of Complicated Automata". The work of von Neumann was later published as the "Theory of self-reproducing automata". In his essay von Neumann described how a computer program could be designed to reproduce itself.[3] Von Neumann's design for a self-reproducing computer program is considered the world's first computer virus, and he is considered to be the theoretical father of computer virology.[4]

In 1972 Veith Risak, directly building on von Neumann's work on self-replication, published his article "Selbstreproduzierende Automaten mit minimaler Informationsübertragung" (Self-reproducing automata with minimal information exchange).[5] The article describes a fully functional virus written in assembler language for a SIEMENS 4004/35 computer system.

In 1980 Jürgen Kraus wrote his diplom thesis "Selbstreproduktion bei Programmen" (Self-reproduction of programs) at the University of Dortmund.[6] In his work Kraus postulated that computer programs can behave in a way similar to biological viruses.

In 1984 Fred Cohen from the University of Southern California wrote his paper "Computer Viruses - Theory and Experiments".[7] It was the first paper to explicitly call a self-reproducing program a "virus", a term introduced by Cohen's mentor Leonard Adleman. In 1987, Fred Cohen published a demonstration that there is no algorithm that can perfectly detect all possible viruses.[8]

An article that describes "useful virus functionalities" was published by J. B. Gunn under the title "Use of virus functions to provide a virtual APL interpreter under user control" in 1984.[9]

Science fiction

The actual term "virus" was first used to denote a self-reproducing program in a short story by David Gerrold in Galaxy magazine in 1969—and later in his 1972 novel, When HARLIE Was One. In that novel, a sentient computer named HARLIE writes viral software to retrieve damaging personal information from other computers to blackmail the man who wants to turn him off.

The Terminal Man, a science fiction novel by Michael Crichton (1972), told (as a sideline story) of a computer with telephone modem dialing capability, which had been programmed to randomly dial phone numbers until it hit a modem that is answered by another computer. It then attempted to program the answering computer with its own program, so that the second computer would also begin dialing random numbers, in search of yet another computer to program.

...