Protecting Data and Software from Viruses

On May 14, 1988, most computers attached to the Israel University had their hard disks corrupted. It was reported that nearly 115,000 disks were corrupted on that day. Later on, it was found to be a virus that was programmed to change the system areas of all accessible hard disks. This virus was named the Jerusalem Black Hole virus.

In another incident, people purchasing BASIC programs suddenly found that characters on the screen started bouncing up and down. This was attributed to a virus known as the Italian Ping-Pong virus.

These are just two of the numerous news items related to computer viruses, which you have probably read. One of the buzzwords in the field of computers today is virus. A virus is an actively infectious computer program that places copies of itself into other applications and programs. It also infects data files and documents. The reason why a virus attaches itself to an executable program is that, in order to perform its destructive action, it has to get executed. Thus, it remains dormant until you run the application or program to which it is attached. Viruses, which infect document files, load the virus code into the RAM whenever the document is read.

Typically, on running the program to which a virus is attached, the virus infects all portions of memory and then infects other files on your disks (diskettes and hard disks). So the next person using the same diskette on a different computer spreads the virus to the new system.

The reason why viruses cause so much fear is that they destroy valuable data and programs, which could mean that you loose months of work.

When PCs have been connected together to form a network, the damage can be worse. This is because the virus program spreads from one PC to another, thus infecting all the workstations (the computers that form part of the network).

Effects of Viruses

The effect of a virus can sometimes be very destructive, involving large amounts of data. Different viruses have different effects. Some of these effects are listed below:

• Corrupting files
• Increasing file sizes
• Interference with the display on the VDU
• Formatting the hard disk, thus destroying data
• Marking good sectors as bad
• Destroying contents of some sectors at random
• Slowing down the system
• Scrambling file names by manipulating the directory contents; the data is all there, but the user is unable to access it
• Changing all filenames to a single name.

Viruses are triggered off in various ways. For example, some viruses are triggered off by the date, such as the Jerusalem-B virus which waits for Friday the 13th, when it deletes the program files you execute without your permission. Other viruses are triggered by booting a system, such as the PC Stone virus, that occasionally displays the message 'Your PC is now STONED!' as your computer starts, and causes data loss on, both, the hard disk and floppy disks. The Raindrop virus waits till a .COM file is executed and then starts pushing the characters to the bottom of your screen. Hence, no proper display is possible till the virus is eradicated.

Types of Viruses

There are two main types of viruses. They are:

1. File viruses
2. Boot-sector/partition-table viruses

These two types may be detectable or non-detectable. Non-detectable viruses are called Stealth Viruses.

File Virus

A file virus attacks executable program files (files with extension .COM and .EXE). It may replace a portion of the original file with its own code, thus destroying the file, or it may attach itself to the file and yet allow the file to be executed. Examples of file viruses are Raindrop and Jerusalem-B.

Once an infected file is executed, the virus finds itself in the main or internal memory. It continues to exist in the memory even after the file has completed execution. When another file is executed, the virus attaches itself to this file and writes the modified file onto the disk, thus causing one more file to become infected. Some viruses infect a file only once, while others infect a file each time it is executed. The virus continues to infect files till the machine is switched off or re-booted.

How Boot-sector/Partition-table Virus damages your Computer

When an operating system is installed from a floppy disk, the first sector in the outermost track of the floppy contains a short program called the bootstrap loader. This program does the job of loading the operating system into the computer's memory when the computer is switched on. In a hard disk, the first sector contains a program called the master boot program, which does the same job of locating and loading the operating system into the computer's memory. This activity is called booting.

A boot sector virus substitutes itself for the bootstrap loader, and a partition-table virus substitutes itself for the master boot program. These viruses get loaded every time you switch on the system. Once the virus is loaded into RAM, it goes about infecting all files on the disk. Also, to simulate normal processing, the virus program transfers control to the original bootstrap loader so that booting can take place.

The virus infects other diskettes in the following manner. Whenever a diskette is accessed, the virus first checks whether the diskette is infected. If it is already infected, the requested disk access is performed and control is returned to the user. If the diskette is not infected, the virus moves the original boot record of the diskette to some other safe sector and copies its own code onto the boot sector, thus infecting this diskette. It then proceeds with the requested disk access. Some examples of boot-sector/partition-table viruses are C Brain, PC Stone and Birthday Joshi.

Stealth Virus

Stealth viruses are those written in a way so as to avoid detection by standard anti-virus software. A particular virus may be a file virus and a stealth virus, or a boot-sector virus and a stealth virus. The techniques used to avoid detection are self-encryption (where the virus converts its code into some sort of program code), and alteration of disk directory data. One example of a stealth virus is the Whale virus. This is, both, a file infector and a stealth virus. This virus infects .EXE files and adds 9216 bytes to each file size. The virus then subtracts 9216 bytes from this file's entry in the directory to give the impression that no change has taken place.

Virus Detection and Cleaning

Your machine first contracts a virus from an infected diskette. It then passes the infection to other diskettes. When those diskettes are used on other machines, they also get infected. In a networking environment, your workstation can get infected when you interact with other machines on the network.

Viruses are normally identified by the standard messages they use, such as 'Your PC is now Stoned' or 'Welcome to the Dungeon'. If they do not use messages, they can be detected by their signature, i.e. a series of bytes unique to a virus. The detection of viruses is normally carried out by standard software.

Virus Attack Symptoms

You look out for the following symptoms, which may indicate a possible virus attack, viz.

• Programs take a long time to load.
• Accessing the disk takes a long time.
• Strange or irrelevant error messages or screen displays appear.
• Files disappear; strange files may appear.
• Executable files change in size.
• Drive lights come on without reason.