| Early viruses were pieces of code attached to
a common program like a popular game or a popular word
processor. A person might download an infected game from a
bulletin board and run it. A virus like this is a small piece of
code embedded in a larger, legitimate program. Any virus is
designed to run first when the legitimate program gets executed.
The virus loads itself into memory and looks around to see if it
can find any other programs on the disk. If it can find one, it
modifies it to add the virus's code to the unsuspecting program.
Then the virus launches the "real program." The user really has
no way to know that the virus ever ran. Unfortunately, the virus
has now reproduced itself, so two programs are infected. The
next time either of those programs gets executed, they infect
other programs, and the cycle continues. If one of the
infected programs is given to another person on a floppy disk,
or if it is uploaded to a bulletin board, then other programs
get infected. This is how the virus spreads.
The spreading part is the infection phase of the virus.
Viruses wouldn't be so violently despised if all they did was
replicate themselves. Unfortunately, most viruses also have some
sort of destructive attack phase where they do some damage. Some
sort of trigger will activate the attack phase, and the virus
will then "do something" -- anything from printing a silly
message on the screen to erasing all of your data. The trigger
might be a specific date, or the number of times the virus has
been replicated, or something similar.
As virus creators got more sophisticated, they learned new
tricks. One important trick was the ability to load viruses into
memory so they could keep running in the background as long as
the computer remained on. This gave viruses a much more
effective way to replicate themselves. Another trick was the
ability to infect the boot sector on floppy disks and hard
disks. The boot sector is a small program that is the first part
of the operating system that the computer loads. The boot sector
contains a tiny program that tells the computer how to load the
rest of the operating system. By putting its code in the boot
sector, a virus can guarantee it gets executed. It can load
itself into memory immediately, and it is able to run whenever
the computer is on. Boot sector viruses can infect the boot
sector of any floppy disk inserted in the machine, and on
college campuses where lots of people share machines they spread
like wildfire.
In general, both executable and boot sector viruses are not
very threatening any more. The first reason for the decline has
been the huge size of today's programs. Nearly every program you
buy today comes on a compact disc. Compact discs cannot be
modified, and that makes viral infection of a CD impossible. The
programs are so big that the only easy way to move them around
is to buy the CD. People certainly can't carry applications
around on a floppy disk like they did in the 1980s, when
floppies full of programs were traded like baseball cards. Boot
sector viruses have also declined because operating systems now
protect the boot sector.
Both boot sector viruses and executable viruses are still
possible, but they are a lot harder now and they don't spread
nearly as quickly as they once could. Call it "shrinking
habitat," if you want to use a biological analogy. The
environment of floppy disks, small programs and weak operating
systems made these viruses possible in the 1980s, but that
environmental niche has been largely eliminated by huge
executables, unchangeable CDs and better operating system
safeguards. |