Dr Frederick Cohen (1984) defined a Computer Virus as a program that can “infect� other programs by modifying them to include a possible evolved version of itself. A virus replicates and then spreads by becoming attached to a host, commonly harming the host while doing so. The host, which is normally another computer program or computer operating system, then infects the applications that are transferred to other computers.
The Computer Virus can be spread between computers in two ways, depending on its type and capabilities. The first way or traditional way for a virus to be spread is through host files that are added to a computer from removable media, such as floppy disks. Before computer networks became widespread, most viruses were spread on removable media, particularly floppy disks (Wikipedia 2002). In the early days of personal computers, many users regularly exchanged information and programs on disks. Infected disks transferred infected files from computer to computer, and relied predominantly on human assistance to spread the file from one user to the next.
The second and increasingly common way to spread a virus is through host files attached to e-mail and transferred over the Internet. Originally viruses were spread using the Internet by infecting popular software that was traded online, predominantly games and applications. The spreading of these viruses also relied on human assistance to a large degree – the user had to locate and download the file. In more recent times however, viruses have begun to act more independantly. Many viruses are now predominantly capable of spreading themselves without assistance – these viruses locate e-mail addresses stored in the infected computer and use these to send disguised infected emails to unsuspecting victims. Some viruses even go so far as to disguise themselves as emails regarding virus protection or warnings.
Once a virus has been spread from one computer to the next, it then actively spreads within the newly infected host computer itself. Each virus can affect and spread within a new host in two different ways, therefore can be classified into two different categories.
The first category is a nonresident virus. Wikipedia (2002) suggests that a nonresident virus consists of two different modules – a finder module and a replicator module. The virus first uses the finder module to locate new files to infect. For each new executable file that is located, the virus then uses the replicator model to replicate and infect that file. A nonresident virus immediately searches for other hosts that can be infected, and infects these targets.
The second category is a resident virus. Wikipedia (2002) infers that a resident virus concentrates predominantly on replication, and consists of a replication module. The virus loads the replication module into memory and ensures that this module is executed each time the operating system is called to perform a certain operation. A resident virus stays active in the background of normal functions and infects unsuspecting hosts when those files are accessed by other programs or the operating system itself.
Cohen, F. 1984. Experiments with Computer Viruses. http://www.all.net/books/virus/part5.html (accessed October 26, 2004).
Computer Virus. 2002. Wikipedia Web site: http://en.wikipedia.org/wiki/Computer_virus#Replication_Strategies#Replication_Strategies (accessed October 26, 2004).
Melissa Patch 21:00, 28 Oct 2004 (EST)
