FUNGEN2.CVP   910804

                       Viral operations

Although the "original" definition of computer viral programs
refers to reproduction by attaching to other programs, viri that
act in this manner having been less successful than those that
use other means.  In the personal computer world, boot sector
infectors have been much more effective.  (Examples in the
MS-DOS community are the BRAIN and Stoned viral programs. 
Examples in the Mac realm are not as clear, but the WDEF virus
could be said to be a type of boot sector infector, as the WDEF
resource is one that is run automatically as soon as any Mac
disk is inserted, although this has changed under System 7.)

In larger systems, mini and mainframe computers, network and
mail viral programs have, so far, had the greatest impact.  The
Morris/Internet/UNIX worm managed to spread and reproduce using
the facility of networked machines to submit programs to each
other.  (A VMS program, WANK, used many of the same techniques.) 
The CHRISTMA EXEC used mainframe mail commands, and the ability
to submit programs by mail, in order to reproduce copies which
eventually flooded the network.

Network and mail viral programs carry, in a sense, their own
payload.  The reproduction of the programs themselves uses the
resources of the hosts affected, and in the cases of both the
Morris and CHRISTMA worms went so far as to deny service to
users by using all available computing or communications
resources.

Most other viral programs seem to be written "for their own
sake".  A kind of electronic graffiti which writes itself on
further walls.  However, even these can do damage, as with the
Stoned virus, which overwrites sections of the FAT with the
original boot sector.  Some appear to be written as pranks, and
others as a kind of advertising, although the potential for
damage from even "benign" viri cannot be considered funny, and
the "advertising" viri probably don't engender much goodwill.

Relatively few viral programs carry a deliberately damaging
payload.  Those which do attempt to erase infected programs or
disks are, fortunately, self limiting.

The last payload, or function, which a viral program may carry,
is some kind of intelligence to enable it to evade detection. 
So far the various kinds of evasive action; self-modification,
multiple encryption and "stealth" activity; have not proven to
have any advantageous "survival" characteristics.  In one sense,
this is to be regretted, as it demonstrates that the majority of
computer users are not taking the most elementary precautions to
defend against viral programs.

copyright Robert M. Slade, 1991   FUNGEN2.CVP   910804 