Viruses. How They Work & What They Do

By Rachelle Benson

A computer virus is a small piece of programming created to enter computer systems and infect files. Like its counterpart in nature a computer virus infects healthy files in its host computer and then spreads its infection to other healthy computers. Typically a virus will replicate itself and try to infect as many files and systems as it can.

Some viruses are benign and may do no more than cause a message to appear or music to play, while others can be downright malicious, destroying files and even making your system unusable. Even the benign ones can create chaos as badly written code can cause unforeseen damage once on your system.

Computer viruses can be written into just about any type of file, so take care when loading software. There have even been isolated incidents where viruses have spread via licensed, sealed software, though you're generally safe with legally purchased software from a reliable source.

Viruses generally have two phases: infection and attack. When a virus is released it infects available programs and files, then depending on the virus, searches for other victims each time those programs and files are opened. Other viruses wait for a trigger before they become infectious. This could be anything, a date, a time or specific event like the deletion of an employee's payroll record.

The attack phase too often waits on a trigger, so a virus can inhabit your system for days, months, even years before it attacks. Then depending on its instructions, it may slow your computer down, change files names or incapacitate your system.

Viruses are generally spread in two ways. Firstly, from files added to your computer from removable media like floppy disks. Secondly and ever increasingly via email and the Internet. The manner in which a virus spreads and what it does depends on the type of virus.

• Boot Sector Viruses
  Boot sector viruses can infect hard drives and removable media like floppy disks. Boot sectors are small areas on a hard drive or disk where information about the drive or disk structure is stored. Whenever the computer boots up or the disk is loaded the virus is loaded into memory.
  
  A boot sector virus can be executed if an infected floppy disk is in the drive when you reboot. Once loaded, this virus can infect any disk placed in the drive, as well as the hard drive itself.
  
  Symptoms of a boot sector virus may be that your computer gives error messages when it boots, or even worse refuses to boot entirely, or if your drive defragmenting utility suddenly reports bad sectors on your disk.
   
• File or Program Infector Viruses
  These viruses attach themselves to executable programs. Once the original infected program is run the virus transfers to your computer's memory and may replicate itself further, spreading the infection. These viruses can be spread beyond your system as soon as the infected file or program is passed to another computer.
  
  The simplest of these viruses work by overwriting part of the program they're infecting. These can thankfully be caught early, because the program rarely continues to work as it should.
  
  More sophisticated versions hide their presence by saving the program or file's original instructions so that these are executed even after infection. This type may not be noticed until it is too late and enters the attack phase.
  
  There are also file infector viruses that do not change the infected program or file, but rather the route your computer takes to open that file.
   
• Macro Viruses
  Macro viruses work by infecting files from programs that run macros, another word for a prescribed sequence of actions. Spreadsheets, for example, have macros that let them conduct calculations, while word-processing programs have macros that let them check spelling and finish words.
  
  Macro viruses can easily spread because they infect files, not programs. People readily exchange files in the course of a day's work. To make it worse, macro viruses are platform-independent and so can easily spread between Microsoft, Macintosh and other operating systems.
   
• Multipartite Viruses
  These possess the characteristics of both program and boot sector viruses and can start out in a program and then spread to the boot sector, or vice versa.

Though technically not viruses, the breeds of malicious code described below can have similar effects.

• Worms
  A worm is a self-replicating program that doesn't necessarily infect other programs. Instead it proliferates across networks and the Internet. The Melissa virus, for example replicates itself via Microsoft Outlook® contact lists. Worms work in invisible parts of the system, and it's possible to only become aware of them once they've consumed most of the system's resources.
   
• Trojan Horse
  Like its mythological counterpart, a Trojan Horse is a piece of programming that sneaks in under the guise of being useful, entertaining, or merely mysterious, and bides its time until it's ready to reveal its destructive purpose. This breed may destroy files, but it's most common use is to create a back door for intruders to access and control your computer. Trojan Horses do not replicate like viruses and worms.

New viruses are created every day, so it's vital to understand how your computers can be exposed and what you can do to protect them.