The Basics of the Computer Virus

A plethora of negative magazine articles and books have catalyzed a new kind of hypochondria among computer users: an unreasonable fear of computer viruses. This hypochondria is possible because a) computers are very complex machines which will often behave in ways which are not obvious to the average user, and b) computer viruses are still extremely rare. Thus, most computer users have never experienced a computer virus attack. Their only experience has been what they’ve read about or heard about (and only the worst problems make it into print). This combination of ignorance, inexperience and fear-provoking reports of danger is the perfect formula for mass hysteria.

Most problems people have with computers are simply their own fault. For example, they accidentally delete all the files in their current directory rather than in another directory, as they intended, or they format the wrong disk. Or perhaps someone routinely does something wrong out of ignorance, like turning the computer off in the middle of a program, causing files to get scrambled. Following close on the heels of these kinds of problems are hardware problems, like a misaligned floppy drive or a hard disk failure. Such routine problems are made worse than necessary when users do not plan for them, and fail to back up their work on a regular basis. This stupidity can easily turn a problem that might have cost $300 for a new hard disk into a nightmare which will ultimately cost tens of thousands of dollars. When such a disaster happens, it is human nature to want to find someone or something else to blame, rather than admitting it is your own fault. Viruses have proven to be an excellent scapegoat for all kinds of problems.

Of course, there are times when people want to destroy computers. In a time of war, a country may want to hamstring their enemy by destroying their intelligence databases. If an employee is maltreated by his employer, he may want to retaliate, and he may not be able to get legal recourse. One can also imagine a totalitarian state trying to control their citizens’ every move with computers, and a group of good men trying to stop it. Although one could smash a computer, or physically destroy its data, one does not always have access to the machine that will be the object of the attack. At other times, one may not be able to perpetrate a physical attack without facing certain discovery and prosecution. While an unprovoked attack, and even revenge, may not be right, people still do choose such avenues (and even a purely defensive attack is sure to be considered wrong by an arrogant agressor). For the sophisticated programmer, though, physical access to the machine is not necessary to cripple it.

People who have attacked computers and their data have invented several different kinds of programs. Since one must obviously conceal the destructive nature of a program to dupe somebody into executing it, deceptive tricks are an absolute must in this game. The first and oldest trick is the “trojan horse.” The trojan horse may appear to be a useful program, but it is in fact destructive. It entices you to execute it because it promises to be a worthwhile program for your computer—new and better ways to make your machine more effective—but when you execute the program, surprise! Secondly, destructive code can be hidden as a “logic bomb” inside of an otherwise useful program. You use the program on a regular basis, and it works well. Yet, when a certain event occurs, such as a certain date on the system clock, the logic bomb “explodes” and does damage. These programs are designed specifically to destroy computer data, and are usually deployed by their author or a willing associate on the computer system that will be the object of the attack.

There is always a risk to the perpetrator of such destruction. He must somehow deploy destructive code on the target machine without getting caught. If that means he has to put the program on the machine himself, or give it to an unsuspecting user, he is at risk. The risk may be quite small, especially if the perpetrator normally has access to files on the system, but his risk is never zero.

With such considerable risks involved, there is a powerful incentive to develop cunning deployment mechanisms for getting destructive code onto a computer system. Untraceable deployment is a key to avoiding being put on trial for treason, espionage, or vandalism. Among the most sophisticated of computer programmers, the computer virus is the vehicle of choice for deploying destructive code. That is why viruses are almost synonymous with wanton destruction.

However, we must realize that computer viruses are not inherently destructive. The essential feature of a computer program that causes it to be classified as a virus is not its ability to destroy data, but its ability to gain control of the computer and make a fully functional copy of itself. It can reproduce. When it is executed, it makes one or more copies of itself. Those copies may later be executed, to create still more copies, ad infinitum. Not all computer programs that are destructive are classified as viruses because they do not all reproduce, and not all viruses are destructive because reproduction is not destructive. However, all viruses do reproduce. The idea that computer viruses are always destructive is deeply ingrained in most people’s thinking though. The very term “virus” is an inaccurate and emotionally charged epithet. The scientifically correct term for a computer virus is “self-reproducing automaton,” or “SRA” for short. This term describes correctly what such a program does, rather than attaching emotional energy to it. We will continue to use the term “virus” throughout this book though, except when we are discussing computer viruses (SRA’s) and biological viruses at the same time, and we need to make the difference clear.

If one tries to draw an analogy between the electronic world of programs and bytes inside a computer and the physical world we know, the computer virus is a very close analog to the simplest biological unit of life, a single celled, photosynthetic organism. Leaving metaphysical questions like “soul” aside, a living organism can be differentiated from non-life in that it appears to have two goals: (a) to survive, and (b) to reproduce. Although one can raise metaphysical questions just by saying that a living organism has “goals,” they certainly seem to, if the onlooker has not been educated out of that way of thinking. And certainly the idea of a goal would apply to a computer program, since it was written by someone with a purpose in mind. So in this sense, a computer virus has the same two goals as a living organism: to survive and to reproduce. The simplest of living organisms depend only on the inanimate, inorganic environment for what they need to achieve their goals. They draw raw materials from their surroundings, and use energy from the sun to synthesize whatever chemicals they need to do the job. The organism is not dependent on another form of life which it must somehow eat, or attack to continue its existence. In the same way, a computer virus uses the computer system’s resources like disk storage and CPU time to achieve its goals. Specifically, it does not attack other self-reproducing automata and “eat” them in a manner similar to a biological virus. Instead, the computer virus is the simplest unit of life in this electronic world inside the computer. (Of course, it is conceivable that one could write a more sophisticated program which would behave like a biological virus, and attack other SRA’s.)

Before the advent of personal computers, the electronic domain in which a computer virus might “live” was extremely limited. Computers were rare, and they had many different kinds of CPU’s and operating systems. So a tinkerer might have written a virus, and let it execute on his system. However, there would have been little danger of it escaping and infecting other machines. It remained under the control of its master. The age of the mass-produced computer opened up a whole new realm for viruses, though. Millions of machines all around the world, all with the same basic architecture and operating system make it possible for a computer virus to escape and begin a life of its own. It can hop from machine to machine, accomplishing the goals programmed into it, with no one to control it and few who can stop it. And so the virus became a viable form of electronic life in the 1980’s.

Now one can create self-reproducing automata that are not computer viruses. For example, the famous mathematician John von Neumann invented a self-reproducing automaton “living” in a grid array of cells which had 29 possible states. In theory, this automaton could be modeled on a computer. However, it was not a program that would run directly on any computer known in von Neumann’s day. Likewise, one could write a program which simply copied itself to another file. For example “1.COM” could create “2.COM” which would be an exact copy of itself (both program files on an IBM PC style machine.) The problem with such concoctions is viability. Their continued existence is completely dependent on the man at the console. A more sophisticated version of such a program might rely on deceiving that man at the console to propagate itself. This program is known as a worm. The computer virus overcomes the roadblock of operator control by hiding itself in other programs. Thus it gains access to the CPU simply because people run programs that it happens to have attached itself to without their knowledge. The ability to attach itself to other programs is what makes the virus a viable electronic life form. That is what puts it in a class by itself. The fact that a computer virus attaches itself to other programs earned it the name “virus.” However that analogy is wrong since the programs it attaches to are not in any sense alive.

Types of Viruses

Computer viruses can be classified into several different types. The first and most common type is the virus which infects any application program. On IBM PC’s and clones running under PC-DOS or MS-DOS, most programs and data which do not belong to the operating system itself are stored as files. Each file has a file name eight characters long, and an extent which is three characters long. A typical file might be called “TRUE.TXT”, where “TRUE” is the name and “TXT” is the extent. The extent normally gives some information about the nature of a file—in this case “TRUE.TXT” might be a text file. Programs must always have an extent of “COM”, “EXE”, or “SYS”. Under DOS, only files with these extents can be executed by the central processing unit. If the user tries to execute any other type of file, DOS will generate an error and reject the attempt to execute the file.

Since a virus’ goal is to get executed by the computer, it must attach itself to a COM, EXE or SYS file. If it attaches to any other file, it may corrupt some data, but it won’t normally get executed, and it won’t reproduce. Since each of these types of executable files has a different structure, a virus must be designed to attach itself to a particular type of file. A virus designed to attack COM files cannot attack EXE files, and vice versa, and neither can attack SYS files. Of course, one could design a virus that would attack two or even three kinds of files, but it would require a separate reproduction method for each file type.

The next major type of virus seeks to attach itself to a specific file, rather than attacking any file of a given type. Thus, we might call it an application-specific virus. These viruses make use of a detailed knowledge of the files they attack to hide better than would be possible if they were able to infiltrate just any file. For example, they might hide in a data area inside the program rather than lengthening the file. However, in order to do that, the virus must know where the data area is located in the program, and that differs from program to program.

This second type of virus usually concentrates on the files associated to DOS, like COMMAND.COM, since they are on virtually every PC in existence. Regardless of which file such a virus attacks, though, it must be very, very common, or the virus will never be able to find another copy of that file to reproduce in, and so it will not go anywhere. Only with a file like COMMAND.COM would it be possible to begin leaping from machine to machine and travel around the world.

The final type of virus is known as a “boot sector virus.” This virus is a further refinement of the application-specific virus, which attacks a specific location on a computer’s disk drive, known as the boot sector. The boot sector is the first thing a computer loads into memory from disk and executes when it is turned on. By attacking this area of the disk, the virus can gain control of the computer immediately, every time it is turned on, before any other program can execute. In this way, the virus can execute before any other program or person can detect its existence.

The Functional Elements of a Virus

Every viable computer virus must have at least two basic parts, or subroutines, if it is even to be called a virus. Firstly, it must contain a search routine, which locates new files or new areas on disk which are worthwhile targets for infection. This routine will determine how well the virus reproduces, e.g., whether it does so quickly or slowly, whether it can infect multiple disks or a single disk, and whether it can infect every portion of a disk or just certain specific areas. As with all programs, there is a size versus functionality tradeoff here. The more sophisticated the search routine is, the more space it will take up. So although an efficient search routine may help a virus to spread faster, it will make the virus bigger, and that is not always so good.

Secondly, every computer virus must contain a routine to copy itself into the area which the search routine locates. The copy routine will only be sophisticated enough to do its job without getting caught. The smaller it is, the better. How small it can be will depend on how complex a virus it must copy. For example, a virus which infects only COM files can get by with a much smaller copy routine than a virus which infects EXE files. This is because the EXE file structure is much more complex, so the virus simply needs to do more to attach itself to an EXE file.

While the virus only needs to be able to locate  suitable hosts and attach itself to them, it is usually helpful to incorporate some additional features into the virus to avoid detection, either by the computer user, or by commercial virus detection software. Anti-detection routines can either be a part of the search or copy routines, or functionally separate from them. For example, the search routine may be severely limited in scope to avoid detection. A routine which checked every file on every disk drive, without limit, would take a long time and cause enough unusual disk activity that an alert user might become suspicious. Alternatively, an antidetection routine might cause the virus to activate under certain special conditions. For example, it might activate only after a certain date has passed (so the virus could lie dormant for a time).

Figure 1: Functional diagram of a virus.

Alternatively, it might activate only if a key has not been pressed for five minutes (suggesting that the user was not there watching his computer).

Search, copy, and anti-detection routines are the only necessary components of a computer virus, and they are the components which we will concentrate on in this volume. Of course, many computer viruses have other routines added in on top of the basic three to stop normal computer operation, to cause destruction, or to play practical jokes. Such routines may give the virus character, but they are not essential to its existence. In fact, such routines are usually very detrimental to the virus’ goal of survival and self-reproduction, because they make the fact of the virus’ existence known to everybody. If there is just a little more disk activity than expected, no one will probably notice, and the virus will go on its merry way. On the other hand, if the screen to one’s favorite program comes up saying “Ha! Gotcha!” and then the whole computer locks up, with everything on it ruined, most anyone can figure out that they’ve been the victim of a destructive program. And if they’re smart, they’ll get expert help to eradicate it right away. The result is that the viruses on that particular system are killed off, either by themselves or by the clean up crew.

Although it may be the case that anything which is not essential to a virus’ survival may prove detrimental, many computer viruses are written primarily to be smart delivery systems of these “other routines.” The author is unconcerned about whether the virus gets killed in action when its logic bomb goes off, so long as the bomb gets deployed effectively. The virus then becomes just like a Kamikaze pilot, who gives his life to accomplish the mission. Some of these “other routines” have proven to be quite creative. For example, one well known virus turns a computer into a simulation of a wash machine, complete with graphics and sound. Another makes Friday the 13th truly a bad day by coming to life only on that day and destroying data. None the less, these kinds of routines are more properly the subject of volume three of this series, which discusses the military applications of computer viruses. In this volume we will stick with the basics of designing the reproductive system. And if you’re real interest is in military applications, just remember that the best logic bomb in the world is useless if you can’t deploy it correctly. The delivery system is very, very important. The situation is similar to having an atomic bomb, but not the means to send it half way around the world in fifteen minutes. Sure, you can deploy it, but crossing borders, getting close to the target, and hiding the bomb all pose considerable risks. The effort to develop a rocket is worthwhile.

Tools Needed for Writing Viruses

Viruses are written in assembly language. High level languages like Basic, C, and Pascal have been designed to generate stand-alone programs, but the assumptions made by these languages render them almost useless when writing viruses. They are simply incapable of performing the acrobatics required for a virus to jump from one host program to another. That is not to say that one could not design a high level language that would do the job, but no one has done so yet. Thus, to create viruses, we must use assembly language. It is just the only way we can get exacting control over all the computer system’s resources and use them the way we want to, rather than the way somebody else thinks we should.

If you have not done any programming in assembler before, I would suggest you get a good tutorial on the subject to use along side of this book. (A few are mentioned in the Suggested Reading at the end of the book.) In the following chapters, I will assume that your knowledge of the technical details of PC’s—like file structures, function calls, segmentation and hardware design—is limited, and I will try to explain such matters carefully at the start. However, I will assume that you have some knowledge of assembly language—at least at the level where you can understand what some of the basic machine instructions, like mov ax,bx do. If you are not familiar with simpler assembly language programming like this, get a tutorial book on the subject. With a little work it will bring you up to speed.

At present, there are three popular assemblers on the market, and you will need one of them to do any work with computer viruses. The first and oldest is Microsoft’s Macro Assembler, or MASM for short. It will cost you about $100 to buy it through a mail order outlet. The second is Borland’s Turbo Assembler, also known as TASM. It goes for about $100 too. Thirdly, there is A86, which is shareware, and available on many bulletin board systems throughout the country. You can get a copy of it for free by calling up one of these systems and downloading it to your computer with a modem. Alternatively, a number of software houses make it available for about $5 through the mail. However, if you plan to use A86, the author demands that you pay him almost as much as if you bought one of the other assemblers. He will hold you liable for copyright violation if he can catch you. Personally, I don’t think A86 is worth the money. My favorite is TASM, because it does exactly what you tell it to without trying to outsmart you. That is exactly what you want when writing a virus. Anything less can put bugs in you programs even when they are correctly written. Whichever assembler you decide to use, though, the viruses in this book can be compiled by all three. Batch files are provided to perform a correct assembly with each assembler.

If you do not have an assembler, or the resources to buy one, or the inclination to learn assembly language, the viruses are provided in Intel hex format so they can be directly loaded onto your computer in executable form. The program disk also contains compiled, directly executable versions of each virus. However, if you don’t understand the assembly language source code, please don’t take these programs and run them. You’re just asking for trouble, like a four year old child with a loaded gun.