Computer Viruses
A computer virus is a program that inserts itself into one or more files and then performs some
action, which may be harmless, disruptive, or destructive. Viruses usually have two stages: the
insertion phase, where the virus hides itself inside a file or disk sector, and the execution phase,
where it activates and carries out its programmed actions.
History of Computer Viruses
The history of computer viruses began in 1980, when the first experimental viruses appeared on
Apple II computers. In 1983, Fred Cohen demonstrated the concept of a computer virus on a UNIX
system, coining the term that became widely accepted. In 1986, the Brain virus, also called the
Pakistani virus, became the first virus to infect IBM PC boot sectors and spread through floppy disks.
By 1987, viruses like the MacMag Peace virus and the infamous Jerusalem virus had emerged, with
the latter becoming one of the first destructive MS-DOS viruses. In 1989, a virus targeting Lotus 1-2-3
macros showed that office applications could also be infected, paving the way for macro viruses.
Types of Computer Viruses
Boot Sector Infectors
Boot sector viruses infect the boot sector of a disk, which contains the code the system runs when it
starts up or mounts the disk. Because the boot sector is always executed first, these viruses load
immediately into memory and then spread to other disks. The Brain virus (1986) is the earliest and
most famous example, infecting IBM PCs by moving the original boot sector and inserting its own
code. Another example is the Stoned virus (1987), which displayed the message “Your PC is now
Stoned” while infecting floppy disks.
Executable Infectors
These viruses infect executable programs like .COM and .EXE files. When an infected program is run,
the virus loads into memory and attaches itself to other executables. The Jerusalem virus (1987) is a
classic case, infecting COM and EXE files, staying resident in memory, and on Friday the 13th,
deleting any programs executed that day. The Cascade virus also falls into this category, famously
making letters on the screen fall downward.
Multipartite Viruses
A multipartite virus can infect both boot sectors and executables, making it harder to remove since
cleaning one area is not enough. The Tequila virus (1991) is an example, acting both as a boot sector
infector and an executable infector.
TSR (Terminate and Stay Resident) Viruses
TSR viruses remain resident in memory after the host program or boot process finishes, enabling
them to monitor system activity and infect new files. The Jerusalem virus (executable TSR) and the
Brain virus (boot sector TSR) are both examples. Another case is the Encroacher virus, which
appended itself to the ends of executables.
Stealth Viruses
Stealth viruses specialize in concealment. They intercept operating system calls and return false
information to trick the user. For example, if a user checks file size, the virus displays the original
clean size, even though the infected file is larger. If the file is opened, the virus temporarily disinfects
it and reinfects it after closing. The Stealth (4096) virus is a well-known example; it even altered file
timestamps to disguise infections. The Frodo virus (1989) also used similar techniques.
Encrypted Viruses
Encrypted viruses hide their code using encryption. Only a small decryptor routine and a random
cryptographic key remain visible. When the infected file runs, the decryptor unlocks the hidden virus
before executing it. The 1260 virus (1989) is an example, which used two encryption keys and XOR
operations to disguise its body, making signature-based detection difficult.
Polymorphic Viruses
Polymorphic viruses are more advanced: they not only encrypt their code but also change their
decryptor routine each time they replicate. This means no two infections look the same, frustrating
antivirus scanners that rely on fixed signatures. For example, one infection might use add 0 while
another uses subtract 0, both producing the same result but looking different. Examples include the
Marburg virus (1998) and the Storm Worm (2007). Early virus developers also used tools like the
Mutation Engine (MtE) to generate polymorphic variants automatically.
Macro Viruses
Macro viruses are written in the macro languages of applications such as Microsoft Word or Excel.
They target documents, not system files, and can run on any system that uses the infected program.
The Melissa virus (1999) is the most famous case. It infected Word 97 and Word 98 files, inserted
itself into the Word Normal template, and then spread via Microsoft Outlook by sending copies to
the first 50 contacts in the victim’s email address book. The Concept virus (1995) was the first Word
macro virus, and others like [Link] spread through Office macros.
Computer Worms
A computer worm is a self-replicating program that spreads from one computer to another without
needing to attach itself to a host program, unlike traditional viruses. Worms propagate automatically
across networks and can cause significant disruption even if they do not carry a destructive payload.
Their ability to exploit system vulnerabilities or use communication channels such as email makes
them a major cybersecurity concern.
Early Research
Research into worms began in the mid-1970s, when John Shoch and Jon Hupp at Xerox PARC
experimented with distributed programs. These programs were designed to perform tasks such as
animations and broadcast messaging by moving across workstations. If a workstation was idle, a
worm would copy itself there, execute computations, and communicate results back to its controller.
Once the user returned to the machine, the worm stopped. These experiments laid the groundwork
for later self-replicating network programs.
The 1988 Internet Worm
One of the most famous early worms was the Internet Worm, released on November 2, 1988 by
Robert Tappan Morris. It targeted Berkeley and Sun UNIX-based systems. Within hours, it spread
rapidly across the Internet, disabling several thousand machines. The worm inserted instructions into
running processes, which allowed it to propagate further. Recovery required disconnecting
computers from the network, rebooting them, and patching critical software. Fortunately, the
worm’s purpose was primarily self-propagation and not destruction, but its scale revealed the
dangers of such attacks. This incident raised global awareness of cybersecurity and led to the first
U.S. conviction under the Computer Fraud and Abuse Act.
The Father Christmas Worm
Another significant example was the Father Christmas Worm, which appeared slightly before the
Internet Worm. It spread through IBM networks as an electronic Christmas card. When recipients
saved and executed the program, it displayed a blinking Christmas tree with the message “Merry
Christmas!” However, it also scanned the recipient’s email address book and mailbox to collect new
contacts, then sent itself to them. The worm overwhelmed IBM networks, forcing administrators to
shut down systems to stop the spread. Written in a high-level job control language, it demonstrated
that worms could act like macro viruses, executing within software environments rather than at the
system level.
Characteristics of Worms
Worms differ from viruses in that they spread independently without requiring a host file. They
replicate themselves across networks, often exploiting communication systems such as email or
scripts. While some worms simply spread and consume resources, others may deliver destructive
payloads or install backdoors for further attacks. Even worms without malicious intent can
overwhelm networks and servers, causing system slowdowns or outages. Examples such as the 1988
Internet Worm and the Father Christmas Worm highlight both the disruptive potential and variety of
worm behaviors.
Other Forms of Malicious Logic
Apart from traditional computer viruses and worms, there are other forms of malicious logic that can
cause serious damage to computer systems. Two important types are Rabbits/Bacteria and Logic
Bombs.
Rabbits or Bacteria are programs that multiply excessively and quickly consume system resources,
leading to a denial of service attack. They do not necessarily use all resources on a system but can
target specific classes such as file descriptors or process table entries. This makes it impossible for
new processes to run even though existing ones may continue. An example of this was provided by
Dennis Ritchie, who demonstrated a shell script for UNIX Version 7. The script repeatedly created
directories and changed into them, rapidly exhausting disk space or inode tables. Such attacks crash
the system by overwhelming available resources.
Logic Bombs are malicious programs that trigger destructive actions when a specific external event
occurs. They are often associated with disgruntled employees or insiders, who insert them into
systems to activate under certain conditions, such as a particular date or a change in user status. A
well-known case occurred in the early 1980s, when a program posted on the USENET news network
promised easier system administration. Hidden within the code were commands such as cd /
followed by rm -rf *, which deleted all files on the system when executed with root privileges. This
incident highlights how logic bombs exploit trust and timing to cause significant damage.
In summary, rabbits, bacteria, and logic bombs represent dangerous forms of malicious logic that
differ from viruses and worms but can still disrupt systems severely. Rabbits and bacteria drain
resources, while logic bombs wait for specific triggers to unleash destructive actions.