Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg Page 1 of 8
Computer Virus Myths
(8th Edition, March 1992)
by Rob Rosenberger
with Ross M. Greenberg
A number of myths have surfaced about the threat of computer "viruses".
There are myths about how widespread they are, how dangerous they are, and
even myths about what a computer virus really is. We'd like the facts to
be known.
The first thing to learn is that a virus is a malicious programming tech-
nique in the realm of "Trojan horses." All viruses are Trojan horses, but
few Trojan horses can be called a virus.
That having been said, it's time to go over the terminology we use when we
lecture:
BBS Bulletin Board System. If you have a modem, you can call
a BBS and leave messages, transfer computer files back &
forth, and learn a lot about computers. (What you're
reading right now, for example, most likely came to you
from a BBS.)
Bug an accidental flaw in the logic of a program which makes
it do things it shouldn't really be doing. Programmers
don't mean to put bugs in their program, but they always
creep in. Programmers tend to spend more time debugging
their programs than they do writing them in the first
place. Inadvertent bugs have caused more data loss than
all the viruses combined.
Hacker someone who really loves computers and who wants to push
them to the limit. Hackers have a healthy sense of curi-
osity: they try doorknobs just to see if they're locked,
and they tinker with a piece of equipment until it's "just
right." The computer revolution itself is a result of
hackers.
Shareware a distribution method for quality software available on a
"try before you buy" basis. You pay for the program only
if you find it useful. Shareware programs can be down-
loaded from BBSs and you are encouraged to give evaluation
copies to friends. Many shareware applications rival the
power of off-the-shelf counterparts, at just a fraction of
the price. (You must pay for the shareware you continue
to use -- otherwise you're stealing software.)
Trojan horse a generic term describing a set of computer instructions
purposely hidden inside a program. Trojan horses tell a
program to do things you don't expect it to do. The term
comes from a legendary battle in which the ancient city of
Computer Virus Myths Page 2 of 8
Troy received the gift of a large wooden horse. The
"gift" secretly held soldiers in its belly, and when the
Trojans rolled it into their fortified city....
Virus a term for a very specialized Trojan horse which spreads
to other computers by secretly "infecting" programs with a
copy of itself. A virus is the only type of Trojan horse
which is contagious, like the common cold. If it doesn't
meet this definition, then it isn't a virus.
Worm a term similar to a Trojan horse, but there is no "gift"
involved. If the Trojans had left that wooden horse out-
side the city, they wouldn't have been attacked. Worms,
on the other hand, can bypass your defenses without having
to deceive you into dropping your guard. An example is a
program designed to spread itself by exploiting bugs in a
network software package. Worms are usually released by
someone who has normal access to a computer or network.
Wormers the name given to the people who unleash destructive
Trojan horses. Let's face it, these people aren't angels.
What they do hurts us. They deserve our disrespect.
Viruses, like all Trojan horses, purposely make a program do things you
don't expect it to do. Some viruses are just an annoyance, perhaps only
displaying a "Peace on earth" greeting. The viruses we're worried about
are designed to destroy your data (the most valuable asset of your com-
puter!) and waste your valuable time in recovering from an attack.
Now you know the difference between a virus and a Trojan horse and a bug.
Let's get into some of the myths:
"All purposely destructive code comes as a virus."
Wrong. Remember, "Trojan horse" is the general term for purposely
destructive code. Very few Trojan horses actually qualify as viruses. Few
newspaper or magazine reporters have a real understand of computer crimes,
so they tend to call almost anything a virus.
"Viruses and Trojan horses are a recent phenomenon."
Trojan horses have been around since the first days of the computer;
hackers toyed with viruses in the early 1960s as a form of amusement. Many
different Trojan horse techniques emerged over the years to embezzle money,
destroy data, etc. The general public didn't know of this problem until
the IBM PC revolution brought it into the spotlight. Banks still hush up
computerized embezzlements (as they did during the 1980s) because they
believe customers will lose faith in their computer systems if the word
gets out.
"Viruses are written by hackers."
Yes, hackers have purposely unleashed viruses, but so has a computer
magazine publisher. And according to one trusted military publication, the
U.S. Defense Department develops them as weapons. Middle-aged men wearing
business suits created Trojan horses for decades before the advent of com-
Computer Virus Myths Page 3 of 8
puter viruses. We call people "wormers" when they abuse their knowledge of
computers. You shouldn't fear hackers just because they know how to write
viruses. This is an ethics issue, not a technology issue. Hackers know a
lot about computers; wormers abuse their knowledge. Hackers (as a whole)
got a bum rap when the mass media corrupted the term.
"Viruses infect 25% of all IBM PCs every month."
If 25% suffer an infection every month, then 100% would have a virus
every four months assuming the user took no preventive measures -- in other
words, every IBM PC would suffer an infection three times per year. This
astronomical estimate surfaced after virus expert (and antivirus vendor)
Dr. Peter Tippett published "The Kinetics of Computer Virus Replication," a
complex thesis on how viruses might spread in the future. Computer viruses
exist all over the planet, yes -- but they won't take over the world. Only
about 400 different viruses exist at this time and some of them have been
completely eliminated "from the wild." (Of course, virus experts retain
copies even of "extinct" viruses in their archives.) You can easily reduce
your exposure to viruses with a few simple precautions. Yes, it's still
safe to turn on your computer!
"Only 400 different viruses? But most experts talk about them in the thou-
sands."
The virus experts who "originate" these numbers tend tto work for
antivirus firms. They count even the most insignificant variations of
viruses as part of the grand total for advertising purposes. When the
Marijuana virus first appeared, for example, it displayed the word
"legalise," but a miscreant later modified it to read "legalize." Any pro-
gram capable of detecting the original virus will detect the version with
one letter changed -- but antivirus companies count them as "two" viruses.
Such obscure differentiations quickly add up.
"Viruses could destroy all the files on my disks."
Yes, and a spilled cup of coffee will do the same thing. If you have
adequate backup copies of your data, you can recover from any virus or
coffee problem. Backups mean the difference between a nuisance and
a disaster. It is safe to presume there has been more accidental loss of
data than loss by viruses and Trojan horses.
"Viruses have been documented on over 300,000 computers (1988)."
"Viruses have been documented on over 400,000 computers (1989)."
"Viruses have been estimated on over 5,000,000 computers (1992)."
These numbers come from John McAfee, a self-styled virus fighter who
craves attention and media recognition. If we assume it took him a mere
five minutes to adequately document each viral infection, it would have
taken four man-years of effort to document a problem only two years old by
1989. We further assume McAfee's statements include every floppy disk ever
infected up to that time by a virus, as well as all of the computers
participating in the Christmas and InterNet worm attacks. (Worms cannot be
included in virus infection statistics.)
McAfee prefers to "estimate" his totals these days. Let's assume we
have about 100 million computers of all types & models in use around the
world. McAfee's estimate means 1 out of every 20 computers on the planet
supposedly has a virus. It sounds like a pretty astronomical number to
most other virus experts.
Computer Virus Myths Page 4 of 8
"Viruses can hide inside a data file."
Data files can't wreak havoc on your computer -- only an executable pro-
gram file can do that (including the one that runs when you first turn on
your computer). If a virus infected a data file, it would be a wasted
effort. But let's be realistic: what you think is 'data' may actually be
an executable program file. For example, a "batch file" qualifies as text
on an IBM PC, yet the MS-DOS operating system treats it just like a pro-
gram.
"BBSs and shareware programs spread viruses."
Here's another scary myth drummed up in the big virus panic, this one
spouted as gospel by many "experts" who claim to know how viruses spread.
"The truth," says PC Magazine publisher Bill Machrone, "is that all major
viruses to date were transmitted by [retail] packages and private mail sys-
tems, often in universities." (PC Magazine, October 11, 1988.) Machrone
said this back in 1988 and it still applies to this day. Almost 50 retail
companies so far have admitted spreading infected master disks to tens of
thousands of customers since 1988 -- compared to only five shareware
authors who have spread viruses on master disks to less than 100 customers.
Machrone goes on to say "bulletin boards and shareware authors work extra-
ordinarily hard at policing themselves to keep viruses out." Reputable
sysops check every file for Trojan horses; nationwide sysop networks help
spread the word about dangerous files. Yes, you should beware of the soft-
ware you get from BBSs and shareware authors, but you should also beware of
the retail software you find on store shelves. (By the way, many stores
now have software return policies. Do you know for sure you were the only
one who used those master disks?)
"My computer could be infected if I call an infected BBS."
BBSs can't write information on your disks -- the communications soft-
ware you use performs this task. You can only transfer a dangerous file to
your computer if you let your software do it. And there is no "300bps sub-
carrier" that lets a virus slip through a high speed modem. A joker named
Mike RoChenle (IBM's "micro channel" PS/2 architecture, get it?) started
the 300bps myth when he left a techy-joke message on a public BBS. Unfor-
tunately, a few highly respected journalists were taken in by the joke.
"So-called 'boot sector' viruses travel primarily in software downloaded
from BBSs."
This common myth -- touted as gospel even by Australia's Computer Virus
Information Group -- expounds on the mythical role computer bulletin boards
play in spreading viruses. Boot sector viruses can only spread by direct
contact and "booting" the computer from an infected disk. BBSs deal exclu-
sively in program files and have no need to pass along copies of disk boot
sectors. Bulletin board users therefore have a natural immunity to boot-
sector viruses when they download software.
We should make a special note about "dropper" programs developed by
virus researchers as an easy way to transfer boot sector viruses among
themselves. Since they don't replicate, "dropper" programs don't qualify
as a virus in and of themselves. Such programs have never been discovered
on any BBS to date and have no real use other than to transfer infected
boot sectors.
Computer Virus Myths Page 5 of 8
"My files are damaged, so it must have been a virus attack."
It also could have happened because of a power flux, or static elec-
tricity, or a fingerprint on a floppy disk, or a bug in your software, or
perhaps a simple error on your part. Power failures and spilled cups of
coffee have destroyed more data than all viruses combined.
"Donald Burleson was convicted of releasing a virus."
Newspapers all over the country hailed a Texas computer crime trial as a
"virus" trial. The defendent, Donald Burleson, was in a position to
release a destructive Trojan horse on his employer's mainframe computer.
This particular software couldn't spread to other computers, so it couldn't
possibly have qualified as a virus. Davis McCown, the prosecuting attor-
ney, claims he "never brought up the word virus" during the trial. So why
did the media call it one?
1. David Kinney, an expert witness testifying for the defense, claimed
Burleson had unleashed a virus. The prosecuting attorney didn't argue
the point and we don't blame him -- Kinney's bizarre claim probably
helped sway the jury to convict Burleson, and it was the defense's
fault for letting him testify.
2. McCown gave reporters the facts behind the case and let them come up
with their own definitions. The Associated Press and USA Today, among
others, used such vague definitions that any program would have
qualified as a virus. If we applied their definitions to the medical
world, we could safely label penicillin as a biological virus (which
is, of course, absurd).
3. McCown claims many quotes attributed to him were "misleading or fab-
ricated" and identified one in particular which "is total fiction."
Reporters sometimes print a quote out of context, and McCown appar-
ently fell victim to it. (It's possible a few bizarre quotes from
David Kinney or John McAfee were accidentally attributed to McCown.)
"Robert Morris Jr. released a benign virus on a defense network."
It may have been benign but it wasn't a virus. Morris, the son of a
chief computer scientist at the U.S. National Security Agency, decided one
day to take advantage of a bug in the Defense Department's networking soft-
ware. This tiny bug let him send a worm through the network. Among other
things, Morris's "InterNet" worm sent copies of itself to other computers
in the network. Unfortunately, the network clogged up in a matter of hours
due to some bugs in the worm module itself. The press originally called it
a "virus," like it called the Christmas worm a virus, because it spread to
other computers. Yet Morris's programs didn't infect any computers. A
few notes:
1. Reporters finally started calling it a worm a year after the fact, but
only because lawyers in the case constantly referred to it as a worm.
2. The worm operated only on Sun-3 & Vax computers which employ a UNIX
operating system and were specifically linked into the InterNet net-
work at the time.
3. The 6,200 affected computers cannot be counted in virus infection
statistics (since they weren't infected).
4. It cost way less than $98 million to clean up the attack. An official
Cornell University report claims John McAfee, the man behind this wild
estimate, "was probably serving [him]self" in an effort to drum
up business. People familiar with the case estimated the final figure
at under $1 million.
Computer Virus Myths Page 6 of 8
5. Yes, Morris could easily have added some infection code to make it a
worm/virus if he'd had the urge.
6. The network bug exploited in the attack has since been fixed.
7. Morris went to trial for launching the InterNet worm and received a
federal conviction. The Supreme Court refused to hear the case, so
his conviction stands.
"The U.S. government planted a virus in Iraq military computers during the
Gulf War."
U.S. News & World Report published a story in early 1992 accusing the
National Security Agency of replacing a computer chip in a printer bound
for Iraq just before the Gulf War with a secret computer chip containing a
virus. The magazine cited "two unidentified senior U.S. officials" as
their source, saying "once the virus was in the [Iraqi computer] system,
...each time an Iraqi technician opened a 'window' on his computer screen
to access information, the contents of the screen simply vanished." How-
ever, the USN&WR story shows amazing similarities to a 1991 April Fool's
story published by InfoWorld magazine. Most computer experts dismiss the
USN&WR story as a hoax -- an "urban legend" innocently created by the Info-
World joke. Some notes:
1. USN&WR has refused to retract the story, but it did issue a "clarifi-
cation" stating "it could not be confirmed that the [virus] was ulti-
mately successful." The editors broke with tradition and refused to
publish any of the numerous letters readers submitted about the virus
story.
2. Ted Koppel, a well-known American news anchor, opened one of his
"Nightline" broadcasts with a report on the alleged virus. Koppel's
staff politely refers people to talk with USN&WR about the story's
validity.
3. InfoWorld didn't label their story as fiction, but the last paragraph
identified it as an April Fool's joke.
"Viruses can spread to all sorts of computers."
All Trojan horses are limited to a family of computers, and this is
especially true for viruses. A virus designed to spread on IBM PCs cannot
infect an IBM 4300 series mainframe, nor can it infect a Commodore C64, nor
can it infect an Apple Macintosh.
"My backups will be worthless if I back up a virus."
No, they won't. Let's suppose a virus does get backed up with your
files. You can restore important documents and databases -- your valuable
data -- without restoring an infected program. You just reinstall programs
from master disks. It's tedious work, but not as hard as some people
claim.
"Antivirus software will protect me from viruses."
There is no such thing as a foolproof antivirus program. Trojan horses
and viruses can be (and have been) designed to bypass them. Antivirus
products themselves can be tricky to use at times, and they occasionally
have bugs. Always use a good set of backups as your first line of defense;
rely on antivirus software as a second line of defense.
Computer Virus Myths Page 7 of 8
"Read-only files are safe from virus infections."
This common myth among IBM PC users has been printed even in some com-
puter magazines. Supposedly, you can protect yourself by using the DOS
ATTRIB command to set the read-only attribute on program files. However,
ATTRIB is software -- and what it can do, a virus can undo. The ATTRIB
command seldom halts the spread of viruses.
"Viruses can infect files on write-protected disks."
Here's another common IBM PC myth. If viruses can modify read-only
files, people assume they can modify write-protected floppies. However,
the disk drive itself knows when a floppy is protected and refuses to write
to it. You can physically disable an IBM PC drive's write-protect sensor,
but you can't override it with a software command.
We hope this dispels the many computer virus myths. Viruses DO exist, they
ARE out there, they WANT to spread to other computers, and they CAN cause
you problems. But you can defend yourself with a cool head and a good set
of backups.
The following guidelines can shield you from Trojan horses and viruses.
They will lower your chances of being infected and raise your chances of
recovering from an attack.
1. Implement a procedure to regularly back up your files and follow it
religiously. Consider purchasing a user-friendly program to take the
drudgery out of this task. (There are plenty to choose from.)
2. Rotate between at least two sets of backups for better security (use
set #1, then set #2, then set #1...). The more sets you use, the
better protected you are. Many people take a "master" backup of their
entire hard disk, then take "incremental" backups of those files which
changed since the last time they backed up. Incremental backups might
only require five minutes of your time each day.
3. Download files only from reputable BBSs where the sysop checks every
program for Trojan horses. If you're still afraid, consider getting
programs from a BBS or "disk vendor" company which gets them direct
from the authors.
4. Let newly uploaded files "mature" on a BBS for one or two weeks before
you download it (others will put it through its paces).
5. Consider using a program that searches, or "scans," disks for known
viruses. Almost all infections to date involved viruses known to
antivirus companies. A recent copy of any "scanning" program will in
all probability identify a virus before it gets the chance to infect
your computer -- and as they say, "an ounce of prevention is worth a
pound of cure." A "scanning" program can dramatically lower your
chaces of getting infected by a computer virus in the first place.
(But remember: there is no perfect antivirus defense.)
6. Consider using a program that creates a unique "signature" of all the
programs on your computer. Run this program once in awhile to see if
any of your software applications have been modified -- either by a
virus or by a fingerprint on a floppy disk or perhaps even by a stray
gamma ray.
Computer Virus Myths Page 8 of 8
7. DON'T PANIC if your computer starts acting weird. It may be a virus,
but then again maybe not. Immediately turn off all power to your com-
puter and disconnect it from any local area networks. Reboot from a
write-protected copy of your master DOS disk. Do NOT run any programs
on a "regular" disk (you might activate a Trojan horse). If you don't
have adequate backups, try to bring them up to date. Yes, you might
back up a virus as well, but it can't hurt you if you don't use your
normal programs. Set your backups off to the side. Only then can you
safely hunt for problems.
8. If you can't figure out what's wrong and you aren't sure what to do
next, turn off your computer and call for help. Consider calling a
local computer group before you call for an expert. If you need a
professional, consider a regular computer consultant first. Some
"virus removal experts" charge prices far beyond their actual value.
9. [Consider this ONLY as a last resort.] If you can't figure out what's
wrong and you are sure of yourself, execute both a low-level and a
high-level format on all your regular disks. Next, carefully re-
install all software from the master disks (not from the backups).
Make sure the master disks have write-protect tabs! Then, carefully
restore only the data files (not the program files) from your backup
disks.
We'd appreciate it if you would mail us a copy of any Trojan horse or virus
you discover. (Be careful you don't damage the data on your disks while
trying to do this!) Include as much information as you can and put a label
on the disk saying it contains a malicious program. Send it to Ross M.
Greenberg, P.O. Box 908, Margaretville, NY 12254. Thank you.
Ross M. Greenberg is the author of both shareware and retail virus
detection programs. Rob Rosenberger is the author of various phone
productivity applications. (Products are not mentioned by name because
this isn't the place for advertisements.) They each write for national
computer magazines. These men communicated entirely by modem while
writing this treatise.
Copyright 1988,92 by Rob Rosenberger & Ross M. Greenberg
Rosenberger can be reached electronically on CompuServe as [74017,1344], on
GEnie as R.ROSENBERGE, on InterNet as `
[email protected]', and on
various national BBS linkups. Greenberg can be reached on MCI and BIX as
`greenber', on UseNet as `
[email protected]', and on CompuServe as
[72461,3212].
You may give copies of this treatise to anyone if you pass it along in its
entirety. Publications may reprint it at no charge if they give due credit
to the authors and send two copies to: Rob Rosenberger, P.O. Box 643,
O'Fallon, IL 62269.
