Chapter 7: Viruses and Worms

OVERVIEW

Freedom is the most contagious virus known to man.

--HUBERT H. HUMPHREY

TWO OF THE GREATEST THREATS TO EVERY COMPUTER ARE VIRUSES AND WORMS, WHICH ARE NOTHING MORE THAN COMPUTER PROGRAMS THAT SOMEONE EITHER WROTE FOR "FUN," OUT OF CURIOSITY, OR AS A CHALLENGE TO CREATE THE MOST DESTRUCTIVE VIRUS OR WORM POSSIBLE. Although some viruses and worms are completely harmless, the majority of viruses and worms cause a wide range of trouble, from displaying nonsensical messages on the screen, to making the keyboard work erratically, to deleting files or entire hard disks.

While a virus or a worm won't always cause any damage, it is always unwanted on any computer. Table 7-1 lists some of the more infamous viruses, worms, and Trojan horses throughout history:

Table 7-1: Virus, Worm, and Trojan Horse "Milestones"

1986	Brain virus: First computer virus released in Pakistan.
1986	PC-Write Trojan: First Trojan horse disguised as a major shareware program, the PC-Write word processor.
1988	MacMag virus: First Macintosh virus released.
1988	Scores virus: First major Macintosh virus outbreak.
1988	Internet worm: First worm to cause widespread havoc on the Internet, shutting down computers all over the country and making worldwide headlines.
1989	AIDS Trojan: First Trojan horse that held the user's data hostage by encrypting the hard disk and demanding that the user pay for an encryption key that would prevent the Trojan horse from deleting data.
1990	First Virus Exchange Bulletin Board System (VX BBS) appears in Bulgaria where callers could trade live viruses and virus source code.
1990	The Little Black Book of Computer Viruses published by Mark Ludwig. This was one of the first books to provide detailed instructions and accompanying source code to teach people how to write computer viruses.
1991	Tequila virus: First polymorphic virus capable of changing its appearance to avoid detection by antivirus programs.
1992	Michelangelo virus: First computer virus that caused a major media alert. Despite claims that millions of computers were in danger, the Michelangelo virus actually caused relatively little damage.
1992	Dark Avenger Mutation Engine (DAME): First toolkit designed to turn any computer virus into a polymorphic virus. Despite its threatening appearance, its wide-scale use was prevented by the toolkit's complexity and program bugs.
1992	Virus Creation Laboratory (VCL): First toolkit for creating a virus using pull-down menus.
1996	Boza: First Windows 95 virus released.
1996	Concept virus: First macro virus released that infects Word documents.
1996	Laroux virus: First macro virus released that infects Excel spreadsheet files.
1996	Staog virus: First Linux virus released.
1998	Strange Brew virus: First Java virus released.
1998	Back Orifice: First remote access Trojan horse (RAT) that allows others to completely take over a target computer through the Internet.
1999	Melissa virus: First virus to spread by email through Microsoft Outlook and Outlook Express address books.
1999	Tristate virus: First macro virus capable of infecting Word, Excel, and PowerPoint files.
2000	First large-scale denial of service attacks to shut down major websites, including Yahoo, Amazon.com, CNN, and eBay.
2000	Love Bug worm: The fastest spreading worm in history, causing an estimated $2 to $15 billion in damages.
2000	Timofonica worm: First worm to attack mobile phones using calls generated from an infected computer.
2000	Life Stages worm: First worm to spread as an SHS (Microsoft Scrap Object) file that appears as a harmless text file.
2000	Phage: First virus to infect the Palm operating system.
2000	Liberty: First Trojan horse for the Palm operating system. It claims to be a cracking tool for the Liberty Gameboy emulator program.
2000	WebTV/Flood: First virus to affect WebTV users by infecting through Usenet newsgroups messages.
2000	Hybris: First worm that can automatically update itself by connecting to the alt.comp.virus newsgroup and looking for new plug-in components to install.
2001	Klez: A fast-spreading worm that mass mails itself and infects computers with a polymorphic virus named ElKern even if users just preview the infected email message using Microsoft Outlook or Outlook Express.
2001	Rans: First virus to infect Perl files.
2001	Peachy: First worm to infect Adobe Acrobat PDF files.
2001	MTX: First combination worm/virus/Trojan horse. The worm component mass mails itself to infect computers. The virus component attempts to block the infected computer from accessing popular antivirus websites. The Trojan horse component attempts to open a back door allowing access into an infected computer.
2002	SWF.LFM: First virus to infect Shockwave Flash animation files.
2002	Myparty: Mass mailing worm that installs a Trojan horse back door and contacts the worm author so he can break in to all infected computers.
2002	Scalper: First worm to infect Apache webservers.