Copyright: Copr. 1988,93 Rob Rosenberger & Ross M. Greenberg


Computer Virus Myths treatise
COMPUTER VIRUS MYTHS

(10th Edition: October 4, 1993)

by Rob Rosenberger

with Ross M. Greenberg

A number of myths have surfaced about the threat of computer "viruses."  There are myths about how widespread they are, how dangerous they are, and even myths about what a computer virus really is.  We want you to know the facts.

The first thing you need to learn is that a computer virus falls in the realm of malicious programming techniques known as "Trojan horses."  All viruses are Trojan horses, but relatively few Trojan horses can be called a virus.

Click here to see:	Word definitions

Copyright notice & distribution polices

Virus safety guidelines

Submitting viruses to Mr. Greenberg

Viruses, like all Trojan horses, purposely make a program do things you don't expect it to do.  Some viruses will just annoy you, perhaps only displaying a "Peace on earth" greeting.  The viruses we worry about will try to erase your data (the most valuable asset of your computer!) and waste your valuable time in recovering from an attack.

Now let's get into some of the myths:

All purposely destructive code spreads like a virus.

Viruses and Trojan horses are a recent phenomenon.

Viruses are written by teenage hackers.

Viruses infect 25% of all IBM PCs every month.

Only 500 different viruses?  But most experts talk about them in the thousands.

A virus could destroy all the files on my disks.

Viruses have been documented on over 300,000 computers {1988}.

Viruses have been documented on over 400,000 computers {1989}.

The Michelangelo virus alone was estimated to be on over 5,000,000 computers {1992}.

Viruses can hide inside a data file.

Some viruses can completely hide themselves from all antivirus software, making them truly undetectable.

BBSs and shareware programs spread viruses.

My computer could be infected if I call an infected BBS.

So-called 'boot sector'  viruses travel primarily in software downloaded from BBSs.

My files are damaged, so it must have been a virus attack.

Donald Burleson was convicted of releasing a virus.

Robert Morris Jr. released a benign virus on a defense network.

The U.S. government planted a virus in Iraqi military computers during the Gulf War.

Viruses can spread to all sorts of computers.

My backups will be worthless if I back up a virus.

Antivirus software will protect me from viruses.

Read-only files are safe from virus infections.

Viruses can infect files on write-protected floppy disks.


Rosenberger, Rob
ROB ROSENBERGER serves as lead sysop for CompuServe's SHAREWARE forum.  He has researched computer virus myths & hoaxes since 1988.  His research on the cause of the Michelangelo virus scare of 1992 has been reprinted in ISPNews (a computer security industry newsletter); and he has consulted on computer virus & data security books written by Janet Endrijonas, Pamela Kane, and Richard B. Levin.

You can reach Mr. Rosenberger electronically at:

CompuServe:	74017,1344

GEnie:	R.ROSENBERGE

InterNet:	74017.1344@compuserve.com


Greenberg, Ross
ROSS M. GREENBERG writes both shareware and retail virus detection & removal programs.  (Products aren't mentioned by name because this treatise isn't the place for advertisements.)  He serves as a sysop for the Virus & Security RoundTable on GEnie and is also currently working on a number of other products having nothing to do with computer viruses.

You can reach Mr. Greenberg electronically at:

BIX:	greenber

CompuServe:	72461,3212

GEnie:	GREENBER

InterNet:	greenber@ramnet.com

MCImail:	greenber


WORD DEFINITIONS

BBS

bug

hacker

shareware

Trojan horse

virus

worm

wormer


"BBS" defined
BBS

Bulletin Board System.  If you have a modem, you can call a BBS and leave messages, transfer computer files back & forth, and learn a lot about computers.  (What you're reading right now, for example, most likely came to you from a BBS.)


"bug" defined
Bug

An accidental flaw in the logic of a program which makes it do things it shouldn't be doing.  Programmers don't mean to put bugs in their programs, but they always creep in.  Programmers often spend more time "debugging" programs than they do writing them in the first place.  Inadvertent bugs have caused more data loss than all viruses combined.


"hacker" defined
Hacker

Someone who really loves computers and who wants to push them to the limit.  Hackers have a healthy sense of curiosity: they try doorknobs just to see if they're locked, for example.  They also love to tinker with a piece of equipment until it's "just right."  The entire computer revolution itself is largely a result of hackers.


"shareware" defined
Shareware

A distribution method for quality software available on a "try before you buy" basis.  You must pay for it if you continue using it after the trial period.  Shareware authors let you download their programs from BBSs and encourage you to give evaluation copies to friends.  Many shareware applications rival their retail-shelf counterparts at a fraction of the price.  (You must pay for the shareware you continue to use -- otherwise you're stealing software.)


"Trojan horse" defined
Trojan horse

A generic term describing a set of computer instructions purposely hidden inside a program.  Trojan horses tell programs to do things you don't expect them to do.  The term comes from the legendary battle in which the ancient city of Troy received a large wooden horse to commemorate a fierce battle.  The "gift" secretly held enemy soldiers in its belly and, when the Trojans rolled it into their fortified city....


"virus" defined
Virus

A term for a very specialized Trojan horse which spreads to other computers by secretly "infecting" programs with a copy of itself.  A virus is the only type of Trojan horse which is contagious, much like the common cold.  If a Trojan horse doesn't meet this definition, then it isn't a virus.


"worm" defined
Worm

A term similar to a Trojan horse, but there is no "gift" involved.  If the Trojans had left that wooden horse outside the city, they wouldn't have been attacked from inside the city.  Worms, on the other hand, can bypass your defenses without having to deceive you into dropping your guard.  An example would be a program designed to spread itself by exploiting bugs in a network software package.  Worms usually come from someone who has legitimate access to the computer or network.


"wormer" defined
Wormers

What we call people who unleash Trojan horses onto an unsuspecting public.  Let's face it, these people aren't angels.  What they do hurts us.  They deserve our disrespect.


Myth: all purposely destructive code spreads like a virus
MYTH:  All purposely destructive code spreads like a virus.

Wrong.  Remember, Trojan horse describes purposely destructive code in general.  Very few Trojan horses actually qualify as viruses.  Newspaper & magazine reporters tend to call almost anything a virus because they often have no real understanding of computer crime.


Myth: viruses and Trojan horses are a recent phenomenon
MYTH:  Viruses and Trojan horses are a recent phenomenon.

Trojan horses have existed since the first days of the computer; hackers toyed with viruses in the early 1960s as a form of amusement.  Many different Trojan horse techniques have emerged over the decades to embezzle money, destroy data, fool investors, etc.  The general public really didn't know of this problem until the IBM PC revolution brought it into the spotlight.  Banks still hush up computerized embezzlements to this day because they believe customers will lose faith in them if word gets out.


Myth: viruses are written by teenage hackers
MYTH:  Viruses are written by teenage hackers.

Yes, hackers have unleashed viruses -- but so has a computer magazine publisher.  And according to one trusted military publication, the U.S. Defense Department creates computer viruses for use as weapons.  Trojan horses for many decades sprang from the minds of middle-aged men; computer prices have only recently dropped to a level where teenagers could get into the act.  We call people "wormers" when they abuse their knowledge of computers.

You shouldn't fear hackers just because some of them know how to write viruses.  This whole thing boils down to an ethics issue, not a technology issue.  Hackers know a lot about computers; wormers abuse their knowledge.  Hackers as a whole got a bum rap when the mass media corrupted the term.


Myth: viruses infect 25% of all IBM PCs every month
MYTH:  Viruses infect 25% of all IBM PCs every month.

If 25% suffer an infection every month, then 100% would have a virus every four months -- in other words, every IBM PC would suffer an infection three times per year.  This mythical estimate surfaced in the media after researcher Peter Tippett wrote a complex thesis on how viruses might spread in the future.

Computer viruses exist all over the planet, yes -- but they won't take over the world.  Only about 500 different viruses exist at this time; many of them have never existed "in the wild" and some have since been completely eliminated "from the wild."  You can easily reduce your exposure to viruses with a few simple precautions.  Yes, it's still safe to turn on your computer!


Myth: thousands of different viruses
MYTH:  Only 500 different viruses?  But most experts talk about them in the thousands.

The virus experts who claim much larger numbers usually work for antivirus companies.  They count even the most insignificant variations for advertising purposes.  When the Marijuana virus first appeared, for example, it contained the word "legalise," but a miscreant later modified it to read "legalize."  Any program which can detect the original virus can detect the version with one letter changed -- but antivirus companies count them as "two" viruses.  These obscure differentiation's quickly add up.

And take note: the majority of "new" computer viruses discovered these days are only minor variations on well-known viruses.


Myth: a virus could destroy all the files on my disks
MYTH:  A virus could destroy all the files on my disks.

Yes, and a spilled cup of coffee could do the same thing.  You can recover from any virus or coffee problem if you have adequate backups of your data.  Backups mean the difference between a nuisance and a disaster.  You can safely presume there has been more accidental loss of data than loss by all viruses and Trojan horses.


Myth: millions of computers infected by viruses
MYTH:  Viruses have been documented on over 300,000 computers {1988}.

MYTH:  Viruses have been documented on over 400,000 computers {1989}.

MYTH:  The Michelangelo virus alone was estimated to be on over 5,000,000 computers {1992}.

These numbers originated from John McAfee, a self-styled virus fighter who craves attention and media recognition.  If we assume it took him a mere five minutes to adequately document each viral infection, it would have taken four man-years of effort to document a problem only two years old by 1989.  We further assume McAfee's statements included every floppy disk ever infected up to that time by a virus, as well as every computer involved in the Christmas and InterNet worm attacks.  (Worms cannot be included in virus infection statistics.)

McAfee prefers to "estimate" his totals these days and was widely quoted during the Michelangelo virus hysteria in early 1992.  Let's do some estimating ourselves by assuming about 80 million IBM PC-compatible computers around the world.  McAfee's estimate meant one out of every 16 of those computers not only had a virus of some type, it specifically had the Michelangelo virus.  Many other virus experts considered it an astronomical estimate based on the empirical evidence.


Myth: viruses can hide inside a data file
MYTH:  Viruses can hide inside a data file.

Data files can't wreak havoc on your computer -- only an executable program file can do that (including the one that runs every time you turn on or reboot a computer).  If a virus infected a data file, it would be a wasted effort.  But let's be realistic: what you think is 'data' may actually be an executable program file.  For example, a "batch file" on an IBM PC contains only text, yet DOS treats it just like an executable program.


Myth: some viruses can hide from all antivirus software
MYTH:  Some viruses can completely hide themselves from all antivirus software, making them truly undetectable.

This myth ironically surfaced when certain antivirus companies publicized how they could detect so-called "Mutation Engine" viruses.  The myth gained national exposure in early 1993 when the Associated Press printed excerpts from a new book about viruses.  Most viruses have a character-based "signature" which identifies it both to the virus (so it doesn't infect a program too many times) and to antivirus software (which uses the signature to detect the virus).  A Mutation Engine virus employs an algorithm signature rather than a character-based signature -- but it still has a unique, readily identifiable signature.

The technique of using algorithm signatures really doesn't make it any harder to detect a virus.  You just have to do some calculations to know the correct signature -- no big deal for an antivirus program.


Myth: BBSs and shareware programs spread viruses
MYTH:  BBSs and shareware programs spread viruses.

Here's another scary myth, this one spouted as gospel by many "experts" who claim to know how viruses spread.  "The truth," says PC Magazine publisher Bill Machrone, "is that all major viruses to date were transmitted by [retail] packages and private mail systems, often in universities."  [PC Magazine, October 11, 1988.]  What Machrone said back then still applies today.  Over 50 retail companies have admitted spreading infected master disks to tens of thousands of customers since 1988 -- compared to only nine shareware authors who have spread viruses on master disks to less than 300 customers since 1990.

Machrone goes on to say "bulletin boards and shareware authors work extraordinarily hard at policing themselves to keep viruses out."  Reputable sysops check every file for Trojan horses; nationwide sysop networks help spread the word about dangerous files.  Yes, you should beware of the software you get from BBSs and shareware authors, but you should also beware of retail software found on store shelves.

By the way, many stores now routinely re-shrinkwrap returned software and put it on the shelf again.  Do you know for sure only you ever touched those master disks?


Myth: my computer could be infected if I call an infected BBS
MYTH:  My computer could be infected if I call an infected BBS.

BBSs can't write information on your disks -- the communications software you use performs this task.  You can only transfer a dangerous file to your computer if you let your software do it.

And there is no "300bps subcarrier" by which a virus can slip through a modem.  A joker who called himself Mike RoChenle ("micro channel," get it?) started this myth after leaving a techy-joke message on a public network.  Unfortunately, some highly respected journalists got taken in by the joke.


Myth: boot sector viruses travel via BBS downloads
MYTH:  So-called 'boot sector' viruses travel primarily in software downloaded from BBSs.

This common myth -- touted as gospel even by "experts" -- expounds on the supposed role bulletin boards play in spreading infections.  Boot sector viruses spread only if you directly copy an infected floppy disk, or if you try to "boot" a computer from an infected disk, or if you use a floppy in an infected computer.  BBSs deal exclusively with program files and don't pass along copies of boot sectors.  Bulletin board users thus have a natural immunity to boot-sector viruses in downloaded software.  (And since the clear majority of infections stem from boot sector viruses, this fact alone exonerates the BBS community as the so-called "primary" source for the spread of viruses.)

We should make a special note about "dropper" programs developed by virus researchers as an easy way to transfer boot sector viruses among themselves.  Since they don't replicate, "dropper" programs don't qualify as viruses.  These programs have never appeared on BBSs to date and have no real use other than to transfer infected boot sectors.


Myth: my files are damaged, so it must have been a virus
MYTH:  My files are damaged, so it must have been a virus attack.

It also could have happened because of a power flux, or static electricity, or a fingerprint on a floppy disk, or a bug in your software, or perhaps a simple error on your part.  Power failures, spilled cups of coffee, and user errors have destroyed more data than all viruses combined.


Myth: Donald Burleson convicted for releasing a virus
MYTH:  Donald Burleson was convicted of releasing a virus.

Newspapers all over the country hailed a 1989 Texas computer crime trial as a "virus" trial.  The defendant, Donald Burleson, had released a destructive Trojan horse on his employer's mainframe computer.  The software in question couldn't spread to other computers, and prosecuting attorney Davis McCown claimed he "never brought up the word virus" during Burleson's trial.  So why did the media call it one?

1.	David Kinney, an expert witness testifying for the defense, claimed Burleson had unleashed a virus.  The prosecuting attorney didn't argue the point and we don't blame him -- Kinney's claim may have actually swayed the jury to convict Burleson.

2.	McCown gave reporters the facts behind the case and let them come up with their own definitions.  The Associated Press and USA Today, among others, used such vague definitions that any program would have qualified as a virus.  If we applied their definitions to the medical world, we could safely label penicillin as a biological virus (which is, of course, absurd).


Myth: Robert Morris released virus on defense network
MYTH:  Robert Morris Jr. released a benign virus on a defense network.

It supposedly may have been benign, but it wasn't a virus.  Morris, the son of a chief computer scientist at the U.S. National Security Agency, decided one day to take advantage of bugs in the software which controls InterNet, a network the Defense Department often uses.  These tiny bugs let Morris send a worm throughout the network.  Among other things, the "InterNet worm" sent copies of itself to other computers -- and clogged the entire network in a matter of hours due to bugs in the worm module itself.  The press called it a "virus," like it called the 1987 "Christmas worm" a virus, because it spread to other computers.  Yet Morris's work didn't infect any computers.  A few notes:

1.	Reporters finally started calling it a worm a year after the fact, but only because lawyers on both sides of the case constantly referred to it as a worm.

2.	The worm operated only on Sun-3 & VAX computers which employ the UNIX operating system and which were specifically linked into InterNet at the time of the attack.

3.	The 6,200 affected computers cannot be counted in virus infection statistics (they weren't infected).

4.	It cost way less than $98 million to clean up the attack.  An official Cornell University report claims John McAfee, the man behind this wild estimate, "was probably serving [him]self" in an effort to drum up business.  People familiar with the case estimated the final figure at slightly under $1 million.

5.	Yes, Morris could easily have added some infection code to make it both a worm and a virus if he'd had the urge.

6.	InterNet gurus have since fixed the bugs Morris exploited in the attack.

7.	Morris went on trial for launching the worm and received a federal conviction.  The Supreme Court refused to hear his case, so the conviction stands.


Myth: U.S. put virus in Iraqi computers during Gulf War
MYTH:  The U.S. government planted a virus in Iraqi military computers during the Gulf War.

U.S. News & World Report in early 1992 claimed the National Security Agency had replaced a computer chip in a printer bound for Iraq just before the Gulf War with a secret computer chip containing a virus.  The magazine cited "two unidentified senior U.S. officials" as their source, saying "once the virus was in the [Iraqi computer] system, ...each time an Iraqi technician opened a 'window' on his computer screen to access information, the contents of the screen simply vanished."

Yet the USN&WR story shows amazing similarities to a 1991 April Fool's joke published by InfoWorld magazine.  Most computer experts dismiss the USN&WR story as a hoax -- an "urban legend" innocently created by the InfoWorld joke.  Some notes:

1.	USN&WR continues to stand by its story, but did publish a "clarification" stating "it could not be confirmed that the [virus] was ultimately successful."  The editors broke with tradition by declining to print any letters readers had submitted about it.

2.	Ted Koppel, a well-known American news anchor, opened one of his "Nightline" broadcasts with a report on the alleged virus.  Koppel's staff politely refers people to talk with USN&WR about the story's validity.

3.	InfoWorld didn't label their story as fiction, but the last paragraph identified it as an April Fool's joke.


Myth: viruses can spread to all sorts of computers
MYTH:  Viruses can spread to all sorts of computers.

The design of all Trojan horses limits them to a family of computers, something especially true for viruses.  A virus written for IBM PCs cannot infect an IBM 4300 series mainframe, nor can it infect a Commodore C64, nor can it infect an Apple Macintosh.

But take note: some computers can now run software written for other types of computers.  An Apple Macintosh, with the right products, can run IBM PC software for example.  If one type of computer can run software written for another type of computer, then it can also catch viruses written for the other type of computer.


Myth: my backups will be worthless if I back up a virus
MYTH:  My backups will be worthless if I back up a virus.

No, they won't.  Let's suppose a virus does get backed up with your files.  You can restore important documents and databases and spreadsheets -- your valuable data -- without restoring an infected program.  You just reinstall the programs from master disks.  It's tedious work, but not as hard as some people claim.


Myth: antivirus software will protect me from viruses
MYTH:  Antivirus software will protect me from viruses.

There is no such thing as a foolproof antivirus program.  Viruses and other Trojan horses can be (and have been) designed to bypass them.  Antivirus products also can be tricky to use at times and they occasionally have bugs.  Always use a good set of backups as your first line of defense; rely on antivirus software only as a second line of defense.


Myth: read-only files are safe from virus infections
MYTH:  Read-only files are safe from virus infections.

This common myth among IBM PC users has appeared even in some computer magazines.  Supposedly, you can protect yourself by using the ATTRIB command to set the read-only attribute on program files.  Yet ATTRIB is software -- what it can do, a virus can undo.  The ATTRIB command cannot halt the spread of most viruses.


Myth: viruses can infect files on write-protected floppies
MYTH:  Viruses can infect files on write-protected floppy disks.

Another common IBM PC myth.  If viruses can modify read-only files, people assume they can also modify files on write-protected disks.  However, the disk drive itself knows when a floppy has a write-protect tab and refuses to write to the disk.  You can't override an IBM PC drive's write-protect sensor with a software command.


VIRUS SAFETY GUIDELINES

The following guidelines can shield you from viruses and other Trojan horses.  They will lower your chances of getting infected and raise your chances of recovering from an attack.

1.	Implement a procedure to regularly back up your files and follow it religiously.  We can't emphasize this enough!  Consider purchasing a user-friendly program or a tape backup device to take the drudgery out of this task.  You'll find plenty of inexpensive programs and tape backup hardware to choose from.

2.	Rotate between at least two sets of backups for better security (use set #1, then set #2, then set #1...).  The more sets you use, the better protection you have.  Many people take a "master" backup of their entire hard disk, then take a number of "incremental" backups of files which have changed since the last time they backed up.  Incremental backups might only require five minutes of your time each day.

3.	Many IBM PC computers now have a "BIOS option" to ignore floppy drives during the bootup process.  Consult your computer's documentation to see if you can set this option.  It will greatly reduce your exposure to boot sector viruses (the most common type of computer virus).

4.	Download files only from reputable BBSs where the sysop checks every program for Trojan horses.  If you're still afraid, consider getting programs from a BBS or "disk vendor" company which obtains files direct from the authors.

5.	Let a newly uploaded file "mature" on a BBS for one or two weeks before you download it (others will put it through its paces).

6.	Consider using a program that searches ("scans") for known viruses.  Almost all infections involve viruses known to antivirus companies.  A recent version (no more than four months old) of any "scanning" program will in all probability identify a virus before it can infect your computer.  But remember: there is no perfect antivirus defense.

7.	Consider using a program that creates a unique "signature" of all the programs on your computer.  Run this software once in awhile to see if any of your program files have been modified -- either by a virus or perhaps just by a stray gamma ray.

8.	DON'T PANIC if your computer starts acting weird.  You might have a virus, but then again you might not.  Immediately turn off all power to your computer and disconnect it from any local area networks.  Reboot from a write-protected copy of your master DOS disk.  Don't run any programs on a "regular" disk -- you might activate a Trojan horse.  If you don't have adequate backups, try to bring them up-to-date.  (Yes, you might back up a virus as well, but it can't hurt you if you don't use your normal programs.)  Set your backups off to the side.  Only then can you safely hunt for problems.

9.	If you can't figure out the problem and you don't know what to do next, just turn off your computer and call for help.  Consider calling a local computer group before you call for an expert.  If you need a professional, consider a regular computer consultant first.  (Some "virus removal experts" charge prices far beyond their actual value.)


SUBMITTING VIRUSES TO MR. GREENBERG

We'd appreciate it if you would submit a copy of any Trojan horse or virus you discover.  (Be careful you don't damage the data on your disks while trying to do this!)  Include as much information as you can and put a label on the disk saying it contains a malicious program.  Send it to Ross M. Greenberg, Software Concepts Design, Virus Acres, New Kingston, NY 12459.  Thank you.


COPYRIGHT NOTICES & DISTRIBUTION POLICIES

© 1988,93 Rob Rosenberger & Ross M. Greenberg

You may give copies of this treatise to anyone if you pass it along unmodified and in its entirety.  We especially encourage antivirus vendors and book authors to bundle it with their products as a public service.

Printed publications may reprint this treatise in whole or in part, at no charge, if they give due credit to the authors.  For-profit publications must submit two copies to: Rob Rosenberger, P.O. Box 1115, O'Fallon, IL 62269.  Book publications need only submit one copy.  Non-profit publications do not have to submit any copies.