The Functional Elements of a Virus
Every viable computer virus must have at least two basic parts, or subroutines, if it is even to be called a virus. Firstly, it must contain a search routine, which locates new files or new areas on disk which are worthwhile targets for infection. This routine will determine how well the virus reproduces, e.g., whether it does so quickly or slowly, whether it can infect multiple disks or a single disk, and whether it can infect every portion of a disk or just certain specific areas. As with all programs, there is a size versus functionality tradeoff here. The more sophisticated the search routine is, the more space it will take up. So although an efficient search routine may help a virus to spread faster, it will make the virus bigger, and that is not always so good.
Secondly, every computer virus must contain a routine to copy itself into the area which the search routine locates. The copy routine will only be sophisticated enough to do its job without getting caught. The smaller it is, the better. How small it can be will depend on how complex a virus it must copy. For example, a virus which infects only COM files can get by with a much smaller copy routine than a virus which infects EXE files. This is because the EXE file structure is much more complex, so the virus simply needs to do more to attach itself to an EXE file.
While the virus only needs to be able to locate suitable hosts and attach itself to them, it is usually helpful to incorporate some additional features into the virus to avoid detection, either by the computer user, or by commercial virus detection software. Anti-detection routines can either be a part of the search or copy routines, or functionally separate from them. For example, the search routine may be severely limited in scope to avoid detection. A routine which checked every file on every disk drive, without limit, would take a long time and cause enough unusual disk activity that an alert user might become suspicious. Alternatively, an anti- detection routine might cause the virus to activate under certain special conditions. For example, it might activate only after a certain date has passed (so the virus could lie dormant for a time).
Figure : Functional diagram of a virus.
Alternatively, it might activate only if a key has not been pressed for five minutes (suggesting that the user was not there watching his computer).
Search, copy, and anti-detection routines are the only necessary components of a computer virus, and they are the components which we will concentrate on in this volume. Of course, many computer viruses have other routines added in on top of the basic three to stop normal computer operation, to cause destruction, or to play practical jokes. Such routines may give the virus character, but they are not essential to its existence. In fact, such routines are usually very detrimental to the virus’ goal of survival and self-re-production, because they make the fact of the virus’ existence known to everybody. If there is just a little more disk activity than expected, no one will probably notice, and the virus will go on its merry way. On the other hand, if the screen to one’s favorite program comes up saying “Ha! Gotcha!” and then the whole computer locks up, with everything on it ruined, most anyone can figure out that they’ve been the victim of a destructive program. And if they’re smart, they’ll get expert help to eradicate it right away. The result is that the viruses on that particular system are killed off, either by themselves or by the clean up crew.
Although it may be the case that anything which is not essential to a virus’ survival may prove detrimental, many computer viruses are written primarily to be smart delivery systems of these “other routines.” The author is unconcerned about whether the virus gets killed in action when its logic bomb goes off, so long as the bomb gets deployed effectively. The virus then becomes just like a Kamikaze pilot, who gives his life to accomplish the mission. Some of these “other routines” have proven to be quite creative. For example, one well known virus turns a computer into a simulation of a wash machine, complete with graphics and sound. Another makes Friday the 13th truly a bad day by coming to life only on that day and destroying data. None the less, these kinds of routines are more properly the subject of volume three of this series, which discusses the military applications of computer viruses. In this volume we will stick with the basics of designing the reproductive system. And if you’re real interest is in military applications, just remember that the best logic bomb in the world is useless if you can’t deploy it correctly. The delivery system is very, very important. The situation is similar to having an atomic bomb, but not the means to send it half way around the world in fifteen minutes. Sure, you can deploy it, but crossing borders, getting close to the target, and hiding the bomb all pose considerable risks. The effort to develop a rocket is worthwhile.
