About the Virus Problem
David J. Stang, Ph.D.

What is a Virus?
How Many Viruses Are There?
Where Do They Come From?
What Do They Look Like?

They are Small!

Why Do People Write Viruses?
How Do Viruses Spread?

Piracy and Computer Viruses

Is it a Problem?

Aren't Viruses Rare?
Do All Viruses Cause Damage?
Aren't there any "Good" Viruses?
The Dollar Costs of Viruses
Does Your Computer Have AIDS?

Viruses, the Law, and Morality

What is a Virus?

The word "virus" has become synonymous with "trouble." Computer won't boot? "Maybe it's a virus!" Usually, troubles with a computer are not caused by viruses, but rather by hardware that is failing, changes in CONFIG.SYS or AUTOEXEC.BAT, or user errors.

Viruses, worms, Trojan Horses, and logic bombs are all unwanted, uninvited, potentially dangerous software, but there are important distinctions among them. The differences lie in whether the category requires a host program and whether it makes copies of itself. All four may cause damage, but this is not integral to the definitions. The table defines each one.

Defining Virus, Worm, Trojan Horse, Bug, and Bomb
| Requires Host? | Replicates?
Virus | Yes. Viruses require a host, by definition. By inserting themselves in existing executable programs, they are harder to detect, and ensure that they will be run from time to time. | Yes. All viruses make copies of themselves, infecting other boot sectors, master boot records, or programs as the opportunity arises.
Worm | No. A host is not required, because worms are typically a mainframe problem, and do not need to hide from most users. | Yes. A worm makes copies of itself as it finds the opportunity.
Trojan Horse | No. While the term "Trojan horse" sometimes refers to the program containing destructive code, the term is more often used to refer to the entire COM or EXE. | No. Most Trojan horses activate when they are run, and often destroy the structure of the current drive (FATs, directory), obliterating themselves in the process.
Bug, Logic Bomb, Time Bomb | Yes. Programmers cannot write a bug without also writing other code -- although it's fair to say that most programmers do not intentionally write bugs; logic bombs and time bombs are inserted by programmers in otherwise "good" code. | No. This code generally has better things to do than making copies of itself. Logic bombs and time bombs wish to remain hidden, with only their effects visible. Bugs do just about everything except make more bugs.

Viruses are programs that require a host and replicate. Viruses are fairly rare but when infections occur, the viruses came from home computers (as a result of contact with high risk areas such as schools), service technicians, sales representatives, new computers, repaired computers, commercial shrink - wrapped software that has never been opened, and software that has been infected, returned to the dealer, re - packaged, and re - sold. Most of the viruses we know about today were written in the former USSR, Bulgaria, Germany, and the US, and were probably written by teenagers and college students.

The best prevention is a combination of changing your computing behavior and using an anti - virus product wisely:

- scan all new software
- scan all new data diskettes
- be on the lookout for suspicious activity
- disable drive A:
- shop for an anti - virus product that suits your needs.
- when removing a virus, don't let your anti - virus product do everything it claims it can -- at least not right away.

How Many Viruses Are There?

How many viruses are there? I asked this question on December 31, 1994.

- One method of assessing how many viruses there are in the world is to assume the perfection of one or more scanners, and ask the vendor how many viruses the scanner detects. Of products reviewed, one scanner vendor claimed to detect 5,563 different viruses as of December 31, 1994.
- An inference of the extent to which FRISK Software's F-Prot undercounts boot viruses would estimate that there are 7,130 viruses in the world at the end of 1994..
- An inference based on a range of scanner underestimations in general suggests that there may have been 8,344 different viruses in the world at the end of 1994.
- V-Base reported 5,797 viruses as of October, 1994. Assuming that V-Base described every single virus written up to October 1, then based on growth rates for the period 1986 through October 1994, we could infer 7,847 viruses at the end of 1994.
- V-Base undercounts newer viruses. Based on growth rates for the period 1987-1992, we can estimate 7,108 viruses at the end of 1994.

For those who believe in averages, the average of these estimation methods is 7,198 viruses as of December 31, 1994.

The table below tracks viruses for the PC by date of authorship, where such information was available.

Year | Viruses Authored | Cumulative Viruses
1986 | 8 | 8
1897 | 32 | 40
1988 | 33 | 73
1989 | 150 | 223
1990 | 333 | 556
1991 | 746 | 1302
1992 | 1260 | 2562
1993 | 1082 | 3644
1994 | 2730 | 6374

Where Do They Come From?

Viruses come from all over the globe, but a few countries produce far more than their share: Germany, Bulgaria, the former USSR, and the U.S. The total number of viruses authored is shown in the table below. One day, we'll have a better understanding of the number of computers in each country, and will be able to look at authorship rates per 1,000 computers. Our impression is that such rates are highest in eastern and southern Europe and the former USSR.

Country | Viruses Authored
Argentina | 3
Australia | 30
Bulgaria | 202
Canada | 31
China | 32
Czechoslovakia | 6
Denmark | 3
Eastern Europe | 21
England | 30
Estonia | 2
Finland | 12
France | 8
Germany | 148
Greece | 4
Hungary | 13
Iceland | 8
India | 4
Indonesia | 15
Israel | 25
Italy | 76
Japan | 4
Korea | 1
Malaysia | 1
Malta | 2
Mexico | 1
New Zealand | 6
Norway | 29
Pakistan | 3
Poland | 57
Portugal | 3
Puerto Rico | 1
Scotland | 1
South Africa | 14
Spain | 16
Sweden | 22
Switzerland | 11
Taiwan | 36
The Netherlands | 34
USA | 118
USSR | 113

What Do They Look Like?

To make our lives miserable, a virus can infect files and boot sectors, since boot sectors are executable programs. Many more viruses are designed to infect files than to infect boot or master boot sectors, and that some boot viruses won't infect hard disks.

While boot viruses are our most common office infections, there just aren't as many species of them as there are species of file viruses. Among the boot viruses, some such as Brain will infect the hard disk, but most do.

Of all viruses, over 80% infect COM files, but only 40% infect EXE files. The structure of a COM file is much easier for a virus author to deal with, and many authors write their first virus to infect COM files only. Viruses are easier to identify when they have infected COM files, for most add a constant number of bytes to a COM file, a variable number of bytes to an EXE file. By determining how many bytes have been added to a COM file, you can use V-Base to look up the virus.

Host Information |
Number of viruses infecting EXE files | 2313
Number of viruses infecting EXE files only | 445
Number of viruses infecting COM files | 4355
Number of viruses infecting COMMAND.COM | 1513
Number of viruses infecting COM files only | 2487
Number of viruses infecting both COM & EXE files | 1868
Number of viruses infecting Floppy Boot | 461
Number of viruses infecting H.D. Boot | 363
Number of viruses infecting MBR | 417
Number of viruses for which host information is known | 5361

Note: Writing a virus that only infects COM files is probably easier than writing a virus that infects EXE files, which is easier than writing a virus that infects both.

Most file viruses found in the wild infect both COM and EXE files. Most viruses found in the wild infect the hard disk's boot sector or master boot sector, not files.

They are Small!

Viruses are very, very small -- the smallest programs we will ever have in our computers. Their diminutive size is partly because they are written in assembly language, which creates small programs, and partly because the authors do their best to escape notice. An elephant in your computer will be noticed sooner than a flea. Based on 3,551 viruses for which I analyzed size, the average size is 1,198 bytes. An awfully tiny bundle of trouble!

Virus Size
Average size of virus: | 1,198 bytes.
Minimum size of virus: | 29 bytes.
Maximum size of virus: | 15,022 bytes.
Number of viruses for which size was counted: | 3,551 bytes.

Why Do People Write Viruses?

Most folks think that the virus problem is something of a battle between themselves, as defenders of their computers, and viruses, as attackers. Sometimes I meet someone who realizes that the warfare is not with viruses, but with virus authors. Once someone asked me why a virus author would want to harm a system they had never even seen, to injure someone they had never met.

That is a good question.

The answer may be this: the warfare does not target the user. The warfare is between viruses and anti-virus products, between virus authors and anti-virus product developers. Just as in Missile Command games, the victims are those who live in the cities below, where the shrapnel lands.

There are many reasons why I know this battle is between vendors and virus authors. First, I think that many virus authors see it this way.

- For many years, I have seen viruses that targeted specific anti-virus products. For instance, the virus author known as Dark Avenger has written a number of viruses that seek programs containing the copyright notice of Vesselin Bontchev, and destroy or disable them when found. Such programs are anti-virus products, which are intended to destroy the work of Dark Avenger. Similarly, the new Peach virus targets the checksum files produced by Central Point Anti-Virus.
- A number of virus authors seem more interested in getting the attention of anti-virus product developers than in actually spreading their virus "in the field." A number of viruses seem to find their way directly to our hands and those of other researchers, without ever being seen in the field
- Many viruses contain far more code to make them difficult to analyze than they contain code that makes them hard to detect. For instance, the Whale virus is encrypted 64 layers deep. It took anti-virus product developers and researchers several man-weeks each to take this thing apart, only to find very little of interest inside this contraption. Similarly, while Dark Avenger's viruses are typically somewhat difficult to detect, many are disassembly-resistant, producing useless disassemblies of hundreds pages for source code that is only a few K in size. And the Dark Avenger's self-mutating engine is a tool that makes viruses which incorporate it more difficult for and-virus products to detect, not more lethal or effective in spreading on your computer.
- Some viruses are designed to spread using your anti-virus product as an agent, hardly a trait that will make you love your anti-virus product more. Viruses such as Frodo will infect when DOS opens a file; any scanner or checksum program which opens a file when such viruses are in memory will provide the virus with an opportunity to infect it. Your anti-virus product will play right into the hands of such a virus, if it is unable to detect it in memory and act appropriately.

It is not merely the virus author who sees this as an international game of Missile Command, targeting the anti-virus products. The developers of the product also seem to feel this way, targeting the most interesting viruses, and sometimes ignoring the shrapnel that lands on the cities below. Consider this:

- When Whale was first discovered and shared by the virus research community, everyone seemed to stop work in progress to deal with it. All products somehow need to detect Whale, even though there have been no reports of it in the US (to our knowledge), and only scattered reports elsewhere. Now that Pogue is making the rounds in the research community, the same thing seems to be happening. There is much hubbub about polymorphic viruses, which will be much ado about nothing for the next year or so.
- Anti-virus products seem to focus on scanning, a fun technology to develop if you are a marketing department, because you get to report body counts. No product seems to have shown any interest in virus removal - some can't do it at all, and the rest generally do it quite poorly. All products detect far more viruses than they remove, a commentary on the vendor's focus on the incoming missiles, rather than the shrapnel landing on the cities.

If the war is now between the virus authors and the anti-virus product developers, and the battleground is in your computer, then we certainly have an interest in the outcome of the battle. The results now seem to be clear: the virus authors have won, and continue to win, the battles. The virus authors will win the war. Here's why I think this:

- The US won the Revolution and lost in Vietnam for many reasons, but military historians know that volunteers often fight harder than paid mercenaries. A virus author is quite willing to stay up all night; some programmers working on anti-virus products go home at 5 PM.
- Military historians know there is strength in union. The virus authors are working together, the anti-virus product developers are working in isolation. The virus authors have several commercially-published books available on how to write viruses. They have a number of BBSs around the world through which they share source code, viruses, and information. The anti-virus product developers get together from time to time, but all their programmers have signed such restrictive non-disclosure agreements that there is little exchange of technology.
- Military historians also know that the size of the army affects the outcome. At the moment, there may be 300-400 virus authors at work on their projects around the world. The thousands of viruses they have created are battling a few dozen products. In your computer, any one of these viruses may be doing battle with one product or less. That one product is the work of just one to 6 programmers, on average. Very few anti-virus products are the work of more than a half dozen programmers. Because anti-virus developers work in isolation, the armies number perhaps 50 to 100 bad guys for every good guy.
- One military historian is reported to have observed that the secret to success is to "get there fustest with the mostest" Surely these two armies are distributed differently. Viruses are free; products must be paid for. Viruses are self-installing; products must be installed. Viruses run automatically; products must be deliberately run by the user. The virus is likely to get there first.
- The talent embodied in our viruses is certainly beyond that embodied in our average user. Virus authors understand the intricacies of assembly language, the CPU, the operating system, disk and file structure, the boot process. Few users can claim to have mastered a single application program.

It would be nice to say something upbeat here, but that's the way it looks: the virus authors have won the war. It's up to you to win as many of the battles as you can.

How Do Viruses Spread?

No one really knows how many viruses are out there because virus infections are under-reported. One of the reasons for under-reporting is the stigma attached to being infected with a virus -- "this happened because I've done something bad". And so most infections are not reported to anyone. In one major survey of North American corporations, we learned that by far the most common source of office infections is via diskette brought in to work from a home computer. But viruses can spread using all of the channels, both formal and informal, through which software is distributed. You can get them from service technicians, sales representatives, new computers, repaired computers, commercial shrink-wrapped software that has never been opened, and software that has been infected, returned to the dealer, re-packaged, and re-sold. The most common sources of virus infections, as reported in a Dataquest study done in late 1991, are shown below.

Source of Virus Infections |
Disk from Home | 43%
Don't Know | 29
Electronic BBS | 7
Disk from Sales Demo | 6
Disk from Repair or Service Person | 6
Disk with Shrink Wrapped Application | 3
Other Download | 2
Disk from Intercompany | 2
Disk - Purposely Planted | 1
Disk from Client | 1
Disk from School | 1
Came with PC | 1
Disk from Consultant | 1
Disk from LAN Manager or Supervisor | 1

I don't propose that you stop taking work home. If you have a home PC, it is probably not at risk of infection from software brought home from work, but rather from disks that your son or daughter may bring home from school, have shared with their friends, etc. Use your home PC to do work for your company, if that is consistent with corporate policy. But scan your machine before using it, if you share the computer with other family members who might not be so thoughtful.

Because of the variety of ways that a virus can get into your machine, it is important for you to begin feeling a bit concerned about every new diskette you put in your machine. In our office, our policy is to never boot with an unknown floppy, and never run a program from an untrusted source without first checking it for viruses.

Piracy and Computer Viruses

Software piracy has never provoked the kind of emotion that child abduction or grand theft auto has. After all, when a child or car is taken, no copy of it is left behind. The owner is deprived.

Piracy is different. When I give you a copy of my favorite program, I seem to do you a favor. You appreciate the favor, and reciprocate in some way. We both come out ahead There do not seem to be any victims. But there are.

Piracy refers to some violation of copyright law or license agreement, in which a copy that might have been sold by a vendor is, instead, given freely by another patty, depriving the vendor of some revenue.

Since many users are not particularly fond of vendors, such deprivation does not seem to be one of life's greatest tragedies. Vendors get what they deserve, say some users. Their software is overpriced. Their support is lacking. I wouldn't have bought it anyway. I don't use it very often. If I really get to using it a lot, I'D buy my own copy. We've heard it many times. We've thought it. We've said it.

I will not argue here that piracy is impoverishing American vendors. It is not piracy but the economy that is killing software vendors in this country today. And even if piracy were hurting vendors deeply, most users wouldn't care. Such loss does not seem to have any personal consequence for users.

I will not argue that if your firm is using pirated software, tomorrow's mail might contain a letter from the Software Publishers Association. Not to be confused with the Publishers Clearinghouse, this group won't be sending you any million dollar checks. Instead you might learn that you are about to lose tens of thousands of dollars in penalties they will levy (and your boss and stockholders will pay) in an out-of-court settlement. Sure, this is a good threat, but SPA is still in business because pirates never think that what they are doing is very wrong. A little wrong, maybe. But not very wrong.

What I will argue is that piracy causes problems that dc affect you. That there are, indeed, some good reasons why you should Pay for what you use.

I have two arguments against piracy, and I'll tell you both. Then you can decide if there is enough reason to start paying for software.

My first argument deals with the virus problem, a problem that has an immediate impact on you. The problem is that viruses travel through the same channels that other kinds of software travel. Pirated software, being software that has been passed from one machine to another, is software that has had a great opportunity to acquire a virus or two. The more machines a program has been in, the greater its chance of being infected. The more desirable a program, the more machines it has a chance of being in. This is why we warn our users to be careful of game software. Because it is fun, it is likely to be pirated. Because it is pirated, it is likely to be infected. But our warning should not be about games. It should be about piracy or viruses or both.

Piracy is not a problem when people do not respect the notion of intellectual property. In the old Soviet Union, there was little personal ownership of anything, including an idea Without such a concept of property ownership, we could hardly expect much clamor about piracy or trademark infringement. The Soviet Union, as a consequence, has one of the highest infection rates in the world. Soviets are joined by all of Asia and by Eastern Europe, which also lack much in the way of property, intellectual property, or laws to protect intellectual property.

In China, for instance, the only legislation that protects software is just one year old. Developed in apparent response to US pressure, it protects only new software, and only if registered in 30 days. Registration is not necessarily a good idea. According to the Wall Street Journal (June 17, 1991, p. 7) China's bureaucracy "employs a strategy of poaching technology from overseas. Whether the product is farm chemicals, machine tools, medicines, or software, China's central government ministries all have departments designated to obtain foreign technology at no cost to China." With a whole infrastructure within the ministries set up to copy things, registering your software with the government of China sounds like a great opportunity for them to acquire your technology without leaving the office. Legislation alone cannot change a public morality or protect our software industry. Consumers and users must revise their thinking and behavior. What are the consequences of this pervasive piracy? Our chance of getting an infection in a computer in the US is perhaps one infection per 400 computers per year in 1992. In Asia, it is more like one infection per computer per week.

The worldwide variation in infection rates corresponds surprisingly well with the worldwide variation in piracy. But there are local variations that are also of interest. Consider our hotbeds of computer viruses: high schools and colleges. It is in these settings where piracy is also at its highest.

Or consider who in your office experienced the most recent infection. I wasn't there, I don't know. But I wouldn't be surprised if it was someone who didn't think it was very wrong to borrow software, to try it a little bit before paying for it, who was always curious about how new software works.

I told you I had two arguments against software piracy. My second argument concerns what piracy does to the software industry long-term On this point, let me tell you three stories.

Story #1: I once ran a company named Starware. Back in 1982-1983, we were one of Washington DC's first places (other than the IBM Product Centers) where you could buy an IBM PC. We were there before Computerland. There wasn't much graphics software available for the PC, so we wrote The Draftsman, a graphics program that could do pie, bar, line and scatterplot charts, text charts, mix them together on the page, add illustrations, and put them all together in a slideshow. The F1 key pulled up context-sensitive help, and you could print or plot your work We grossed $50,000 the first month we sold it. At $200 a pop, it was priced fairly, and did just fine until our little business folded. I turned our treasure into shareware, inviting those who found it valuable to send a check for $25. In the last 10 years, as a shareware author, I've made nearly $200 - the price of one copy when we sold it commercially.

I don't know how other shareware authors do, but I know that many don't pay the rent with their work and most never release a second product I think that the shareware industry has been badly crippled by user attitudes. Users think that shareware is free. They don't have the foggiest idea of why a shareware author would write the programs. I've had faxes from Australia, asking if I have any new versions that work with the Blimpo 2000 color-fax-pancake maker. I've had calls at midnight asking for hard copies of the manuals. I've had everything but checks. These inquiries prove that people are copying its using it, and not paying for it.

Story #2: Starware released MathDrills, a program to teach the multiplication tables. It also taught division, addition, and subtraction. It did it with the only technique that works: endless drill, ample reward It kept score. It made little tunes. It was fun. My son learned the times tables with it one weekend I sold hundreds of individual copies through the IBM Product Centers. I gave hundreds of "evaluation copies" to school districts. I never received an order from one school. How could it sell so well in the stores, yet so badly by mail to school systems? You might quip that the name was the best part, and anyone who had a chance to try it would have enough sense not to buy it. I'm not so sure. My son liked it.

In my old age, I've come to think that the biggest pirates in our land share two things in common: high need, low budget. They are teenagers and teachers. Neither seems disposed to pay for software. And as a result, there is effectively no educational software industry in the world

Story #3: I was in Kuala Lumpur, standing in a computer store, admiring the empty shelves. You don't need shelving in Asian computer stores, because there is nothing you can put on them that you can sell. Software in Asia sells one or two copies the week it comes out and any other copies gather dust. Do I exaggerate? Not according to everyone I talked to. In the world of viruses in Asia, one of the best selling products is PC<illin. It is so thoroughly copy protected that it requires a dongle(and is made by a firm that began in the dongle business.) But better selling than PC-Cillin is a product merely named "PC-Cillin Compatible." This fine product bears a marvelous resemblance to PC-Cillin, except that it requires a cheap card, rather than a dongle, and sells for half the price. Piracy? Grand Larceny!

It isn't just software that takes a bruising in Asia. Firmware (software in hardware) can be reverse engineered and brought to market over the weekend. I know. A friend in Thailand is in that line of work And what has been the net effect of this? There is nearly no software industry in Asia There is nearly no software industry in the Soviet Union. There is nearly no software industry in the Eastern Block countries. Everywhere in the world where piracy flourishes, software industries wither and die.

America needs a software industry. So does any country with dreams of a growing economy and world leadership. Or any country that dreams that one day, computers will make lives more productive and more pleasant.

Maybe the SPA will come get the pirates. Maybe it will be the viruses. Maybe it will be the collapse of the software industry whose products they so enjoy. My wife has a phrase for all this. She says "what goes around comes around" Maybe it will.

Is it a Problem?

Aren't Viruses Rare?

Viruses were once a very minor security problem. Your probability of infection was too low to justify the devotion of too many resources to the ;problem. But today the probability of infection has risen to an astonishing level. Given the certainty that your organization will experience an infection in the next six months, and given the likelihood that systems lacking virusfree backups will lose important programs and perhaps data files, some intelligent action for prevention and detection is now required.

While the best defense against viruses is prevention, the cost of complete ;prevention is probably excessive. Consequently, your best use of your ;antivirus budget would be to save some funds for recovery.

Your exact probability of being infected is a function of several factors: the number of viruses appearing at your door, and the measures you have in place for preventing their entry through that door. The number "at the door" is determined by the frequency with which new software is brought into your organization (by disk or modem) and the increasing probability that this software is virusinfected. The measures in place are established by policy and procedure.

The magnitude of the threat is difficult to estimate, given the extent of underreporting. Victims of crimes, like the rest of us, wish to believe in a "just world", in which good things happen to good people, bad things happen to bad people. Because a virus infection is definitely a bad thing, victims often feel some shame and guilt. No one feels pride when they experience an infection, no one seems to want to talk about it. But it is increasingly clear that computer viruses are posing a new, grave threat to safe computing. You can do something to help make computing safe again. We're all counting on you.

We'll try to answer the "commonness" question with two sets of numbers. The first is the result of surveying 16 U.S. corporate computer security experts. Combined, they had information about viruses for over 60,000 PCs. We asked them how many of those PCs were infected with a virus in the last 12 months. The table shows their answers. Just over one in ten office computers in North America seems to have been infected in 1992.

PC's Infected with a Virus in a 12 Month Period, 1992
Infected | 11%
Not Infected | 89%

Does this percentage match your own experience? If users are not punished for reporting an infection, and if they know who to call when they find an infection, then your own statistics on infection may be fairly accurate. If they are higher than 11% for 1992, then you might consider your organization basically "high risk". If they are lower, then you are among the "low risk" organizations. Of course, .00001% might still be considered too high.

The second answer comes from the 1,811 viruses analyzed for prevalence in the May 1993 version of V-Base. Of these viruses, you are unlikely to come across 96% of them.

Prevalence of Viruses
Very rare. Perhaps never found in the wild | 796
Almost never found in the wild | 428
Rarely found in the wild | 1042
Sometimes found in the wild | 197
Among the most common viruses | 68

Do All Viruses Cause Damage?

I frequently get calls from people who have just discovered a virus on a floppy or on their hard disk, and the first thing they want to know is: "What damage does this virus do?" We can answer this question with three graphs.

A survey of our BBS callers suggests that most infections are not particularly damaging. The table shows the caller's rating of their most recent infection. As users become more adept at virus removal, and detect viruses earlier, we can expect the overall damage caused by viruses to decrease.

Survey of BBS Callers: What Damage Did the Virus Do?
Little/None a Nuisance | 69%
Moderate, little; no lost data | 15
Great Deal plus Lost Data | 11
Don't Know | 5

The table below shows what effect an infection has on a workgroup -- mostly lost productivity, but a large number of corrupted files and lost data.

Effects a Virus Infection Has on a Group
Loss of Productivity | 52%
Screen Message, Interference, Lockup | 41
Corrupted Files | 38
Lost Data | 30
Unreliable Applications | 24
System Crash | 23
Loss of Confidence | 20
Don't Know | 9
Corrupted E-Mail | 4
Threat of Job Loss | 3

V-Base rates viruses for "damage potential". Highly damaging viruses overwrite critical areas, such as the FAT, the root, or other sectors. Damage ratings are based solely on severity of damage, not frequency or probability. Thus Michelangelo is rated as causing substantial damage, even though it only does this once a year. Of the 1,001 virus analyses that include damage ratings, 38% have substantial damage potential.

Virus Damage Potential
None | 15
Insignificant | 178
Minor | 431
Substantial | 377

Aren't there any "Good" Viruses?

Definers disagree, but most would say that a computer virus is a computer program that makes copies of itself by inserting itself into other programs.

By its design, if not its definition, the virus modifies your software without your knowledge or approval. Often, but not always, the virus damages some aspect of your system or interferes with your work. Often, but not always, the virus causes unintended damage due to bug in it or incompatibilities with your system.

Is the virus a bad thing? Some argue that there can be such a thing as a "good virus." I think they are wrong. Here's why.

Many argue that there is nothing illegal about writing, selling, or distributing viruses. They may be incorrect. Consider our license agreements for our software. Most indicate that you may not make alterations to the software you have purchased; most require that if alterations are made, your license is no longer in effect, and you must destroy all copies you have. The virus violates this agreement.

We also have the Computer Security Act of 1987, which makes it a crime to damage the information in government computers. The virus is likely to do just this. No virus contains safeguards to prevent itself from entering government systems, and consequently the government has been the victim of thousands of infections. We must conclude that virus authors knowingly write code that will ultimately enter and damage government systems.

And we have a Bill of Rights which gives you the right of self-determination. The virus takes this right away, and determines things for you.

As computer users, we value the control we have over our computers. Computer users enjoy their computers when they are predictable, when a known action at the keyboard produces a predictable reaction on the screen and drives, and when the only events in the machine are those of our own doing. The virus takes our control away, takes that control for itself. With a virus, our computer can no longer be trusted to do what we expect.

From an economic standpoint, viruses must be opposed. Every day, an increasing fraction of our GNP comes from the work done by computers, as we move to an information society. The virus stands as an enemy of the economy, threatening to take us back to the Stone Age of pads and pens. The effects on the GNP include direct effects, when the virus damages our information, and indirect effects, when the virus problem means that we must buy anti-virus products, read and learn about viruses, and take anti-virus precautions. The cost of 50 million PC users spending one minute each day scanning for viruses comes to $200 million per year, if the average user earns just $10 per hour. If scanning time averages five minutes per day, and wages average $20 per hour, then the virus bill comes to $2 billion per year. Add to this the cost of 50 million anti-virus products which we hope these 50 million users will rush out and purchase (so the virus is stopped at their machine, before it gets to ours) at an average cost of perhaps $30 each with site licenses: $1.5 billion. Shall I calculate the cost of installing 50 million products? Reading 50 million manuals? And remember that this cost is per year, for last year's scanner won't give you much protection this year!

Many of the costs are difficult to calculate in dollars. But even if we didn't have these social costs to reckon with, consider the problem of removing a virus. If a virus gets into your network, and it must be brought down for a few days while you check every single diskette in the building, what is that cost? Some businesses could think about going under if they couldn't function for a few days. Others will merely sink farther into debt

While these costs are starting to look like the national bill for health care, we must remember that the computer health care bill is avoidable. Computer viruses are not "natural" problems. They are not evolving life forms. They are deliberately written by programmers.

Software developers must be enraged by the virus problem. No longer can users trust software downloaded from bulletin boards or purchased in shrink wrap or delivered by sales representatives. Viruses are coming from everywhere, and no distribution channel is safe any longer.

Even if no virus ever did any intentional damage, it is hard to imagine a virus that never did unintended damage. Much of the damage caused by common viruses appears to be the result of incompatibility between virus and machine. Early authors, for instance, could not foresee the advent of disk drives with capacities over 360K. Virus authors are not God. They do not know what computers we will own tomorrow, and cannot write for those computers. What they write today is likely to damage us tomorrow.

How can we permit anyone to stand on a soapbox and advocate our destruction? How can we grant them space in the pages of our publications to announce a reward for "clever" viruses? To argue the case that a virus can be good? It is time we all said "enough." If your reading of the law is not like mine, and you think that writing viruses is legal, then let's change the law. Nothing this destructive should be legal.

Several years ago, I was asked by a television interviewer what I would do if I found a confirmed virus author sitting on the sofa next to me. I replied that I would "probably break his face." That was the sound bite that made the evening news. I don't regret my policy on such faces. I hope you will adopt my policy as your own.

The Dollar Costs of Viruses

To make your case for purchasing anti-virus software and implementing a virus prevention program, you must justify the costs. The costs of a virus are influenced by factors such as the strain involved (some cause more damage than others), the delay in detection (longer delays mean more widespread infection), the involvement of a network (in a networked office where the server is unprotected, a virus may spread to all logged in nodes in a few minutes), your experience in removing viruses (your first experience will be the most expensive), and other factors. Many infections will cost under $2,000 in labor costs in eradicating the virus, though sometimes costs exceed $100,000. One Federal agency reported that a virus cost them $25,000 per hour, for a total of one week. That works out to a million dollars!

The table below shows the dollar costs of virus infections, from a study by Dataquest in late 1991 -- one third of virus infections cost up to $2000; some cost over $100,000.

Costs of a Virus Infection
$0 - $1,999 | 31%
$2,000 - $9,999 | 20
$10,000 - $99,999 | 16
> $100,000 | 7
Don't Know | 27

The table below shows the dollar costs to detect and clean up virus infections at one enterprise from 1990 through 1991. The curve makes a clear point -- the cost of the first infections are the highest.

Costs Of Virus Infections Decrease Over Time
Aug. 07, 1990 | $187,173
Sep. 19, 90 | $160
Oct. 01, 90 | $50
Feb. 21, 91 | $0
Feb. 22, 91 | $0
Mar. 01, 91 | $450
Mar. 04, 91 | $0
May 02, 91 | $50
May 14, 91 | $50
May 29, 91 | $0
Jun. 20, 91 | $0
Jun. 25, 91 | $160
Jul. 15, 91 | $25
Aug. 12, 91 | $448
Aug. 12, 91 | $96
Aug. 15, 91 | $240

Does Your Computer Have AIDS?

"Your computer has AIDS" is the message displayed by the AIDS computer virus. Not very funny. The epidemic that is beginning to sweep our computers is less devastating, and less consequential, than the biological epidemics that have swept this planet. Unfortunately, this does not weaken the metaphor. The lessons of biological epidemiology should serve us in the field of artificial, unwanted life: computer virus epidemiology.

One stark lesson may come from our rediscovery of the Pollyanna Principle. Once, as a psychologist, I wrote a book of that title. Its premise, as I recall was that humans have a special skill in seeing the silver lining of every cloud, of putting on a happy face, of finding some good in every tragedy that afflicts them. Even Job didn't pack it in.

The problem with Pollyanna was that she made a rotten forecaster. She wouldn't have wanted to believe in global warming, holes in the ozone layer, the end of the Spotted Owl . And she wouldn' t have wanted to believe in viruses. When she was forced to face the facts, she would have wanted to believe that this was just another problem for computer science to tackle, and everything would work out.

We are all Pollyannas. Consider how we've been Pollyannas about the (biological) AIDS epidemic. An AP wirestory recently reported that a "grim new vision of the world AIDS epidemic predicts that more than 25 million people will have the disease by the end of the decade, and up to 120 million will be infected" Consider these points that come from a study, released by Harvard University researchers as an 800 page book, "AIDS in the World 1992":

Recognition of the problem comes too late. When the AIDS epidemic was first recognized in 1981, an estimated 100,000 people around the world were already infected. If we continue to delay in recognizing the computer virus problem, hundreds of gigabytes of information will be lost, and hundreds of thousands of computers will be infected. Late recognition of a problem means less time available to consider and implement solutions.

Early pessimism proves optimistic. The new study predicts that infections will be far greater than the recent projections of the World Health Organization, which predicted that the problem will be far greater than previous predictions.

This sounds like our projections for global warming, for the ozone hole, for the virus problem. Why can't we face unpleasant predictions earlier? In 1991, the virus problem was worse than anyone had imagined it would be in 1990. Today the problem has gotten worse than anyone imagined it would be in any prior year. Let's get serious about projections, and stop fooling around with wishful thinking.

Problems are unstable. According to the report, HIV and AIDS are not increasing at a steady rate. They are growing geometrically. In 1981, there were an estimated 100,000 cases of HIV worldwide. In 1992, the number had reached 2.6 million. For this 11 year period, the number doubled 4.5 times, a doubling rate of every 29 months. But the study forecasts that the number of HIV cases in the year 2000 will be between 48 million and 120 million. Assuming that the result is somewhere in between 48 and 120 million, for this eight year period, the problem will double about 8 times, a doubling rate of every 19 months. The doubling rate is not constant, but growing worse.

For a time, IBM researchers suggested that the rate at which the virus incidents were increasing could best be described as a straight line. Those who understand Catastrophe Theory know that straight lines approximate very little in the world, especially things biological. IBM does understand geometric progression when it comes to the number of computer viruses, concluding that the number of different viruses is doubling about every 8.5 months.

Local problems become global problems. In 1981, when HIV was first discovered by the Western world, 100,000 in the Third World were already afflicted. The study predicts that by the turn of the century, 42% of AIDS infections will be in Asia, 31% in sub-Saharan Africa

The computer virus epidemic is also not uniformly distributed. Asia, the old Soviet Union, and Eastern Europe all seem to have more than their fair share of viruses. But what you don't know can hurt you. Without attention, HIV has become a global menace. So has the computer virus problem.

Global problems require global solutions. The report contends that a new global strategy is needed to stop the AIDS epidemic, or at least slow it down.

The same might be said of the computer virus problem, which knows no political boundaries.

Viruses, the Law, and Morality

What is the effect of talking about the virus problem? Opinions differ. One view is that only with a full discussion of the problem can those who should respond be prepared for a proper response. Others feel that a public discussion serves to attract attention to the problem, and to generate more interest in it on the part of more trouble makers.

We have heard these arguments in various forms.

- NSA, NCSC, the FBI, Secret Service, CIA, and other organizations with an interest in computer security do not like to talk about what they know, on the grounds that it would expose known security holes, leaving systems vulnerable. Security experts, on the other hand, protest that they are unable to benefit from the wisdom of these agencies in making their systems more secure if these agencies do not provide them with some assistance.
- Many vendors encrypt the scan strings in their anti-virus products, so that virus authors have more trouble modifying existing viruses so that the scanner does not detect them. But users then complain that their scanner won't accept encrypted or unencrypted scan strings from other sources.
- Security BBSs sometimes come under fire when they distribute information normally available only through the underground. Should the COMSEC BBS in San Francisco, for instance, carry "40HEX", an underground publication including virus disassemblies? Some argue that it should, for the information may be of value to security practitioners, and knowledge of the existence of such information may also be valuable. Some argue no, that security experts have no need to see a virus disassembly, nor does anyone else.
- We have heard stories of folks who felt that the best way to deal with the virus problem was to help folks develop first-hand experience with viruses, and so made viruses available to any who seemed "qualified" and interested. Some of these folks have been anti-virus vendors, whose qualification process meant establishing that the recipient was a potential purchaser, and distributed the viruses at no charge. Others established that the recipient was apparently interested in performing some virus research, thus qualifying the recipient for "researcher" status, and distributing the viruses for a small "handling fee." We indeed live in a world of gray that color monitors have done nothing to sharpen. What is the difference between giving a virus to someone and charging a handling fee? What is the difference between giving a virus to a stranger and giving a virus to a friend, who will in turn give it to a stranger?

In this office, I try to see in terms of black and white, rather than gray. We'd like to say that no one should give a virus to anyone for any reason. But I'd also like to say that good guy virus researchers should have access to viruses. The problem is that good guys don't wear white hats. Among virus researchers are a large number of seemingly gray individuals-those who have clearly done both good and evil, those who seem to be good yet don't beget our trust, those who have earned our trust and then seem to betray us.

This grayness is clear to users. One week, I asked my class if anyone in the room trusted anti-virus vendors. Not one would raise their hand. I asked if anyone believed the back of the anti-virus product box. None did. Instead, I am asked by classes every week if vendors write viruses.

I must say that this is an improvement over two years ago, when classes believed that viruses were somewhat mythical beings invented by vendors to scare users into buying products. Many of the public saw through the vendor-inspired hysteria of Michelangelo last March. Garrick Utley asked me on CBS Evening News if I thought this Michelangelo thing was the result of profiteering. I replied that I believed that while there had been much profit-taking, vendors had generally been well-behaved and tried to present the truth.

There were so many exceptions to this claim, however, that I think I may have lied to TV viewers. With the biggest anti-virus vendors in the US each making more than a million in profits in that month, it is certainly the sort of question that bears close examination.

What will we do with all the grayness in our lives? Will we take a stand anywhere? I think we should, whenever we feel strongly. I think that if we can begin to take a stand on some of the moral issues related to viruses, that some of the grayness will recede, and other issues will become more clear.

I believe that it is wrong to write a virus, particularly one which is not easily detected and/or includes any destructive code within it. I am not sure that all viruses are equally "bad". For instance, a virus that provides obvious evidence of its presence (such as Flip or Devils Dance) or a virus that is written to carefully avoid a user's data (such as Brain or Farm) is somehow less bad than a virus that employs stealth techniques, targets anti-virus products or user files, and contains destructive code. Nevertheless, I believe that there are no "good" viruses, and thus all viruses are bad, and that writing a virus, therefore, is a bad thing .

If that is true, then you can understand my feelings about those who would teach how to write a virus. Teaching how to write a virus is possibly worse than writing one directly, for from each teacher can come dozens or thousands of students busy writing viruses. Books about how to write a virus, whether well-done or poorly done, are as bad as their subject matter, and the authors are as bad as their books.

If vi}uses are bad, then the distribution of them is too. Thus the BBS that distributes viruses, the vendor who shares them with a potential customer, or the teenager who offers them to friends or strangers, for free or for a fee, is bad.

What isn't clear is whether my notions of good and bad can somehow account for why I think it is good for me to share a new virus I have received with Fridrik Skulason or Vesselin Bontchev or Alan Solomon. I think I must be guided, somehow, by the notion that none of those I call good would call this bad. I am guided, I think, by the notion that they agree with me, more or less, in what I've said so far in this column, and that they would not write a virus, place a virus in another's computer, run a virus BBS, sell a virus to the public, give a virus to a customer, write a book about how to write viruses, etc. Instead, they have dedicated their lives to the task of destroying viruses and protecting users. The virus author is dedicated to the opposite set of tasks.

In my black and white world, you are either part of my gang, or my gang is going to get you. If you run a virus BBS, we will shut you down. If you write a book about how to write viruses, we will black list and boycott you. If you are a vendor who gives viruses to customers, we hope to somehow repay you for this misdeeds

But anyone who notices moral issues finds themselves frequently with one morality interfering with another. Consider how much we value freedom of speech, then rethink the problem of writing a book about how to write a virus.

How much do we value freedom of speech? How much do we value the information in our computers? How much do we value being in control of our computers? I recently had an opportunity to debate Mark Ludwig, the author of a nasty little book which explains how to write a computer virus. I'm not sure who won the debate, since the audience was already on my side, Mr. Ludwig hardly fought back, and surely did not present any compelling arguments for writing such books.

I've read the book, as you probably will. I think it is well-written, and certainly useful to anyone who wants to write a virus.

During the debate, Mr. Ludwig suggested that the book might be of help to those who wish to understand viruses. I'm not sure this is the case, because it doesn't talk about any of those now roaming the earth. The Ludwig viruses use a variety of interesting techniques, which, while not novel, are not necessarily those used by the common viruses, either. Understand everything in the book, and you still won't know a scrap about Jerusalem or Stoned.

Mr. Ludwig also contended that the book would be helpful to managers who need to defend against viruses. Hardly. There is no explanation provided as to how to defend against a virus, and he suggests a low-level destructive format of your hard disk as a means of removing one of the file viruses presented!

It seems to us that Mr. Ludwig's motives are revolutionary: "It is inevitable that these books will offend some people. In fact, I hope they do... Our leaders... are busy trying to centralize all power into their own hands... Truth seekers and wise men have been persecuted by powerful idiots in every age..." He would seem to be calling for the violent overthrow of the computer using establishment. For instance, on page 51, he writes "one could write a routine called DESTROY, which would wreak all kinds of havoc, and then code it in like this... if one wanted to do damage only after a successful infection took place, or like this... if one wanted the damage to always take place, no matter what, or like this... ii one wanted damage to occur only in the event that the virus did not find a file to infect, etc., etc." I stand, in my old age, among the counter-revolutionaries.

Mr. Ludwig's book raises the question of how much evil we may say in print or sell on disk. For a small fee he will send you a disk with all the viruses in his book-a great convenience to virus authors who don't have the time to read his book, and just want to get busy infecting the office. Thus Ludwig also raises the question of whether it should be legal to create or sell computer viruses. We think not, and in this issue you will find model legislation that would make such practices unlawful.

I am inclined to think that your freedom to swing your fist ends at my nose. Freedom of speech should not imperil our data any more than our data should imperil your free speech.

The world has had a history of book burning and suppression. None of us has fond memories of Senator McCarthy or the Nazis. What we have not yet had is a history of data destruction. In your computer, Mr. Ludwig's viruses perform the electronic equivalent of book burning. While he shouldn't want us to burn his book (until we've paid for it), we shouldn't feel kindly when his viruses bum our electronic information.

I hope that Mr. Ludwig will stop shipping his current book. I hope Mr. Ludwig will not write his other promised books on viruses, one of which "will probe military strategies and real-life attacks, and dig into the development of viral weapon systems, defeating anti-viral defenses, etc." I hope he will join our side, with a useful book on how to defeat viruses. I hope that Mr. Ludwig will contribute some of the proceeds from the income on his first book to a User Defense Fund that will be used to help develop anti-virus legislation, prosecute virus authors, and develop public domain anti-virus products.

If my hopes are not fulfilled, then we will have to do something more. We already have enough problems in our computers. There is no need to teach folks how to create more.