Q: How do viruses enter a computer?

A: There are three main avenues:

• Co-workers via LAN Server
• Diskette in Drive A
• Telephone via Modem to BBS

Q: How are diskettes exposed to viruses in the first place?

A: It starts with a computer, somewhere, that's unknowingly contaminated (called a "host computer"). Each diskette placed in its drive A can innocently become a "host" infected diskette that later can foul every other computer in which it's used. LAN and modem connections are other ways viruses can be spread from the host computer without the user realizing it until it's too late. Some experts urge caution regarding diskettes used in computers at public libraries, universities and even high schools or junior highs. Because people who like to experiment with computers and swap diskettes often congregate in those places, the chances of contracting a computer virus are greater there. Also risky are the computers of co-workers, repair technicians, friends or strangers who like to share software applications, data or games. Some of those programs are honestly paid for, some are free or low-cost shareware and some are pirated illegally which is short-sighted because it cheats their producers of revenue needed to create more programs. Don't transfer questionable files from risky computers or people unless you can check for viruses (see Anti-Virus Scanners) or try them out on a computer not connected to your LAN. When you're away from your office for long periods, it's important to protect your computer so others can't innocently infect it without your knowledge. Turn it off. Lock it up if there is a keyed lock on the chassis. Also use the password system, change your password often, and don't choose passwords a stranger could rather easily guess. Another potential source of infected diskettes is the store. When you buy new software applications on diskettes, or a new box of data diskettes, you can't tell if they were previously bought, tried in an infected computer, and returned for a refund or exchange. In a hurry, some stores do not scan all returns for viruses. They shrink-wrap the packages in their back room and re-stock them. If the next buyers wind up with computer viruses, they mistakenly blame the diskette factory. However, most diskette plants have elaborate precautions and tests against viruses. Leading manufacturers like 3M are starting to apply a tamper-evident strip at the factory leading manufacturers also place a unique tamper-evident strip around their package shrink-wrapping so customers can tell they're getting fresh diskettes. Look for it, it's worth it to buy well-known brands of software applications and data disks from trusted stores. Before using, scan for viruses or try out the products on a computer isolated from your LAN.

Q: Where do viruses hide on a computer hard disk or diskette?

A: Viruses move right in on host programs, co-mingling their computer code. When the program is opened, the virus reproduces and sends a clone out hunting for a new host program to conquer. At some point, the virus may also do its dirty work.

Boot-sector Infecting Viruses

Many viruses attach themselves to a small program in a special "boot sector" area of hard disks and diskettes (even if the diskette isn't designed to boot the computer). Programs that help run the computer operating system are kept there.

• Infection A boot-sector virus can enter the boot sector or partition table of the hard disk if the computer is booted from an infected diskette.
• Replication When the computer is booted a second time from the infected hard disk, the virus is loaded into memory. There it reproduces itself any time the computer accesses a diskette sitting in drive A.
• Activation Sooner or later, when the user unknowingly takes a specific action or a computer condition or date is reached, the virus in memory activates. It may be merely a nuisance. Or it may be seriously corrupting or overwriting data files, erasing the hard disk, or scrambling vital tables or directories so badly that even though the data files are unharmed they might as well be destroyed because they can no longer be found by the computer.

File-infecting Viruses

• Infection When a computer accesses an infected program, the virus can enter other executable files on the hard disk or diskettes. Or the virus may settle down in the memory (become memory resident).
• Replication A file-infecting virus replicates and spreads to other executable files when the program it is attached to is run. If in memory, the virus can replicate at random and spread often to other executable files.
• Activation Sooner or later, the proper condition is reached and the virus sets off its destruction, similar to boot sector viruses.

A: No, with knowledge and care you can reduce your chances of a virus infection. Let's start with an understanding of how your computer boots. When power is turned on, most IBM-compatible computers are instructed to look first to any diskette in drive A for booting instructions before looking on the hard disk. Do not leave any diskette in drive A of an IBM-compatible computer either when you boot the computer or shut it down (if you forget, the diskette will be accessed when you next boot the system). Most Macintosh computers don't have that risk at startup. Macs eject any diskette in drive A and access the hard disk when the user tries to boot the computer. You would have to push the diskette in again to boot it that way. On IBM-compatible computers, merely placing a diskette in drive A of an already booted machine doesn't transfer files unless you instruct it to. But Macs again work differently. Do not place a suspicious diskette in drive A of an already booted Mac. It automatically executes the desktop file on the diskette in such a way that it could infect the hard disk without you giving it any instructions.

Q: Are There Any Other Virus Methods?

A: Another popular nest for viruses in most computers is the partition table area which manages the division of a large hard disk into more convenient drive C and drive D, for example. This area also is loaded into memory when the computer boots, setting free any viruses. Still others hit the links, the File Allocation Tables on the hard disk, which are so important that computer designers include two of them. In one stroke, viruses there can link with and infect every file on the hard disk. To avoid capture, some viruses hide out in the computer's random-access memory (they're "memory resident") and snare executable programs passing through. A technique of other viruses is to randomly change their appearance or habits every time they reproduce (they're known as "self encrypting" or polymorphic). Still others are so elusive they're called Stealth viruses. They can make directories and messages on your screen look normal while behind the scenes the viruses are causing a massacre.

Q: Can a specific virus contaminate every kind of computer?

A: No, each virus must be written for a particular type of computer operating system such as DOS/IBM-compatible or Apple/Macintosh.

Go To | Evading a Virus | How Viruses Work |

Copyright 1996 Imation. All rights reserved.