A brief history of PC viruses

By Dr Alan Solomon, S&S International


1986-1987 - the prologue

It all started in 1986. Basit and Amjad realised that the boot
sector of a floppy diskette contained executable code, and this
code is run whenever you start up the computer with a diskette in
drive A. They realised that they could replace this code with
their own program, that this could be a memory resident program,
and that it could install a copy of itself on each floppy
diskette that is accessed in any drive. The program copied itself
- they called it a virus. But it only infected 360 kb floppy
disks.

In 1987, the University of Delaware realised that they had this
virus, when they started seeing the label " (c) Brain" on floppy
diskettes. That's all it did - copy itself, and put a volume
label on diskettes.

Meanwhile, also in 1986, a programmer called Ralf Burger realised
that a file could be made to copy itself, by attaching a copy of
itself to other files. He wrote a demonstration of this effect,
which he called VIRDEM. He distributed it at the Chaos Computer
Club conference that December, where the theme was viruses.
VIRDEM would infect any COM file; again the payload was pretty
harmless.

This attracted so much interest, that he was asked to write a
book. Ralf hadn't thought of boot sector viruses like Brain, so
his book doesn't even mention them. But by then, someone had
started spreading a virus, in Vienna.

In 1987, Franz Swoboda became aware that a virus was being spread
in a program called Charlie. He called it the Charlie virus. He
made lots of noise about the virus (and got badly bitten as a
result). At this point, there are two versions of the story -
Burger claims that he got a copy of this virus from Swoboda, but
Swoboda denies this. In any case, Burger obtained a copy, and
gave it to Berdt Fix, who disassembled it (this was the first
time anyone had disassembled a virus). Burger included the
disassembly in his book, after patching out a couple of areas to
make it less infectious and changing the payload. The normal
payload of Vienna is to cause one file in eight to reboot the
computer (the virus patches the first five bytes of the code);
Burger (or maybe Fix) replaced this reboot code with five spaces.
The effect was that patched files hung the computer, instead of
rebooting. This isn't really an improvement.

Meanwhile, in the US, Fred Cohen had completed his doctoral
dissertation, which was on computer viruses. Dr Cohen proved that
you cannot write a program that can, with 100% certainty, look at
a file and decide whether it is a virus. Of course, no one ever
thought that you could, but Cohen made good use of an existing
mathematical theorem and earned a doctorate. He also did some
experiments; he released a virus on a system, and discovered that
it travelled further and faster than anyone had expected.

In 1987, Cohen was at Lehigh, as was Ken van Wyk. So was the
author of the Lehigh virus. Lehigh was an extremely unsuccessful
virus - it never managed to spread outside its home university,
because it could only infect COMMAND.COM and did a lot of damage
to its host after only four replications. One of the rules of the
virus is that a virus that quickly damages it host, cannot
survive. However, the Lehigh virus got a lot of publicity, and
led to van Wyk setting up the Virus-L newsgroup on Usenet. Lehigh
was nasty. After four replications, it did an overwrite on the
disk, hitting most of the File Allocation Table. But a virus that
only infects COMMAND.COM, isn't very infectious.

Meanwhile, in Tel Aviv, Israel (some say in Italy), another
programmer was experimenting. His first virus was called Suriv-01
(virus spelled backwards). It was a memory resident virus, but it
could infect any COM file, whereas Lehigh could only infect
COMMAND.COM. This is a much better infection strategy than the
non-TSR strategy used by Vienna, as it leads to files on all
drives and all directories being infected. His second virus was
called Suriv-02, and
that could infect only EXE files, but it was the first EXE
infector in the world. His third attempt was called Suriv-03, and
it could handle COM and EXE files. His fourth effort escaped into
the world, and became known as Jerusalem virus. Every Friday
13th, instead of infecting files that are run, it deletes them.
but Friday 13t are not common, so the virus is pretty
inconspicuous, most of the time. It avoids infecting COMMAND.COM,
because in those days, many people believed that this was the
file to watch (see Lehigh).

It looks as if it escaped rather than was released, because it
plainly was not ready for release. The author decided to change
the way that the virus detected itself in EXE files, and had made
part of that change. There is redundant code from the Suriv
viruses still in place, and also what looks like debugging code.
It was found in the Hebrew University of Jerusalem (hence the
name) by Yisrael Radai.

While all this was going on, a young student at the University of
Wellington, New Zealand, had found a very simple way to create a
very effective virus. One time in eight, when booting from an
infected floppy, it also displayed the message 'Your PC is now
Stoned', hence the name of the virus.

The virus itself was just a few hundred bytes long, but because
of its selfrestraint, and memory-resident replication, it has
become the most widespread virus in the world, accounting for
over a quarter of outbreaks. It is very unlikely that Stoned
virus will ever become rare. The virus spread rapidly, because of
its inconspicuousness (and because in those days, people were
keeping a careful eye on COMMAND.COM, because of Lehigh).

In Italy, at the University of Turin, a programmer was writing
another boot sector virus. This one put a bouncing ball up on the
screen, if the disk was accessed exactly on the half hour. It
became known as Italian virus, Ping pong, or Bouncing Ball. But
this virus had a major defect - it couldn't work on anything
except an 8088 or 8086 computer, because it uses an instruction
that doesn't work on more advanced chips. As a result, this virus
has almost died out (as has Brain, which can only infect 360 kb
floppies, and which foolishly announces its presence via the
volume label).

Back in the US, an American was demonstrating a problem that has
continued to dog US virus writers ever since - incompetence. The
Lehigh didn't make it outside a small circle - neither did the
Yale virus. This was another boot sector virus, but it only
copied itself when you booted from an infected floppy, then put
another floppy in to continue the boot process.  No subsequent
diskette was infected, and if the boot-up continued from a hard
disk, there was no infection at all. Yale never spread at all
widely, either.

But also in 1987, a German programmer was writing a very
competent virus, the Cascade, so called after the falling letters
display that it gave. Cascade used a new idea - most of the virus
was encrypted, leaving only a small stub of code in clear for
decrypting the rest of the virus. The reason for this was not
clear, but it certainly made it more difficult to repair infected
files, and it restricted the choice of search string to the first
couple of dozen bytes. This idea was later extended by Mark
Washburn when he wrote the first polymorphic virus, 1260
(Chameleon). Washburn based Chameleon on a virus that he found in
a book - the Vienna, published by Burger.

Cascade was supposed to look at the Bios, and if it found and IBM
copyright, it would refrain from infecting. This part of the code
didn't work. The author soon released another version of the
virus, 1704 bytes long instead of 1701, in order to correct this
bug. But the corrected version had a bug that meant that it still
didn't detect IBM Bioses.

Of these early viruses, only Stoned, Cascade and Jerusalem are
common today, but those three are very common.

1988 - the game begins

1988 was fairly quiet, as far as virus writing went. Mostly, it
was the year that anti-virus vendors started appearing, making
a fuss about what was at that time only a potential problem,
and not selling very much anti-virus software. The vendors were
all small companies, selling their software for very low prices
(#5 or $10 was common). Some of them were shareware, some were
freeware.  Occasionally some larger company tried to pop up, but
no-one was paying serious cash to solve a potential problem.

In some ways, that was a pity, because 1988 was a very virus-
friendly year. It gave Stoned, Cascade and Jerusalem a chance to
spread undetected, and to establish a pool of infected objects
that will ensure that they never become rare.

It was in 1988 that IBM realised that it had to take viruses
seriously. This was not because of the well-known Christmas tree
worm, which was pretty easy to deal with. It was because IBM had
an outbreak of Cascade at the Lehulpe site, and found itself in
the embarrassing position of having to inform its customers that
they might have become infected there. In fact, there was no real
problem, but from this point on, IBM took viruses very seriously
indeed, and the High Integrity Computing Laboratory in Yorktown
was given responsibility for the IBM research effort in this
field.

1988 saw a few scattered, sporadic outbreaks of Brain, Italian,
Stoned, Cascade and Jerusalem. It also saw the final arguments
about whether viruses existed or not. Peter Norton, in an
interview, said that they were an urban legend, like the
crocodiles in the New York sewers, and one UK expert claimed that
he had a proof that viruses were a figment of the imagination. In
1988, the real virus experts would debate with such people -
after that year, real virus experts would simply walk away from
anyone who had such absurd beliefs.

Each outbreak of a virus was dealt with on a case-by-case basis.
One American claimed that he had a fully equipped mobile home for
dealing with virus outbreaks (and another one extrapolated to the
notion that soon there would be many such mobile units). Existing
software was used to detect boot sector viruses (by inspecting
the boot sector), and one-off software was written for dealing
with outbreaks of Cascade and Jerusalem.

In 1988, a virus that is called "Virus-B" was written. This is
another virus that doesn't go memory resident, and it is a
modification of another virus that deletes files on Friday 13th.
When this virus is run, it displays "WARNING!!!! THIS PROGRAM IS
INFECTED WITH VIRUS-B! IT WILL INFECT EVERY .COM FILE IN THE CURRENT
SUBDIRECTORY!". A virus that is as obvious as that, was clearly
not written to spread. It was obviously written as a
demonstration virus. Virus researchers are often asked for
"harmless viruses" or "viruses for demonstration"; most
researchers offer some alternative, such as an overhead foil, or
a non-virus program that does a falling letters display. But it
looks as if VIRUS-B was written with the intention of giving it
away as a demonstration virus - hence the warning. And, indeed,
we find that an American company was offering it to "large
corporations, universities and research organizations" on a
special access basis.

At the end of 1988, a few things happened almost at once. The
first was a big outbreak of Jerusalem at a large financial
institution, which meant that dozens of people were tied up in
doing a big clean-up for several days. The second was that a
company called S&S did the first ever Virus Seminar that actually
explained what a virus was and how they worked. The third was
Friday 13th.

It was clear that we couldn't go out and help everyone with a
virus, even if we bought a mobile home and equipped it (with
what)?  It was also clear that the financial institution, and the
academic site, could easily handle a virus outbreak, but they
didn't have the tools to do the job. All they needed was a decent
virus detector, which was not available. So we wrote one, added
some other tools that experience said might be useful, and
created the first Anti Virus Toolkit.

In 1989, the first Friday 13th was in January. At the end of
1988, it was clear that Jerusalem was in Spain and the UK, at
least, and was in academic as well as commercial sites. Because
of the destructive payload in the virus, we felt that if we failed
to send out some sort of warning, we would be negligent. But the
media grabbed the ball and ran with it; the predictability of the
trigger day, together with the feature of it being Friday 13th,
caught their imagination, and the first virus media circus was
under way.

On the 13th of January, we had dozens of phone calls, mostly from
the media wanting to know if the world had ended yet. But we also
had calls from a large corporate site, a small vendor of PC
hardware, and a couple of single users. We were invaded by TV
cameras in droves, and had to schedule them carefully to avoid
them tripping over each other. In the middle of all this, the PC
Support person from the infected corporate arrived. The TV people
wanted nothing better than a victim to film, but the corporate
wanted anonymity. We pretended that he was just one of our staff.
Also, at that time, British Rail contacted us - they also had an
outbreak of Jerusalem, and they went public on it. Later, they
regretted that decision, because for a long time afterwards,
their PC Support person was badgered by the media seeking
interviews.

1989 - Datacrime

1989 was the year that things really started to move. The Fu
Manchu virus (a modification of Jerusalem) was sent anonymously
to a virus researcher in the UK, and the 405 virus (a
modification of the overwriting virus in the Burger book) was
sent to another UK researcher. A third UK researcher wrote
a virus and sent it to another UK researcher - in 1989, the UK
was where it was all happening. But not quite all. In 1989, the
Bulgarians started getting interested in viruses, and Russia was
beginning to awaken.

In March of 1989, a minor event happened that was to trigger an
avalanche. A new virus was written in Holland. A Dutchman calling
himself Fred Vogel (a very common Dutch name) contacted a UK
virus researcher, and said that he had found this virus all over
his hard disk. He also said that it was called Datacrime, and
that he was worried that it would trigger on the 13th of the next
month.

When the virus was disassembled, it was found that on any day
after October 12th, it would trigger a low level format of
cylinder zero of the hard disk, which would, on most hard disks,
wipe out the File Allocation Table, and leave the user
effectively without any data. It would also display the virus's
name, Datacrime virus. A straightforward write-up of the effect
of this virus was published, but it was another non-memory-
resident virus, and so highly unlikely to spread.

However, the write-up was reprinted by a magazine, another
magazine repeated the story, a third party embellished it a bit,
and by June it was becoming an established fact that it would
trigger on October 12th (not true, it triggers on any day *after*
the 12th, up till December 31st) and that it would low level
format the whole hard disk. In America, the press started calling
it "Columbus Day virus" (October 12th) and it was suggested that
it had been written by Norwegian terrorists, angry at the fact
that Eric the Red had discovered America, not Columbus.

Meanwhile, in Holland, the Dutch police were doing one of the
things that falls within those things that police are supposed to
do - crime prevention. Datacrime virus was obviously a crime, and
the way to prevent it was to run a detector for it. So the
commissioned a programmer to write a Datacrime detector, and
offered it at Dutch police stations for $1. It sold really well.
But it gave a number of false alarms, and it had to be recalled,
and replaced with version 2. There were long queues outside the
Dutch police stations, lots of confusion about whether anyone
actually had this virus (hardly anyone did, but the false alarms
muddied the waters).

If the police take something seriously, it must be serious,
right? So in July, large Dutch companies started asking IBM
if viruses were a serious threat. Datacrime isn't, but there
is a distinct possibility that a company could get Jerusalem,
Cascade or Stoned (or Italian, in those days before 8088
computers became a rarity). So what is IBM doing about this
threat, they asked?

IBM had internal-use-only anti-virus software. They used this to
check incoming media, and to make sure that an accident like
Lehulpe could never happen again. IBM had a problem - if they
didn't offer this software to their customers, they could look
very bad if on October 13th a lot of computers went down. The
technical people knew that this wouldn't happen, but obviously
they knew that someone, somewhere, might have important data on a
computer that would get hit by Datacrime.  IBM had to make a
decision about whether to release their software, and they had a
very strict deadline to work to - October the 13th would be too
late.

In September of 1989, IBM sent out version 1.0 of the IBM
scanning software, together with a letter telling their customers
what it was, and why they were sending it out. When you get a
letter like that from IBM, and a disk, you would be pretty brave
to take no notice, so a lot of large companies scanned a lot of
computers, for the first time. Hardly anyone found Datacrime, but
there were instances of the usual viruses.

October 13th fell on a Friday, so there was a double event -
Jerusalem and Datacrime. In the US, Datacrime (Columbus Day) had
been hyped out of all proportion for a virus that is as
uninfective as this one, and it is highly likely that not a
single user had the virus. In Europe (especially in Holland)
there might have been a few, but not many.

In London, the Royal National Institute for the Blind announced
that they'd had a hit, and had lost large amounts of valuable
research data, and months of work. We investigated this
particular incident, and the truth was that they had a very minor
outbreak of Jerusalem, and a few easily-replaced program files
had been deleted. Four computers were infected. But the RNIB
outbreak has passed into legend as a Great Disaster. Actually,
the RNIB took more damage from the invasion of the television and
print media than from the virus.

By the end of 1989, there were a couple of dozen viruses that we
knew about, but we didn't know that in Bulgaria and Russia, big
things were brewing.

1990 - the game gets more complex

By 1990, it was no longer a matter of running a couple of dozen
search strings down each file. Mark Washburn had taken the Vienna
virus, and created the first polymorphic virus from it. We didn't
use that word at first, but the idea of his viruses (1260, V2P1,
V2P2 and V2P6) was that the whole virus would be variably
encrypted, and there would be a decryptor at the start of the
virus. But the decryptor could take a very wide number of forms,
and in the first few viruses, the longest possible search string
was just two bytes long (V2P6 got this down to one byte). To
detect this virus, it was necessary to write an algorithm that
would apply logical tests to the file, and decide whether the
bytes it was looking at were one of the possible decryptors.

One consequence of this, was that some vendors couldn't do this.
It isn't easy to write such an algorithm, and many vendors were,
by this time, relying on search strings extracted by someone
else. The three main sources of search strings were a newsletter
called Virus Bulletin, the IBM scanner, and reverse engineering a
competitor's product. But you can't detect a polymorphic virus
this way (indeed, two years after these viruses were published,
many products are still incapable of detecting these viruses).
Washburn also published his source code, which is now widely
available. At the time, we thought that this would bring out a
number of imitators; in practice, no-one seems to be using
Washburn's code. However, plenty of virus authors are using his
idea.

Another consequence of polymorphic viruses, was an increase in
the false alarm rate. If you write code to detect something that
has as many possibilities as V2P6, then there is a chance that
you will flag an innocent file, and that chance is much greater
than with the sort of virus that you can find with a 24-byte scan
string. A false alarm can be as much hassle to the user as a real
virus, as he will put all his anti-virus procedures into action.

Also, in 1990, we saw a number of virus coming out of Bulgaria,
especially from someone who called himself "Dark Avenger". The
Dark Avenger viruses introduced two new ideas. The first idea was
the "Fast infector"; with these viruses, if the virus is in
memory, then simply opening a file for reading, triggers the
virus infection. The entire hard disk is very soon infected.  The
second idea in this virus, was that of subtle damage. Dark
Avenger-1800 occasionally overwrites a sector on the hard disk.
If this isn't noticed for a period of time, the corrupted files
are backed up, and when the backup is restored, the data is still
no good. Dark Avenger targets backups, not just data. Other
viruses came from the same source, such as the Number-of-the-
Beast (stealth in a file virus) and Nomenklatura (with an even
nastier payload than Dark Avenger.

Also, Dark Avenger was more creative about distributing his
viruses. He would upload them to BBSes, infecting shareware anti-
virus programs, together with a documentation file that gave
reassurance to anyone who checked the file size and checksums. He
uploaded his source code also, so that people could learn how to
write viruses.

In 1990, another event happened in Bulgaria - the first virus
exchange BBS. The idea was that if you uploaded a virus, you could
download a virus, and if you uploaded a new virus, you were given
full access. This, of course, encourages the creation of new
viruses, and gets viruses into wider circulation. Also, the VX BBS
offered source code, which makes the technology of writing a virus
more widely available.

In the second half of 1990, The Whale appeared. Whale was a very
large, and very complex virus. It didn't do very much; mostly, it
crashed the computer when you tried to run it. But it was an
exercise in complexity and obfuscation, and it arrived in virus
author's hands like a crossword puzzle to be solved. Some virus
researchers wasted weeks unravelling Whale, although in practice
you could detect it with a couple of dozen search strings, and you
didn't really need to do any more, as the thing was too clumsy to
work anyway. But because it was so large and complex, it achieved
fame.

At the end of 1990, the anti-virus people saw that they had to get
more organised - they had to be at least as organised as the virus
authors. So EICAR (European Institute for Computer Antivirus
Research) was born in Hamburg, in December 1990. This gave a very
useful forum for the anti-virus researchers and vendors to meet
and exchange ideas (and specimens), and to encourage the
authorities to try to prosecute virus authors more vigorously. At
the time that EICAR was founded, there were about 150 viruses, and
the Bulgarian "Virus factory" was in full swing.


1991 - product launches and polymorphism

In 1991, the virus problem was sufficiently interesting to attract
the large marketing companies. Symantec launched Norton Anti Virus
in December 1990, and Central Point launched CPAV in April 1991.
This was soon followed by Xtree, Fifth Generation and a couple of
others. Most of these companies were rebadging other companies
program (nearly all Israeli). The other big problem of 1991 was
"glut". In December 1990, there were about 200-300 viruses; by
December 1991 there were 1000 (there may have been even more
written that year, because by February, we were counting 1300).

Glut means lots of viruses, and this causes a number of unpleasant
problems. In every program, there must be various limitations. In
particular, a scanner has to store search strings in memory, and
under Dos, there is only 640 kb to use (and Dos, the network shell
and the program's user interface might take half of that).

Another Glut problem, is that some scanners slow down in
proportion to the number of viruses scanned for. Not many
scanners work this way, but it certainly poses a problem for
those that do.

A third Glut problem, comes with the analysis of viruses; this is
necessary if you want to detect the virus reliably, to repair it,
and if you want to know what it does. If it takes one researcher
one day to disassemble one virus, then he can only do 250 per
year. If it takes one hour, that figure becomes 2000 per year,
but whatever the figure, more viruses means more work.

Glut also means a lot of viruses that are similar to each other.
This then can lead to mis-identification, and therefore a wrong
repair. Very few scanners attempt a complete virus
identification, so this confusion about exactly which virus is
being found, is very common.

Most of these viruses came from Eastern Europe and Russia - the
Russian virus production was in full swing. But another major
source of new viruses was the virus exchange BBSes.

Bulgaria pioneered the VX BBS, but a number of other countries
quickly followed. Some shut down not long after they started up,
but the Milan "Italian Virus Research Laboratory" was where a
virus author called Cracker Jack uploaded his viruses (which were
plagiarised versions of the Bulgarian viruses). Germany had
Gonorrhea, Sweden had Demoralised Youth, America had Hellpit, UK
had Dead On Arrival and Semaj. Some of these have now either
closed down or gone underground, but they certainly contributed
to the glut problem. With a VX BBS, all a virus author has to do,
is download some source code, make a few simple changes, then
upload a new virus, which gives him access to all the other
viruses on the board.

1991 was also the year that polymorphic viruses first made a
major impact on users. Washburn had written 1260 and the V2
series long before, but because these were based on Vienna, they
weren't infectious enough to spread. But in April of 1991,
Tequila burst upon the world like a comet. It was written in
Switzerland, and was not intended to spread. But it was stolen
from the author by a friend, who planted it on his father's
master disks. Father was a shareware vendor, and soon Tequila was
very widespread.

Tequila used full stealth when it installed itself on the
partition sector, and in files it used partial stealth, and was
fully polymorphic. A full polymorphic virus in one for which no
search string can be written down, even if you allow the use of
wild cards. Tequila was the first polymorphic virus that was
widespread. By May, the first few scanners were detecting it, but
it was not until September that all the major scanners could
detect it reliably. If you don't detect it reliably, then you
miss, say, 1% of infected files. The virus starts another
outbreak from these overlooked instances, and has to be put down
again, but now there is that old 1%, plus another 1% of files
that are infected but not detected. This can continue for as long
as the user has patience, until eventually the hard disk contains
nothing but files that the scanner cannot detect. The user,
thinks that after the virus coming back a number of times, it
gradually infected fewer and fewer files, until now he has gotten
rid of it completely.

In September 1991, Maltese Amoeba spread through Europe - another
polymorphic virus. By the end of the year, there were a few dozen
polymorphic viruses. Each of these is classified as "difficult",
meaning it takes a virus researcher more than a few hours to do
everything that needs to be done. Also, most products need some
form of hard coding in order to detect the virus, which means
program development, which means bugs, debugging, beta testing
and quality control. Furthermore, although a normal virus won't
slow down most scanners, a polymorphic virus might.

It was also in 1991, that Dark Avenger announced the first virus
vapourware. He threatened a virus that had 4,000,000,000
different forms. In January 1992, this virus appeared, but it
wasn't a virus.

1992 - Michelangelo

January 1992 saw the Self Mutating Engine (MtE) from Dark
Avenger. At first, all we saw was a virus that we named
Dedicated, but shortly after that, we saw the MtE. This came as
an OBJ file, plus the source code for a simple virus, and
instructions on how to link the OBJ file to a virus to give you a
full polymorphic virus. Immediately, virus researchers set to
work on detectors for it. Most companies did this in two stages.
In some outfit, stage one was look at it and shudder, stage two
was ignore it and hope it goes away. But at the better R&D sites,
stage one was usually a detector that found between 90 and 99% of
instances, and was shipped very quickly, and stage two was a
detector that found 100%. At first, it was expected that there
would be lots and lots of viruses using the MtE, because it was
fairly easy to use this to make your virus hard to find. But the
virus authors quickly realised that a scanner that detected one
MtE virus, would detect all MtE viruses fairly easily. So very
few virus authors have taken advantage of the engine (there are
about a dozen or two viruses that use it).

This was followed by Dark Avenger's Commander Bomber. Before CB,
you could very easily predict where in the file the virus would
be. Many products take advantage of this predictability to run
fast; some only scan the top and tail of the file, and some just
scan the one place in the file that the virus must occupy if it
is there at all. Bomber transforms this, and so products either
have to scan the entire file, or else they have to be more
sophisticated about locating the virus.

Another virus that came out at about that time, was Starship.
Starship is a fully polymorphic virus (to defeat scanners), with
a few neat anti-debugging tricks, and it also aims to defeat
checksummers with a very simple trick. Checksumming programs aim
to detect a virus by the fact that it has to change executable
code in order to replicate. Starship only infects files as they
are copied from the hard disk to the floppy. So files on the hard
disk never change. But the copy on the floppy disk is infected,
and if you then copy that onto a new hard disk, and tell the
checksummer on the new machine about this new file, the
checksummer will happily accept it, and never report any changes.
Starship also installs itself on the hard disk, but without
changing executable code. It changes the partition data, making a
new partition as the boot partition. No code is changed, but the
new partition contains the virus code, and this is run before it
passes control on to the original boot partition.

Probably the greatest event of 1992 was the great Michelangelo
scare. One of the American anti-virus vendors forecast that five
million computers would go down on March the 6th, and many other
US vendors climbed on to the band wagon. PC users went into a
purchasing frenzy, as the media whipped up the hype. On March the
6th, between 5,000 and 10,000 machines went down, and naturally
the US vendors that had been hyping the problem put this down to
their timely and accurate warning. We'll probably never know how
many people had Michelangelo, but certainly in the days leading
up to March the 6th, a lot of computers were checked for viruses.
After March 6th, there were a lot of discredited experts around.

The reaction to the Michelangelo hype did a lot of damage to the
credibility of people advicating sensible antivirus strategies,
and outweighed any possible benefits from the gains in awareness.

In August 1992, we saw the first serious virus authoring
packages. First the VCL (Virus Creation Laboratory) from Nowhere
Man, and then Dark Angel's Phalcon/Skism Mass-Produced Code
Generator. These packages made it possible for anyone who could
use a computer, to write a virus. Within twelve months, dozens of
viruses had been created using these tools.

Towards the end of 1992, a new virus writing group called ARCV
(Association of Really Cruel Viruses) had appeared in England -
within a couple of months, the Computer Crime Unit of New
Scotland Yard had tracked them down and arrested them. ARCV
flourished for about three months, during which they wrote a few
dozen viruses and attracted a few members.

Another happening of 1992, was the appearance of people selling
(or trying to sell) virus collections. To be more precise, these
were collections of files, some of which were viruses, and many
of which were assorted harmless files. In America, John Buchanan
offered his collection of a few thousand files for $100 per
copy, and in Europe, The Virus Clinic offered various options
from #25. The Virus Clinic was raided by the Computer Crime
Unit; John Buchanan is still offering viruses for sale.

Towards the end of 1992, the US Government was offering viruses
to people who called the relevant BBS.

1993 - Polymorphics and Engines

Early in 1993, XTREE announced that they were quitting the
antivirus business. This was the first time that a major company
had given up the struggle.

Early in 1993, a new virus writing group appeared, in Holland,
called Trident. The main Trident author, Masouf Khafir, wrote a
polymorphic engine called the Trident Polymorphic Engine, and
release a virus that used it, called GIRAFE. This was followed by
updated versions of the TPE. The TPE is much more difficult to
detect reliably than the MtE, and very difficult to avoid false
alarming on.

Khafir also released the first virus that worked according to a
principle first described by Fred Cohen. The Cruncher virus was a
data compression virus, that automatically added itself to files
in order to auto-install on as many computers as possible.

Meanwhile, Nowhere Man, of the Nuke group, had been busy. Early
in 1993, he released the Nuke Encryption Device (NED). This was
another mutator that was more tricky than MtE. A virus called
Itshard soon followed.

Phalcon/Skism was not to be left out. Dark Angel released DAME
(Dark Angel's Multiple Encyptor) in an issue of 40hex; a virus
called Trigger uses this. Trident released version 1.4 of TPE
(again, this is more complex and difficult than previous
versions) and released a virus called Bosnia that uses it.

Soon after that, Lucifer Messiah, of Anarkick Systems had taken
version 1.4 of the TPE and written a virus POETCODE, using a
modified version of this engine (1.4b).

Early in 1993, another highly polymorphic virus appeared, called
Tremor. This rocketed to stardom when it got included in a TV
broadcast of software (received via a decoder).

In the middle of 1993, Trident got a boost when Dark Ray and John
Tardy joined the group. Tardy has released a fully polymorphic
virus in 444 bytes, and we can expect more difficult things from
Trident.

The main events of 1993, were the emergence of an increasing
number of polymorphic engines, which will make it easier and
easier to write viruses that scanners find difficult to detect.


The future

There will be more viruses - that's an easy prediction. How
many more is a difficult call, but over the last five years,
the number of viruses has been doubling every year or so. This
surely must slow down. If we say 1500 viruses in mid-1992, and
3000 in mid-1993, then we could imagine 5000 in mid 1994 and we
could expect to reach the 8,000 mark some time in 1995. Or
perhaps we are being optimistic?

The glut problem will continue, and could get sharply worse.
Whenever a group of serious anti-virus researchers meet, we find
an empty room, hang "Closed for cleaning" on the door, and
frighten each other with "nightmare scenarios". Some of the older
nightmare scenarios have already come true, others have not, but
remain possibilities. The biggest nightmare for all anti-virus
people is glut. There are only about 10-15 first class anti-virus
people in the world, and most of the anti-virus companies have
just one of these people (some have none). It would be difficult
to create more, as the learning curve is very steep. The first
time you disassemble something like Jerusalem virus, it takes a
week. After you've done a few hundred viruses, you could whip
through something as simple as Jerusalem in 15 minutes.

The polymorphic viruses will get more numerous. It turns out that
they are a much bigger problem than the stealth viruses, because
stealth is aimed at checksummers, but polymorphism is aimed at
scanners, which is what most people are using. And each
polymorphic virus will be a source of false alarms, and will
cause the researchers much more work than the normal viruses.

The polymorphic viruses will also continue to get more complex,
as virus authors learn the technique, and increasingly try to
ensure that their viruses cannot be detected.

Scanners will get larger - more code will be needed because more
viruses will need hard coding to scan for them. The databases
that scanners use will get larger; each new virus needs to be
detected, identified and repaired. Loading the databases will
take longer, and some programs will have memory shortage
problems.

As Windows becomes more popular, people will be increasingly
reluctant to run scanners under Dos. But if you are running
Windows, you have run software on the hard disk, and if one of
the things you've run is infected by a virus, you have a virus in
memory. If there is a virus in memory, you cannot trust what the
computer is saying - it could be a stealth virus. Windows will
make antivirus software less secure.

The R&D effort to keep scanners up-to-date will get more and
more. Some companies won't be able to do it, and will decide that
scanning is outdated technology, and try to rely on checksumming.
Other companies will licence scanners from one of the few
companies that still maintains adequate R&D (we've already
started seeing some of this). Some companies will decide that the
anti-virus business isn't as profitable as they had thought, and
will abandon their anti-virus product, and go back to their core
business.

Users will get a lot more relaxed about viruses. We've long since
passed the stage where a virus is regarded as a loathsome
disease, to be kept secret. But we're increasingly seeing people
who regard a virus on their system with about the same degree of
casualness as a bit of fluff on their jacket. Sure, they'll wipe
it off, but there's not real need to worry about it happening
again. This is perhaps a bit too relaxed an attitude, but what
can you expect if a user keeps on getting hit by viruses, and
nothing terrible ever seems to result.

Anti-virus products will mature a lot. Those without any kind of
decent user interface will have a hard time competing against
the pretty ones. Those with a long run time will be rejected
in favour of those that run in seconds. Exactly which viruses
are detected will have far less emphasis (it is very difficult
for users to swallow claims about so many thousands of viruses)
than the ease of use of the product, and the amount of impact it
has on the usability of the computer.

New products will keep arriving, as each company invents the
product that makes all previous products obsolete. Sometimes the
magic ingredient will be software (AI, neural nets, whatever is
the latest buzzword) and sometimes it will be hardware (which can
never be infected, except that that isn't the problem). These
products will burst on a startled world in a blaze of publicity,
and vanish without trace when users find that installing them
makes their computer unusable, or else it doesn't find any
viruses, or both. But new ones will come along to take their
place.

Gradually, people will trade up from Dos to whatever takes its
place - OS/2, Windows-NT or Unix, and the Dos virus will become
as irrelevant as CPM. Except that Dos will still be around 10 or
even 20 years from now, and viruses for the new operating system
will start to appear as soon as it is worth writing them.

Some computers are already being built with ingrained resistance
to viruses. Some brands of computer are already immune to boot
sector viruses, provided you make a simple choice in the CMOS
setup (don't boot from the floppy). Right now, very few users are
being told that these computers can be set up that way, but
people are gradually finding out for themselves. This doesn't
solve the virus problem, but anything that makes the world a
difficult place for viruses must be a help.

The virus problem will be with us for ever. It isn't the
dramatic, worldshaking kind of problem that Michelangelo was made
out to be; nor is it the fluff-on-your-jacket kind of problem.
But as long as people have problems with computers, other people
will be offering solutions for those problems.


