You are working away on your computer, engrossed in your spreadsheet when a message pops up, "You’re now Stoned." What was that?

While trying to open a database of business contacts, your friend gets a message that the file cannot be read. She doesn’t have a backup of the file—now all the information that she collected over years is lost.

You are copying files from a floppy disk to the hard drive, and you find that all the files are only 1kB in size after being copied.

How did these happen? What could be wrong? Could these be the work of... viruses?

If things seem slow on your PC, files mysteriously disappear, or the computer crashes for no apparent reason, your PC may well be under a virus attack. A computer virus attack can cause a whole lot of damage to your program and data files. You may not even notice them for a long time while they quietly go about deleting and damaging your important files. If viruses are not found and removed in time, you may find one day that your hard disk has been formatted, and that is not a pleasant thing at all.

So what are these viruses? How do they spread? Here we answer some of your questions on computer viruses.

A computer virus is a program that spreads across computers by attaching a copy of itself to the files on your computer. When you run the infected file the virus goes into action. A virus is usually harmful and can corrupt data, overwrite files, or use up system resources and slow it down in the process. Some may be merely annoying like asking you to type in a certain message to continue or popping up messages on the screen.

Viruses are usually written by mischievous programmers to cause trouble. Some people say that it is an example of creativity gone astray. It all started in 1986 when two Pakistani programmers Amjad and Basit created a virus called Brain. They were upset over the fact that they couldn’t land a good job. The Brain virus was rather tame and didn’t cause any real damage. When it infected a disk, it would simply change the volume label to "(c) Brain". It only worked on 360 kB disks (you can find these in museums today).

When word about Brain got around, other programmers got into the act. The first few viruses were not very dangerous. A virus called Pong showed a bouncing ball on the screen and another called Joshi would ask you to type in "Happy birthday Joshi" for the system to continue working. Though these menaces were around, programs to detect and remove them (called anti-virus programs) were rare. Most programs were shareware or freeware. But by 1990, malicious viruses started appearing. These included Dark Avenger, Jerusalem, and 1260. These viruses would deliberately delete or damage files from hard disks and floppies. Only after these viruses appeared on the scene did companies sit up and take notice. Commercial virus scanners were developed—the foremost was the McAfee Viruscan. By 1993, smarter viruses such as stealth and polymorphic viruses that evaded virus scanners appeared.

Yes, there are. Let’s look at the main types depending on the area they infect.

Boot sector viruses: These viruses infect the boot sector of disks. A boot sector stores the programs that have to be executed when you start your PC. By infecting this area of a disk, the virus loads itself whenever you boot with that disk. It then remains in your PC’s memory and infects any other disk you use on your system.

There’s a more dangerous virus type you’ve to watch out for—the Partition Sector virus. It stays in an area called the Master Boot Record (MBR) which stores the information about the partitions on your hard drive. The partition sector also has a program that is run every time you power up your PC. So when you start your PC the virus is loaded into memory straight away. Some viruses also encrypt the contents of the Master Boot Record. This makes removal of the virus dangerous—removing it might mean that the contents of your hard disk cannot be accessed any more (since only the virus can decrypt the MBR contents).

File viruses: These are by far the most infectious kind. File viruses attach a copy of themselves onto the beginning of an executable file (files with a .COM or .EXE extension). When you run the infected file, the virus code gets executed. The more intelligent viruses then execute the actual file—so everything appears normal. But the virus is now in your PC’s memory. When another "clean" executable file is run, the virus attaches itself to that file. It soon infects most of the programs on your hard disk. So all your precious data is at great risk.

Cluster viruses: Cluster viruses store a single virus copy in a certain area on the disk. Then they change the DOS directory information so that the location of each program in the File Allocation Table (FAT) points to the area where the virus sits. When you run a program, the virus gets to work, and then it runs the original program. And this increases the chances of your data getting corrupted.

You can also classify viruses in the many ways they infect your computer. Here are the main ones.

Stealth viruses: These viruses try to conceal their presence by hiding the modifications they make. When any application asks for some disk information—file sizes, free disk space, and so on—the virus intercepts it and gives back the original information instead of the actual information. For instance, you ask your PC for a directory listing. If there is a stealth virus at work, it intercepts your query. Instead of reporting a larger file size for an infected file (say, 44 kB), the virus reports the original size of the file (say, 42 kB). So everything looks normal, and you don’t smell a virus.

Polymorphic viruses: Most virus scanners look for "search strings" within a program to detect viruses. For example, the code for the "Stoned" virus contains the string (set of characters or phrase) "Your PC is now Stoned!" Polymorphic viruses encrypt their code on each infection so that the virus codes of two infected files don’t look the same. So detecting these viruses is much harder.

Multipartite viruses: These are particularly nasty. They can infect both the boot sector as well as files. So they spread much more quickly than other viruses. Fortunately, their occurrence is rare.

Fast, slow, and sparse infecting viruses: A fast infecting virus infects files whenever they are accessed. So whenever you read a file, or write or modify it, or just do a directory listing, the file gets infected. This makes them easier to detect but they can be dangerous too. When you run a virus scan all files are read. If your virus scanner is outdated and can’t catch the virus, your entire hard disk will be infected.

Slow infecting viruses infect files only when you modify or create files. Sparse infectors get into action only under certain conditions. For example, such a virus might infect a file only on a certain date or it might infect files above a certain size.

Macro viruses: Some time back it was an accepted fact that viruses couldn’t be executed by viewing pure data such as graphic files, documents, spreadsheets, and so on. That is still largely true. But a new breed of viruses called macro viruses has made the viewing of word processor documents potentially more dangerous. Here’s how they work.

Office suites like Microsoft Office have grown in features over the years. Today, Microsoft Office packs within it a full programming language—Visual Basic for Applications (VBA). This lets users write their own programs to automate repetitive tasks. For example, if you want to replace the occurrence of "Madras" in multiple documents with "Chennai", you can write a macro in VBA to do this instead of doing it manually. Macros are stored in document templates as well as documents. VBA also has a feature that lets you automatically run a macro when a document is opened. To do this, all you have to do is create a macro called AutoOpen. This macro will run automatically. Some nasty people caught onto the fact that this feature could be used to spread harmful codes, and macro viruses were born. A macro virus creates a macro called AutoOpen and writes some code into it that enables it to spread to other documents—usually by infecting the default Normal.DOT template. This problem has now reached very serious proportions because of the frequent exchange of documents, and spreadsheets among people. Microsoft Office 97 now includes a feature that will let you disable macros when files are opened.

Worms, Trojan horses, and logic bombs: While these are not strictly viruses, they deserve a mention. Worms are usually found on networks and do not infect files the way viruses do. Instead, they replicate and keep creating copies of themselves in memory, which in turn create more copies. Fortunately, with proper resource monitoring, they are easy to detect.

Trojan horses are programs that pretend to do something useful but actually harm your system in some way. Trojans don’t spread easily as you must distribute the actual program to other people for it to work. A logic bomb is a program that activates some malicious code once a certain event occurs. This could be a certain date, the hard disk capacity reaching a certain size or even a file with a certain name (such as john.doc) existing on your hard disk. A logic bomb is very difficult to detect because it doesn’t infect files and only gets triggered after a certain event.

Viruses almost always depend upon exchange of data to spread. Here are the major ways they spread.

Pirated software: Commercial software is usually scanned very thoroughly for viruses (though viruses have been known to be on software from some reputed software vendors also). The average software pirate collects lots of software on his hard disk and then burns them onto a CD with a CD writer. If the pirate’s system is infected, the executable files on the newly created CD could be infected as well. These would then infect your system when you install the software. Vendors of assembled PCs sometimes install software on the system you buy from them. A virus scanner is not usually among them. In the bargain, you could be getting a free virus pre-installed for you.

Exchange of programs among friends and relatives: Here’s what usually happens. Anil has a virus on his system. His friend Kartik asks him to give him a copy of a great utility that Anil has. Anil gives it to him on a disk, which gets infected. Kartik takes it home and installs it on his father’s computer. Now his computer is also infected.

Programs used by service engineers: This is quite common. Let’s say that your PC has a problem. You call a service engineer to fix it. The engineer brings a floppy which has some utilities. The disk is infected with a virus. The service engineer boots your PC with his floppy so that no additional drivers or programs are loaded into memory. He does this with good intentions as he wants to identify the precise cause of the problem. Unfortunately, he has just given the virus on his disk a free run since any memory-resident virus scanning program is also disabled.

Internet downloads: It’s true that an executable file that you download could have a virus, but the problem is not as serious as it is hyped up to be. If you download some shareware from popular download sites such as DOWNLOAD.COM, it would have been well scanned for viruses before being put up on the site. What you do have to watch out for though, are any .exe attachments your friends or associates send you. These could be infected.

Next month, we tell you a little more about viruses—how to detect and remove them. We will also answer some of the frequently asked questions about viruses.