A virus (in biology) is a microorganism that reproduces by injecting its own genetic material into an organism's cells. It takes over the cell's reproductive mechanism and uses it to produce copies of itself. Eventually, the cell bursts, releasing the new viruses creates from the original virus's DNA.
A computer virus is a computer program (or a program fragment) that hides itself within a larger program and uses the access that it provides to spread itself to other computers and cause damages to computer data or other unwanted effects. The most common ways of spreading the infection is by floppy disk or by e-mail.
The FBI defines a virus "as any program undetected to the user that has the capacity to infect other computer system by re-creating itself unpredictably or causing some other specific action predetermined circumstances."
In the early 1990s, Computer Virus Industry Association received an average of 15- 20 reports daily. Dozens of different strains exist. Most enter computer systems inadvertently by authorized user. McAfee (publisher of the antivirus program ViruScan) reports that there are currently 60,000 computer viruses in existence.
Computer virus can typically fall into one of the following categories:
Early viruses were pieces of code attached to a common program like a popular game or a popular word processor. A person might download an infected game from a bulletin board and run it. A virus like this is a small piece of code embedded in a larger, legitimate program. Any virus is designed to run first when the legitimate program gets executed. The virus loads itself into memory and looks around to see if it can find any other programs on the disk. If it can find one, it modifies it to add the virus's code to the unsuspecting program. Then the virus launches the "real program." The user really has no way to know that the virus ever ran. Unfortunately, the virus has now reproduced itself, so two programs are infected. The next time either of those programs gets executed, they infect other programs, and the cycle continues.
If one of the infected programs is given to another person on a floppy disk, or if it is uploaded to a bulletin board, then other programs get infected. This is how the virus spreads.
The spreading part is the infection phase of the virus. Viruses wouldn't be so violently despised if all they did was replicate themselves. Unfortunately, most viruses also have some sort of destructive attack phase where they do some damage. Some sort of trigger will activate the attack phase, and the virus will then "do something" -- anything from printing a silly message on the screen to erasing all of your data. The trigger might be a specific date, or the number of times the virus has been replicated, or something similar.
As virus creators got more sophisticated, they learned new tricks. One important trick was the ability to load viruses into memory so they could keep running in the background as long as the computer remained on. This gave viruses a much more effective way to replicate themselves. Another trick was the ability to infect the boot sector on floppy disks and hard disks. The boot sector is a small program that is the first part of the operating system that the computer loads. The boot sector contains a tiny program that tells the computer how to load the rest of the operating system. By putting its code in the boot sector, a virus can guarantee it gets executed. It can load itself into memory immediately, and it is able to run whenever the computer is on. Boot sector viruses can infect the boot sector of any floppy disk inserted in the machine, and on college campuses where lots of people share machines they spread like wildfire.
In general, both executable and boot sector viruses are not very threatening any more. The first reason for the decline has been the huge size of today's programs. Nearly every program you buy today comes on a compact disc. Compact discs cannot be modified, and that makes viral infection of a CD impossible. The programs are so big that the only easy way to move them around is to buy the CD. People certainly can't carry applications around on a floppy disk like they did in the 1980s, when floppies full of programs were traded like baseball cards. Boot sector viruses have also declined because operating systems now protect the boot sector.
Both boot sector viruses and executable viruses are still possible, but they are a lot harder now and they don't spread nearly as quickly as they once could. Call it "shrinking habitat," if you want to use a biological analogy. The environment of floppy disks, small programs and weak operating systems made these viruses possible in the 1980s, but that environmental niche has been largely eliminated by huge executables, unchangeable CDs and better operating system safeguards.
[ http://computer.howstuffworks.com/virus4.htm]Macro viruses use the built-in Word.Basic macro language available in Microsoft Word 6.0 and later. A variant of this language existed in Word 2.0 for Windows, but these macro viruses only run on the version of Word.Basic in Word 6.0 and later. Macintosh versions of Word earlier than 6.0 do not have a macro language though converters are available to allow Word 5 to read Word 6 files. Any Word 6 files converted to Word 5 will have all their macros removed during the conversion process and cannot be infected with a virus.
A virus needs two things to infect a system: they need to get on the system and they need to get executed. Macro viruses get on a system by being attached to template files in Word versions 6 and 7 or any document in Word version 8. Template files can contain text just like a normal document, but they can also hold macros. To get executed on your system, macro viruses take advantage of the fact that if a macro is named AutoOpen or AutoClose the macro is run automatically when a document is opened or closed. They also take advantage of the fact that if a macro has a name like FileOpen or FileSaveAs the macro replaces the menu command with the same name and runs when the menu command is selected. These two methods allow a macro to be run without the user explicitly running the macro or even realizing that he has done so.
When a macro virus has gotten onto a system and is run, the first thing it does is to see if it is in the normal.dot template file or in a document. If the virus is running on the normal.dot template, it looks for a document to infect. When it has infected a document, it saves that document as a Word template file but changes the file name to end in .DOC instead of .DOT, to make the file appear to be a document instead of a template. If it is running on a document, it copies itself onto the normal.dot template.
When the virus is finished infecting a document file, it runs its payload procedure which can do nothing or can do something nasty such as format your hard drive. Word.Basic is a full programming language and a Word.Basic macro can do anything any other program can do including read or write files, send e-mail, change system settings, and so forth. What it does depends on the whim or malicious intent of the virus writer.
[http://computer.howstuffworks.com/framed.htm?parent=virus.htm&url=http://www.cert.org /advisories/CA-1999-04.html]Most system viruses have known "signature patterns", a sequence of bits that always appear. Virus writers use these to prevent the virus from re-infecting infected disks (this makes detection harder). Similarly macro viruses usually have the same sequence of instructions. By checking for known signatures of known viruses, they can spot the known viruses easily.
Unfortunately, there are always new viruses coming out. Some anti-virus programs look for certain behaviors that are typical of certain classes of viruses. This is harder to do and some of these behavior can be typical of innocent programs as well.