Viruses

Chernobyl

The Chernobyl, or PE CIH, virus activates itself every year on the 26th of April - on the anniversary of the Chernobyl, Ukraine nuclear power plant tragedy. It was allegedly written by a Taiwanese citizen in 1998.

The virus wipes the first megabyte of data from the hard disk of a personal computer thus making the rest of the files of no use. In addition to this it also deletes the data on the computer's Basic Input-Output System (BIOS) chip so that the computer cannot function till a new chip is fitted or the data on the old one is restored. Fortunately only those BIOSes, which can be changed or updated, face a threat from this virus.

This virus affects only executable files. Since these are distributed less often than documents, the spread of Chernobyl is more confined than that of most macro viruses.

VBS_LOVELETTER

The VBS_LOVELETTER virus (better known as the Love Bug or the ILOVEYOU virus) was reportedly written by a Filipino undergraduate. In May 2000, this deadly virus beat the Melissa virus hollow - it became the world's most prevalent virus. It struck one in every five personal computers in the world. When the virus was brought under check the true magnitude of the losses was incomprehensible. Losses incurred during this virus attack were pegged at US $ 10 billion. he original VBS_LOVELETTER utilized the addresses in Microsoft Outlook and e-mailed tself to those addresses. The e-mail which was sent out had "ILOVEYOU" in its subject line.

The attachment file was named "LOVE-LETTER-FOR-YOU.TXT.vbs". People wary of opening e-mail attachments were conquered by the subject line and those who had some knowledge of viruses, did not notice the tiny .vbs extension and believed the file to be a text file. The message in the e-mail was "kindly check the attached LOVELETTER coming from me".

Since the initial outbreak over thirty variants of the virus have been developed many of them following the original by just a few weeks. In addition, the Love Bug also uses the Internet Relay Chat (IRC) for its propagation. It e-mails itself to users in the same channel as the infected user.

Unlike the Melissa virus this virus does have a destructive effect. Whereas the Melissa, once installed, merely inserts some text into the affected documents at a particular instant during the day, VBS_LOVELETTER first selects certain files and then inserts its own code in lieu of the original data contained in the file. This way it creates ever-increasing versions of itself.

Pakistani Brain

The Brain, the first virus known to have spread all over the world, was a boot sector virus. This implies that it would take the system commands, those that help in starting the computer, from their designated space (sector) on the hard disk and put them in the next unused space (sector). Then, it would mark the space where the system commands now reside as bad sectors. This way, it would become impossible to boot (start) the computer. Moreover, it would continue to take up all the unused space in the computer's disk and mark it as corrupted sectors.

All the strains of the Brain virus carried the name of the program, the author and often their address in the boot sector of the virus-infected disk. The other known versions of this virus include Ashar or Ashar-Shoe viruses, which are very common in Malaysia.

Stoned-Marijuana

Originally reported to have been written in New Zealand, this was another boot sector virus with a difference. It would infect the boot sector of floppy disks. The File Allocation Table (FAT) on the hard disk drive - the system used by DOS to identify and locate files on a disk - would also be affected. The virus would most often regularly display a message, which said, "Your PC is stoned. Legalize Marijuana." Moreover, it would damage the File Allocation Table on hard disk drives with more than one partition. The FAT on floppy disks, which had been formatted as high density, would also be harmed so that access to files on both the hard disk and the floppy disk would become nearly impossible to achieve.

Jerusalem

The Jerusalem virus a.k.a. "Israeli" and "Friday the 13th" has several versions including the Jerusalem-B virus. It starts by infecting the .COM and .EXE files in a computer. After existing or being resident in a computer for half an hour, it slows down the system processes by a factor of ten. On a pre-set date, Friday the 13th, the Jerusalem virus deletes all the infected files from the user's computer. Apart from the damage that it does, the other strain of the Jerusalem virus, Jerusalem-B, also shows a "black window" in the center of the screen at regular intervals.

Cascade

The Cascade virus originally appeared between September and December during the years 1980 and 1988. Its basic target were machines with colour monitors. This virus is also called "Falling Letters" or "1701". It initially appeared as a Trojan horse in the form of a program designed to turn off the Num-Lock light on the user's keyboard. In fact, what it actually did was to make the characters on the screen drop in a heap to the bottom of the screen. What is special about this virus is that it utilizes an encryption algorithm to evade detection. Now, variants of this virus occur as a memory resident .COM virus.

Michelangelo

The Michelangelo virus also referred to by some virus watchers as Stoned.Michelangelo, first spread in the early 1990's. Since then, a number of strains have been introduced, and it is now also known by a variety of other names. This virus was also responsible for the founder of Trend Micro entering the anti-virus business.

This virus was entitled after the very famous Italian Renaissance artist Michelangelo Buonarroti. It gets activated every year on the artist's birthday - 6th March. The person responsible for giving the name was the researcher not the writer of the virus.

The Michelangelo is a boot record virus and on the date that it gets triggered it destroys files by overwriting certain critical areas of the hard disk or floppy disk. These areas are overwritten with garbage, making the disk or floppy completely useless. If this virus infects a bootable floppy (a floppy that can be used to boot a computer), the floppy no longer remains a bootable floppy.

An infection with this virus is caused by using infected disks for a system boot-up. After being installed in the memory of the computer, Michelangelo then goes on to infect all nonwrite protected disks that are used in the computer.