Deep brain stimulation (DBS) is a neurosurgical procedure involving the placement of a medical device called a neurostimulator (sometimes referred to as a "brain pacemaker"), which sends electrical impulses, through implanted electrodes, to specific targets in the brain (brain nuclei) for the treatment of movement disorders, including Parkinson's disease, essential tremor, and dystonia.
While its underlying principles and mechanisms are not fully
understood, DBS directly changes brain activity in a controlled manner.
DBS is used to manage some of the symptoms of Parkinson's disease that cannot be adequately controlled with medications.
It is recommended for people who have PD with motor fluctuations and
tremor inadequately controlled by medication, or to those who are
intolerant to medication, as long as they do not have severe neuropsychiatric problems. Four areas of the brain have been treated with neural stimulators in PD. These are the globus pallidus internus, thalamus, subthalamic nucleus and the pedunculopontine nucleus. However, most DBS surgeries in routine practice target either the globus pallidus internus, or the Subthalamic nucleus.
DBS of the globus pallidus internus reduces uncontrollable shaking movements called dyskinesias.
This enables a patient to take adequate quantities of medications
(especially levodopa), thus leading to better control of symptoms.
DBS of the subthalamic nucleus directly reduces symptoms of
Parkinson's. This enables a decrease in the dose of anti-parkinonian
medications.
DBS of the PPN may help with freezing of gait, while DBS of the
thalamus may help with tremor. These targets are not routinely utilized.
Selection of the correct DBS target is a complicated process.
Multiple clinical characteristics are used to select the target
including – identifying the most troublesome symptoms, the dose of
levodopa that the patient is currently taking, the effects and
side-effects of current medications and concurrent problems. For
example, subthalamic nucleus DBS may worsen depression and hence is not
preferred in patients with uncontrolled depression.
Generally DBS is associated with 30–60% improvement in motor score evaluations.
Tourette syndrome
DBS has been used experimentally in treating adults with severe Tourette syndrome that does not respond to conventional treatment. Despite widely publicized early successes, DBS remains a highly experimental procedure for the treatment of Tourette's, and more study is needed to determine whether long-term benefits outweigh the risks.
The procedure is well tolerated, but complications include "short
battery life, abrupt symptom worsening upon cessation of stimulation,
hypomanic or manic conversion, and the significant time and effort
involved in optimizing stimulation parameters".
As of 2006, five people with TS had been reported on; all experienced
reduction in tics and the disappearance of obsessive-compulsive
behaviors.
The procedure is invasive and expensive, and requires long-term
expert care. Benefits for severe Tourette's are not conclusive,
considering less robust effects of this surgery seen in the Netherlands. Tourette's is more common in pediatric
populations, tending to remit in adulthood, so in general this would
not be a recommended procedure for use on children. Because diagnosis of
Tourette's is made based on a history of symptoms rather than analysis
of neurological activity, it may not always be clear how to apply DBS
for a particular person. Due to concern over the use of DBS in Tourette syndrome treatment, the Tourette Association of America convened a group of experts to develop recommendations guiding the use and potential clinical trials of DBS for TS.
Robertson reported that DBS had been used on 55 adults by 2011,
remained an experimental treatment at that time, and recommended that
the procedure "should only be conducted by experienced functional
neurosurgeons operating in centres which also have a dedicated Tourette
syndrome clinic". According to Malone et al.
(2006), "Only patients with severe, debilitating, and
treatment-refractory illness should be considered; while those with
severe personality disorders and substance-abuse problems should be
excluded." Du et al. (2010) say, "As an invasive therapy, DBS is currently only advisable for severely affected, treatment-refractory TS adults".
Singer (2011) says, "pending determination of patient selection
criteria and the outcome of carefully controlled clinical trials, a
cautious approach is recommended". Viswanathan et al. (2012) say DBS should be used for people with "severe functional impairment that cannot be managed medically".
Adverse effects
Arteriogram of the arterial supply that can hemorrhage during DBS implantation.
DBS carries the risks of major surgery, with a complication rate
related to the experience of the surgical team. The major complications
include hemorrhage (1–2%) and infection (3–5%).
Because the brain can shift slightly during surgery, the
electrodes can become displaced or dislodged from the specific location.
This may cause more profound complications such as personality changes,
but electrode misplacement is relatively easy to identify using CT scan.
Also, complications of surgery may occur, such as bleeding within the
brain. After surgery, swelling of the brain tissue, mild disorientation,
and sleepiness are normal. After 2–4 weeks, a follow-up visit is used
to remove sutures, turn on the neurostimulator, and program it.
Impaired swimming skills surfaced as an unexpected risk of the
procedure; several Parkinson's disease patients lost their ability to
swim after receiving deep brain stimulation.
Mechanisms
The exact mechanism of action of DBS is not known. A variety of hypotheses try to explain the mechanisms of DBS:
Depolarization blockade: Electrical currents block the neuronal output at or near the electrode site.
Synaptic inhibition: This causes an indirect regulation of the
neuronal output by activating axon terminals with synaptic connections
to neurons near the stimulating electrode.
Desynchronization of abnormal oscillatory activity of neurons
Antidromic activation either activating/blockading distant neurons or blockading slow axons
DBS represents an advance on previous treatments which involved pallidotomy (i.e., surgical ablation of the globus pallidus) or thalamotomy (i.e., surgical ablation of the thalamus). Instead, a thin lead with multiple electrodes is implanted in the globus pallidus, nucleus ventralis intermedius thalami, or subthalamic nucleus, and electric pulses are used therapeutically. The lead from the implant is extended to the neurostimulator under the skin in the chest area.
Its direct effect on the physiology of brain cells and neurotransmitters
is currently debated, but by sending high-frequency electrical impulses
into specific areas of the brain, it can mitigate symptoms and directly diminish the side effects induced by PD medications, allowing a decrease in medications, or making a medication regimen more tolerable.
Components and placement
The DBS system consists of three components: the implanted pulse generator (IPG), the lead, and an extension. The IPG is a battery-powered neurostimulator encased in a titanium housing, which sends electrical pulses to the brain that interfere with neuralactivity at the target site. The lead is a coiled wire insulated in polyurethane with four platinum-iridium
electrodes and is placed in one or two different nuclei of the brain.
The lead is connected to the IPG by an extension, an insulated wire that
runs below the skin, from the head, down the side of the neck, behind
the ear, to the IPG, which is placed subcutaneously below the clavicle, or in some cases, the abdomen. The IPG can be calibrated by a neurologist, nurse, or trained technician to optimize symptom suppression and control side effects.
All three components are surgically implanted inside the body.
Lead implantation may take place under local anesthesia or under general
anesthesia ("asleep DBS") such as for dystonia. A hole about 14 mm in
diameter is drilled in the skull and the probe electrode is inserted stereotactically, using either frame-based or frameless stereotaxis.
During the awake procedure with local anesthesia, feedback from the
person is used to determine the optimal placement of the permanent
electrode. During the asleep procedure, intraoperative MRI guidance is
used for direct visualization of brain tissue and device. The installation of the IPG and extension leads occurs under general anesthesia. The right side of the brain is stimulated to address symptoms on the left side of the body and vice versa.
Major depression and obsessive-compulsive disorder
Lateral X-ray of the head: Deep brain stimulation in obsessive–compulsive disorder (OCD). 42 year old man, surgery in 2013.
DBS has been used in a small number of clinical trials to treat people with severe treatment-resistant depression (TRD).
A number of neuroanatomical targets have been used for DBS for TRD
including the subgenual cingulate gyrus, posterior gyrus rectus, nucleus accumbens, ventral capsule/ventral striatum, inferior thalamic peduncle, and the lateral habenula. A recently proposed target of DBS intervention in depression is the superolateral branch of the medial forebrain bundle; its stimulation lead to surprisingly rapid antidepressant effects.
The small numbers in the early trials of DBS for TRD currently limit the selection of an optimal neuroanatomical target. Evidence is insufficient to support DBS as a therapeutic modality for depression; however, the procedure may be an effective treatment modality in the future.
In fact, beneficial results have been documented in the neurosurgical
literature, including a few instances in which people who were deeply
depressed were provided with portable stimulators for self treatment.
A systematic review of DBS for TRD and OCD identified 23 cases,
nine for OCD, seven for TRD, and one for both. "[A]bout half the
patients did show dramatic improvement" and adverse events were
"generally trivial" given the younger age of the psychiatric population
relative to the age of people with movement disorders.
The first randomized, controlled study of DBS for the treatment of TRD
targeting the ventral capsule/ventral striatum area did not demonstrate a
significant difference in response rates between the active and sham
groups at the end of a 16-week study.
However, a second randomized controlled study of ventral capsule DBS
for TRD did demonstrate a significant difference in response rates
between active DBS (44% responders) and sham DBS (0% responders). Efficacy of DBS is established for OCD, with on average 60% responders in severely ill and treatment-resistant patients.
Based on these results the FDA has approved DBS for treatment-resistant
OCD under a Humanitarian Device Exemption (HDE), requiring that the
procedure be performed only in a hospital with specialist qualifications
to do so.
DBS for TRD can be as effective as antidepressants and can have
good response and remission rates, but adverse effects and safety must
be more fully evaluated. Common side effects include "wound infection,
perioperative headache, and worsening/irritable mood [and] increased
suicidality".
Other clinical applications
Results
of DBS in people with dystonia, where positive effects often appear
gradually over a period of weeks to months, indicate a role of
functional reorganization in at least some cases. The procedure has been tested for effectiveness in people with epilepsy that is resistant to medication. DBS may reduce or eliminate epileptic seizures with programmed or responsive stimulation.
DBS of the septal areas of persons with schizophrenia have resulted in enhanced alertness, cooperation, and euphoria. Persons with narcolepsy and complex-partial seizures also reported euphoria and sexual thoughts from self-elicited DBS of the septal nuclei.
Orgasmic ecstasy was reported with the electrical stimulation of the brain with depth electrodes in the left hippocampus at 3mA, and the right hippocampus at 1 mA.
In 2015, a group of Brazilian researchers led by neurosurgeon Erich Fonoff [pt]
described a new technique that allows for simultaneous implants of
electrodes called bilateral stereotactic procedure for DBS. The main
benefits are less time spent on the procedure and greater accuracy.
In 2016, DBS was found to improve learning and memory in a mouse model of Rett syndrome.
More recent (2018) work showed, that forniceal DBS upregulates genes
involved in synaptic function, cell survival, and neurogenesis, making some first steps at explaining the restoration of hippocampal circuit function.
A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a computer virus.
Computer viruses generally require a host program.
The virus writes its own code into the host program. When the program
runs, the written virus program is executed first, causing infection and
damage. A computer worm does not need a host program, as it is an independent program or code chunk. Therefore, it is not restricted by the host program, but can run independently and actively carry out attacks.
Computer viruses cause billions of dollars' worth of economic damage each year.
In 1989 The ADAPSO Software Industry Division published Dealing With Electronic Vandalism, in which they followed the risk of data loss by "the added risk of losing customer confidence."
Damage
is due to causing system failure, corrupting data, wasting computer
resources, increasing maintenance costs or stealing personal
information. Even though no antivirus software can uncover all computer
viruses (especially new ones), computer security researchers are
actively searching for new ways to enable antivirus solutions to more
effectively detect emerging viruses, before they become widely
distributed.
The term "virus" is also misused by extension to refer to other types
of malware. "Malware" encompasses computer viruses along with many
other forms of malicious software, such as computer "worms", ransomware, spyware, adware, trojan horses, keyloggers, rootkits, bootkits, malicious Browser Helper Object
(BHOs), and other malicious software. The majority of active malware
threats are trojan horse programs or computer worms rather than computer
viruses. The term computer virus, coined by Fred Cohen in 1985, is a misnomer.[24] Viruses often perform some type of harmful activity on infected host computers, such as acquisition of hard disk space or central processing unit (CPU) time, accessing and stealing private information (e.g., credit card numbers, debit card
numbers, phone numbers, names, email addresses, passwords, bank
information, house addresses, etc.), corrupting data, displaying
political, humorous or threatening messages on the user's screen, spamming their e-mail contacts, logging their keystrokes, or even rendering the computer useless. However, not all viruses carry a destructive "payload"
and attempt to hide themselves—the defining characteristic of viruses
is that they are self-replicating computer programs that modify other
software without user consent by injecting themselves into the said
programs, similar to a biological virus which replicates within living
cells.
The first academic work on the theory of self-replicating computer programs[25] was done in 1949 by John von Neumann who gave lectures at the University of Illinois about the "Theory and Organization of Complicated Automata".
The work of von Neumann was later published as the "Theory of
self-reproducing automata". In his essay von Neumann described how a
computer program could be designed to reproduce itself.[26]
Von Neumann's design for a self-reproducing computer program is
considered the world's first computer virus, and he is considered to be
the theoretical "father" of computer virology.[27] In 1972, Veith Risak directly building on von Neumann's work on self-replication,
published his article "Selbstreproduzierende Automaten mit minimaler
Informationsübertragung" (Self-reproducing automata with minimal
information exchange).[28] The article describes a fully functional virus written in assembler programming language for a SIEMENS 4004/35 computer system. In 1980 Jürgen Kraus wrote his diplom thesis "Selbstreproduktion bei Programmen" (Self-reproduction of programs) at the University of Dortmund.[29] In his work Kraus postulated that computer programs can behave in a way similar to biological viruses.
Science fiction
The first known description of a self-reproducing program in fiction is in the 1970 short story The Scarred Man by Gregory Benford which describes a computer program called VIRUS which, when installed on a computer with telephone modem
dialing capability, randomly dials phone numbers until it hits a modem
that is answered by another computer, and then attempts to program the
answering computer with its own program, so that the second computer
will also begin dialing random numbers, in search of yet another
computer to program. The program rapidly spreads exponentially through
susceptible computers and can only be countered by a second program
called VACCINE.[30]
The 1973 Michael Crichtonsci-fi movie Westworld made an early mention of the concept of a computer virus, being a central plot theme that causes androids to run amok.[32]Alan Oppenheimer's
character summarizes the problem by stating that "...there's a clear
pattern here which suggests an analogy to an infectious disease process,
spreading from one...area to the next." To which the replies are
stated: "Perhaps there are superficial similarities to disease" and, "I
must confess I find it difficult to believe in a disease of machinery."[33]
First examples
The MacMag virus 'Universal Peace', as displayed on a Mac in March 1988
The Creeper virus was first detected on ARPANET, the forerunner of the Internet, in the early 1970s.[34] Creeper was an experimental self-replicating program written by Bob Thomas at BBN Technologies in 1971.[35] Creeper used the ARPANET to infect DECPDP-10 computers running the TENEX operating system.[36]
Creeper gained access via the ARPANET and copied itself to the remote
system where the message, "I'm the creeper, catch me if you can!" was
displayed. The Reaper program was created to delete Creeper.[37]
In 1982, a program called "Elk Cloner"
was the first personal computer virus to appear "in the wild"—that is,
outside the single computer or computer lab where it was created.[38] Written in 1981 by Richard Skrenta, a ninth grader at Mount Lebanon High School near Pittsburgh, it attached itself to the Apple DOS 3.3 operating system and spread via floppy disk.[38] On its 50th use the Elk Cloner
virus would be activated, infecting the personal computer and
displaying a short poem beginning "Elk Cloner: The program with a
personality."
In 1984 Fred Cohen from the University of Southern California wrote his paper "Computer Viruses – Theory and Experiments".[39] It was the first paper to explicitly call a self-reproducing program a "virus", a term introduced by Cohen's mentor Leonard Adleman. In 1987, Fred Cohen published a demonstration that there is no algorithm that can perfectly detect all possible viruses.[40] Fred Cohen's theoretical compression virus[41] was an example of a virus which was not malicious software (malware),
but was putatively benevolent (well-intentioned). However, antivirus
professionals do not accept the concept of "benevolent viruses", as any
desired function can be implemented without involving a virus (automatic
compression, for instance, is available under Windows
at the choice of the user). Any virus will by definition make
unauthorised changes to a computer, which is undesirable even if no
damage is done or intended. The first page of Dr Solomon's Virus Encyclopaedia explains the undesirability of viruses, even those that do nothing but reproduce.[42][5]
An article that describes "useful virus functionalities" was published by J. B. Gunn under the title "Use of virus functions to provide a virtual APL interpreter under user control" in 1984.[43] The first IBM PC virus in the "wild" was a boot sector virus dubbed (c)Brain,[44] created in 1986 by Amjad Farooq Alvi and Basit Farooq Alvi in Lahore, Pakistan, reportedly to deter unauthorized copying of the software they had written.[45] The first virus to specifically target Microsoft Windows, WinVir was discovered in April 1992, two years after the release of Windows 3.0.[46] The virus did not contain any Windows APIcalls, instead relying on DOS interrupts.
A few years later, in February 1996, Australian hackers from the
virus-writing crew VLAD created the Bizatch virus (also known as "Boza"
virus), which was the first known virus to target Windows 95. In late 1997 the encrypted, memory-resident stealth virus Win32.Cabanas was released—the first known virus that targeted Windows NT (it was also able to infect Windows 3.0 and Windows 9x hosts).[47]
Even home computers were affected by viruses. The first one to appear on the Commodore Amiga was a boot sector virus called SCA virus, which was detected in November 1987.[48]
Operations and functions
Parts
A viable computer virus must contain a search routine,
which locates new files or new disks that are worthwhile targets for
infection. Secondly, every computer virus must contain a routine to copy
itself into the program which the search routine locates.[49] The three main virus parts are:
Infection mechanism (also called 'infection vector'):
This is how the virus spreads or propagates. A virus typically has a
search routine, which locates new files or new disks for infection.[50]
Trigger: Also known as a logic bomb, this is the compiled version that could be activated any time within an executable file when the virus is run that determines the event or condition for the malicious "payload" to be activated or delivered[51]
such as a particular date, a particular time, particular presence of
another program, capacity of the disk exceeding some limit,[52] or a double-click that opens a particular file.[53]
Payload: The "payload"
is the actual body or data which carries out the malicious purpose of
the virus. Payload activity might be noticeable (e.g., because it causes
the system to slow down or "freeze"), as most of the time the "payload"
itself is the harmful activity,[50] or some times non-destructive but distributive, which is called virus hoax.[54]
Phases
Virus phases is the life cycle of the computer virus, described by using an analogy to biology. This life cycle can be divided into four phases:
Dormant phase: The virus program is idle during this
stage. The virus program has managed to access the target user's
computer or software, but during this stage, the virus does not take any
action. The virus will eventually be activated by the "trigger" which
states which event will execute the virus. Not all viruses have this
stage.[50]
Propagation phase: The virus starts propagating, which is
multiplying and replicating itself. The virus places a copy of itself
into other programs or into certain system areas on the disk. The copy
may not be identical to the propagating version; viruses often "morph"
or change to evade detection by IT professionals and anti-virus
software. Each infected program will now contain a clone of the virus, which will itself enter a propagation phase.[50]
Triggering phase: A dormant virus moves into this phase when
it is activated, and will now perform the function for which it was
intended. The triggering phase can be caused by a variety of system
events, including a count of the number of times that this copy of the
virus has made copies of itself.[50]
The trigger may occur when an employee is terminated from their
employment or after a set period of time has elapsed, in order to reduce
suspicion.
Execution phase: This is the actual work of the virus, where
the "payload" will be released. It can be destructive such as deleting
files on disk, crashing the system, or corrupting files or relatively
harmless such as popping up humorous or political messages on screen.[50]
Infection targets and replication techniques
Computer viruses infect a variety of different subsystems on their host computers and software.[55] One manner of classifying viruses is to analyze whether they reside in binary executables (such as .EXE or .COM files), data files (such as Microsoft Word documents or PDF files), or in the boot sector of the host's hard drive (or some combination of all of these).[56][57]
Resident vs. non-resident viruses
A memory-resident virus (or simply "resident virus") installs itself as part of the operating system when executed, after which it remains in RAM from the time the computer is booted up to when it is shut down. Resident viruses overwrite interrupt handling code or other functions,
and when the operating system attempts to access the target file or
disk sector, the virus code intercepts the request and redirects the control flow to the replication module, infecting the target. In contrast, a non-memory-resident virus
(or "non-resident virus"), when executed, scans the disk for targets,
infects them, and then exits (i.e. it does not remain in memory after it
is done executing).[58][59][60]
Macro viruses
Many common applications, such as Microsoft Outlook and Microsoft Word, allow macro programs to be embedded in documents or emails, so that the programs may be run automatically when the document is opened. A macro virus (or "document virus") is a virus that is written in a macro language
and embedded into these documents so that when users open the file, the
virus code is executed, and can infect the user's computer. This is one
of the reasons that it is dangerous to open unexpected or suspicious attachments in e-mails.[61][62]
While not opening attachments in e-mails from unknown persons or
organizations can help to reduce the likelihood of contracting a virus,
in some cases, the virus is designed so that the e-mail appears to be
from a reputable organization (e.g., a major bank or credit card
company).
The most common way of transmission of computer viruses in boot
sector is physical media. When reading the VBR of the drive, the
infected floppy disk or USB flash drive connected to the computer will
transfer data, and then modify or replace the existing boot code. The
next time a user tries to start the desktop, the virus will immediately
load and run as part of the master boot record.[66]
Email virus
Email
viruses are viruses that intentionally, rather than accidentally, uses
the email system to spread. While virus infected files may be
accidentally sent as email attachments, email viruses are aware of email system functions. They generally target a specific type of email system (Microsoft Outlook
is the most commonly used), harvest email addresses from various
sources, and may append copies of themselves to all email sent, or may
generate email messages containing copies of themselves as attachments.[67]
Stealth techniques
To avoid detection by users, some viruses employ different kinds of deception. Some old viruses, especially on the DOS
platform, make sure that the "last modified" date of a host file stays
the same when the file is infected by the virus. This approach does not
fool antivirus software, however, especially those which maintain and date cyclic redundancy checks on file changes.[68]
Some viruses can infect files without increasing their sizes or
damaging the files. They accomplish this by overwriting unused areas of
executable files. These are called cavity viruses. For example, the CIH virus, or Chernobyl Virus, infects Portable Executable files. Because those files have many empty gaps, the virus, which was 1 KB in length, did not add to the size of the file.[69]
Some viruses try to avoid detection by killing the tasks associated
with antivirus software before it can detect them (for example, Conficker).
In the 2010s, as computers and operating systems grow larger and more
complex, old hiding techniques need to be updated or replaced. Defending
a computer against viruses may demand that a file system migrate
towards detailed and explicit permission for every kind of file access.[citation needed]
Read request intercepts
While
some kinds of antivirus software employ various techniques to counter
stealth mechanisms, once the infection occurs any recourse to "clean"
the system is unreliable. In Microsoft Windows operating systems, the NTFS file system
is proprietary. This leaves antivirus software a little alternative but
to send a "read" request to Windows files that handle such requests.
Some viruses trick antivirus software by intercepting its requests to
the operating system. A virus can hide by intercepting the request to
read the infected file, handling the request itself, and returning an
uninfected version of the file to the antivirus software. The
interception can occur by code injection
of the actual operating system files that would handle the read
request. Thus, an antivirus software attempting to detect the virus
will either not be permitted to read the infected file, or, the "read"
request will be served with the uninfected version of the same file.[70]
The only reliable method to avoid "stealth" viruses is to
"reboot" from a medium that is known to be "clear". Security software
can then be used to check the dormant operating system files. Most
security software relies on virus signatures, or they employ heuristics.[71][72] Security software may also use a database of file "hashes"
for Windows OS files, so the security software can identify altered
files, and request Windows installation media to replace them with
authentic versions. In older versions of Windows, file cryptographic hash functions of Windows OS files stored in Windows—to allow file integrity/authenticity to be checked—could be overwritten so that the System File Checker
would report that altered system files are authentic, so using file
hashes to scan for altered files would not always guarantee finding an
infection.[73]
Most modern antivirus programs try to find virus-patterns inside ordinary programs by scanning them for so-called virus signatures.[74]
Unfortunately, the term is misleading, in that viruses do not possess
unique signatures in the way that human beings do. Such a virus
"signature" is merely a sequence of bytes that an antivirus program
looks for because it is known to be part of the virus. A better term
would be "search strings".
Different antivirus programs will employ different search strings, and
indeed different search methods, when identifying viruses. If a virus
scanner finds such a pattern in a file, it will perform other checks to
make sure that it has found the virus, and not merely a coincidental
sequence in an innocent file, before it notifies the user that the file
is infected. The user can then delete, or (in some cases) "clean" or
"heal" the infected file. Some viruses employ techniques that make
detection by means of signatures difficult but probably not impossible.
These viruses modify their code on each infection. That is, each
infected file contains a different variant of the virus.[citation needed]
Encrypted viruses
One method of evading signature detection is to use simple encryption to encipher (encode) the body of the virus, leaving only the encryption module and a static cryptographic key in cleartext which does not change from one infection to the next.[75]
In this case, the virus consists of a small decrypting module and an
encrypted copy of the virus code. If the virus is encrypted with a
different key for each infected file, the only part of the virus that
remains constant is the decrypting module, which would (for example) be
appended to the end. In this case, a virus scanner cannot directly
detect the virus using signatures, but it can still detect the
decrypting module, which still makes indirect detection of the virus
possible. Since these would be symmetric keys, stored on the infected
host, it is entirely possible to decrypt the final virus, but this is
probably not required, since self-modifying code is such a rarity that finding some may be reason enough for virus scanners to at least "flag" the file as suspicious.[citation needed]
An old but compact way will be the use of arithmetic operation like
addition or subtraction and the use of logical conditions such as XORing,[76]
where each byte in a virus is with a constant so that the exclusive-or
operation had only to be repeated for decryption. It is suspicious for a
code to modify itself, so the code to do the encryption/decryption may
be part of the signature in many virus definitions.[citation needed]
A simpler older approach did not use a key, where the encryption
consisted only of operations with no parameters, like incrementing and
decrementing, bitwise rotation, arithmetic negation, and logical NOT.[76]
Some viruses, called polymorphic viruses, will employ a means of
encryption inside an executable in which the virus is encrypted under
certain events, such as the virus scanner being disabled for updates or
the computer being rebooted.[77] This is called cryptovirology.
Polymorphic code
Polymorphic code was the first technique that posed a serious threat
to virus scanners. Just like regular encrypted viruses, a polymorphic
virus infects files with an encrypted copy of itself, which is decoded
by a decryption
module. In the case of polymorphic viruses, however, this decryption
module is also modified on each infection. A well-written polymorphic
virus therefore has no parts which remain identical between infections,
making it very difficult to detect directly using "signatures".[78][79] Antivirus software can detect it by decrypting the viruses using an emulator, or by statistical pattern analysis of the encrypted virus body. To enable polymorphic code, the virus has to have a polymorphic engine (also called "mutating engine" or "mutation engine") somewhere in its encrypted body. See polymorphic code for technical detail on how such engines operate.[80]
Some viruses employ polymorphic code in a way that constrains the
mutation rate of the virus significantly. For example, a virus can be
programmed to mutate only slightly over time, or it can be programmed to
refrain from mutating when it infects a file on a computer that already
contains copies of the virus. The advantage of using such slow
polymorphic code is that it makes it more difficult for antivirus
professionals and investigators to obtain representative samples of the
virus, because "bait" files that are infected in one run will typically
contain identical or similar samples of the virus. This will make it
more likely that the detection by the virus scanner will be unreliable,
and that some instances of the virus may be able to avoid detection.
Metamorphic code
To
avoid being detected by emulation, some viruses rewrite themselves
completely each time they are to infect new executables. Viruses that
utilize this technique are said to be in metamorphic code. To enable metamorphism, a "metamorphic engine" is needed. A metamorphic virus is usually very large and complex. For example, W32/Simile consisted of over 14,000 lines of assembly language code, 90% of which is part of the metamorphic engine.[81][82]
Vulnerabilities and infection vectors
Software bugs
As
software is often designed with security features to prevent
unauthorized use of system resources, many viruses must exploit and
manipulate security bugs, which are security defects in a system or application software, to spread themselves and infect other computers. Software development strategies that produce large numbers of "bugs" will generally also produce potential exploitable "holes" or "entrances" for the virus.
Social engineering and poor security practices
To
replicate itself, a virus must be permitted to execute code and write
to memory. For this reason, many viruses attach themselves to executable files that may be part of legitimate programs (see code injection). If a user attempts to launch an infected program, the virus' code may be executed simultaneously.[83] In operating systems that use file extensions
to determine program associations (such as Microsoft Windows), the
extensions may be hidden from the user by default. This makes it
possible to create a file that is of a different type than it appears to
the user. For example, an executable may be created and named
"picture.png.exe", in which the user sees only "picture.png" and
therefore assumes that this file is a digital image and most likely is safe, yet when opened, it runs the executable on the client machine.[84] Viruses may be installed on removable media, such as flash drives.
The drives may be left in a parking lot of a government building or
other target, with the hopes that curious users will insert the drive
into a computer. In a 2015 experiment, researchers at the University of
Michigan found that 45–98 percent of users would plug in a flash drive
of unknown origin.[85]
Vulnerability of different operating systems
The vast majority of viruses target systems running Microsoft Windows. This is due to Microsoft's large market share of desktop computer users.[86] The diversity of software systems on a network limits the destructive potential of viruses and malware.[87]Open-source operating systems such as Linux allow users to choose from a variety of desktop environments,
packaging tools, etc., which means that malicious code targeting any of
these systems will only affect a subset of all users. Many Windows
users are running the same set of applications, enabling viruses to
rapidly spread among Microsoft Windows systems by targeting the same
exploits on large numbers of hosts.[14][15][16][88]
While Linux and Unix in general have always natively prevented normal users from making changes to the operating system
environment without permission, Windows users are generally not
prevented from making these changes, meaning that viruses can easily
gain control of the entire system on Windows hosts. This difference has
continued partly due to the widespread use of administrator accounts in contemporary versions like Windows XP. In 1997, researchers created and released a virus for Linux—known as "Bliss".[89]
Bliss, however, requires that the user run it explicitly, and it can
only infect programs that the user has the access to modify. Unlike
Windows users, most Unix users do not log in as an administrator, or "root user",
except to install or configure software; as a result, even if a user
ran the virus, it could not harm their operating system. The Bliss virus
never became widespread, and remains chiefly a research curiosity. Its
creator later posted the source code to Usenet, allowing researchers to see how it worked.[90]
Many users install antivirus software that can detect and eliminate known viruses when the computer attempts to download or run the executable file (which may be distributed as an email attachment, or on USB flash drives,
for example). Some antivirus software blocks known malicious websites
that attempt to install malware. Antivirus software does not change the
underlying capability of hosts to transmit viruses. Users must update
their software regularly to patchsecurity vulnerabilities ("holes"). Antivirus software also needs to be regularly updated to recognize the latest threats. This is because malicious hackers and other individuals are always creating new viruses. The German AV-TEST Institute publishes evaluations of antivirus software for Windows[91] and Android.[92]
Examples of Microsoft Windows anti virus and anti-malware software include the optional Microsoft Security Essentials[93] (for Windows XP, Vista and Windows 7) for real-time protection, the Windows Malicious Software Removal Tool[94] (now included with Windows (Security) Updates on "Patch Tuesday", the second Tuesday of each month), and Windows Defender (an optional download in the case of Windows XP).[95]
Additionally, several capable antivirus software programs are available
for free download from the Internet (usually restricted to
non-commercial use).[96] Some such free programs are almost as good as commercial
competitors.[97] Common security vulnerabilities are assigned CVE IDs and listed in the US National Vulnerability Database. Secunia PSI[98]
is an example of software, free for personal use, that will check a PC
for vulnerable out-of-date software, and attempt to update it. Ransomware and phishingscam alerts appear as press releases on the Internet Crime Complaint Center noticeboard.
Ransomware is a virus that posts a message on the user's screen saying
that the screen or system will remain locked or unusable until a ransom payment is made. Phishing
is a deception in which the malicious individual pretends to be a
friend, computer security expert, or other benevolent individual, with
the goal of convincing the targeted individual to reveal passwords or other personal information.
Other commonly used preventive measures include timely operating
system updates, software updates, careful Internet browsing (avoiding
shady websites), and installation of only trusted software.[99] Certain browsers flag sites that have been reported to Google and that have been confirmed as hosting malware by Google.[100][101]
There are two common methods that an antivirus software application uses to detect viruses, as described in the antivirus software article. The first, and by far the most common method of virus detection is using a list of virus signature definitions. This works by examining the content of the computer's memory (its Random Access Memory (RAM), and boot sectors)
and the files stored on fixed or removable drives (hard drives, floppy
drives, or USB flash drives), and comparing those files against a database
of known virus "signatures". Virus signatures are just strings of code
that are used to identify individual viruses; for each virus, the
antivirus designer tries to choose a unique signature string that will
not be found in a legitimate program. Different antivirus programs use
different "signatures" to identify viruses. The disadvantage of this
detection method is that users are only protected from viruses that are
detected by signatures in their most recent virus definition update, and
not protected from new viruses (see "zero-day attack").[102]
A second method to find viruses is to use a heuristicalgorithm
based on common virus behaviors. This method can detect new viruses for
which antivirus security firms have yet to define a "signature", but it
also gives rise to more false positives
than using signatures. False positives can be disruptive, especially in
a commercial environment, because it may lead to a company instructing
staff not to use the company computer system until IT services have
checked the system for viruses. This can slow down productivity for
regular workers.
Recovery strategies and methods
One may reduce the damage done by viruses by making regular backups
of data (and the operating systems) on different media, that are either
kept unconnected to the system (most of the time, as in a hard drive), read-only or not accessible for other reasons, such as using different file systems. This way, if data is lost through a virus, one can start again using the backup (which will hopefully be recent).[103] If a backup session on optical media like CD and DVD
is closed, it becomes read-only and can no longer be affected by a
virus (so long as a virus or infected file was not copied onto the CD/DVD). Likewise, an operating system on a bootable
CD can be used to start the computer if the installed operating systems
become unusable. Backups on removable media must be carefully inspected
before restoration. The Gammima virus, for example, propagates via
removable flash drives.[104][105]
Virus removal
Many
websites run by antivirus software companies provide free online virus
scanning, with limited "cleaning" facilities (after all, the purpose of
the websites is to sell antivirus products and services). Some
websites—like Google subsidiary VirusTotal.com—allow
users to upload one or more suspicious files to be scanned and checked
by one or more antivirus programs in one operation.[106][107]
Additionally, several capable antivirus software programs are available
for free download from the Internet (usually restricted to
non-commercial use).[108] Microsoft offers an optional free antivirus utility called Microsoft Security Essentials, a Windows Malicious Software Removal Tool that is updated as part of the regular Windows update regime, and an older optional anti-malware (malware removal) tool Windows Defender that has been upgraded to an antivirus product in Windows 8.
Some viruses disable System Restore and other important Windows tools such as Task Manager and CMD. An example of a virus that does this is CiaDoor. Many such viruses can be removed by rebooting the computer, entering Windows "safe mode" with networking, and then using system tools or Microsoft Safety Scanner.[109]System Restore on Windows Me, Windows XP, Windows Vista and Windows 7 can restore the registry
and critical system files to a previous checkpoint. Often a virus will
cause a system to "hang" or "freeze", and a subsequent hard reboot will
render a system restore point from the same day corrupted. Restore
points from previous days should work, provided the virus is not
designed to corrupt the restore files and does not exist in previous
restore points.[110][111]
Operating system reinstallation
Microsoft's System File Checker (improved in Windows 7 and later) can be used to check for, and repair, corrupted system files.[112] Restoring an earlier "clean" (virus-free) copy of the entire partition from a cloned disk, a disk image, or a backup
copy is one solution—restoring an earlier backup disk "image" is
relatively simple to do, usually removes any malware, and may be faster
than "disinfecting" the computer—or reinstalling and reconfiguring the
operating system and programs from scratch, as described below, then
restoring user preferences.[103]
Reinstalling the operating system is another approach to virus removal.
It may be possible to recover copies of essential user data by booting
from a live CD,
or connecting the hard drive to another computer and booting from the
second computer's operating system, taking great care not to infect that
computer by executing any infected programs on the original drive. The
original hard drive can then be reformatted and the OS and all programs
installed from original media. Once the system has been restored,
precautions must be taken to avoid reinfection from any restored executable files.[113]
Before computer networks became widespread, most viruses spread on removable media, particularly floppy disks. In the early days of the personal computer,
many users regularly exchanged information and programs on floppies.
Some viruses spread by infecting programs stored on these disks, while
others installed themselves into the disk boot sector,
ensuring that they would be run when the user booted the computer from
the disk, usually inadvertently. Personal computers of the era would
attempt to boot first from a floppy if one had been left in the drive.
Until floppy disks fell out of use, this was the most successful
infection strategy and boot sector viruses were the most common in the
"wild" for many years. Traditional computer viruses emerged in the
1980s, driven by the spread of personal computers and the resultant
increase in bulletin board system (BBS), modem use, and software sharing. Bulletin board–driven software sharing contributed directly to the spread of Trojan horse programs, and viruses were written to infect popularly traded software. Shareware and bootleg software were equally common vectors for viruses on BBSs.[114][115] Viruses can increase their chances of spreading to other computers by infecting files on a network file system or a file system that is accessed by other computers.[116]
Macro viruses
have become common since the mid-1990s. Most of these viruses are
written in the scripting languages for Microsoft programs such as Microsoft Word and Microsoft Excel and spread throughout Microsoft Office by infecting documents and spreadsheets. Since Word and Excel were also available for Mac OS, most could also spread to Macintosh computers. Although most of these viruses did not have the ability to send infected email messages, those viruses which did take advantage of the Microsoft OutlookComponent Object Model (COM) interface.[117][118]
Some old versions of Microsoft Word allow macros to replicate
themselves with additional blank lines. If two macro viruses
simultaneously infect a document, the combination of the two, if also
self-replicating, can appear as a "mating" of the two and would likely
be detected as a virus unique from the "parents".[119]
A virus may also send a web address link as an instant message
to all the contacts (e.g., friends and colleagues' e-mail addresses)
stored on an infected machine. If the recipient, thinking the link is
from a friend (a trusted source) follows the link to the website, the
virus hosted at the site may be able to infect this new computer and
continue propagating.[120] Viruses that spread using cross-site scripting were first reported in 2002,[121] and were academically demonstrated in 2005.[122] There have been multiple instances of the cross-site scripting viruses in the "wild", exploiting websites such as MySpace (with the Samy worm) and Yahoo!.
