Virus Research and Defense

© February 2005 Tony Lawrence
February 2005

Warning: heavy geek zone ahead.

Over 700 pages and two and a half pounds of virus information: history, methodology, analysis of specific attacks, analysis of detection techniques and more, all presented in fantastic detail.

Peter Szor is Symantec's chief antivirus researcher. He saw his first computer virus in 1990 when his own system was infected with the "Stoned" virus. At that time, Peter didn't even know assembly language, but he figured out that this was a boot sector virus and eventually wrote a program to eradicate it. That began his career as a virus researcher.

According to Peter, the first microcomputer virus was Elk Cloner. Things have changed a bit since then: viri might take weeks or even years to spread any significant amount. Nowadays, viruses spread so quickly that many, many machines can get infected before the virus is even noticed.

This book can be heavy geek territory. If you aren't fascinated by the details of executable programs and the like, some of this will be hard sledding. But if you are the type who likes to take things apart to see how they work, this is for you. A lot of this is, of course Windows related, but there is also coverage of Linux viruses and worms. All sorts of virus types are explored and laid out in general, and certain specific instances are explored in great detail. I have learned a lot just in my first quick read-through, and expect to spend many hours reading details more thoroughly. It's really an encyclopedic piece of work.

I was interested in Peter's description of how Macro viruses can mutate due to a bug in Microsoft's code. I was not surprised to hear him explain that virus defense is made more difficult by Microsoft refusing to release details of their file formats or, if they do release under a NDA, the information is often innacurate and incomplete. Good old Microsoft, helping us every step of the way.

Recommended mostly for the curious geek or serious security professional only, but highly, highly recommended for that audience. For the less geeky, this would still be of interest because the historical and more general overviews it contains.

• Peter Szor
• Addison-Wesley
• 0321304543

Got something to add? Send me email.

---

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us