Saddam Hussein threatens computers outside Kuwait.

Saddam Hussein threatens computers outside Kuwait

It is quite possible that one day you could be opening a file on your IBM computer and, instead of finding a spreadsheet, Saddam Hussein's face would appear on your screen.

Saddam, who is known to roll his eyes at computer users, is one of the newest computer viruses going around, according to John Wack, a computer scientist at the National Institute of Standards and Technology, part of the U.S. Department of Commerce, which is studying computer viruses.

Computer viruses, which first began infecting the nation's computer screens in 1987, are growing in number of infections and number of species in the 1990s, according to computer scientists which are developing cures for the computer bugs.

The Computer Virus Industry Association in the Silicon Valley received 1,021 reports of virus infections from companies and individuals in the period of Aug. 3 to Oct. 22, 1990, said John McAfee, director of the association. The approximately 500 infections a month is up from the about three reports a month McAfee received in 1987.

Viruses are not cute or funny to companies, that when infected, can lose vital information, expensive equipment and employee hours. Viruses have the ability to replicate themselves, over and over, erasing programs and sometimes damaging the computer's hard disk.

But viruses are also a source of income to a growing industry of anti-virus remedy producers.

There are about 20 U.S. companies in the business of making anti-virus software or other remedies, said Michael Heylin, computer market analyst for Creative Strategies Research in Santa Clara. The anti-virus business is probably a $25 million to $50 million industry in 1990, Heylin said.

"I don't think (the anti-virus industry) has a real sharp growth curve," Heylin said. He predicted that sales could double in the next few years, but then flatten out. He also predicted that companies that make software for general computer security will always include virus cures in the future.

Heylin conducted a study in the summer of 1990 of 250 companies that found that virus bugs accounted for only 7 percent of lost data. Computer operator error accounted for 80 percent of lost information, Heylin said. Heylin added that he was skeptical about McAfee's 500 reported viruses a month.

The Santa Monica-based Peter Norton Group has sold 250,000 copies of anti-viral software for Macintosh-compatible systems in the last year at $99 each, according to company spokesmen. The company, which has just developed anti-viral software for IBM-compatible systems, will begin shipping it soon.

A survey, commissioned by Cupertino, Calif.-based Symantec Corp., of 20 Fortune 100 companies found that seven of the 20 had been hit with a computer virus. None of the seven companies had publicized that the virus had caused them to lose data, productivity and had corrupted files, according to the study.

McAfee, who invites infected companies and individuals to download for free on his anti-virus bulletin board, also licenses his remedy to corporations. He said that 1550 corporations have brought his virus cure.

McAfee charges large corporations, with 1,000 or more company computers, about $3.50 a machine, he said. McAfee said that currently, he is the only source of virus incident reports in the nation.

The U.S. government is planning a meeting of computer companies with the purpose of gathering statistics on the number of incidences of computer viruses, said Wack of NIST.

"I don't think anybody out there is deliberately spreading misinformation. Some information (on viruses) comes from the business of people selling anti-virus software," Wack said. `If it comes out of an independent agency such as NIST, people will have a better sense of security about the information they're getting."

IBM has been collecting and analyzing computer viruses since 1987, said Steve White, computer scientist and manager of IBM's computing laboratory, the Thomas J. Watson Center. White's menagerie of viruses has grown in three years from one to more than 200 strains of virus that attack IBM computers.

"The vast majority of viruses exist only in the collection and are not out there infecting some innocent person's machine," White said. About six or eight viruses constitute the vast majority of the nation's computer infections, he added.

Some viruses, like the Saddam Hussein virus, make themselves known to the computer user, but others erase files and wreak havoc without leaving a calling card, White said.

Viruses, which can destroy anything from a single file to everything on the hard disk, are spread primarily by plugging into infected bulletin boards and sharing infected disks.

Computer viruses are spread very much the same way that biological viruses are, according to White. In fact, the analogy is "so compelling" that IBM is currently conducting a study to try to determine how a computer virus spreads around the world's computer population by looking at how fast biological viruses spread in the world's human population.

Just like human viruses, some computer viruses are more contagious than others, White said. Some only spread if a computer user runs a certain program, others only need the contact of placing the disk in the drive to spread, he said. Scientists at the National Center for Disease Control in Atlanta, chuckled when White told them about his research, but IBM is serious about the study, he said.

Although there are more than 200 IBM viruses, only 23 have been discovered that attack the Macintosh, said Lee Lensky, director of Macintosh products for the Peter Norton Group. And as a rule, IBM viruses are "more serious, more vicious" than Mac viruses, Lensky said.

An example of a sweet-natured Apple virus, was the Peace sign virus that struck Macintoshes a couple of years ago, Lensky said. It merely flashed a peace sign at the user.

One of the latest Macintosh viruses causes the computer's mouse to run away from the menu, Lensky said. The mousechasing virus has been named Garfield the Cat, he said.

No one really knows who is to blame for computer viruses but computer hackers have been blamed for the phenomena.

"We don't know who they are. . . ..Most of these viruses come from outside the U.S., from Taiwan, Germany," said McAfee. "Some of these viruses, the way they are designed, have clearly been written by children or young teenagers. Every kid has a computer somewhere."

McAfee said that it usually takes his staff a day to analyze and find a cure for a virus. Simplistic programs written by teenagers take three or four hours to decipher, he said.

Recently, McAfee has run across a virus unlike any he has seen before. "The Whale" took McAfee's staff an entire week to decipher, he said. "That virus appears to be the only one that was written by committee."

There were at least four different styles of programming in the virus, he said. When virus scientists got to the core of the virus, they found the word "whale" written in English, McAfee said.

The Whale is a "stealth virus," completely invisible, and completely destructive, he said. It erases data and will ultimately destroy the entire computer system, he said.

McAfee Associates and Symantec are two anti-virus companies which constantly keep abreast of the new viruses, decipher them, and then give the updated information to their customers. A major criticism of the anti-virus industry is that new viruses are being invented all the time and the software only has cures for known viruses.

Companies with virus problems have them because they allow employees to violate computer security polices which were developed 15 years ago, said Bill Bener, head of computer security for the TRW data security division. Bener said he considers buying anti-virus software a waste of time.

"People are getting viruses because of sloppy operation," he said. At TRW, employees sign a policy promising not to bring software from home or download on any outside bulletin boards, Bener said.

"Every once in a while there will be an audit to attest to the fact" that employees are following the rules, Bener said. "Unless you do that, people will think that you're just putting up policies and not enforcing them," he said.

TRW, which keeps credit information on individuals nationwide, contracted only one virus infection on an isolated personal computer, Bener said. The computer had been sent out for repairs and when it was returned, it was infected.

Bener said he believes that the repair person had used an infected disk on several computers in the repair shop. TRW detected the virus immediately and cleaned it up, Bener said.

Computer hackers have stolen credit reports from TRW, but have never implanted a virus in the system, Bener said. Hackers who have tried to tamper with TRW systems have been arrested, he added.

McAfee said, "you would not believe the number of times" that he has called the local police and the FBI to report viruses. But the police agencies say that there is nothing they can do.

The Computer Crimes Unit of the Los Angeles Police Department has only had two reports of computer viruses in the five years since it was formed in 1985, said Detective Paul Geggie. There are a lot of computer crimes which are not reported to the police, Geggie said. He added that if companies "think they've been criminally abused, they should call us. There's no such thing as a harmless computer virus."

Deputy Los Angeles District Attorney Richard Lowenstein said he's only had one computer-virus type crime come across his desk in the year he's overseen the electronic crimes unit of the Major Fraud Division of the Los Angeles County Prosecutor's office.

In that case a computer consultant was accused of implanting a "time bomb" virus in the computer of Ronda Pharmalogical, a City of Industry-based health and beauty wholesale company, Lowenstein said. The consultant, who did some work for the company, felt the company owed him money, Lowenstein said.

One day a company employee turned on a computer to find a message that read, "Death to Pirates. Do not proceed further or information on your hard disk will be trashed."

The message allegedly told the computer user to call the consultant's phone number. "He wanted a cashier's check for what he contended they owed him," Lowenstein said.

The consultant is charged with destroying computer data, attempting to destroy computer data and attempted extortion, Lowenstein said. He could face a maximum of four years in prison.

Ironically, the Macintosh system at the district attorney's office has been infected with a computer virus, Lowenstein said. But there have been no arrests in that case.

There was "no way to prove who did it," Lowenstein said.