VIRUS HUNTERS WEED OUT BUGS.

Byline: Steve Lohr The New York Times

The narrow, windowless room is guarded by electronic locks and the red-beam light rays of motion detectors. The room is ringed by two dozen computers, blinking as programs run. A couple of filing cabinets have bars and locks.

David Chess unlocks one metal cabinet, gently opening a drawer that holds row after row of unassuming computer disks. ``This is our collection,'' Chess said with genuine pride, as if he were a wine collector showing off his cellar. ``It's a complete set of the world's known computer viruses.''

A tall, bearded 36-year-old computer scientist, Chess works at the IBM Thomas J. Watson Research Center, where he specializes in the detection, analysis and extermination of computer viruses. He is a member of the small close-knit community of professional virus hunters, estimated at fewer than 100 people, scattered around the world from Silicon Valley to Reykjavik, Iceland.

Their field is only a decade old, tracing its origins to 1987 when the early viruses like ``Brain'' and ``Jerusalem'' began to infect personal computers. Yet today, the anti-virus experts find themselves not only in a fast-paced, rapidly growing business but also being forced to pursue innovations in artificial intelligence and computer-immune systems to stay a step ahead of new viruses that are spreading over the Internet.

``With the Internet, viruses can spread 10 times faster than they ever did before,'' said Peter Tippett, president of the National Computer Security Association, an anti-virus group in Carlisle, Pa.

Even so-called benign computer viruses can cause problems because they are unwanted strands of software code, which can act as bugs. For example, the ``Concept'' virus, which infects Word documents, is not deliberately destructive. But it causes bug-like problems, altering data or hindering printing, in 2 percent to 5 percent of the infected cases, estimates the National Computer Security Association. The cost of all computer viruses to users in terms of lost time, cleanup and repair is more than $2 billion a year, the association says.

Virus hunters are engaged in the digital-age equivalent of medieval warfare, an escalating battle between arms and armor. Their adversaries - the virus writers - have traditionally been a few hundred bright, bored teen-age boys. These nerdish vandals give themselves swaggering nicknames like Death Star, Dark Avenger or Tough Guy, and they often belong to gangs like Nuke, Vlad, Phalcon/Skism or the Digital Hackers Alliance.

Most virus writers are the graffiti scribblers of cyberspace, since only about one-third of viruses are deliberately destructive. But other virus writers are closer to digital arsonists, writing virus programs intended to crash computers or erase data. (Legally, the malicious intent is difficult to prove. Only in a few nations, including Italy and Switzerland, is distributing a computer virus against the law.)

Typically, virus writers abandon their adolescent mischief when they reach their 20s. ``Most virus writers stop when they grow up, get a girlfriend or a real job,'' said Fridrik Skulason, the president of Frisk Software International, an anti-virus software company in Iceland.

Yet the profile of the typical virus writer seems to be changing too. Sarah Gordon, security analyst for Command Software Systems, an anti-virus company in Jupiter, Fla., specializes in the sociology of virus writers. Recently, she has noticed a difference, as more virus writers are in their 20s and 30s.

``The new virus writer is a whole different breed, older, more talented, using better equipment and less likely to be linked to groups,'' Gordon said.

More than anything else, the Internet is changing the craft of the virus hunter. For years, computer viruses spread mainly by people physically exchanging infected diskettes.

But viruses are starting to spread by people sending infected documents by e-mail over the Internet. The Concept virus, which infects templates and documents written in Microsoft Word, first appeared last summer. It is now, by far, the most common virus in the world, accounting for half of all reported incidents.

As new Internet programs and even intelligent agents begin to forage on their own on the global computer network, the virus problem seems certain to grow. Even today, anti-virus researchers say they are detecting six new viruses a day, about double the pace of a few years ago. Last month, another major new virus appeared, called ``Laroux,'' which infects a hidden data sheet in Microsoft Excel spreadsheets.

The field is moving so fast that it has anti-virus experts scrambling to keep up. Alex Haddox, the manager of the Symantec Corp.'s anti-virus research center in Santa Monica, plans to take a hiking vacation this month, but he has qualms about being away. ``I'm afraid I'm going to miss something,'' he said.

Sales of anti-virus programs are rising sharply. In the first six months of this year, retail sales of anti-virus software in America have increased more than threefold, according to PC Data, a market research firm in Reston, Va. At the current pace, retail sales would reach $152 million in 1996, up from $40 million last year.

The leading titles are Symantec's Norton Antivirus and McAfee's Viruscan. Seeing an opportunity, the International Business Machines Corp. entered the field last year. Previously, it had conducted research and offered anti-virus software as a service to its big corporate customers, but the company had not marketed anti-virus products.

Computer virologists work much as do their counterparts in biology. When a new virus surfaces, the anti-virus experts take a sample back to their computer laboratories. They replicate the viral program, take it apart and identify its ``signature'' (a repeated strand of computer instructions, or code, always found in the virus).

Once the virus is analyzed, code can be written to kill the virus. Most viruses are fairly simple programs, typically 100 to 300 lines of code. Skilled anti-virus experts can often analyze a new virus and write a disinfector program in a matter of hours.

CAPTION(S):

2 Photos

Photo: (1--Color) David Chess, 36, is a virus hunter who corrals the world's computer bugs for IBM in Hawthorne, N.Y.

(2) Jeffrey O. Kephart, a senior researcher at IBM's lab in Hawthorne, N.Y., demonstrates a computer model on the spread of viruses.

Chris Maynard/The New York Times