Nearly every desktop computer and server in use today contains one or more hard-disk drives. Every mainframe and supercomputer is normally connected to hundreds of them. You can even find VCR-type devices and camcorders that use hard disks instead of tape. These billions of hard disks do one thing well — they store changing digital information in a relatively permanent form. They give computers the ability to remember things when the power goes out.

The other important parameter is the capacity of the drive, which is the number of bytes it can hold.

Inside: Electronics Board

The best way to understand how a hard disk works is to take a look inside. (Note that OPENING A HARD DISK RUINS IT, so this is not something to try at home unless you have a defunct drive.)

Here is a typical hard-disk drive:

It is a sealed aluminum box with controller electronics attached to one side. The electronics control the read/write mechanism and the motor that spins the platters. The electronics also assemble the magnetic domains on the drive into bytes (reading) and turn bytes into magnetic domains (writing). The electronics are all contained on a small board that detaches from the rest of the drive:

Inside: Beneath the Board

Underneath the board are the connections for the motor that spins the platters, as well as a highly-filtered vent hole that lets internal and external air pressures equalize:

Removing the cover from the drive reveals an extremely simple but very precise interior:

In this picture you can see:

• The platters – These typically spin at 3,600 or 7,200 rpm when the drive is operating. These platters are manufactured to amazing tolerances and are mirror-smooth (as you can see in this interesting self-portrait of the author… no easy way to avoid that!).
• The arm – This holds the read/write heads and is controlled by the mechanism in the upper-left corner. The arm is able to move the heads from the hub to the edge of the drive. The arm and its movement mechanism are extremely light and fast. The arm on a typical hard-disk drive can move from hub to edge and back up to 50 times per second — it is an amazing thing to watch!

Inside: Platters and Heads

In order to increase the amount of information the drive can store, most hard disks have multiple platters. This drive has three platters and six read/write heads:

The mechanism that moves the arms on a hard disk has to be incredibly fast and precise. It can be constructed using a high-speed linear motor.

Many drives use a “voice coil” approach — the same technique used to move the cone of a speaker on your stereo is used to move the arm.

Storing the Data

Data is stored on the surface of a platter in sectors and tracks. Tracks are concentric circles, and sectors are pie-shaped wedges on a track, like this:

A typical track is shown in yellow; a typical sector is shown in blue. A sector contains a fixed number of bytes — for example, 256 or 512. Either at the drive or the operating system level, sectors are often grouped together into clusters.

The process of low-level formatting a drive establishes the tracks and sectors on the platter. The starting and ending points of each sector are written onto the platter. This process prepares the drive to hold blocks of bytes. High-level formatting then writes the file-storage structures, like the file-allocation table, into the sectors. This process prepares the drive to hold files.

For more information on hard disks and related topics, check out the links on the next page.

Form Factor

A motherboard by itself is useless, but a computer has to have one to operate. The motherboard’s main job is to hold the computer’s microprocessor chip and let everything else connect to it. Everything that runs the computer or enhances its performance is either part of the motherboard or plugs into it via a slot or port.

Photo courtesy Consumer Guide Products A modern motherboard. See more motherboard pictures.

The shape and layout of a motherboard is called the form factor. The form factor affects where individual components go and the shape of the computer’s case. There are several specific form factors that most PC motherboards use so that they can all fit in standard cases. For a comparison of form factors, past and present, check out Motherboards.org.

The form factor is just one of the many standards that apply to motherboards. Some of the other standards include:

• The socket for the microprocessor determines what kind of Central Processing Unit (CPU) the motherboard uses.
• The chipset is part of the motherboard’s logic system and is usually made of two parts — the northbridge and the southbridge. These two “bridges” connect the CPU to other parts of the computer.
• The Basic Input/Output System (BIOS) chip controls the most basic functions of the computer and performs a self-test every time you turn it on. Some systems feature dual BIOS, which provides a backup in case one fails or in case of error during updating.
• The real time clock chip is a battery-operated chip that maintains basic settings and the system time.

The slots and ports found on a motherboard include:

• Peripheral Component Interconnect (PCI)- connections for video, sound and video capture cards, as well as network cards
• Accelerated Graphics Port (AGP) – dedicated port for video cards.
• Integrated Drive Electronics (IDE) – interfaces for the hard drives
• Universal Serial Bus or FireWire – external peripherals
• Memory slots

Some motherboards also incorporate newer technological advances:

• Redundant Array of Independent Discs (RAID) controllers allow the computer to recognize multiple drives as one drive.
• PCI Express is a newer protocol that acts more like a network than a bus. It can eliminate the need for other ports, including the AGP port.
• Rather than relying on plug-in cards, some motherboards have on-board sound, networking, video or other peripheral support.

Photo courtesy Consumer Guide Products A Socket 754 motherboard

Many people think of the CPU as one of the most important parts of a computer. We’ll look at how it affects the rest of the computer in the next section.

Sockets and CPUs

The CPU is the first thing that comes to mind when many people think about a computer’s speed and performance. The faster the processor, the faster the computer can think. In the early days of PC computers, all processors had the same set of pins that would connect the CPU to the motherboard, called the Pin Grid Array (PGA). These pins fit into a socket layout called Socket 7. This meant that any processor would fit into any motherboard.

Photo courtesy HowStuffWorks Shopper A Socket 939 motherboard

Today, however, CPU manufacturers Intel and AMD use a variety of PGAs, none of which fit into Socket 7. As microprocessors advance, they need more and more pins, both to handle new features and to provide more and more power to the chip.

Current socket arrangements are often named for the number of pins in the PGA. Commonly used sockets are:

• Socket 478 – for older Pentium and Celeron processors
• Socket 754 – for AMD Sempron and some AMD Athlon processors
• Socket 939 – for newer and faster AMD Athlon processors
• Socket AM2 – for the newest AMD Athlon processors
• Socket A – for older AMD Athlon processors

Photo courtesy HowStuffWorks Shopper A Socket LGA755 motherboard

The newest Intel CPU does not have a PGA. It has an LGA, also known as Socket T. LGA stands for Land Grid Array. An LGA is different from a PGA in that the pins are actually part of the socket, not the CPU.

Anyone who already has a specific CPU in mind should select a motherboard based on that CPU. For example, if you want to use one of the new multi-core chips made by Intel or AMD, you will need to select a motherboard with the correct socket for those chips. CPUs simply will not fit into sockets that don’t match their PGA.

The CPU communicates with other elements of the motherboard through a chipset. We’ll look at the chipset in more detail next.

Chipsets

The chipset is the “glue” that connects the microprocessor to the rest of the motherboard and therefore to the rest of the computer. On a PC, it consists of two basic parts — the northbridge and the southbridge. All of the various components of the computer communicate with the CPU through the chipset.

Photo courtesy HowStuffWorks Shopper The northbridge and southbridge

The northbridge connects directly to the processor via the front side bus (FSB). A memory controller is located on the northbridge, which gives the CPU fast access to the memory. The northbridge also connects to the AGP or PCI Express bus and to the memory itself.

The southbridge is slower than the northbridge, and information from the CPU has to go through the northbridge before reaching the southbridge. Other busses connect the southbridge to the PCI bus, the USB ports and the IDE or SATA hard disk connections.

Chipset selection and CPU selection go hand in hand, because manufacturers optimize chipsets to work with specific CPUs. The chipset is an integrated part of the motherboard, so it cannot be removed or upgraded. This means that not only must the motherboard’s socket fit the CPU, the motherboard’s chipset must work optimally with the CPU.

Next, we’ll look at busses, which, like the chipset, carry information from place to place.

Bus Speed

A bus is simply a circuit that connects one part of the motherboard to another. The more data a bus can handle at one time, the faster it allows information to travel. The speed of the bus, measured in megahertz (MHz), refers to how much data can move across the bus simultaneously.

<!– Photo courtesy URL title –>Busses connect different parts of the motherboard to one another

Bus speed usually refers to the speed of the front side bus (FSB), which connects the CPU to the northbridge. FSB speeds can range from 66 MHz to over 800 MHz. Since the CPU reaches the memory controller though the northbridge, FSB speed can dramatically affect a computer’s performance.

Here are some of the other busses found on a motherboard:

• The back side bus connects the CPU with the level 2 (L2) cache, also known as secondary or external cache. The processor determines the speed of the back side bus.
• The memory bus connects the northbridge to the memory.
• The IDE or ATA bus connects the southbridge to the disk drives.
• The AGP bus connects the video card to the memory and the CPU. The speed of the AGP bus is usually 66 MHz.
• The PCI bus connects PCI slots to the southbridge. On most systems, the speed of the PCI bus is 33 MHz. Also compatible with PCI is PCI Express, which is much faster than PCI but is still compatible with current software and operating systems. PCI Express is likely to replace both PCI and AGP busses.

The faster a computer’s bus speed, the faster it will operate — to a point. A fast bus speed cannot make up for a slow processor or chipset.

Now let’s look at memory and how it affects the motherboard’s speed.

Memory and Other Features

We’ve established that the speed of the processor itself controls how quickly a computer thinks. The speed of the chipset and busses controls how quickly it can communicate with other parts of the computer. The speed of the RAM connection directly controls how fast the computer can access instructions and data, and therefore has a big effect on system performance. A fast processor with slow RAM is going nowhere.

The amount of memory available also controls how much data the computer can have readily available. RAM makes up the bulk of a computer’s memory. The general rule of thumb is the more RAM the computer has, the better.

Photo courtesy HowStuffWorks Shopper 184-pin DDR DIMM RAM

Much of the memory available today is dual data rate (DDR) memory. This means that the memory can transmit data twice per cycle instead of once, which makes the memory faster. Also, most motherboards have space for multiple memory chips, and on newer motherboards, they often connect to the northbridge via a dual bus instead of a single bus. This further reduces the amount of time it takes for the processor to get information from the memory.

Photo courtesy HowStuffWorks Shopper 200-pin DDR SODIMM RAM

A motherboard’s memory slots directly affect what kind and how much memory is supported. Just like other components, the memory plugs into the slot via a series of pins. The memory module must have the right number of pins to fit into the slot on the motherboard.

Photo courtesy HowStuffWorks Shopper 64MB SDRAM SIMM

In the earliest days of motherboards, virtually everything other than the processor came on a card that plugged into the board. Now, motherboards feature a variety of onboard accessories such as LAN support, video, sound support and RAID controllers.

Motherboards with all the bells and whistles are convenient and simple to install. There are motherboards that have everything you need to create a complete computer — all you do is stick the motherboard in a case and add a hard disk, a CD drive and a power supply. You have a completely operational computer on a single board.

For many average users, these built-in features provide ample support for video and sound. For avid gamers and people who do high-intensity graphic or computer-aided design (CAD) work, however, separate video cards provide much better performance.

For more information on motherboards and related topics, check out the links on the following page.

CPU is a well-known acronym in the computing world, but what is in them? Learn more about CPUs, including the differences between Pentium and Celeron processors, or how graphics cards work.

When you buy a CPU chip, it has a “maximum” speed rating stamped on the chip’s case. For example, the chip might indicate that it is a 3-GHz part. This means that the chip will perform without error when executed at or below that speed within the chip’s normal temperature parameters.

There are two things that limit a chip’s speed:

• Transmission delays on the chip
• Heat build-up on the chip

Transmission delays occur in the wires that connect things together on a chip. The “wires” on a chip are incredibly small aluminum or copper strips etched onto the silicon. A chip is nothing more than a collection of transistors and wires that hook them together, and a transistor is nothing but an on/off switch. When a switch changes its state from on to off or off to on, it has to either charge up or drain the wire that connects the transistor to the next transistor down the line. Imagine that a transistor is currently “on.” The wire it is driving is filled with electrons. When the switch changes to “off,” it has to drain off those electrons, and that takes time. The bigger the wire, the longer it takes.As the size of the wires has gotten smaller over the years, the time required to change states has gotten smaller, too. But there is some limit — charging and draining the wires takes time. That limit imposes a speed limit on the chip.

There is also a minimum amount of time that a transistor takes to flip states. Transistors are chained together in strings, so the transistor delays add up. On a complex chip like the G5, there are likely to be longer chains, and the length of the longest chain limits the maximum speed of the entire chip.

Finally, there is heat. Every time the transistors in a gate change state, they leak a little electricity. This electricity creates heat. As transistor sizes shrink, the amount of wasted current (and therefore heat) has declined, but there is still heat being created. The faster a chip goes, the more heat it generates. Heat build-up puts another limit on speed.

You can try to run your chip at a faster speed — doing that is called overclocking. On many chips (especially certain models of the Celeron — see the first link below), it works very well. Sometimes, you have to cool the chip artificially to overclock it. Other times, you cannot overclock it at all because you immediately bump into transmission delays.

These links will help you learn more:

• Microprocessor/CPU
• Celeron Overclocking FAQ
• Overclocking Database
• Circuit design techniques for the high-performance CMOS IBM S/390
• Webopedia: Microprocessor Comparison Chart
• How Microprocessors Work
• How Semiconductors Work
• What is the difference between a Pentium and a Celeron processor?

A computer is full of busses — highways that take information and power from one place to another. For example, when you plug an MP3 player or digital camera into your computer, you’re probably using a universal serial bus (USB) port. Your USB port is good at carrying the data and electricity required for small electronic devices that do things like create and store pictures and music files. But that bus isn’t big enough to support a whole computer, a server or lots of devices simultaneously.

SCSI devices usually connect to a controller card like this one. See more pictures of SCSI connectors and cables.

For that, you’d need something more like SCSI. SCSI originally stood for Small Computer System Interface, but it’s really outgrown the “small” designation. It’s a fast bus that can connect lots of devices to a computer at the same time, including hard drives, scanners, CD-ROM/RW drives, printers and tape drives. Other technologies, like serial-ATA (SATA), have largely replaced it in new systems, but SCSI is still in use. This article will review SCSI basics and give you lots of information on SCSI types and specifications

SCSI Basics

SCSI is based on an older, proprietary bus interface called Shugart Associates System Interface (SASI). SASI was originally developed in 1981 by Shugart Associates in conjunction with NCR Corporation. In 1986, the American National Standards Institute (ANSI) ratified SCSI (pronounced “scuzzy”), a modified version of SASI. SCSI uses a controller to send and receive data and power to SCSI-enabled devices, like hard drives and printers.

SCSI connector

SCSI has several benefits. It’s fairly fast, up to 320 megabytes per second (MBps). It’s been around for more than 20 years and it’s been thoroughly tested, so it has a reputation for being reliable. Like Serial ATA and FireWire, it lets you put multiple items on one bus. SCSI also works with most computer systems.

However, SCSI also has some potential problems. It has limited system BIOS support, and it has to be configured for each computer. There’s also no common SCSI software interface. Finally, all the different SCSI types have different speeds, bus widths and connectors, which can be confusing. When you know the meaning behind “Fast,” “Ultra” and “Wide,” though, it’s pretty easy to understand. We’ll look at these SCSI types next.

RAIDSCSI is often used to control a redundant array of independent discs (RAID). Other technologies, like serial-ATA (SATA), can also be used for this purpose. Newer SATA drives tend to be faster and cheaper than SCSI drives.A RAID is a series of hard drives treated as one big drive. These drives can read and write data at the same time, known as striping. The RAID controller determines which drive gets which chunk of data. While that drive writes the data, the controller sends data to or reads it from another drive.RAID also improves fault tolerance through mirroring and parity. Mirroring makes an exact duplicate of one drive’s data on a second hard drive. Parity uses a minimum of three hard drives, and data is written sequentially to each drive, except the last one. The last drive stores a number that represents the sum of the data on the other drives. For more information on RAID and fault tolerance, check out this page.

SCSI Types

SCSI has three basic specifications:

• SCSI-1: The original specification developed in 1986, SCSI-1 is now obsolete. It featured a bus width of 8 bits and clock speed of 5 MHz.
• SCSI-2: Adopted in 1994, this specification included the Common Command Set (CCS) — 18 commands considered an absolute necessity for support of any SCSI device. It also had the option to double the clock speed to 10 MHz (Fast), double the bus width from to 16 bits and increase the number of devices to 15 (Wide), or do both (Fast/Wide). SCSI-2 also added command queuing, allowing devices to store and prioritize commands from the host computer.
• SCSI-3: This specification debuted in 1995 and included a series of smaller standards within its overall scope. A set of standards involving the SCSI Parallel Interface (SPI), which is the way that SCSI devices communicate with each other, has continued to evolve within SCSI-3. Most SCSI-3 specifications begin with the term Ultra, such as Ultra for SPI variations, Ultra2 for SPI-2 variations and Ultra3 for SPI-3 variations. The Fast and Wide designations work just like their SCSI-2 counterparts. SCSI-3 is the standard currently in use.

Different combinations of doubled bus speed, doubled clock speed and SCSI-3 specifications have led to lots of SCSI variations. The chart below compares several of them. Many of the slower ones are no longer in use — we’ve included them for comparison.

In addition to the increased bus speed, Ultra320 SCSI uses packeted data transfer, increasing its efficiency. Ultra2 was also the last type to have a “narrow,” or 8-bit, bus width.

All of these SCSI types are parallel — bits of data move through the bus simultaneously rather than one at a time. The newest type of SCSI, called Serial Attached SCSI (SAS), uses SCSI commands but transmits data serially. SAS uses a point-to-point serial connection to move data at 3.0 gigabits per second, and each SAS port can support up to 128 devices or expanders.

SCSI controller

All the different SCSI varieties use controllers and cables to interface with devices. We’ll look at this process next.

Controllers, Devices and Cables

A SCSI controller coordinates between all of the other devices on the SCSI bus and the computer. Also called a host adapter, the controller can be a card that you plug into an available slot or it can be built into the motherboard. The SCSI BIOS is also on the controller. This is a small ROM or Flash memory chip that contains the software needed to access and control the devices on the bus.

Each SCSI device must have a unique identifier (ID) in order for it to work properly. For example, if the bus can support sixteen devices, their IDs, specified through a hardware or software setting, range from zero to 15. The SCSI controller itself must use one of the IDs, typically the highest one, leaving room for 15 other devices on the bus.

Internal SCSI devices connect to a ribbon cable.

Internal devices connect to a SCSI controller with a ribbon cable. External SCSI devices attach to the controller in a daisy chain using a thick, round cable. (Serial Attached SCSI devices use SATA cables.) In a daisy chain, each device connects to the next one in line. For this reason, external SCSI devices typically have two SCSI connectors — one to connect to the previous device in the chain, and the other to connect to the next device.

External SCSI devices connect using thick, round cables.

The cable itself typically consists of three layers:

• Inner layer: The most protected layer, this contains the actual data being sent.
• Media layer: Contains the wires that send control commands to the device.
• Outer layer: Includes wires that carry parity information, which ensures that the data is correct.

Different SCSI variations use different connectors, which are often incompatible with one another. These connectors usually use 50, 68 or 80 pins. SAS uses smaller, SATA-compatible connectors.

68-pin Alternative 3 SCSI connector

50-pin Centronics SCSI connector

Once all of the devices on the bus are installed and have their own IDs, each end of the bus must be closed. We’ll look at how to do this next.

Termination

If the SCSI bus were left open, electrical signals sent down the bus could reflect back and interfere with communication between devices and the SCSI controller. The solution is to terminate the bus, closing each end with a resistor circuit. If the bus supports both internal and external devices, then the last device on each series must be terminated.

Types of SCSI termination can be grouped into two main categories: passive and active. Passive termination is typically used for SCSI systems that run at the standard clock speed and have a distance of less than 3 feet (1 m) from the devices to the controller. Active termination is used for Fast SCSI systems or systems with devices that are more than 3 feet (1 m) from the SCSI controller.

Some SCSI terminators are built into the SCSI device, while others may require an external terminator like this one.

SCSI also employs three distinct types of bus signaling, which also affect termination. Signaling is the way that the electrical impulses are sent across the wires.

• Single-ended (SE): The controller generates the signal and pushes it out to all devices on the bus over a single data line. Each device acts as a ground. Consequently, the signal quickly begins to degrade, which limits SE SCSI to a maximum of about 10 ft (3 m). SE signaling is common in PCs.
• High-voltage differential (HVD): Often used for servers, HVD uses a tandem approach to signaling, with a data high line and a data low line. Each device on the SCSI bus has a signal transceiver. When the controller communicates with the device, devices along the bus receive the signal and retransmit it until it reaches the target device. This allows for much greater distances between the controller and the device, up to 80 ft (25 m).
• Low-voltage differential (LVD): LVD is a variation on HVD and works in much the same way. The big difference is that the transceivers are smaller and built into the SCSI adapter of each device. This makes LVD SCSI devices more affordable and allows LVD to use less electricity to communicate. The downside is that the maximum distance is half of HVD — 40 ft (12 m).

An active terminator

Both HVD and LVD normally use passive terminators, even though the distance between devices and the controller can be much greater than 3 ft (1 m). This is because the transceivers ensure that the signal is strong from one end of the bus to the other.

For more information on SCSI and other busses, check out the links on the following page.

There are a lot of terms used to describe computers. Most of these words imply the size, expected use or capability of the computer. While the term computer can apply to virtually any device that has a microprocessor in it, most people think of a computer as a device that receives input from the user through a mouse or keyboard, processes it in some fashion and displays the result on a screen.

John Foxx/Getty Images Laptops are portable computers that integrate components in a battery-operated package slightly larger than an average hardcover book.

• PC – The personal computer (PC) defines a computer designed for general use by a single person. While a Mac is a PC, most people relate the term with systems that run the Windows operating system. PCs were first known as microcomputers because they were a complete computer but built on a smaller scale than the huge systems in use by most businesses.
• Desktop – A PC that is not designed for portability. The expectation with desktop systems are that you will set the computer up in a permanent location. Most desktops offer more power, storage and versatility for less cost than their portable brethren.
• Laptop – Also called notebooks, laptops are portable computers that integrate the display, keyboard, a pointing device or trackball, processor, memory and hard drive all in a battery-operated package slightly larger than an average hardcover book.
• Palmtop – More commonly known as Personal Digital Assistants (PDAs), palmtops are tightly integrated computers that often use flash memory instead of a hard drive for storage. These computers usually do not have keyboards but rely on touchscreen technology for user input. Palmtops are typically smaller than a paperback novel, very lightweight with a reasonable battery life. A slightly larger and heavier version of the palmtop is the handheld computer.
• Workstation – A desktop computer that has a more powerful processor, additional memory and enhanced capabilities for performing a special group of task, such as 3D Graphics or game development.
• Server – A computer that has been optimized to provide services to other computers over a network. Servers usually have powerful processors, lots of memory and large hard drives.
• Mainframe – In the early days of computing, mainframes were huge computers that could fill an entire room or even a whole floor! As the size of computers has diminished while the power has increased, the term mainframe has fallen out of use in favor of enterprise server. You’ll still hear the term used, particularly in large companies to describe the huge machines processing millions of transactions every day.
• Minicomputer – Another term rarely used anymore, minicomputers fall in between microcomputers (PCs) and mainframes (enterprise servers). Minicomputers are normally referred to as mid-range servers now.
• Supercomputer – This type of computer usually costs hundreds of thousands or even millions of dollars. Although some supercomputers are single computer systems, most are comprised of multiple high performance computers working in parallel as a single system. The best known supercomputers are built by Cray Supercomputers.
• Wearable – The latest trend in computing is wearable computers. Essentially, common computer applications (e-mail, database, multimedia, calendar/scheduler) are integrated into watches, cell phones, visors and even clothing!

Strange as it may sound, the computer virus is something of an Information Age marvel. On one hand, viruses show us how vulnerable we are — a properly engineered virus can have a devastating effect, disrupting productivity and doing billions of dollars in damages. On the other hand, they show us how sophisticated and interconnected human beings have become.

Virus Origins

Computer viruses are called viruses because they share some of the traits of biological viruses. A computer virus passes from computer to computer like a biological virus passes from person to person. Unlike a cell, a virus has no way to reproduce by itself. Instead, a biological virus must inject its DNA into a cell. The viral DNA then uses the cell’s existing machinery to reproduce itself. In some cases, the cell fills with new viral particles until it bursts, releasing the virus. In other cases, the new virus particles bud off the cell one at a time, and the cell remains alive. A computer virus shares some of these traits. A computer virus must piggyback on top of some other program or document in order to launch. Once it is running, it can infect other programs or documents. Obviously, the analogy between computer and biological viruses stretches things a bit, but there are enough similarities that the name sticks.

People write computer viruses. A person has to write the code, test it to make sure it spreads properly and then release it. A person also designs the virus’s attack phase, whether it’s a silly message or the destruction of a hard disk. Why do they do it?

There are at least three reasons. The first is the same psychology that drives vandals and arsonists. Why would someone want to break a window on someone’s car, paint signs on buildings or burn down a beautiful forest? For some people, that seems to be a thrill. If that sort of person knows computer programming, then he or she may funnel energy into the creation of destructive viruses. The second reason has to do with the thrill of watching things blow up. Some people have a fascination with things like explosions and car wrecks. When you were growing up, there might have been a kid in your neighborhood who learned how to make gunpowder. And that kid probably built bigger and bigger bombs until he either got bored or did some serious damage to himself. Creating a virus is a little like that — it creates a bomb inside a computer, and the more computers that get infected the more “fun” the explosion. The third reason involves bragging rights, or the thrill of doing it. Sort of like Mount Everest — the mountain is there, so someone is compelled to climb it. If you are a certain type of programmer who sees a security hole that could be exploited, you might simply be compelled to exploit the hole yourself before someone else beats you to it. Of course, most virus creators seem to miss the point that they cause real damage to real people with their creations. Destroying everything on a person’s hard disk is real damage. Forcing a large company to waste thousands of hours cleaning up after a virus is real damage. Even a silly message is real damage because someone has to waste time getting rid of it. For this reason, the legal system is getting much harsher in punishing the people who create viruses. For example, experts estimate that the Mydoom worm infected approximately a quarter-million computers in a single day in January 2004. Back in March 1999, the Melissa virus was so powerful that it forced Microsoft and a number of other very large companies to completely turn off their e-mail systems until the virus could be contained. The ILOVEYOU virus in 2000 had a similarly devastating effect. In January 2007, a worm called Storm appeared — by October, experts believed up to 50 million computers were infected. That’s pretty impressive when you consider that many viruses are incredibly simple. ­When you listen to the news, you hear about many different forms of electronic infection. The most common are:

• Viruses – A virus is a small piece of software that piggybacks on real programs. For example, a virus might attach itself to a program such as a spreadsheet program. Each time the spreadsheet program runs, the virus runs, too, and it has the chance to reproduce (by attaching to other programs) or wreak havoc.
• E-mail viruses – An e-mail virus travels as an attachment to e-mail messages, and usually replicates itself by automatically mailing itself to dozens of people in the victim’s e-mail address book. Some e-mail viruses don’t even require a double-click — they launch when you view the infected message in the preview pane of your e-mail software .
• Trojan horses – A Trojan horse is simply a computer program. The program claims to do one thing (it may claim to be a game) but instead does damage when you run it (it may erase your hard disk). Trojan horses have no way to replicate automatically.
• Worms – A worm is a small piece of software that uses computer networks and security holes to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there, as well.

In this article, we will discuss viruses — both “traditional” viruses and e-mail viruses — so that you can learn how they work and understand how to protect yourself.

Virus History

Traditional computer viruses were first widely seen in the late 1980s, and they came about because of several factors. The first factor was the spread of personal computersPCs). Prior to the 1980s, home computers were nearly non-existent or they were toys. Real computers were rare, and they were locked away for use by “experts.” During the 1980s, real computers started to spread to businesses and homes because of the popularity of the IBM PC (released in 1982) and the Apple Macintosh (released in 1984). By the late 1980s, PCs were widespread in businesses, homes and college campuses. (

The second factor was the use of computer bulletin boards. People could dial up a bulletin board with a modem and download programs of all types. Games were extremely popular, and so were simple word processors, spreadsheets and other productivity software. Bulletin boards led to the precursor of the virus known as the Trojan horse. A Trojan horse is a program with a cool-sounding name and description. So you download it. When you run the program, however, it does something uncool like erasing your disk. You think you are getting a neat game, but it wipes out your system. Trojan horses only hit a small number of people because they are quickly discovered, the infected programs are removed and word of the danger spreads among users.

The third factor that led to the creation of viruses was the floppy disk. In the 1980s, programs were small, and you could fit the entire operating system, a few programs and some documents onto a floppy disk or two. Many computers did not have hard disks, so when you turned on your machine it would load the operating system and everything else from the floppy disk. Virus authors took advantage of this to create the first self-replicating programs.

Early viruses were pieces of code attached to a common program like a popular game or a popular word processor. A person might download an infected game from a bulletin board and run it. A virus like this is a small piece of code embedded in a larger, legitimate program. When the user runs the legitimate program, the virus loads itself into memory and looks

Floppy disks were factors in the distribution of computer viruses.

around to see if it can find any other programs on the disk. If it can find one, it modifies the program to add the virus’s code into the program. Then the virus launches the “real program.” The user really has no way to know that the virus ever ran. Unfortunately, the virus has now reproduced itself, so two programs are infected. The next time the user launches either of those programs, they infect other programs, and the cycle continues. If one of the infected programs is given to another person on a floppy disk, or if it is uploaded to a bulletin board, then other programs get infected. This is how the virus spreads. The spreading part is the infection phase of the virus. Viruses wouldn’t be so violently despised if all they did was replicate themselves. Most viruses also have a destructive attack phase where they do damage. Some sort of trigger will activate the attack phase, and the virus will then do something — anything from printing a silly message on the screen to erasing all of your data. The trigger might be a specific date, the number of times the virus has been replicated or something similar. In the next section, we will look at how viruses have evolved over the years

Virus Evolution

As virus creators became more sophisticated, they learned new tricks. One important trick was the ability to load viruses into memory so they could keep running in the background as long as the computer remained on. This gave viruses a much more effective way to replicate themselves. Another trick was the ability to infect the boot sector on floppy disks and hard disks. The boot sector is a small program that is the first part of the operating system that the computer loads. It contains a tiny program that tells the computer how to load the rest of the operating system. By putting its code in the boot sector, a virus can guarantee it is executed. It can load itself into memory immediately and run whenever the computer is on. Boot sector viruses can infect the boot sector of any floppy disk inserted in the machine, and on college campuses, where lots of people share machines, they could spread like wildfire. In general, neither executable nor boot sector viruses are very threatening any longer. The first reason for the decline has been the huge size of today’s programs. Nearly every program you buy today comes on a compact disc. Compact discs (CDs) cannot be modified, and that makes viral infection of a CD unlikely, unless the manufacturer permits a virus to be burned onto the CD during production. The programs are so big that the only easy way to move them around is to buy the CD. People certainly can’t carry applications around on floppy disks like they did in the 1980s, when floppies full of programs were traded like baseball cards. Boot sector viruses have also declined because operating systems now protect the boot sector. Infection from boot sector viruses and executable viruses is still possible. Even so, it is a lot harder, and these viruses don’t spread nearly as quickly as they once did. Call it “shrinking habitat,” if you want to use a biological analogy. The environment of floppy disks, small programs and weak operating systems made these viruses possible in the 1980s, but that environmental niche has been largely eliminated by huge executables, unchangeable CDs and better operating system safeguards. E-mail viruses are probably the most familiar to you. We’ll look at some in the next section.

E-mail Viruses

Virus authors adapted to the changing computing environment by creating the e-mail virus. For example, the Melissa virus in March 1999 was spectacular. Melissa spread in Microsoft Word documents sent via e-mail, and it worked like this: Someone created the virus as a Word document and uploaded it to an Internet newsgroup. Anyone who downloaded the document and opened it would trigger the virus. The virus would then send the document (and therefore itself) in an e-mail message to the first 50 people in the person’s address book. The e-mail message contained a friendly note that included the person’s name, so the recipient would open the document, thinking it was harmless. The virus would then create 50 new messages from the recipient’s machine. At that rate, the Melissa virus quickly became the fastest-spreading virus anyone had seen at the time. As mentioned earlier, it forced a number of large companies to shut down their e-mail systems. The ILOVEYOU virus, which appeared on May 4, 2000, was even simpler. It contained a piece of code as an attachment. People who double-clickedVBA, or Visual Basic for Applications. It is a complete programming language and it can be programmed to do things like modify files and send e-mail messages. It also has a useful but dangerous auto-execute feature. A programmer can insert a program into a document that runs instantly whenever the document is opened. This is how the Melissa virus was programmed. Anyone who opened a document infected with Melissa would immediately activate the virus. It would send the 50 e-mails, and then infect a central file called NORMAL.DOT so that any file saved later would also contain the virus. It created a huge mess. Microsoft applications have a feature called Macro Virus Protection built into them to prevent this sort of virus. With Macro Virus Protection turned on (the default option is ON), the auto-execute feature is disabled. So when a document tries to auto-execute viral code, a dialog pops up warning the user. Unfortunately, many people don’t know what macros or macro viruses are, and when they see the dialog they ignore it, so the virus runs anyway. Many other people turn off the protection mechanism. So the Melissa virus spread despite the safeguards in place to prevent it. In the case of the ILOVEYOU virus, the whole thing was human-powered. If a person double-clicked on the program that came as an attachment, then the program ran and did its thing. What fueled this virus was the human willingness to double-click on the executable. on the attachment launched the code. It then sent copies of itself to everyone in the victim’s address book and started corrupting files on the victim’s machine. This is as simple as a virus can get. It is really more of a Trojan horse distributed by e-mail than it is a virus. The Melissa virus took advantage of the programming language built into Microsoft Word called

Worms

A worm is a computer program that has the ability to copy itself from machine to machine. Worms use up computer time and network bandwidth when they replicate, and often carry payloads that do considerable damage. A worm called Code Red made huge headlines in 2001. Experts predicted that this worm could clog the Internet so effectively that things would completely grind to a halt. A worm usually exploits some sort of security hole in a piece of software or the operating system. For example, the Slammer worm (which caused mayhem in January 2003) exploited a hole in Microsoft’s SQL server. “Wired” magazine took a fascinating look inside Slammer’s tiny (376 byte) program. Worms normally move around and infect other machines through computer networks. Using a network, a worm can expand from a single copy incredibly quickly. The Code Red worm replicated itself more than 250,000 times in approximately nine hours on July 19, 2001 [Source: Rhodes]. The Code Red worm slowed down Internet traffic when it began to replicate itself, but not nearly as badly as predicted. Each copy of the worm scanned the Internet for Windows NT or Windows 2000 servers that did not have the Microsoft security patch installed. Each time it found an unsecured server, the worm copied itself to that server. The new copy then scanned for other servers to infect. Depending on the number of unsecured servers, a worm could conceivably create hundreds of thousands of copies. The Code Red worm had instructions to do three things:

• Replicate itself for the first 20 days of each month
• Replace Web pages on infected servers with a page featuring the message “Hacked by Chinese”
• Launch a concerted attack on the White House Web site in an attempt to overwhelm it [Source: eEye Digital Security]

Upon successful infection, Code Red would wait for the appointed hour and connect to the www.whitehouse.gov domain. This attack would consist of the infected systems simultaneously sending 100 connections to port 80 of www.whitehouse.gov (198.137.240.91). The U.S. government changed the IP address of www.whitehouse.gov to circumvent that particular threat from the worm and issued a general warning about the worm, advising users of Windows NT or Windows 2000 Web servers to make sure they installed the security patch. .

Reported VirusesAccording to a report by Symantec published in September 2007, the company received more than 212,000 reports of viruses, worms and other threats during the first half of 2007, a 185% increase over the second half of 2006.

A worm called Storm, which showed up in 2007, immediately started making a name for itself. Storm uses social engineering techniques to trick users into loading the worm on their computers. So far, it’s working — experts believe between one million and 50 million computers have been infected . When the worm is launched, it opens a back door into the computer, adds the infected machine to a botnet and installs code that hides itself. The botnets are small peer-to-peer groups rather than a larger, more easily identified network. Experts think the people controlling Storm rent out their micro-botnets to deliver spam or adware, or for denial-of-service attacks on Web sites. In the next section, we’ll look at patching your system and other things you can do to protect your computer

How to Protect Your Computer from Viruses

You can protect yourself against viruses with a few simple steps:

• If you are truly worried about traditional (as opposed to e-mail) viruses, you should be running a more secure operating system like UNIX. You never hear about viruses on these operating systems because the security features keep viruses (and unwanted human visitors) away from your hard disk.
• If you are using an unsecured operating system, then buying virus protection software is a nice safeguard.
• If you simply avoid programs from unknown sources (like the Internet), and instead stick with commercial software purchased on CDs, you eliminate almost all of the risk from traditional viruses.
• You should make sure that Macro Virus Protection is enabled in all Microsoft applications, and you should NEVER run macros in a document unless you know what they do. There is seldom a good reason to add macros to a document, so avoiding all macros is a great policy.
• You should never double-click on an e-mail attachment that contains an executable. Attachments that come in as Word files (.DOC), spreadsheets (.XLS), images (.GIF), etc., are data files and they can do no damage (noting the macro virus problem in Word and Excel documents mentioned above). However, some viruses can now come in through .JPG graphic file attachments. A file with an extension like EXE, COM or VBS is an executable, and an executable can do any sort of damage it wants. Once you run it, you have given it permission to do anything on your machine. The only defense is never to run executables that arrive via e-mail.

Open the Options dialog from the Tools menu in Microsoft Word and make sure that Macro Virus Protection is enabled. Newer versions of Word allow you to customize the level of macro protection you use.

By following these simple steps, you can remain virus-free. For more information on computer viruses and related topics, see the links on the next page.

An Anti-Virus Virus?As we’ve discussed, worms attack known vulnerabilities in computer operating systems. Someone came up with the idea of turning worm tech around and created a variation of the MSBlast worm that would automatically patch the hole in the operating system and send itself out to other computers to do the same. Sounds like a good idea, right? Not so fast. MSBlast.D, Nachi or Welchia, as it was known, turned out to be more trouble than good. As it multiplied and scanned corporate networks for the vulnerability, it clogged network traffic.

The Black Hat Hackers – Criminals

These hackers are the ones that you’ve seen in shackles arrested for cybercrimes when they were just getting out of puberty. Some have done it for financial gain others just for fun.

1. Kevin Mitnick.

Mitnick is perhaps synonymous with Hacker. The Department of Justice still refers to him as “the most wanted computer criminal in United States history.” His accomplishments were memorialized into two Hollywood movies: Takedown and Freedom Downtime.

Mitnick got his start by exploiting the Los Angeles bus punch card system and getting free rides. Then similar to Steve Wozniak, of Apple, Mitnick tried Phone Phreaking. Mitnick was first convicted for hacking into the Digital Equipment Corporation’s computer network and stealing software.

Mitnick then embarked on a two and a half year coast to coast hacking spree. He has stated that he hacked into computers, scrambled phone networks, stole corporate secrets and hacked into the national defense warning system. His fall came when he hacked into fellow computer expert and hacker Tsutomu Shimomura’s home computer.

Mitnick is now a productive member of society. After serving 5 years and 8 months in solitary confinement, he is now a computer security author, consultant and speaker.

2. Adrian Lamo

Lamo hit major organizations hard, hacking into Microsoft and The New York Times. Lamo would use Internet connections at coffee shops, Kinko’s and libraries to achieve his feats earning him the nickname “The Homeless Hacker”. Lamo frequently found security flaws and exploited them. He would often inform the companies of the flaw.

Lamo’s hit list includes Yahoo!, Citigroup, Bank of America and Cingular. Of course White Hat Hackers do this legally because they are hired by the company to such, Lamo however was breaking the law.

Lamo’s intrusion into The New York Times intranet placed him squarely into the eyes of the top cyber crime offenders. For this crime, Lamo was ordered to pay $65,000 in restitution. Additionally, he was sentenced to six months home confinement and 2 years probation. Probation expired January of 2007. Lamo now is a notable public speaker and award winning journalist.

3. Jonathan James

At 16 years old, James gained enormous notoriety when he was the first minor to be sent to prison for hacking. He later admitted that he was just having fun and looking around and enjoyed the challenge.

James hit high profile organizations including the Defense Threat Reduction Agency, which is an agency of the Department of the Defense. With this hack he was able to capture usernames and passwords and view highly confidential emails.

High on James list, James also hacked in NASA computers and stole software valued at over $1.7 million. The Justice Department was quoted as saying: “The software stolen by James supported the International Space Station’s physical environment, including control of the temperature and humidity within the living space.” Upon discovering this hack, NASA had to shut dow its entire computer system costing taxpayers $41,000. Today James aspires to start a computer security company.

4. Robert Tappan Morris

Morris is the son of a former National Security Agency scientist named Robert Morris. Robert is the creator of the Morris worm. This worm was credited as the first computer worm spread through the Internet. Because of his actions, he was the first person to be prosecuted under the 1986 Computer Fraud and Abuse Act.

Morris created the worm while at Cornell as a student claiming that he intended to use the worm to see how large the Internet was at the time. The worm, however, reproduced itself uncontrollably, shutting down many computers until they had completely malfunctioned. Experts claim 6,000 machines were destroyed. Morris was ultimately sentenced to three years’ probation, 400 hours of community service and assessed a $10,500 fine.

Morris is now a tenured professor at the MIT Computer Science and Artificial Intelligence Laboratory. His focus is computer network architecture.

5. Kevin Poulsen

Frequently referred to as Dark Dante, Poulsen gained national recognition for his hack into Los Angeles radio’s KIIS-FM phone lines. These actions earned him a Porsche among many other items.

The FBI began to search for Poulson, when he hacked into the FBI database and federal computers for sensitive wiretap information. Poulsen’s specialty was hacking into phone lines and he frequently took over all of a station’s phone lines. Poulson also reactivated old Yellow Page escort telephone numbers for a partner who operated a virtual escort agency. Poulson was featured on Unsolved Mysteries and then captured in a supermarket. He was assessed a sentence of five years.

Since his time in prison, Poulsen has worked as a journalist and was promoted to senior editor for Wired News. His most popular article details his work on identifying 744 sex offenders with Myspace profiles.