📸

and on, fiddled with the connecting cables. Still nothing printed out. Finally she rang her company's technical support office.

When the specialist arrived he began running tests on the affected machine. First he created a new document and tried printing that out. It didn't work. He guessed then that the word-processing program itself could be defective, that a file within the package had become corrupted and was preventing the machine from printing out. He went to another computer and copied out the list of program files used by the company; this showed the names of the programs and their size, in bytes (or characters). He then compared the files on the problem machine with the list. Everything matched - except that eight of the files on the affected computer were slightly larger than on the other. He checked the differences. In each case the files on the problem machine were exactly 1,800 bytes larger.

With that information, the specialist knew immediately that the company had been hit by a virus; he also knew it was 1,800 bytes long and attached itself to program files. He called his supervisor who hurried over with a virus detection diskette. They inserted it in the infected computer and instructed it to check the machine for viruses. Program file names appeared briefly, one by one on the screen, as the virus detector bustled through its checks, examining each file for known bugs. After five minutes, a message appeared on the screen: it stated that eighty-three files had been checked and no viruses had been found. In exasperation, the supervisor called the vendor of the virus detection program.

‘It does sound like you've got a virus,’ the vendor agreed. ‘But if it's not getting picked up by our software, then it must be a new virus. Or a new strain of an old one.’

Most virus detection programs operate by looking for known characteristics of familiar viruses - in other words, for a string of text or a jumble of characters that is known to be contained within the program of a previously discovered bug. Such virus detection kits are, of course, unable to detect new or modified viruses.

At the suggestion of the vendor, the technical support staff began a search of one of the infected files, looking for text or messages. Specialized software is needed to inspect the inside of a program file; during the inspection the screen displays a jumble of computer code.

📸