2. Viruses

An estimated 16.000 viruses have been encountered by various antivirus research labs, and that number is expected to continue growing rapidly. Of course, the number of viruses actively spreading in the wild is considered to be much smaller-fewer than 1,000.

Though it is difficult to predict what the next major class of virus will be or when it will hit, the place it hits is likely to be the Internet. The threat will probably be similar to the 1988 Internet worm-a program that hopped from system to system, quickly crippling the Internet. Viruses require some level of human involvement to spread, such as exchanging disks or posting an infected file on a server. But a worm moves from system to system by itself, actively seeking out new computers to infect.

Researchers at IBM's Thomas J. Watson Research Center have laid out a blueprint for an automated system that can identify new viruses as well as develop and disseminate the antidotes. The software would identify a previously unknown virus by either analyzing changes to a file or studying the characteristics of a file for code common to viruses. When a potential virus is identified, the infected file would be sent securely to the IBM virus-lab computer. If the virus is known but not recognized by the user's system because of out-of-date software, updated antivirus data would be sent back to the user.

If the virus is truly unknown, the virus-lab computers would let it spread within a secure environment and then study the way the virus behaves, extracting its signature based on the common characteristics of the infected files. The signature would be tested to ensure it didn't misidentify clean files as infected. If the signature passes, it would be sent back to the machine on which the virus was originally identified and the virus would be removed.

IBM estimates that the entire process should take only about 3 minutes. Within a day, the updated virus signature would be sent out to all computers running IBM's software, protecting them from possible infection. This automated system would be significantly faster than the manual process used in today's antivirus software, which typically takes several weeks to a few months to send new virus signatures to all subscribers.

Other challenges face the antivirus community in the coming years. As computer prices continue to drop and more users get connected, the general level of user sophistication goes down. Preying upon this fact, hoaxes have begun to spread around the Internet like wildfire. They are so prevalent that most users are more likely to bothered by hoaxes than by actual viruses.

A hoax typically takes the form of an e-mail message: It warns the user of a virus spreading as part of another e-mail message that will cause damage to the user's computer. The message urges users to forward the warning to all their colleagues. In fact there is no virus, but the hoaxer's message can take on viruslike characteristics as it replicates from system to system via e-mail. Although it is possible for a virus to spread via e-mail, such a virus has yet to be seen in the wild.

Most users do not understand the difference between viruses and other malicious threats. Because of this, antivirus vendors will have to continue extending their products to address more types of security problems, as well as to better detect the rapidly increasing number of viruses.