Anti-Virus and the Operating System

Since the 1980’s the personal computer has taken over the world.  And also, since the late-1980’s viruses have taken over the personal computer.

Strictly speaking, this is only true of PCs running MS-DOS (or PC-DOS) and later, the Windows operating system.  For the rest of the world, the minority, viruses have been practically non-existent.  As a common definition, a virus is a piece of code or program within a program which attaches itself to a host program (the infected program) and then replicates (and does other things) once the host is ran.

Among features and benefits lists of operating systems, PCs running Windows are at a disadvantage when viruses are discussed.  There’s practically no virus running on UNIX/Linux based systems (which include the Mac’s OS X).

There are some who say that the only reason that Windows has lots of viruses is because it is the most popular operating system around.  And this logic points out that if the Mac were more popular, then there would be more viruses attacking OS X.  The latter logic fails because the Mac has always had a market share ranging from 7% to 10% of yearly sales of all PCs, but the number of viruses on the Mac almost nil.

As I understand the architecture of these Operating Systems, the reason viruses are rampant on Windows and not on UNIX/Linux is a fundamental difference of development philosophy.

Windows started from a base of MS-DOS, which was a single-user operating system.  MS-DOS may have borrowed commands from UNIX, but it was designed for a single user machine.  And as a single-user machine, there was no need to build security between users.  It was an open design.  You turn on the PC, and you can do anything you want with it.  (About 10 years ago, my kids started up the PC and inadvertently renamed the Windows folder. That kind of thing happening is still possible with the XP and Vista.)

On the other hand, from the very beginning, UNIX was designed with the thought to multi-user functionality.  That means that UNIX would be used by any number of users at any point in time.  This raised the issue of security, where one user cannot open anyone else’s files or folders.  UNIX was designed to be a closed system.  Something like a sandbox.  Users are given a sandbox to work in, and everything else outside it are off-limits.  That includes system files, and other user’s files.  And by default, if someone owns a program, it won’t run on anyone else’s space.  This seems like overkill in some ways.

So what happens when a virus comes along?  If there were no anti-virus program on Windows, the code will reside in memory, run in the background, replicate itself, and play with the system files as well as other files it’s supposed to play with.  On UNIX/Linux, even without any anti-virus programs, the virus will have to be downloaded as a program, and explicitly run by a user.  Once the virus or the infected program tries to attach itself to the system files, the system will ask the user for admin-level password (using the “sudo” command).  And only then will it be able to do damage.  But in order to infect other machines, it would again have to ride on someone’s files and downloaded, explicitly, by a user.

So, yes, there is a Mac OS X virus.  But it’s still waiting for “sudo” access in order to run.