viruses case study example

11 real and famous cases of malware attacks

Updated at June 4, 2021
Blog , Threat Research

Many cases of famous hacker attacks use malware at some point. For example, first, the cybercriminal can send you a phishing email . No attachment. No links. Text only. After he gains your trust , in a second moment, he can send you a malicious attachment , that is, malware disguised as a legitimate file.

Malware is a malicious software designed to infect computers and other devices. The intent behind the infection varies. Why? Because the cybercriminal can use malware to make money, to steal secret information that can give strategic advantages, to prevent a business from running or even just to have fun.

Yes, there are hackers who act for pleasure.

In fact, malware is a broad term. It’s like a category. Within this category are different types of threats, such as virus , worm , trojan , and ransomware .

To fight malware delivered via email, here at Gatefy we offer a secure email gateway solution and an anti-fraud solution based on DMARC . You can request a demo or more information .

To get an idea, according to the FBI , damages caused by ransomware amounted to more than USD 29.1 million just in 2020. And one of the most widely used form of malware spreading continues to be via email . As a Verizon report confirmed : 30% of the malware was directly installed by the actor, 23% was sent there by email and 20% was dropped from a web application.

The cases listed below show how malware attacks can work and give you a glimpse of the harm they cause to businesses and individuals.

In this post, we’ll cover the following malware cases:

Icon of the Gatefy's cloud email security solution.

Check out 11 real cases of malware attacks

1. covidlock, ransomware, 2020.

Fear in relation to the Coronavirus (COVID-19) has been widely exploited by cybercriminals. CovidLock ransomware is an example. This type of ransomware infects victims via malicious files promising to offer more information about the disease.

The problem is that, once installed, CovidLock encrypts data from Android devices and denies data access to victims. To be granted access, you must pay a ransom of USD 100 per device.

2. LockerGoga, ransomware, 2019

LockerGoga is a ransomware that hit the news in 2019 for infecting large corporations in the world, such as Altran Technologies and Hydro. It’s estimated that it caused millions of dollars in damage in advanced and targeted attacks.

LockerGoga infections involve malicious emails , phishing scams and also credentials theft. LockerGoga is considered a very dangerous threat because it completely blocks victims’ access to the system.

3. Emotet, trojan, 2018

Emotet is a trojan that became famous in 2018 after the U.S. Department of Homeland Security defined it as one of the most dangerous and destructive malware. The reason for so much attention is that Emotet is widely used in cases of financial information theft, such as bank logins and cryptocurrencies.

The main vectors for Emotet’s spread are malicious emails in the form of spam and phishing campaigns . 2 striking examples are the case of the Chilean bank Consorcio, with damages of USD 2 million, and the case of the city of Allentown, Pennsylvania, with losses of USD 1 million.

4. WannaCry, ransomware, 2017

One of the worst ransomware attacks in history goes by the name of WannaCry , introduced via phishing emails in 2017. The threat exploits a vulnerability in Windows.

It’s estimated that more than 200,000 people have been reached worldwide by WannaCry, including hospitals, universities and large companies, such as FedEx, Telefonica, Nissan and Renault. The losses caused by WannaCry exceed USD 4 billion.

By the way, have you seen our article about the 7 real and famous cases of ransomware attacks ?

5. Petya, ransomware, 2016

Unlike most ransomware , Petya acts by blocking the machine’s entire operating system. We mean, Windows system. To release it, the victim has to pay a ransom.

It’s estimated that the losses involving Petya and its more new and destructive variations amount to USD 10 billion since it was released in 2016. Among the victims are banks, airports and oil and shipping companies from different parts of the world.

6. CryptoLocker, ransomware, 2013

The CryptoLocker is one of the most famous ransomware in history because, when it was released in 2013, it used a very large encryption key, which made the experts’ work difficult. It’s believed that it has caused more than USD 3 million in damage, infecting more than 200,000 Windows systems.

This type of ransomware was mainly distributed via emails, through malicious files that looked like PDF files , but, obviously, weren’t.

7. Stuxnet, worm, 2010

The Stuxnet deserves special mention on this list for being used in a political attack, in 2010, on Iran’s nuclear program and for exploiting numerous Windows zero-day vulnerabilities . This super-sophisticated worm has the ability to infect devices via USB drives, so there is no need for an internet connection.

Once installed, the malware is responsible for taking control of the system. It’s believed that it has been developed at the behest of some government. Read: USA and Israel.

8. Zeus, trojan, 2007

Zeus is a trojan distributed through malicious files hidden in emails and fake websites, in cases involving phishing . It’s well known for propagating quickly and for copying keystrokes, which led it to be widely used in cases of credential and passwords theft, such as email accounts and bank accounts.

The Zeus attacks hit major companies such as Amazon, Bank of America and Cisco. The damage caused by Zeus and its variations is estimated at more than USD 100 million since it was created in 2007.

9. MyDoom, worm, 2004

In 2004, the MyDoom worm became known and famous for trying to hit major technology companies, such as Google and Microsoft. It used to be spread by email using attention-grabbing subjects, such as “Error”, “Test” and “Mail Delivery System”.

MyDoom was used for DDoS attacks and as a backdoor to allow remote control. The losses are estimated, according to reports, in millions of dollars.

10. ILOVEYOU, worm, 2000

The ILOVEYOU worm was used to disguise itself as a love letter, received via email. Reports say that it infected more than 45 million people in the 2000s, causing more than USD 15 billion in damages.

ILOVEYOU is also considered as one of the first cases of social engineering used in malware attacks. Once executed, it had the ability to self-replicate using the victim’s email.

Also see 10 real and famous cases of social engineering .

11. Melissa, virus, 1999

The Melissa virus infected thousands of computers worldwide by the end of 1999. The threat was spread by email, using a malicious Word attachment and a catchy subject: “Important Message from (someone’s name)”.

Melissa is considered one of the earliest cases of social engineering in history. The virus had the ability to spread automatically via email. Reports from that time say that it infected many companies and people, causing losses estimated at USD 80 million.

How to fight malware attacks

There are 2 important points or fronts to fight and prevent infections caused by malware.

1. Cybersecurity awareness

The first point is the issue regarding cybersecurity awareness. You need to be aware on the internet. That means: watch out for suspicious websites and emails . And that old tip continues: if you’re not sure what you’re doing, don’t click on the links and don’t open attachments.

2. Technology to fight malware

The second point involves the use of technology . It’s important that you have an anti-malware solution on your computer or device. For end-users, there are several free and good options on the market.

For companies, in addition to this type of solution, we always recommend strengthening the protection of your email network. As already explained, email is the main malware vector. So, an email security solution can rid your business of major headaches.

Here at Gatefy we offer an email gateway solution and a DMARC solution . By the way, you can request a demo by clicking here or ask for more information . Our team of cybersecurity experts will contact you shortly to help.

Our Network

Computerworld
Network World

11 infamous malware attacks: The first and the worst

Whether by dumb luck or ruthless skill, these malware attacks left their mark on the internet..

binary code, magnifying lens, skull and crossbones

Viruses and other malware spreading for sinister or baffling reasons has been a staple of cyberpunk novels and real-life news stories alike for decades. And in truth, there have been computer viruses on the internet since before it was the internet. This article will take a look at some of the most important milestones in the evolution of malware: These entries each represent a novel idea, a lucky break that revealed a gaping security hole, or an attack that turned to be particularly damaging—and sometimes all three.

Creeper virus (1971)
Brain virus (1986)
Morris worm (1988)
ILOVEYOU worm (2000)
Mydoom worm (2004)
Zeus trojan (2007)
CryptoLocker ransomware (2013)
Emotet trojan (2014)
Mirai botnet (2016)
Petya ransomware/NotPetya wiper (2016/7)
Clop ransomware (2019-Present)

1. Creeper virus (1971)

Computer pioneer John von Neumann’s posthumous work Theory of Self-Reproducing Automata , which posited the idea of computer code that could reproduce and spread itself, was published in 1966. Five years later, the first known computer virus, called Creeper , was a written by Bob Thomas. Written in PDP-10 assembly language, Creeper could reproduce itself and move from computer to computer across the nascent ARPANET.

Creeper did no harm to the systems it infected—Thomas developed it as a proof of concept, and its only effect was that it caused connected teletype machines to print a message that said “I’M THE CREEPER: CATCH ME IF YOU CAN.” We’re mentioning it here despite its benign nature because it was the first, and set the template for everything that followed. Shortly after Creeper’s release, Ray Tomlinson, best known for implementing the first email program, wrote a rival program called Reaper that spread from computer to computer eliminating Creeper’s code.

2. Brain virus (1986)

Creeper was designed to leap across computer networks, but for most of the 1970s and ’80s that infection vector was in limited simply because most computers operated in isolation. What malware did spread from computer to computer did so via floppy disks. The earliest example is Elk Cloner , which was created by a 15-year-old as a prank and infected Apple II computers. But probably the most important of this generation of viruses was one that came to be known as Brain, and started spreading worldwide in 1986.

Brain was developed by computer programmers (and brothers) Amjad and Basit Farooq Alvi, who lived in Pakistan and had a business selling medical software. Because their programs were often pirated, they created a virus that could infect the boot sector of pirated disks. It was mostly harmless but included contact information for them and an offer to “disinfect” the software.

Whether they could actually “fix” the problem isn’t clear, but as they explained 25 years later, they soon started receiving phone calls from all over the world , and were shocked by how quickly and how far Brain had spread (and how mad the people who had illegally copied their software were at them, for some reason). Today Brain is widely regarded as the first IBM PC virus, so we’re including it on our list despite its benign nature, and the brothers still have the same address and phone number that they sent out 25 years ago.

3. Morris worm (1988)

1988 saw the advent of a piece of malware called Morris, which could claim a number of firsts. It was the first widespread computer worm , which meant it could reproduce itself without needing another program to piggyback on. It targeted multiple vulnerabilities to help it spread faster and further. While not designed to do harm, it was probably the first malware to do real substantive financial damage, more than earning its place on this list. It spread incredibly swiftly—within 24 hours of its release, it had infected 10 percent of all internet-connected computers —and created multiple copies of itself on each machine, causing many of them to grind to a halt. Estimates of the costs of the attack ranged into the millions.

The worm is named after its creator Robert Morris , who was a Cornell grad student at the time and meant it as a proof-of-concept and demonstration of widespread security flaws. Morris didn’t anticipate that it would spread so quickly or that its ability to infect individual computers multiple times would cause so much trouble, and he tried to help undo the damage, but it was too late. He ended up the unfortunate subject of another first: The first person convicted under the 1986 Computer Fraud and Abuse Act.

4. ILOVEYOU worm (2000)

Unlike the previous malware creators on this list, Onel de Guzman, who was 24 in 2000 and living in the Philippines, crafted his creation with straightforward criminal intent: he couldn’t afford dialup service, so he built a worm that would steal other people’s passwords so he could piggyback off of their accounts. But the malware so cleverly took advantage of a number of flaws in Windows 95—especially the fact that Windows automatically hid the file extensions of email attachments so people didn’t realize they were launching executable files—that it spread like wildfire, and soon millions of infected computers were sending out copies of the worm and beaming passwords back to a Filipino email address . It also erased numerous files on target computers, causing millions of dollars in damage and briefly shutting down the U.K. Parliament’s computer system.

de Guzman was never charged with a crime, because nothing he did was illegal in the Philippines at the time, but he expressed regret in an interview 20 years later , saying he never intended the malware to spread as far as it did. He also ended up being something of a pioneer in social engineering : the worm got its name because it spread with emails with “ILOVEYOU” in the subject line . “I figured out that many people want a boyfriend, they want each other, they want love, so I called it that,” de Guzman said.

5. Mydoom worm (2004)

Mydoom may be almost 20 year old as of this writing, but as of today still holds a number of records. The Mydoom worm infected computers via email , then took control of the victim computer to email out more copies of itself, and did it so efficiently that at its height it accounted for a quarter of all emails sent worldwide, a feat that’s never been surpassed. The infection ended up doing more than $35 billion in damages, which, adjusted for inflation, has also never been topped.

The creator and ultimate purpose of Mydoom remain mysteries today. In addition to mailing out copies of the worm, infected computers were also used as a botnet to launch DDoS attacks on the SCO Group (a company that aggressively tried to claim intellectual property rights over Linux ) and Microsoft , which led many to suspect some rogue member of the open source community . But nothing specific has ever been proven.

6. Zeus trojan (2007)

Zeus was first spotted in 2007, at the tail end of the Web 1.0 era, but it showed the way for the future of what malware could be. A Trojan that infects via phishing and drive-by downloads from infected websites, isn’t just one kind of attacker; instead, it acts as a vehicle for all sorts of malicious payloads. Its source code and operating manual leaked in 2011, which helped both security researchers and criminals who wanted to exploit its capabilities .

You’ll usually hear Zeus referred to as a “banking Trojan,” since that’s where its variants focus much of their energy. A 2014 variant, for instance, manages to interpose itself between a user and their banking website , intercepting passwords, keystrokes, and more. But Zeus goes beyond banks, with another variation slurping up Salesforce.com info .

7. CryptoLocker ransomware (2013)

Zeus could also be used to create botnets of controlled computers held in reserve for some later sinister purpose. The controllers of one such botnet, called Gameover Zeus, infected their bots with CryptoLocker, one of the earliest prominent versions of what became known as ransomware . Ransomware encrypts many of the files on the victim’s machine and demands a payment in cryptocurrency in order to restore access.

CryptoLocker became famous for its rapid spread and its powerful asymmetric encryption that was (at the time) uniquely difficult to break. It also became famous due to something unusual in the malware world: a happy ending. In 2014, the U.S. DoJ and peer agencies overseas managed to take control of the Gameover Zeus botnet , and restore the files of CryptoLocker victims free of charge. Unfortunately, CryptoLocker spread via good old-fashioned phishing as well, and variants are still around.

8. Emotet trojan (2014)

Emotet is another piece of malware whose functionality has shifted and changed of the years that it has remained active. In fact, Emotet is a prime example of what’s known as polymorphic malware , with its code changing slightly every time it’s accessed, the better to avoid recognition by endpoint security programs . Emotet is a Trojan that, like others on this list, primarily spreads via phishing (repeat after us: do not open unknown email attachments ).

Emotet first appeared in 2014, but like Zeus, is now a modular program most often used to deliver other forms of malware, with Trickster and Ryuk being two prominent examples. Emotet is so good at what it does that Arne Schoenbohm, head of the German Federal Office for Information Security, calls it the “king of malware.”

9. Mirai botnet (2016)

All the viruses and other malware we’ve been discussing so far have afflicted what we think of as “computers”—the PCs and laptops that we use for work and play. But in the 21st century, there are millions of devices with more computing power than anything that Creeper could have infected. These internet of things (IoT) devices are omnipresent, ignored, and often go unpatched for years.

The Mirai botnet was actually similar to some of the early malware we discussed because it exploited a previously unknown vulnerability and wreaked far more havoc than its creator intended. In this case, the malware found and took over IoT gadgets (mostly CCTV cameras) that hadn’t had their default passwords changed. Paras Jha, the college student who created the Mirai malware, intended to use the botnets he created for DoS attacks that would help settle scores in the obscure world of Minecraft server hosting, but instead he unleashed an attack that focused on a major DNS provider and cut off much of the U.S. east coast from the internet for the better part of a day.

10. Petya ransomware/NotPetya wiper (2016/7)

The ransomware Trojan dubbed Petra started afflicting computers in 2016. Though it had a clever mechanism for locking down its victims’ data—it encrypts the master file table, which the OS uses to find files—it spread via conventional phishing scams and wasn’t considered particularly virulent.

It would probably be forgotten today if not for what happened the following year. A new self-reproducing worm variant emerged that used the NSA’s leaked EternalBlue and EternalRomance exploits to spread from computer to computer. Originally distributed via a backdoor in a popular Ukrainian accounting software package, the new version— dubbed NotPetya —quickly wreaked havoc across Europe. The worst part? Though NotPetya still looked like ransomware, it was a wiper designed wholly to ruin computers, as the address displayed where users could send their ransom was randomly generated and did no good. Researchers believe that Russian intelligence repurposed the more ordinary Petya malware to use as a cyberweapon against Ukraine—and so, in addition to the massive damage it caused, NotPetya earns its place on this list by illustrating the symbiotic relationship between state sponsored and criminal hackers.

11. Clop ransomware (2019-Present)

Clop (sometimes written Cl0p) is another ransomware variant that emerged on the scene in 2019 and has grown increasingly prevalent since, to the extent that it was dubbed one of the top malware threats of 2022 . In addition to preventing victims from accessing their data, Clop allows the attacker to exfiltrate that data as well. McAfee has a breakdown of the technical details , including a review of ways it can bypass security software.

What makes Clop so interesting and dangerous, however, is not how it’s deployed, but by whom. It’s at the forefront of a trend called Ransomware-as-a-Service , in which a professionalized group of hackers does all the work for whoever will pay them enough (or share in a percentage of the ransomware riches they extract from victims). The earlier entries in this list are from a day when the internet was for hobbyists and lone wolves; today, it seems even cybercrime is largely the province of governments and the professionals.

More from this author

What is the cia triad a principled framework for defining infosec policies, crisc certification: exam, requirements, training, potential salary, tabletop exercise scenarios: 10 tips, 6 examples, what is swatting criminal harassment falsely involving armed police, ccsp certification: exam, cost, requirements, training, salary, certified ethical hacker (ceh): certification cost, training, and value, whitelisting explained: how it works and where it fits in a security program, download our password managers enterprise buyer’s guide, most popular authors.

Gyana Swain

Show me more

Major github repos leak access tokens putting code and clouds at risk.

Thousands of NetSuite stores leak sensitive data due to access control misconfiguration

MIT delivers database containing 700+ risks associated with AI

CSO Executive Sessions: Guardians of the Games - How to keep the Olympics and other major events cyber safe

CSO Executive Session India with Dr Susil Kumar Meher, Head Health IT, AIIMS (New Delhi)

CSO Executive Session India with Charanjit Bhatia, Head of Cybersecurity, COE, Bata Brands

Cybersecurity Insights for Tech Leaders: Addressing Dynamic Threats and AI Risks with Resilience

Computer Virus Examples (2024): The 9 Worst Attacks Ever

By Tibor Moes / Updated: May 2024

Computer Virus Examples (2023): The 17 Worst Attacks Ever

Computer viruses pose a significant threat to global digital security, causing widespread damage to personal, corporate, and governmental systems.

In this article, we will explore nine of the most devastating computer virus attacks in history, providing insights into their impact and the lessons learned from each incident.

A computer virus is a type of malicious software that replicates itself by modifying other computer programs and inserting its own code.

Morris Worm (1988): This early internet worm rapidly infected around 6,000 computers, showcasing the vulnerability of connected systems. The financial damage soared into the millions, marking a new era in digital security threats.
ILOVEYOU (2000): A deceptive email worm that infected over ten million Windows PCs, causing widespread data loss and significant financial damage.
Code Red and Code Red II (2001): These worms targeted Microsoft’s IIS web server, infecting over 359,000 systems in less than 14 hours and causing over $2 billion in damages.
Mydoom (2004): Known for causing an estimated $38 billion in damages, Mydoom infected around 50 million computers, making it one of the most damaging viruses ever.
Stuxnet (2010): A sophisticated worm that targeted Iran’s nuclear program, damaging about one-fifth of its nuclear centrifuges and infecting over 200,000 computers.
CryptoLocker (2013): This ransomware infected up to 250,000 computers, with its operators extorting around $3 million from victims.
Bad Rabbit (2017): A ransomware attack that demanded payments in Bitcoin, affecting numerous organizations and translating to a ransom of about $1,070 today.
WannaCry (2017): Infected about 200,000 computers across 150 countries, with financial and economic losses potentially reaching $4 billion.
Shlayer (2018): The most common threat for macOS users in 2019, affecting 10% of all Macs analyzed by Kaspersky.

Don’t become a victim of a computer virus. Protect your devices with the best antivirus software and your privacy with the best VPN service .

Computer Virus Examples

1. morris worm (1988).

In the late 1980s, the digital world witnessed one of its first major security crises with the emergence of the Morris Worm. This incident, a landmark in the history of cyber threats, unfolded rapidly and with startling impact. Within just 24 hours of its release, the Morris Worm had infiltrated an estimated 6,000 computers . This number might seem modest by today’s standards, but it was a significant proportion of the roughly 60,000 computers connected to the then-nascent Internet.

The worm, named after its creator Robert Tappan Morris, was not designed with malicious intent. Instead, it was an experiment that spiraled out of control. Morris, a graduate student at Cornell University, aimed to gauge the size of the Internet. However, due to a programming error, the worm replicated excessively, clogging up network resources and slowing down systems to the point of unresponsiveness.

The financial toll of the Morris Worm was substantial, though difficult to quantify precisely. Initial estimates of the damage started at around $100,000 , but as the full extent of the disruption became clear, figures soared into the millions . The incident served as a wake-up call to the digital world, highlighting the need for better security protocols and measures. It was a stark reminder of how quickly and extensively digital threats could propagate, even in the Internet’s early days.

2. ILOVEYOU (2000)

Fast forward to the year 2000, and the world faced a new, more sophisticated breed of computer worm: ILOVEYOU. This deceptively named worm unleashed a global crisis, infecting over ten million Windows personal computers starting on May 5, 2000.

The ILOVEYOU worm was a masterclass in social engineering, exploiting human curiosity and trust. It spread via email with the subject line “ILOVEYOU” and an attachment named “LOVE-LETTER-FOR-YOU.txt.vbs.” Many recipients, intrigued by the romantic connotation, opened the attachment, unwittingly unleashing the worm.

Once activated, ILOVEYOU replicated itself and overwrote files, causing widespread data loss. It also emailed itself to the first 50 contacts in the user’s Windows address book, which significantly aided its rapid global spread. The financial impact of ILOVEYOU was staggering, with damages estimated in billions of dollars. It affected both individual users and large organizations, including corporations and government agencies.

The ILOVEYOU worm was a significant event in cybersecurity history, illustrating the devastating potential of computer viruses and the importance of cautious online behavior. It underscored the need for robust digital hygiene practices, such as not opening suspicious emails and attachments, and the critical role of up-to-date security software.

3. Code Red and Code Red II (2001)

In the summer of 2001, the digital world was shaken by the emergence of Code Red, a rapidly spreading computer worm. This cyber threat was remarkable for its speed and scale of infection. Within a mere 14 hours of its release, Code Red had successfully infiltrated over 359,000 systems . The worm targeted computers running Microsoft’s IIS web server software, exploiting a known vulnerability to replicate and spread.

Code Red was unique in its approach. It didn’t require human interaction, such as opening an email or a file, to propagate. Instead, it automatically infected vulnerable systems connected to the Internet. The worm caused widespread outages and significantly slowed down Internet traffic, affecting both individual users and large organizations.

The financial repercussions were enormous, with the total damage caused by Code Red estimated to exceed $2 billion . This figure encapsulates the costs of disrupted services, lost productivity, and the extensive efforts required to eradicate the worm from infected systems.

The subsequent variant, Code Red II, emerged shortly after and used a similar method to spread. It further highlighted the need for timely software updates and robust cybersecurity measures to protect against such vulnerabilities.

4. Mydoom (2004)

Mydoom, which struck in 2004, stands as one of the most damaging viruses in history. Its impact was both widespread and costly, with estimates suggesting that Mydoom caused a staggering $38 billion in damages. This figure reflects the extensive harm and disruption caused to businesses, governments, and individuals across the globe.

The reach of Mydoom was unprecedented, infecting around 50 million computers worldwide . It spread primarily through email, enticing recipients with deceptive subject lines and attachments. Once opened, the virus replicated and sent itself to email addresses found in the user’s contact list, perpetuating a rapid and extensive spread.

Mydoom’s design was not just to replicate; it also opened backdoors on infected computers, leaving them vulnerable to further exploitation. This aspect of the virus caused long-term security concerns, as it allowed attackers to access and control infected systems even after the initial outbreak was contained.

The Mydoom virus underscored the importance of cautious email practices and the necessity of having updated antivirus software. It also highlighted the broader implications of such attacks on Internet infrastructure and the global economy.

5. Stuxnet (2010)

In 2010, the cybersecurity world was rocked by the discovery of Stuxnet, a highly sophisticated computer worm unlike any seen before. Stuxnet was not just a piece of malware; it was a weaponized software designed to target and disrupt specific industrial control systems. The primary target of this cyberattack was Iran’s nuclear program, where it reportedly damaged almost one-fifth of the country’s nuclear centrifuges.

The scale and precision of Stuxnet were unprecedented. It infected over 200,000 computers , but its real impact was in the physical world – causing 1,000 machines to physically degrade. This worm marked a significant shift in the landscape of cyber threats, moving beyond data theft and vandalism to the realm of physical destruction. Stuxnet operated by exploiting multiple zero-day vulnerabilities and was capable of stealthily manipulating industrial processes.

The revelation of Stuxnet’s capabilities and targets sent shockwaves through the international community. It highlighted the potential for cyber warfare to cause physical damage to critical infrastructure, a concern that extended far beyond Iran’s borders. This incident underscored the need for stringent security measures in industrial control systems and raised questions about the ethics and implications of state-sponsored cyber warfare.

6. CryptoLocker (2013)

CryptoLocker, which emerged in 2013, represented a new and insidious threat in the form of ransomware. This malicious software encrypted the files on a victim’s computer, then demanded a ransom for the decryption key. By mid-December of that year, Dell Secureworks reported that between 200,000 to 250,000 computers had been infected by CryptoLocker.

The impact of CryptoLocker was not just in its widespread infection but in the financial losses it inflicted. The operators of this trojan were alarmingly successful, extorting an estimated total of around $3 million from victims . The ransom typically had to be paid in Bitcoin, making the transactions difficult to trace and prosecute.

CryptoLocker’s modus operandi opened a new chapter in cybercrime, where attackers could directly monetize their exploits through victim payments. It highlighted the importance of regular data backups and the dangers of opening email attachments from unknown sources. The CryptoLocker saga also prompted a significant response from law enforcement and cybersecurity professionals, leading to a coordinated effort to take down the network used by the malware.

7. Bad Rabbit (2017)

In 2017, the digital world was hit by another ransomware attack known as Bad Rabbit. This malware, as reported by moonlock.com, demanded a ransom of 0.05 Bitcoins , equivalent to about $290 at that time . Given the fluctuations in Bitcoin’s value, this amount would be approximately $1,070 today .

Bad Rabbit spread through a fake Adobe Flash update on compromised websites, tricking users into installing it. Once installed, it encrypted the user’s files, displaying a ransom note with the payment demand. The attack primarily targeted organizations in Russia and Ukraine but also affected systems in Turkey, Germany, and other countries.

Bad Rabbit’s method of spreading and its financial demands highlighted the evolving tactics of cybercriminals and the importance of being cautious with software updates and downloads from the internet.

8. WannaCry (2017)

WannaCry, another ransomware attack that occurred in 2017, was unprecedented in its scale and impact. According to Europol and as reported by bbc.com, around 200,000 computers were infected across 150 countries , making it one of the most widespread cyberattacks in history.

The financial and economic losses from the WannaCry attack were immense, potentially reaching up to $4 billion . WannaCry exploited a vulnerability in Microsoft Windows, and despite a patch being available, many systems remained unupdated and vulnerable. The attack caused significant disruptions in various sectors, including healthcare, where it infamously impacted the UK’s National Health Service.

WannaCry’s global reach and the substantial financial losses it caused underscored the critical need for regular software updates and robust cybersecurity measures in both personal and organizational contexts.

9. Shlayer (2018)

In 2018, the cybersecurity landscape for macOS users changed dramatically with the emergence of the Shlayer Trojan. This malware challenged the long-standing perception that Mac systems were largely immune to the kind of security threats frequently encountered on Windows platforms.

As reported by Wired.com, by 2019, the Shlayer Trojan had become the most common threat for macOS users. A startling statistic from Kaspersky revealed that 10% of all Macs analyzed were affected by this Trojan, underscoring its widespread impact.

Shlayer was particularly insidious because it disguised itself as a legitimate software update or download, tricking users into installing it. Once installed, it bombarded users with an onslaught of adware and potentially unwanted programs. This not only compromised the user experience but also exposed users to further security risks.

The prevalence of Shlayer served as a critical wake-up call to the Mac community, highlighting the importance of vigilance even in a relatively secure ecosystem. It reminded users and developers alike that no system is impervious to attack and that maintaining cybersecurity is a continuous and evolving challenge.

The history of computer viruses, from the Morris Worm to Shlayer, illustrates a clear and evolving threat in the digital world. These examples highlight not only the sophistication and diversity of cyberattacks but also the extensive financial and operational damages they can inflict. Each incident serves as a reminder of the vulnerabilities inherent in digital systems and the continuous need for vigilance and updated security measures.

In the context of these threats, particularly for users of Windows 11 , investing in robust antivirus software is more crucial than ever. Brands like Norton , Avast , TotalAV , Bitdefender , McAfee , Panda , and Avira offer comprehensive protection that goes beyond basic defense mechanisms. These antivirus solutions provide real-time monitoring, advanced threat detection, and proactive measures to prevent malware infections.

With cyber threats becoming more sophisticated, the right antivirus software is not just a tool—it’s an essential layer of defense that protects personal data, financial information, and ensures uninterrupted digital experiences. The cost of antivirus software pales in comparison to the potential losses from a cyberattack, making it a wise and necessary investment for any Windows 11 user.

Researchgate.net
Nordvpn.com
MAC-solutions.net
Moonlock.com
CBSnews.com

Author: Tibor Moes

Founder & Chief Editor at SoftwareLab

Tibor has tested 39 antivirus programs and 30 VPN services , and holds a Cybersecurity Graduate Certificate from Stanford University.

He uses Norton to protect his devices, CyberGhost for his privacy, and Dashlane for his passwords.

You can find him on LinkedIn or contact him here .

Antivirus Comparisons

Best Antivirus for Windows 11 Best Antivirus for Mac Best Antivirus for Android Best Antivirus for iOS

Antivirus Reviews

Norton 360 Deluxe Bitdefender Total Security TotalAV Antivirus McAfee Total Protection

A World of Viruses

Viruses All Around Us

What comes to mind when you hear the word “virus”? Perhaps the common cold, a cold sore, or maybe even a global pandemic, such as the one we are living in now, caused by a coronavirus that may have originated in bats.

In fact, viruses are ever-present in the living world, infecting, affecting, and interacting with all organisms, from the minuscule to the gigantic, and can be found in every ecosystem on the planet. They are as ubiquitous and essential to our lives as the air we breathe, the water we drink, and the food we eat. But what, exactly, are they? Are they alive? What do they do, and how do they do it?

Small, but Mighty

Viruses are the smallest of all microbes. It would take 500 million rhinoviruses, the virus known to cause the common cold, to cover the head of a pin. They exist by hijacking the cellular machinery of another living thing in order to reproduce. An individual virus known as a virion does this by injecting its genetic material, packets of nucleic acids known as RNA and/or DNA, into a host cell. They then replicate within, and ultimately explode out of, the cell in the form of new virions ready to infect other cells. These minuscule microbes can pack a powerful punch, infecting us with an array of diseases from chicken pox to AIDS. To see how a virus enters a host cell, check out this animation.

Five stages of how a virus infects a host cell.

Viruses are Everywhere

Viruses do not only infect humans. They are, in fact, ever present in our world, occupying nearly all organisms, and found in virtually every type of habitat, even in the air we breathe and the deepest depths of the ocean. They are also ancient, predating some of the earliest forms of life. Scientists believe they are at least as old as the first cells, which emerged around 4 billion years ago, but viruses could be even older, existing in the precellular world as self-replicating entities that subsequently evolved into forms that parasitize other cells.

Coronavirus

COVID-19 is the disease caused by the new coronavirus, seen below, an airborne virus that emerged in China in December 2019, and subsequently led to the global pandemic of 2020. Harvard Medical School created an online learning module on how the human body reacts to viruses like Covid-19. You can find it here.

Are Viruses Alive?

Viruses occupy a space on the tree of life that blurs the line between existence and nonexistence. Life is generally defined as an organism that can live and reproduce autonomously using its own energy-producing biological mechanisms.

Viruses, on the other hand, are essentially parasites that, in order to multiply, must harness a host cell’s replication mechanisms. Because they are unable to do any of this on their own, some argue that they are not among the living. However, other scientists suggest that because viruses are made up of the same building blocks of life, DNA and RNA, they verge on life. It’s an ongoing debate that has remained largely unresolved in the scientific community for the last 100 years.

Viral Shapes

Viruses come in many different shapes and sizes, but all are made of two essential components: a core of genetic material, either DNA or RNA, which is surrounded by a protective protein coat called a capsid. Packaged together, a single virion comes in four different shapes: helical, polyhedral, spherical, and complex.

Viral Assemblies

How can you fight something you can’t see? Viruses like influenza spread so effectively, and as a result can be so deadly, because of their ability to spontaneously self-assemble in large numbers.

Researchers at the Harvard John A. Paulson School of Engineering and Applied Sciences have engineered a new way to observe and track viruses as they assemble. This new method may spot weaknesses in viruses that drug makers can exploit to design drugs that prevent viruses from assembling in the first place.

Studying the Invisible

Virus are extremely tiny, even tinier than bacteria, so how do scientists study them? Hannah Gavin, a microbiologist at Harvard, shows us how she does just that in this video.

Viral Alliances

Though viruses are most often associated with illness, they can be a friend as well as a foe. Scientists have learned to manipulate their unique characteristics as a scientific tool.

Bacteriophages are types of viruses that attack bacteria by attaching to bacterial cells and injecting their genetic material into them. Harnessed correctly, this can stop a bacterial infection in its tracks. In this way, phage therapy has been used to treat bacterial infections in humans by injecting the bacteria causing the infection with bacteriophages that essentially stop it from spreading. Similarly, viruses may ultimately save the American Chestnut, an iconic tree species nearly wiped out by a bacterial infection called Chestnut Blight. Scientists have figured out a way to supercharge a virus that attacks the Blight, preventing infection from spreading throughout the tree.

American Chestnut

The American Chestnut, once considered one of the most important forest trees in North America, was nearly wiped out by Chestnut Blight in the first half of the twentieth century, but may recover with the help of viruses.

An official website of the United States government

The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Publications
Account settings
My Bibliography
Collections
Citation manager

Save citation to file

Email citation, add to collections.

Create a new collection
Add to an existing collection

Add to My Bibliography

Your saved search, create a file for external citation management software, your rss feed.

Search in PubMed
Search in NLM Catalog
Add to Search

RNA Viruses: A Case Study of the Biology of Emerging Infectious Diseases

Affiliation.

1 Centre for Immunity, Infection & Evolution, University of Edinburgh, Edinburgh EH9 3JT, United Kingdom.
PMID: 26184815
PMCID: PMC6157708
DOI: 10.1128/microbiolspec.OH-0001-2012

There are 180 currently recognized species of RNA virus that can infect humans, and on average, 2 new species are added every year. RNA viruses are routinely exchanged between humans and other hosts (particularly other mammals and sometimes birds) over both epidemiological and evolutionary time: 89% of human-infective species are considered zoonotic and many of the remainder have zoonotic origins. Some viruses that have crossed the species barrier into humans have persisted and become human-adapted viruses, as exemplified by the emergence of HIV-1. Most, however, have remained as zoonoses, and a substantial number have apparently disappeared again. We still know relatively little about what determines whether a virus is able to infect, transmit from, and cause disease in humans, but there is evidence that factors such as host range, cell receptor usage, tissue tropisms, and transmission route all play a role. Although systematic surveillance for potential new human viruses in nonhuman hosts would be enormously challenging, we can reasonably aspire to much better knowledge of the diversity of mammalian and avian RNA viruses than exists at present.

PubMed Disclaimer

A representation of the pathogen…

A representation of the pathogen pyramid. Each level of the pyramid represents a…

All currently recognized human-infective RNA…

All currently recognized human-infective RNA viruses categorized with respect to their ability to…

A schematic representation of the…

A schematic representation of the relationship between human viruses and viruses from other…

Related information

Grants and funding.

Wellcome Trust/United Kingdom

LinkOut - more resources

Full text sources.

Europe PubMed Central
PubMed Central

Other Literature Sources

scite Smart Citations

Citation Manager

NCBI Literature Resources

MeSH PMC Bookshelf Disclaimer

The PubMed wordmark and PubMed logo are registered trademarks of the U.S. Department of Health and Human Services (HHS). Unauthorized use of these marks is strictly prohibited.

An official website of the United States government

The .gov means it’s official. Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

The site is secure. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Publications
Account settings

Preview improvements coming to the PMC website in October 2024. Learn More or Try it out now .

Advanced Search
Journal List
J Thorac Dis
v.10(5); 2018 May

Case study-based time-course analysis of symptoms of respiratory syncytial virus infections followed by acute sinusitis in otherwise-healthy adults

Hidekazu nishimura.

1 Virus Research Center, Clinical Research Division, Sendai Medical Center, National Hospital Organization, Sendai, Miyagi, Japan;

Francois Marie Ngako Kadji

Suguru ohmiya.

3 Department of Virology, Institute of Tropical Medicine, Nagasaki University, Nagasaki, Japan;

4 Nagasaki Genbaku Isahaya Hospital, Isahaya, Nagasaki, Japan

Sho Hashimoto

2 Department of Otolaryngology, Sendai Medical Center, National Hospital Organization, Sendai, Miyagi, Japan;

Reports on respiratory syncytial virus (RSV) infections are abundant in pediatric and geriatric populations but not many in healthy adults, and particularly, those which demonstrated the illness throughout its time course are rare. We report two otherwise-healthy adult cases, showing a number of evidence essential for confirmation of exclusive infections with RSV, and document their clinical features from the onset of the disease to recovery, including secondary sinusitis with magnetic resonance (MR) and computed tomography (CT) images. The infection was proven by isolating RSV belonging to subgroup B and by observing elevated anti-RSV antibody titer in the paired sera. Possible contribution of other pathogens including almost all respiratory viruses and representative bacteria, was excluded by negative results in multiplex PCR examination. In the first case, illness initiated with pharyngeal pain, followed by symptoms of sneezing, severe rhinorrhea and coughing, which peaked at approximately 5–7 days and persisted for 12 days. The patient experienced a slight chill, but the body temperature did not exceed 37 °C during illness. The patient showed no significant finding but only a slight increase in serum C-reactive protein level in the routine clinical laboratory examinations. On the 9th day of illness, a dull headache started persisting for at least a week after which it gradually waned. Sinusitis was found by chance on MR images of maxillary sinus 8 days after the headache started, and the finding disappeared on CT images taken after 6 months. In the second case, the symptoms included severe rhinorrhea and dull facial pain around the upper nose; the pain also occurred on the 9th day of illness and the symptom was clinically diagnosed to be acute sinusitis during a visit to a physician.

Introduction

Human respiratory syncytial virus (RSV) is a single stranded RNA virus, a member of the family Pneumoviridae and genus Orthopneumovirus , and comprises two subgroups, A and B. Many studies have been published world wide regarding clinical features of RSV infection in pediatric, elderly, and immune-compromised adult populations in detail to demonstrate the clinical significance of the infection ( 1 ). In healthy adult population, several pioneering studies were performed from the late 1970’s to early 2000’s ( 2 ) and, thereafter, studies on healthy young adults of military trainees were performed ( 3 - 5 ), and they showed that the infection was clinically significant in those population, as well. However, their main data were about the symptoms and their durations, and there has been a lack of detailed information, particularly regarding the progression of infection from the onset of the illness. Exceptions to this were the reports of experimental infections where a relatively high dose of virus was administered by pouring viral fluid drops into the nasal cavity ( 6 , 7 ). However, in these reports, the available information only concerned the infection, the description of clinical features was very simple, and the time points of the observations were unclear and did not follow a time course. In this study, we report two cases of healthy adults with community-acquired RSV infections, which were virologically proven to be a single infection without any contribution from other pathogens. In these cases, we systematically recorded the clinical features in detail, from the onset to end of the illness through to acute sinusitis diagnosis. We report a case showing computed tomography (CT) and magnetic resonance (MR) images, which were taken for other reasons and revealed the sinusitis by chance. We further introduce an additional case, which was also a single RSV infection, and showing almost the same clinical features as those of the first case, including the symptom, which was suggestive of acute sinusitis.

Case presentation

The case was a 59-year-old male living in Sendai City, Japan, who did not have any health problems related to infectious diseases. On November 5, 2014, he developed a sore throat without any specific findings on the pharyngeal wall. During this time, the number of children infected with RSV was increasing in the city, leading to an RSV infection epidemic ( Figure 1 ). On the following day, slight fever, fatigue, and chillness occurred. In addition, his body temperature slightly increased to approximately 37 °C, whereas his usual body temperature ranged between 35.8 and 36.2 °C. Two days after the onset of illness (day of illness 2: DOI 2), symptoms of sneezing and rhinorrhea started. Rhinorrhea became severe with continuous running nose, and coughing started on DOI 3. The cough persisted for 12 days and peaked at approximately DOI 5–7. Clear and relatively serous sputum was coughed up at the time when the symptom of cough initiated. On the other hand, the mucus of the sputum coughed up 1 week later was sticky and yellowish. On DOI 9, dull headache started, which persisted for at least a week with gradual waning ( Figure 2 ). The patient received no medication during the time course of the illness. On DOI 1, acute-phase blood was obtained from the patient for performing laboratory examinations. Laboratory examination results did not show significant finding except for a slightly elevated serum C-reactive protein level (0.6 mg/dL).

An external file that holds a picture, illustration, etc.
Object name is jtd-10-05-E322-f1.jpg

RSV isolation by a reference laboratory in Sendai city in 2014 and 2015. Isolating RSV from pediatric patients with acute respiratory diseases in Virus Research Center, Sendai Medical Center. The timing of the RSV from the first case: bold arrow indicates the day when RSV was isolated from the first case; dotted line with arrow denote the day when RSV was isolated from the second case. RSV, respiratory syncytial virus.

An external file that holds a picture, illustration, etc.
Object name is jtd-10-05-E322-f2.jpg

Time course analysis of symptoms of RSV infection. Schematic images of separately show the time courses of occurrence (arrows), duration, and strength of symptoms along the time after the onset of illness, for the two patients. The crescendo and decrescendo demonstrate the augmentation and remission of symptoms, respectively. RSV, respiratory syncytial virus.

Confirmation of RSV infection

On DOI 1, throat swab specimen was obtained from the patient, and it was immediately inoculated to six kinds of cultured cells: HEp-2, Vero, MDCK, MNT-1, LLC-MK2, and HFL-III. These cell lines are competent for isolating a variety of human respiratory viruses, including type A, B, and C influenza viruses; type 1, 2, 3, and 4 parainfluenza viruses; human metapneumovirus; RSV; mumps virus; herpes viruses; cytomegalovirus; adenoviruses; enteroviruses; and rhinoviruses ( 8 ). Six days after inoculation, the cytopathic effect (CPE) was recognized only in HEp-2 cells as a form of cell fusion that was characteristic of RSV infection and other cells exhibited no CPE. The positive and negative results of the CPE in these cells strongly suggested the exclusive isolation of RSV. Moreover, the clinical specimen and the supernatant of the culture for DOI 1 were used for RNA extraction. The RNA obtained from the culture supernatant was subjected to loop-mediated isothermal amplification (LAMP) assay, which has been established for detecting RSV ( 9 ). Using the LAMP assay, the RSV gene of subgroup B was detected, genetically confirming RSV isolation. Finally, to exclude the possibility of co-infection with other possible pathogens, the extracted RNA from the clinical specimen was further subjected to multiplex real-time polymerase chain reaction (PCR), which can detect various respiratory pathogens with high sensitivity ( 10 ). We did not detect any genes of the pathogens listed in Table 1 .

By culture only

Mumps virus

Herpes viruses: types 1, 2

Cytomegalovirus

By real-time PCR analyses

Viruses

Influenza viruses: types A, B, C

Parainfluenza viruses: types 1, 2, 3, 4a, 4b

Human metapneumovirus

Coronaviruses: 229E, OC43, NL63, HKU

Adenoviruses

Enteroviruses

Rhinoviruses

Bacteria

Others

PCR, polymerase chain reaction.

To serologically confirm RSV infection, the antibody against RSV was titrated for the paired sera of acute and convalescent phases, collected at DOI 1 and 3 weeks later, respectively. The titration was performed with the neutralization test using a contemporary strain of RSV subgroup B as the antigen, which was isolated in the same year of the RSV epidemic. We could not use the virus isolated from the subject himself because it did not grow well enough to be used for titration. In this assay, the neutralization titer was defined as the reciprocal of the highest dilution of the serum, at which infection with 100 TCID 50 of active virus in HEp-2 cells was perfectly blocked ( 11 ). The antibody titer showed an increase from 1:120 to 1:480, thereby confirming an RSV infection.

Diagnosis of acute sinusitis

On November 19, 2014, which was DOI 14 and 8 days after the onset of headache, the patient visited an outpatient brain surgery clinic, for an MR imaging (MRI) examination for pre-existent cervical spinal stenosis and then, also consulted the physician regarding his persisting headache. The physician observed thickening of the sinus mucosa and inferred that the headache could be a consequence of sinusitis. An otolaryngologist indicated the marked increase in mucosal thickness at the upper and middle areas of the right maxillary sinus and retention of mucus in the upper area ( Figure 3A,B ). CT image taken after 6 months, i.e., May 14, 2015, during a dental treatment revealed that mucosal thickening disappeared ( Figure 3C,D ). Thus, the occurrence of acute sinusitis was proven in the MR and CT images of the sinus at acute and convalescent phases.

An external file that holds a picture, illustration, etc.
Object name is jtd-10-05-E322-f3.jpg

MRI and CT images suggest acute sinusitis. (A,B ) Axial views of the sinuses of the patient. The mucosal thickening was found to be increased in the MR images of the right maxillary sinus, slightly at the upper level (A) and significantly increased at the middle level (B, arrow); (C,D) CT image of the same levels after 6 months revealed that the mucosal thickening disappeared (arrow head). (C, upper level; D, middle level). MRI, magnetic resonance imaging; CT, computed tomography.

Additional case

The second case was a female in her 50s who also lived in Sendai City, Japan and who did not have without any health problems. Her illness started with fatigue on the morning of December 14, 2015 when RSV infection was spreading in the city ( Figure 1 ). She had slight fever at noon, and her body temperature was approximately 37 °C in the evening. However, she did not have pharyngeal pain. On the following day, similar to the first case, rhinorrhea started and the amount of mucus discharge significantly increased, eventually becoming a runny nose on DOI 3. Similar to the first case, RSV of subgroup B was isolated in HEp-2 cells among various cell line cells, which were inoculated with her nasal swab specimen of DOI 2. Moreover, only the RSV gene was detected in the specimen using multiplex real-time PCR ( Table 1 ), as in the first case. The anti-RSV antibody was titrated for the paired sera with the neutralization test using the virus isolated from the patient as the antigen. The titers of acute and convalescent phase sera were 1:60 and 1:240, respectively, confirming RSV infection.

Her nasal discharge symptom waned within a week. However, the facial dull pain around the nasal area started on DOI 9, and a clinical diagnosis of acute sinusitis was made by the physician. This pain symptom continued only for 4 days without receiving any medication. Unlike the first case, she did not have a symptom of coughing throughout her time course of illness ( Figure 2 ).

In this study, we presented cases of two healthy adults with RSV infections and describe their clinical data in detail from the early stage of the disease. This study unequivocally proved the occurrence of an RSV infection using virologically fundamental methods confirming elevated serum anti-RSV antibody titers, and also isolating active RSV. Detecting a pathogen using conventional PCR do not necessarily imply that the detected virus actually caused an infection, because it is occasionally a result of a false-positive reaction or a contamination without an infection. In addition, the detected pathogen may not be exclusively responsible for the illness, because sometimes more than one pathogen can be simultaneously detected in a sample that is examined using multiplex PCR ( 12 , 13 ). We can reliably suggest that our cases solely had an RSV infection because negative results were obtained for various respiratory pathogens using multiplex PCR of their clinical specimens, which excluded the possibility of a coinfection with other pathogens.

Regarding the symptoms of RSV infection, pneumonia and bronchiolitis are not infrequent in children, particularly infants. The occurrence in children wanes as the age increases and reinfections repeatedly occur; the elderly and immune compromised individuals also sometimes suffer from lower respiratory inflammation ( 1 ). Clinical features of the infections in the adult population were reported in 204 patients diagnosed with RSV infection, although the diagnosis was based only on gene detection with conventional PCR for only RSV. Half of these cases were in their 50’s retrospectively and >90% of them were reported to have symptoms of cough and nasal congestion, although the timings of symptoms were not known ( 14 ). Regarding definitive pure RSV infection in healthy adults, we found two reports of experimental infections in volunteers who were administered high amounts of attenuated RSV of a vaccine candidate strain via the nasal route. The subjects experienced symptoms of nasal stuffiness, sneezing, sore throat, or malaise, which persisted for 1–3 days ( 6 ); in addition, nasal discharge started on the second day and peaked on the seventh day after the inoculation ( 7 ).

Both of our cases did not have a symptom of nasal congestion but had rhinorrhea following slight fever; their general symptoms were only those of upper respiratory illness such as pharyngeal pain, sneezing and prolonged coughing. Furthermore, the dull headache or facial pain which was inferred as sinusitis, occurred approximately on DOI 9 in both cases. All of those symptoms were common with those previously reported ( 2 ).

Acute sinusitis itself is not infrequent and occurs in association with various acute upper respiratory infections with virus or bacteria ( 15 , 16 ). In our first case, it is unclear whether sinusitis was caused by direct RSV infection to the site, or secondarily by other pathogen(s) such as bacteria following an RSV infection in the mucosa, which leads to the disturbance of airflows between the nasal cavity and sinus through the portal site. Sinusitis was diagnosed by CT images in 12 (63%) among 19 immuno compromised adult patients with RSV pneumonia ( 17 ). Furthermore, sinusitis was clinically diagnosed by a physician in one of 12 RSV infection cases, and four of 54 influenza cases ( 15 ). Examining whether RSV infection is prone to cause acute sinusitis would be a challenge for further studies, and future etiological studies of sinusitis associated with upper respiratory infections with many pathogen types will address this question.

Acknowledgements

We thank Dr. Shinsuke Suzuki (Department of Brain Surgery, Sendai Medical Center) for suggesting acute sinusitis during the patient’s visit, Dr. Isolde Dapat and Enago ( www.enago.jp ) for English language review by a native speaker. This work was financially supported by the Clinical Research Division of Sendai Medical Center and the Research Program on Promoting Development of Innovative Drugs against Emerging and Reemerging Infectious Diseases from Japan Agency for Medical Research and Development, AMED.

Informed Consent: Written informed consent was obtained from the patients of this study.

Conflicts of Interest: The authors have no conflicts of interest to declare.

Click through the PLOS taxonomy to find articles in your field.

For more information about PLOS Subject Areas, click here .

Loading metrics

Open Access

Peer-reviewed

Research Article

Hybrid Epidemics—A Case Study on Computer Worm Conficker

* E-mail: [email protected] (CZ); [email protected] (SZ)

Affiliations Department of Computer Science, University College London, London, United Kingdom, Security Science Doctoral Research Training Centre, University College London, London, United Kingdom

Affiliation Department of Computer Science, University College London, London, United Kingdom

Affiliation Division of Infection and Immunity, University College London, London, United Kingdom

Changwang Zhang,
Shi Zhou,
Benjamin M. Chain

Published: May 15, 2015
https://doi.org/10.1371/journal.pone.0127478
Reader Comments

Conficker is a computer worm that erupted on the Internet in 2008. It is unique in combining three different spreading strategies: local probing, neighbourhood probing, and global probing. We propose a mathematical model that combines three modes of spreading: local, neighbourhood, and global, to capture the worm’s spreading behaviour. The parameters of the model are inferred directly from network data obtained during the first day of the Conficker epidemic. The model is then used to explore the tradeoff between spreading modes in determining the worm’s effectiveness. Our results show that the Conficker epidemic is an example of a critically hybrid epidemic, in which the different modes of spreading in isolation do not lead to successful epidemics. Such hybrid spreading strategies may be used beneficially to provide the most effective strategies for promulgating information across a large population. When used maliciously, however, they can present a dangerous challenge to current internet security protocols.

Citation: Zhang C, Zhou S, Chain BM (2015) Hybrid Epidemics—A Case Study on Computer Worm Conficker. PLoS ONE 10(5): e0127478. https://doi.org/10.1371/journal.pone.0127478

Academic Editor: Gui-Quan Sun, Shanxi University, CHINA

Received: December 12, 2014; Accepted: April 14, 2015; Published: May 15, 2015

Copyright: © 2015 Zhang et al. This is an open access article distributed under the terms of the Creative Commons Attribution License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited

Data Availability: All relevant data are within the paper.

Funding: This work was supported in part by the Engineering and Physical Sciences Research Council of UK (no. EP/G037264/1), the China Scholarship Council (file no. 2010611089), and the National Natural Science Foundation of China (project no. 60970034, 61170287, 61232016). The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript.

Competing interests: The authors have declared that no competing interests exist.

Introduction

Epidemic spreading phenomena exist in a wide range of domains [ 1 , 2 ]. Well-known examples include disease spreading [ 3 – 5 ], computer worm proliferation [ 6 – 8 ], and information propagation [ 9 – 11 ]. Modelling and understanding of such phenomena can have important practical values to predict and control real world epidemics [ 3 – 5 , 12 – 15 ].

Some typical spreading mechanisms have been extensively studied, such as the fully-mixed spreading model and the network spreading model. Many epidemics are hybrid as they spread via two or more different mechanisms simultaneously. Previous work on hybrid epidemics has focused on what we call the non-critically hybrid epidemic, where at least one of the spreading mechanisms alone is able to cause an epidemic outbreak, and a mixture of mechanisms brings no advantage.

We are interested in the critically hybrid epidemic, where each spreading mechanism alone is unable to cause any significant spreading whereas the mixture of such mechanisms leads to a huge epidemic outbreak. Recently we proposed a model that explains the behaviour of critically hybrid epidemics, which incorporates two spreading mechanisms in the setting of a metopopulation [ 16 ]. We demonstrated that it is indeed possible to have a highly contagious epidemic by mixing simple, ineffective spreading mechanisms. The properties of such epidemics are critically determined by the ratio at which the different spreading mechanisms are mixed, and usually there is an optimal ratio that leads to a maximal outbreak size.

In this paper we present a detailed analysis of a real hybrid epidemic—the Internet worm Conficker, which erupted on the Internet in 2008 and infected millions of computers. The worm is a hybrid epidemic as the code analysis [ 17 ] has revealed the worm applied three distinct spreading mechanisms: (1) global random spreading, (2) local network spreading, and (3) neighbourhood spreading. It is a critically hybrid epidemic because the first and second spreading mechanisms are highly ineffective if used alone, and the third mechanism, as we will show later, is most effective when mixed with the other two.

We introduce a mathematical model to describe the spreading behaviour of Conficker. Our study was based on measurement data provided by Center for Applied Internet Data Analysis (CAIDA)’s Network Telescope project [ 18 , 19 ], which monitors Internet traffic anomalies. We proposed algorithms to extract Conficker–related features from the CAIDA data. Then we infer the values of our model’s parameters that characterise the worm.

We evaluated our inference results by comparing theoretical predictions with the actual measurement results. Our predictions closely reproduced the outbreak process of Conficker. We then explored possible spreading scenarios based on simulations using different values of parameters. One of the interesting results was that we showed the worm could spread faster, reach a larger outbreak size or survive for longer time by just revising the ratios at which the worm allocated its time on each of the spreading mechanisms (while keeping everything else the same), which can be easily achieved by changing a few lines in its coding.

This paper’s contributions are two fold. Firstly, we present the first study on a real-life critically hybrid epidemic, where the epidemic’s parameter values are inferred from measurement data. Secondly, we analyse the complex interactions among Conficker’s three spreading mechanisms, and show that the worm can be more contagious if it mixes its three spreading mechanisms in an optimal way.

Epidemic spreading mechanisms

A number of epidemic spreading mechanisms have been extensively studied [ 20 , 21 ]. For example, in the fully-mixed spreading models [ 20 , 22 ], a node is connected to all other nodes in a population, thus an epidemic can potentially spread between any two nodes according to a probability. Whereas in the network spreading models [ 1 , 2 , 20 , 23 ], nodes are connected to their neighbours via a network structure, therefore an epidemic can only spread along the connections among nodes. Recent network-based models considered additional physical properties such as location-specific contact patterns [ 24 , 25 ], human mobility patterns [ 26 – 29 ] and spatial effects [ 30 – 33 ].

Hybrid epidemics

Many epidemics are hybrid in the sense that they spread via two or more spreading mechanisms simultaneously. A hybrid epidemic can use fully-mixed spreading and network spreading, or use fully-mixed spreading but at two or more different levels, e.g. at the global level covering the whole population or at the local level consisting of only a part of the population.

There are many real examples. Mobile phone viruses can spread via Bluetooth communication with any nearby devises (local, fully-mixed spreading) and Multimedia Messaging Service with remote contacts (global, network spreading) [ 27 ]. A computer that is infected by the worm Red Code II spends 1/8 of its time probing any computers on the Internet at random (global, fully-mixed spreading) and the rest of the time probing computers located in local area networks (local, fully-mixed spreading) [ 34 ]. Today information is propagated in society via mass media (TV, newspaper, posters) as well as online social media (Facebook, Twitter and emails). Mass media (global, fully-mixed spreading) can potentially deliver the information to a big audience, but the effectiveness of information transmission at an individual level may be small (for example, its ability to alter the target individuals behaviour). In contrast, social media (local, network spreading) may have little or no access to the majority of people who are not connected to the local group, but they provide rapid penetration of a selected target group with higher effectiveness.

It is clear that hybrid epidemics are much more complex than simple epidemics. Their behaviour is affected not only by multiple spreading mechanisms that they use, but also by the population’s overlaid structure on which they spread. Studying hybrid epidemics may provide crucial clues for better understanding of many real epidemics.

Previous works on hybrid epidemics

Hybrid epidemics were initially studied as two levels of mixing in a population where nodes are mixed at both local and global levels [ 35 ]. Recently hybrid epidemics were studied as two levels of mixing in a network [ 36 – 38 ], in structured populations [ 39 ], in structured households [ 40 – 42 ], and in a meta-population which consists of a number of weakly connected sub-populations[ 43 – 48 ]. Studies of epidemics in clustered networks [ 49 – 51 ] are also relevant to the hybrid epidemics.

These previous works focused on analysing how a network’s structure affects hybrid spreading. And most of them studied the non-critically hybrid epidemics, where at least one of the two spreading mechanisms alone can cause an infection outbreak and therefore the mix of two mechanisms is not a necessary condition for an epidemic outbreak. In this case, a hybrid epidemic using two spreading mechanisms is often less contagious than an epidemic using only one of the mechanisms. [ 36 , 52 ].

Our recent study on critically hybrid epidemics

We are interested in the critically hybrid epidemics, where each of the spreading mechanisms alone is not able to cause any significant infection whereas a combination of the mechanisms can cause an epidemic outbreak. In this case, the mix of different spreading mechanisms is a critically condition for an outbreak (see Fig 1 ).

PPT PowerPoint slide
PNG larger image
TIFF original image

(a) Non-critically hybrid epidemic, where at least one of the two mechanisms can cause an outbreak by its own (i.e. when α = 1 or α = 0). (b) critically hybrid epidemics, where each mechanism alone cannot cause any significant infection whereas a mix of them produces an epidemic outbreak. There exists an optimal α that produces the maximum outbreak.

https://doi.org/10.1371/journal.pone.0127478.g001

Recently we proposed a generic model to study the critically hybrid epidemics [ 16 ]. We considered an epidemic which spreads in a meta-population (consisting of many weakly connected sub-populations ) using a mix of the following two typical spreading mechanisms. (1) Fully-mixed spreading on the global level, i.e. infection between any two nodes in the meta-population. (2) Network (or fully-mixed) spreading on the local level, i.e. infection between nodes within a sub-population where the internal topology of a sub-population is a network (or a fully-connected mesh). Each spreading mechanism has its own infection rate and an infected node recovers at a recovery rate. We define a parameter called the hybrid trade-off, α , as the proportion of time that the epidemic devotes to the first spreading mechanism (or the probability of using the first spreading mechanism in a time unit). Thus the proportion of time spent on the second mechanism is (1 − α ).

Our mathematical analysis and numerical simulations based on the model highlight the following two results. Firstly, it is possible to mix two ineffective spreading mechanisms to produce a highly contagious epidemic, because the mix of the mechanisms can help to overcome the weakness of each mechanisms. Secondly, the threshold and the size of outbreak is critically determined by the hybrid trade-off α . We also provided an analytical prediction of the optimal trade-off for the maximum outbreak size.

Computer Worm Conficker

In this paper we will analyse a critically hybrid epidemic, the computer worm Conficker, based on real measurement data. It is one of the most contagious computer worms on record. It erupted on the Internet on 21 November 2008 and infected millions of computers in just a few days [ 7 ]. The worm’s ability to spread to such a large number of computers in so short a time and the fact [ 53 ] that it is still active on the Internet has caused serious concern.

Global spreading, where the worm probes computers with random IP addresses on the Internet;
Local spreading, where the worm on an infected computer probes computers in the same Local Area Network (LAN) with the same IP address prefix;
Neighbourhood spreading, where it probes computers in ten neighbouring LANs (with smaller consecutive IP address prefixes).

(1) global spreading, where it probes any computer on the Internet at random; (2) local spreading, where it probes computers in the same local network; (3) neighbourhood spreading, where it probes computers in ten neighbouring local networks.

https://doi.org/10.1371/journal.pone.0127478.g002

Previous research on Conficker has studied the geographical distribution of infected IP addresses, the distribution of probing packet size [ 7 , 54 , 55 ], and properties of the worm’s global probing [ 56 , 57 ]. The parameters of Conficker’s hybrid spreading and how they affect the epidemic dynamics of the worm can help explain why the worm is so contagious. But they have been hitherto little studied.

Our Model of Conficker

Global spreading with probability α g , where the worm probes nodes on the Internet at random with the global infection rate β g ∈ [0, 1].
Local spreading with probability α l , where it probes nodes in the local subnet with the local infection rate β l ∈ [0, 1];
Neighbourhood spreading with the probability α n , where it probes nodes in ten neighbouring subnets with the neighbourhood infection rate β n ∈ [0, 1];

An infected node is recovered with recovery rate γ ∈ [0, 1]. A recovered node remains recovered and cannot be infected again. Note that for mathematical analysis, the mixing probabilities could be incorporated into the infection rates. But we have treated them as separate parameters, considering that an infection rate reflects inherent properties of a computer worm in the context of a specific target population, whereas mixing probabilities are settings that can be easily modified in the worm’s code. This is also the reason we use the mixing probabilities as controlling parameters in our study below and keep other parameters the same.

Only nodes that can potentially be infected by Conficker are relevant to our study. We call them the relevant nodes. A subnet is relevant if it contains at least one relevant node. Irrelevant nodes include unused IP addresses and those computers that do not have the vulnerabilities that the worm can exploit. Note that although the irrelevant nodes and subnets do not participate in the spreading of Conficker, they will be probed by the worm as the worm does not have the priori knowledge about which nodes are vulnerable.

Let n represent the total number of relevant nodes and N the number of relevant subnets. The average number of relevant nodes in a subnet is n N = n / N . Let N + represent the average number of relevant subnets in ten neighbouring subnets.

At time t , the total number of susceptible, infected, and recovered nodes are S ( t ), I ( t ), and R ( t ), respectively. Then the average number of infected nodes in a subnet is I N ( t ) = I ( t )/ N , and the average number of infected nodes in ten neighbouring subnets is I + ( t ) = I N ( t ) N + . Hence on average a susceptible node can be infected via (1) global probing by I ( t ) infected nodes in the Internet; (2) local probing by I N ( t ) infected nodes in the local subnet; (3) neighbourhood probing by I + ( t ) infected nodes in the neighbouring subnets.

Inferring Conficker Parameters From Data

We infer the parameter values of our Conficker model from the Internet measurement data [ 18 , 19 ] collected by the Center for Applied Internet Data Analysis (CAIDA) in 2008. This is the only publicly available dataset that has captured the initial outbreak process of the worm. The CAIDA Network Telescope project [ 18 , 19 ] monitors Internet traffic sent to a large set of unusable IP addresses, which account for around 1/256 of all addresses. No legitimate traffic should be sent to these monitored addresses because they are not allocated for normal usage [ 58 ]. Thus the traffic data captured by this project provides a good view on various abnormal behaviours on the Internet.

When Conficker spreads on the Internet, its global spreading mechanism sends out probing packets to randomly generated IP addresses, some of which are unused IP addresses and therefore are monitored by the Network Telescope project. Conficke’s probing packets are characterised by the Transmission Control Protocol (TCP) with destination port number 445. This feature can be used to distinguish Conficker packets from other packets in the Network Telescope data.

For each record of Conficker’s probing packet, we are interested in two things: (1) the time when the packet is monitored by the Network Telescope project, and (2) the packet’s source IP address, which gives the location of a Conficker-infected node. We ignore the destination address, as it is a randomly-generated, unused IP address.

We study the Network Telescope project’s daily dataset collected on November 21, 2008, the day when Conficker broke out on the Internet. We use two earlier datasets collected on November 12 and 19, 2008 to filter out background ‘noise’ that has been happening before the outbreak. That is, in the outbreak dataset, we discard packets that were sent from any source address that had already sent packets to any of the unusable addresses in the two earlier datasets. We use the prefix of /24 (i.e. IP address mask of 255.255.255.0) to distinguish different subnets [ 7 ]. Our analysis uses a 10-minute window.

Step One: Inferring node status at a given time

We first infer the status of each node at time t from the CAIDA data. On the day of Conficker outbreak, all relevant nodes were initially susceptible. In the analysis, we assume a node is just infected by the worm when we observe the first Conficker probing packet coming from it; and the node is recovered when we observe its last probing packet before the end of the day. Fig 3 shows the number of susceptible, infected and recovered nodes as observed in a 10-minute window.

Numbers of susceptible nodes S ( t ), infected nodes I ( t ) and recovered nodes R ( t ) as a function of time t , as inferred from CAIDA’s dataset on 21/Nov/2008, the day of Conficker’s outbreak.

https://doi.org/10.1371/journal.pone.0127478.g003

Step Two: Inferring new infections caused by each spreading mechanism

Let dI l ( t ), dI n ( t ) and dI g ( t ) represent the numbers of nodes that are newly infected through local, neighbourhood and global spreading, respectively, at time step t . Our analysis on the data shows that 84% of new infections occurred within already infected subnets or their neighbourhood subnets, i.e. only 16% of new infections appeared outside the reach of local and neighbourhood probing. This agrees with our understanding that local and neighbourhood probing are significantly more effective than global probing [ 7 ]. And 73% of those new infections within the reach of local and neighbourhood probing (i.e. 73%×84% of all new infections) occurred in already infected subnets. This indicates the local probing is more effective than neighbourhood probing. Based on the above analysis we can then approximately identify the probing mechanism that is responsible for a newly infected node by analysing the states of other relevant nodes at the time when the new infection happens.

IF there is an infected node already in the same subnet, the new infection is caused by that infected node via local spreading.
ELSE IF there is an infected node in the ten neighbouring subnets, then the new infection is via neighbourhood spreading.
OTHERWISE, the newly infected node is infected via global spreading.

Fig 4 shows the inferred results, plotting the number of new infections caused by each spreading mechanism as a function of time.

Numbers of nodes newly infected by Conficker via each of the three spreading mechanisms in 10-minute windows on the day of Conficker’s outbreak, as inferred from CAIDA’s dataset on 21/Nov/2008.

https://doi.org/10.1371/journal.pone.0127478.g004

Step Three: Inferring parameters of the Conficker model

Inference results and evaluation

The inferred values of the Conficker model parameters are shown in Table 1 , including the mixing probability α and the infection rate β for three spreading mechanisms, the recover rate γ , the recovery time τ = 1/ γ which is the average time it takes for an infected node to recover, and the probing frequency λ . The parameter values are averaged over time windows between 4:00 and 16:00 when the spreading behaviour was stable. Computers are online and offline on a daily basis following a diurnal pattern [ 59 ]. We find that this factor only has a marginal impact on our results.

https://doi.org/10.1371/journal.pone.0127478.t001

We observe in the data that the worm had infected in total n = 430,135 nodes, which were located in N = 92,267 subnets. On average, each subnet has n N = 4.7 relevant nodes, and N + = 4.3 of ten neighbouring subnets are relevant.

With these parameter values, we can use our Conficker model (see Eq 2 ) to theoretically predict the worm’s outbreak process. As measured from the data, the number of nodes in the three statuses were S = 423,899, I = 3,945, and R = 2,291 at 4:00am. Our prediction starts from 4.00am and uses these numbers as the initial condition. As shown in Fig 5 , our model’s predictions closely match the measurement data.

Points are measured from Network Telescope’s dataset collected on the outbreak day. Curve is theoretical prediction from our Conficker model using the inferred parameters.

https://doi.org/10.1371/journal.pone.0127478.g005

The inferred parameters are in agreement with our expectations. For example the local spreading has a high infection rate because if a computer is already infected, then other computers in the same subnet are likely to have a similar computer system and thus are also likely to be vulnerable to the worm. By comparison, global spreading has an extremely low infection rate. On average, more than 10 million global probings will produce only a single new infection. On average an infected node retains its status for 2.5 hours (156 mins) before it recovers (e.g. switched off or updated with new anti-virus database). The worm only sends out 8 probing packets per minute. Such a deliberately low probing rate helps the worm to evade a computer’s or network’s security systems.

Analysis on Conficker’s Hybrid Spreading

Mix of two spreading mechanisms.

We run simulations using our Conficker model with the parameter values inferred above. The simulation network has 100k subnets. Each subnet contains 5 relevant nodes and has 4 relevant adjacent subnets. This topology setting resembles Conficker’s spreading network observed in the data. Initially two random nodes are infected. The only controlling parameter is the mixing probabilities of the spreading mechanisms. Simulation results on mix of two spreading mechanisms are shown in Fig 6 .

(a) Mix of global ( α g ) and local (1 − α g ) mechanisms; (b) Mix of global ( α g ) and neighbourhood (1- α g ) mechanisms; (c) Mix of local ( α l ) and neighbourhood (1- α l ) mechanisms. In each case we measure the outbreak size, the total duration of the spreading, and the speed of spreading. The outbreak results include both the final outbreak size (square) and the outbreak size at time step 100 (filled circle). Each data point is averaged over 100 runs of a simulation. Note the y axes are all logarithmic.

https://doi.org/10.1371/journal.pone.0127478.g006

Fig 6a shows that as explained above, global spreading or local spreading alone cannot cause an outbreak, whereas a mixture at a ratio of 0.8 to 0.2 produces a large and rapid outbreak. Fig 6b shows that the neighbourhood spreading alone ( α g = 0) can cause a large, but very slow outbreak, whereas the mix of neighbourhood spreading with just a small amount of global spreading can dramatically accelerate the spreading process. Fig 6c shows that adding local spreading to neighbourhood spreading slows down the spreading process considerably. When they are mixed at the ratio of 0.8 to 0.2, the spreading reaches the same final outbreak size but the whole process lasts for the longest time.

Mix of THREE spreading mechanisms

Simulation results on mixing three spreading mechanisms are shown in Fig 7 . Fig 7a shows it is not difficult to achieve a large final outbreak size when the three mechanisms are all present and neither local spreading nor global spreading is dominant. Fig 7b shows spreading will last for longer time if there is less global probing. Fig 7c shows that the most contagious variation of the worm is a mix of global, local and neighbourhood spreading at the probabilities of 0.4, 0.2 and 0.4 (see circle on the plot), which causes the largest final outbreak with the highest spreading speed.

Spreading properties shown include the final outbreak size, the survival time and the spreading speed (see colour maps) as functions of the mixing probabilities of global spreading α g (x axis) and local spreading α l (y axis), where the mixing probability of neighbourhood spreading is α n = 1 − α g − α l .

https://doi.org/10.1371/journal.pone.0127478.g007

In this study, we infer the epidemic spreading parameters of the Conficker worm from observed data collected during the first few hours of the epidemic. Simulations of worm spreading, based on these parameters, allow us to reach some important conclusions about the worm’s use of hybrid spreading mechanisms.

Advantage of mixing hybrid spreading mechanism

Conficker’s global probing is extremely ineffective. The infection rate of global probing is many orders of magnitude smaller than the recovery rate. This means, if Conficker used only the global probing, it would not have caused any significant infection on the Internet at all.

Local probing has a remarkably high infection rate, β l = 0.32, which means when an infected node conducts only local spreading, a susceptible node in the same subnet has an 1/3 chance of being infected in a step (10-mins). However, local probing is confined within a subnet. If the worm used only the local probing, it would not have infected any other subnet apart from those initially containing infected nodes.

Neighbourhood probing is constrained to a neighbourhood of ten subnets. It has a high infection rate because computers in adjacent IP address blocks often belong to the same organisation and they use similar computer systems and therefore have similar vulnerabilities that can be exploited by the worm. Since different nodes’ neighbourhoods can partially overlap with each other, it is in theory possible for the worm to reach any node in the whole meta-population by using only the neighbourhood probing. Such process, however, would be extraordinarily slow as we have shown in Fig 6b .

In summary, if Conficker used only a single spreading mechanism, it would have vanished on the Internet without causing any significant impact.

Thus the enormous outbreak of the worm lies in its ability to do two things. Firstly it needs to devote great efforts to explore every corner of the Internet to find a new vulnerable computer. Every new victim will open a new colony full of similar vulnerable computers. Secondly it needs to make the most out of each new colony.

This is exactly what Conficker does. It allocates most of its time on global probing with a mixing probability of α = 89%. This in a degree compensates the ineffectiveness of global probing. Although the worm allocates small amounts of time on local and neighbouring probing, their high infection rates allow them to exploit all possible victims in the subnets with efficiency. And all newly infected nodes will join the collective effort to flood the Internet with more global random probes.

In short, the Conficker worm is an example of a critically hybrid epidemic. It can cause an enormous outbreak not because it has an advanced ability to exploit weaknesses of a computer, but because it has remarkable capability to discover all potentially vulnerable computers in the Internet, i.e. it is not the infectivity, but the hybrid spreading that makes Conficker one of the most infectious worms on record.

Implication of critically hybrid epidemics

The analysis of critically hybrid epidemics such as Conficker has important general implications. Firstly, it demonstrates that it is possible to design a high impact epidemic based on mechanisms, each of relatively low efficiency. Indeed our result in Fig 7 suggests that Conficker could have had a larger outbreak with higher speed if it had used a different set of mixing probabilities, which requires change of only a few lines of Conficker’s program code. Hybrid mechanisms may therefore be ideal for rapid efficient penetration of a network, for example in the context of an advertising campaign or in order to promulgate important public health or security information. An interesting example might be the use of media campaigns (global spreading) where the reader or viewer is specifically requested to pass on a message via Twitter or Facebook to their “local” group contacts.

Conversely, malicious hybrid epidemics can be extremely difficult to defend against, and many existing defence strategies may not be effective. For example immunising a selected portion of a local population in order to isolate and hence protect the vulnerable nodes will not be effective, because the vulnerable nodes can still be found by the worm through random global spreading.

Another possible measure is to reduce the average time it takes for an infected node to recover, for example to speed up the release of anti-virus software updates or increase the frequency of security scanning on computers. Our theoretical predictions (using Eq 2 ) in Fig 8 show that the final outbreak size (in terms of total recovered nodes) does not change significantly when the recovery time is reduced from 156 minutes to 140 or 120 minutes. In practice, even achieving such reductions represents a remarkable technical challenge. It is clear from the discussion above that epidemics can spread with extremely low global infection rates (far below individual recovery rates), provided there is efficient local infection. The extremely efficient spreading achieved once a given subnet or set of subnets has been penetrated is therefore obviously a key determinant of the worm’s outbreak [ 7 ]. Thus, defence strategies that focus on security co-operation between nodes with a local network neighbourhood (a “neighbourhood watch” strategy [ 7 ]) may be the key to future prevention of similar outbreaks.

Conficker’s recovery time is 156 minutes.

https://doi.org/10.1371/journal.pone.0127478.g008

Our Conficker model

The Conficker worm can be described as a discrete model or a continuous model. The two modelling approaches should give the same prediction results of the spreading dynamics of the worm. In this work we used a discrete approach to model the Conficker worm for three reasons. Firstly the model’s parameters can be defined with clear physical meanings. Secondly we can directly calculate the parameters’ values from the CAIDA measurement data. Lastly it is more convenient to run simulations with a discrete model. If a continuous model were used, the model parameters would be defined differently with less clear physical meanings, and their values would have to be obtained through iterative data fitting.

In our Conficker model, we set the local and global population as fully mixed, because this is how the Conficker worm perceives the structure of the Internet. We considered more complex network structures in a separate work [ 16 ] where we studied hybrid epidemics in general.

Our study uses data collected during the first day of the Conficker epidemic to parametrise a hybrid model to capture the worm’s spreading behaviour. The study highlights the importance of mixing different modes of spreading in order to achieve large, rapid and sustained epidemics, and suggests that the trade-off between the different modes of spreading will be critical in determining the epidemic outcome.

Author Contributions

Conceived and designed the experiments: CZ SZ BMC. Performed the experiments: CZ. Analyzed the data: CZ SZ BMC. Wrote the paper: SZ BMC CZ.

View Article
Google Scholar
PubMed/NCBI
16. Zhang C, Zhou S, Cox IJ, Chain BM. Optimizing Hybrid Spreading in Metapopulations; 2014. Preprint. Available: arXiv:1409.7291. Accessed 10 Feb 2015.
17. Chien E. Downadup: Attempts at Smart Network Scanning; 2010. Available: http://www.symantec.com/connect/blogs/downadup-attempts-smart-network-scanning . Accessed Dec 2014.
18. Center for Applied Internet Data Analysis. The CAIDA UCSD Network Telescope “Three Days Of Conficker”; 2008. Available: http://www.caida.org/data/passive/telescope-3days-conficker_dataset.xml . Accessed Dec 2014.
19. Center for Applied Internet Data Analysis. The CAIDA UCSD Network Telescope “Two Days in November 2008” Dataset; 2008. Available: http://www.caida.org/data/passive/telescope-2days-2008_dataset.xml . Accessed Dec 2014.
20. Newman M. Networks: An Introduction. Oxford University Press, USA; 2010.
34. Moore D, Shannon C, Claffy KC. Code-Red: a case study on the spread and victims of an internet worm. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment. IMW. ACM; 2002. pp. 273–284.
53. ESET Virusradar. Win32/Conficker Charts; 2014. Available: http://www.virusradar.com/en/Win32_Conficker/chart/week . Accessed Dec 2014.
54. Irwin B. A network telescope perspective of the Conficker outbreak. In: Information Security for South Africa; 2012. pp. 1–8.
56. Li R, Gan L, Jia Y. Propagation Model for Botnet Based on Conficker Monitoring. In: International Symposium on Information Science and Engineering; 2009. pp. 185–190.
57. Yao Y, Xiang Wl, Guo H, Yu G, Gao FX. Diurnal Forced Models for Worm Propagation Based on Conficker Dataset. In: International Conference on Multimedia Information Networking and Security; 2011. pp. 431–435.
58. Aben E. Conficker/Conflicker/Downadup as seen from the UCSD Network Telescope; 2009. Available: http://www.caida.org/research/security/ms08-067/conficker.xml . Accessed Dec 2014.
59. Dagon D, Zou C, Lee W. Modeling botnet propagation using time zones. In: Annual Network & Distributed System Security Symposium; 2006.

Influenza: A case study

Introduction

Most people have suffered from influenza (flu) at some time in their lives, so you probably have personal experience or a good idea of the symptoms and progression of the disease. However, influenza is actually one of the world’s most serious diseases. The pandemic of flu that occurred in 1918, immediately following the First World War, is thought to have killed up to 50 million people: many more than died in the war itself. More recently, the 2009 ‘swine flu’ pandemic caused widespread panic across parts of the world, although it resulted in relatively few fatalities.

The following course is a case study of influenza that considers a range of topics such as the nature of the virus itself, its spread, treatment, and diagnosis. There are activities to complete and videos to watch as you work through the text, and a set of self-assessment questions at the end of the course that allow you to judge how well you have understood the course content.

This OpenLearn course is an adapted extract from the Open University course : SK320 Infectious disease and public health .

Learning outcomes

After studying this course, you should be able to:

define and use, or recognise definitions and applications of, each of the glossary terms in the course

describe influenza viruses, their structure, how they are transmitted, how they infect cells and replicate and how they produce their damage in the host

outline the different types of immune defence which are deployed against flu infections, distinguishing those that act against infected cells from those that act against free virus

describe how strains of the virus change over time, and relate this to the flu viruses that occur in birds and other mammals

explain how the epidemic pattern of influenza can be related to the evolution of new strains of virus and to the specificity of the immune response against each strain.

1 Background to the case study

Influenza is a myxovirus belonging to the family of viruses known as Orthomyxoviridae. The virus was originally confined to aquatic birds, but it made the transition to humans 6000–9000 years ago, coinciding with the rise of farming, animal husbandry and urbanisation.

These changes in human behavior and population density provided the ecological niche that enabled influenza, as well as a number of other infectious agents such as the viruses that cause measles and smallpox, to move from animals and adapt to a human host.

Influenza as a disease has been recognised for centuries, even though the viruses which cause it were not correctly identified until the early 1930s, first in the UK and then in the USA. Indeed the name itself is derived from an Italian word meaning ‘influence’, and reflected the widespread belief in medieval times that the disease was caused by an evil climatic influence due to an unfortunate alignment of the stars.

Our current understanding – that infectious diseases are caused by infectious agents – is so ingrained that such mystical causes for an illness now seem absurd. However, even during the Middle Ages, people had a sound idea of infection and realised that some diseases could be passed from one individual to another and others could not. For example, the use of quarantine for a disease such as plague, but not for many other illnesses, shows that people could distinguish infectious diseases from non-infectious diseases even if the causative agent and the method of transmission were obscure.

The idea that influenza is caused by the influence of the stars, though not a satisfactory explanation of how the disease spread, does identify an important feature of flu – that serious epidemics of the disease occur at irregular intervals.

For example, in the twentieth century there were at least five major epidemics of flu that spread around the world (a pandemic), and there were less serious epidemics in most years. In times when people believed in the spontaneous generation of life, the stars would have seemed a reasonable explanation for unpleasant and unexpected epidemics.

1.1 Defining influenza

How would you define ‘influenza’?

You may well have defined influenza as an infection caused by an influenza virus. However, you may have defined it according to its symptoms: an infection that starts in the upper respiratory tract, with coughing and sneezing, spreads to give aching joints and muscles, and produces a fever that makes you feel awful; but usually it has gone in 5–10 days and most people make a full recovery.

The first answer here is the biological definition and, in the Open University course SK320, diseases are defined according to the infectious agent which produces them. This is because different infections can produce the same symptoms, and the same infectious agent can produce quite different symptoms in different people, depending on their age, genetic make-up or the tissue of the body that becomes infected. Here a distinction is made between the infectious disease caused by a particular agent and the disease symptoms.

Unfortunately there is a lot of confusion in common parlance about different diseases. Often, people say that they have ‘a bit of flu’ when they have an infection with some other virus, or a bacterium that produces flu-like symptoms. Such loose terminology is understandable, since most people are firstly concerned with the symptoms of their disease. But to treat and control disease requires accurate identification of the causative agent, so this is the starting point for considering any infectious disease.

Attributing cause to a disease

The difficulties encountered in assigning a particular pathogen to a disease are well-illustrated by influenza.

During the influenza pandemic that occurred in 1890, the microbiologist Pfeiffer isolated a novel bacterium from the lungs of people who had died of flu. The bacterium was named Haemophilus influenzae and since it was the only bacterium that could be regularly cultivated from these individuals at autopsy, it was assumed that H. influenzae was the causative agent of flu.

Again, in the 1918 flu pandemic, the bacterium could be regularly cultivated from people who had died of flu with pneumonia. So it was thought that flu was caused by the bacterium, and H. influenzae came to be called the ‘influenza bacillus’.

The role of H. influenzae was only brought into question in the early 1930s, when Smith, Andrews and Laidlaw showed that it was possible to transfer a flu-like illness from the nasal washings of an infected person to ferrets, using a bacteria-free filtrate. These studies demonstrated that the pathogen was in fact much smaller than any known bacterium and paved the way to the identification of influenza viruses (Figure 1).

Electron microscope image of influenza virus particles.

Electron micrograph picture of influenza viruses. Each viral particle is about 500 nm across and surrounded by a darker-staining lipid bilayer coat derived from the host cell.

Why do you suppose that H. influenzae was incorrectly identified as the causative agent of flu?

The bacterium fulfils two of Koch’s postulates: it is regularly found in serious flu infections and it can be cultured in pure form on artificial media. Moreover, at that time no-one knew what a virus was, and everyone was thinking in terms of bacterial causes for infectious diseases.

Although the precise role of H. influenzae in the 1890 and 1918 flu pandemics is not clear, it is likely that the bacteria were present and acting in concert with the flu virus to produce the pneumonia experienced. Such synergy between virus and bacteria was demonstrated by Shope in 1931. He infected pigs with a bacterial-free filtrate (containing swine influenza virus) with or without the bacteria, and showed that the disease produced by the bacteria and filtrate together was more severe than that produced by either one alone (Van Epps, 2006).

In its role of co-pathogen, H. influenzae is only one of a number of bacteria that can exacerbate the viral infection. This highlights a very important point. In the tidy world of a microbiology or immunology laboratory, scientists typically examine the effect of one infectious agent in producing disease. In the real world, people often become infected with more than one pathogen. Indeed, infection with one agent often lays a person open to infection with another, as immune defences become overwhelmed. For this reason, a particular disease as seen by physicians may be due to a combination of pathogens.

1.2 Influenza infection in humans

Influenza is an acute viral disease that affects the respiratory tract in humans. The virus is spread readily in aerosol droplets produced by coughing and sneezing, which are symptoms of the illness. Other symptoms include fatigue, muscle and joint pains and fever.

Following infection, the influenza virus replicates in the cells lining the host’s upper and lower respiratory tract. Virus production peaks 1–2 days later, and virus particles are shed in secretions over the following 3–4 days. During this period, the patient is infectious and the symptoms are typically at their most severe.

After one week, virus is no longer produced, although it is possible to detect viral antigens for up to 2 weeks. Immune responses are initiated immediately after the virus starts to replicate, and antibodies against the virus start to appear in the blood at 3–4 days post infection. These continue to increase over the following days and persist in the blood for many months.

In a typical flu infection, the virus is completely eliminated from the host’s system within 2 weeks. This is sterile immunity: the virus cannot be obtained from the patient after recovery from the disease. Figure 2 shows the typical time course of an acute flu infection.

In this figure, the horizontal axis is labelled days and is marked from zero, which is the time of infection, up to 10 days at one-day intervals. There are three horizontal bars, labelled virus, symptoms and antibodies, and the depth of each bar corresponds to the amount of virus or antibody or the severity of symptoms respectively. Antibody production is maximal by day 5 and the virus is reduced to a very low level by day 6. Symptoms of infection disappear by day 9.

For infants, older people, and those with other underlying diseases (e.g. of the heart or respiratory system) an infection with flu may prove fatal. However, the severity of a flu epidemic and the case fatality rate depend on the strain of flu involved and the level of immunity in the host population.

During a severe epidemic, there are typically thousands more deaths than would normally be expected for that time of year, and these can be attributed to the disease. Although older people are usually most at risk from fatal disease, this is not always so. In the 1918 flu pandemic there was a surprisingly high death rate in people aged 20–40 (Figure 3), and this was also the case for the 2009 ‘swine flu’ pandemic.

Graph of mortality by age during in 1917 and 1918.

The figure is a line graph in which the horizontal axis is labelled age and is marked in years from zero to 80 at intervals of 20 years. The vertical axis is labelled death rate per 100 000 population and is marked from zero to 3000 at intervals of 500 units. The 1917 plots for both males and females are almost identical U-shaped curves, and show that death rates were in excess of 1500 in newborns, dropped to 200 by age 2 and were zero in 10-year-olds. Rates remained below 200 for those aged 40 or under, increased to 500 in 65-year-olds, and beyond this age, death rate increased very rapidly to reach levels of 3000 per 100 000 for 80-year-olds. The pattern in death rates in 1918 for the younger and older age groups was similar to that in 1917, although rates in newborns were much higher, at 2500. The minimum rate in 1918, again observed in 10-year-olds, was 200. Beyond this age, death rates rose sharply, to 1200 for 30-year-old males and 750 for 30-year-old females. Death rates in both groups fell rapidly, and for those aged 60 or more, were similar to the rates in the previous year.

Older people are often most severely affected during infectious disease outbreaks because they may have a less effective immune response than younger people, or a reduced capacity to repair and regenerate tissue damaged by the infection. However, there are circumstances where older people may be more resistant to infection than younger people because they may have already encountered the disease (in their youth) and could retain some immunity and so be less susceptible than younger people who have not encountered the disease before.

1.3 Influenza infection in other species

Influenza viruses infect a wide range of species, including pigs, horses, ducks, chickens and seals. In most of these other species the virus produces an acute infection.

For example, in most of the mammals the symptoms are very similar to those in humans: an acute infection of the respiratory tract, which is controlled by the immune response although fatal infections occur in some species. However, in wild ducks and other aquatic birds the virus primarily infects the gut and the birds do not appear to have any physical symptoms.

Despite this, ducks may remain infected for 2–4 weeks and during this time they shed virus in their faeces. Potentially this is a very important reservoir of infection; although flu viruses do not often cross the species barrier, the pool of viruses present in other species is an important genetic reservoir for the generation of new flu viruses that do infect humans.

This reservoir becomes particularly important in certain farming communities or in crowded conditions where animals (especially pigs and ducks) are continuously in close proximity with humans (Branswell, 2010). Although such conditions occur in many agricultural communities throughout the world, they are typically observed in South-East and East Asia thereby contributing to these geographical areas often being the source of radically new ‘hybrid’ strains of influenza that incorporate genes from different species-specific strains. (The genetics of influenza are discussed in Section 2.3.)

When strategies for controlling a disease are considered, awareness of the possible presence of an animal reservoir of infection is very important. For example, an immunisation programme against flu would substantially reduce the incidence of the current strain in humans but, because there is always a reservoir of these viruses in other animals, and these viruses are constantly mutating, another strain would inevitably emerge and be unaffected by immunisation. It is useful to distinguish diseases such as rabies, which primarily affect other vertebrates and occasionally infect humans (zoonoses), from diseases such as flu where different strains of the virus can affect several species including humans.

Identify a fundamental difference between the way that zoonoses (e.g. rabies) are transmitted, and the way in which flu is transmitted.

Flu can be transmitted from one human being to another, whereas most zoonoses, including rabies, are not transmitted between people.

2 Influenza viruses

Viruses have very diverse genomes. Whereas the genomes of bacteria, plants and animals are of double-stranded DNA, the genomes of viruses can be constituted from either DNA or RNA and may be double- or single-stranded molecules.

Usually, DNA is a double-stranded molecule with paired, complementary strands (dsDNA) and RNA is a single stranded molecule (ssRNA). However, some viruses have single-stranded DNA genomes (ssDNA) and some have double-stranded RNA genomes (dsRNA). The type of nucleic acid found in the genome depends on the group of viruses involved.

RNA encodes protein in all living things, and the sequence of bases in the RNA determines the sequence of amino acids in the protein. A strand of RNA which has the potential to encode protein is said to be ‘positive sense’ (+). If a strand of RNA is complementary to this, then it is ‘negative sense’ (–). Negative-sense RNA must first be copied to a complementary positive-sense strand of RNA before it can be translated into protein.

The description of the influenza genome as negative-sense ssRNA means that its RNA cannot be translated without copying first. This copying is performed by influenza’s viral RNA polymerase, a small amount of which is packaged with the virus, ready to begin copying the viral genome once it enters a host cell. Viral RNA polymerase consists of three subunits: PB1, PB2, and PA, encoded separately by the first three viral RNA strands.

Understanding the way in which different viruses replicate is important, since it allows the identification of particular points in their life-cycle that may be susceptible to treatment with antiviral drugs.

Classification

Viruses are classified into different families, groups and subgroups in much the same way as are species of animals or plants.

As you have already read, the influenza viruses are (–)ssRNA organisms (Baltimore group V) and belong to a family called the Orthomyxoviruses (see Box 1). They fall into three groups: influenza A, B and C.

Type A viruses are able to infect a wide variety of endothermic (warm-blooded) animals, including mammals and birds, and analysis of their viral genome indicates that all strains of influenza A originated from aquatic birds.

By contrast, types B and C are mostly confined to humans. At any one time, a number of different strains of virus may be circulating in the human population.

Box 1 Families, groups and strains of virus

Viruses were originally classified into different groups according to similarities in their structure, mode of replication and disease symptoms. For example, the Orthomyxoviruses include viruses that cause different types of influenza, while Paramyxoviruses include the viruses that cause measles and mumps.

Such large groupings are often called a family of viruses. The families can be subdivided into smaller groups, such as influenza A, B and C. Even within a single such group of viruses there can be an enormous level of genetic diversity, and this is the basis of the different strains. As an example, two HIV particles from the same individual may be 4% different in their genome; compare this with the 1% difference between the genomes of humans and chimpanzees, which are different species.

2.1 Structure of influenza

The structure of influenza A is shown schematically in Figure 4. The viral genomic RNA, which consists of eight separate strands (see Section 2.3), is enclosed by its associated nucleoproteins to make a ribonucleoprotein complex (RNP), and this is contained in the central core of the virus (the capsid).

The nucleoproteins are required for viral replication and packing of the genome into the new capsid, which is formed by M1-protein (or matrix protein). The M1-protein is the most abundant component of the virus, constituting about 40% of the viral mass; it is essential for the structural integrity of the virus and to control assembly of the virus.

In this cross-sectional diagram of the spherical virus, the convoluted ribonucleoprotein genome with its replication enzymes is inside the capsid which comprises M-protein subunits. The envelope surrounds the capsid and is studded with molecules of haemagglutinin and neuraminidase.

Orthomyxoviruses have a capsid surrounded by a phospholipid bilayer derived from the plasma membrane of the cell that produced the virus. This layer is shown in Figure 4 as the virus’s envelope.

Two proteins, haemagglutinin and neuraminidase, are found on the viral envelope. These proteins are encoded by the viral HA and NA genes (Section 2.3), respectively and are inserted into the plasma membrane of the infected cell before the newly-produced viruses bud off from the cell surface.

The haemagglutinin can bind to glycophorin, a type of polysaccharide that contains sialic acid residues, and which is present on the surface of a variety of host cells. The virus uses the haemagglutinin to attach to the host cells that it will infect. Antibodies and drugs against haemagglutinin are therefore particularly important in limiting the spread of the virus, since they prevent it from attaching to new host cells.

Neuraminidase is an enzyme that cleaves sialic acid residues from polysaccharides. It has a role in clearing a path to the surface of the target cell before infection, namely, digesting the components of mucus surrounding epithelial cells in the respiratory system. Similarly, neuraminidase also promotes release of the budding virus from the cell surface after infection.

The structures of influenza B and influenza C are broadly similar to that of Type A, although in influenza C the functions of the haemagglutinin and the neuraminidase are combined in a single molecule, haemagglutinin esterase. This molecule binds and cleaves a less common type of sialic acid. Influenza C does not normally cause clinical disease or epidemics, so the following discussion is confined to influenza A and B.

2.2 Designation of strains of influenza

A considerable number of genetically different strains of influenza A have been identified, and these are classified according to where they were first isolated and according to the type of haemagglutinin and neuraminidase they express. For example ‘A/Shandong/9/93(H3N2)’ is an influenza A virus isolated in the Shandong province of China in 1993 – the ninth isolate in that year – and it has haemagglutinin type 3 and neuraminidase type 2.

At the start of the twenty-first century, the major circulating influenza A strains are H1N1 (‘swine flu’) and H3N2. At least 16 major variants of haemagglutinin and 9 variants of neuraminidase have been recognised, but to date most of these have only been found in birds.

The designation for influenza B is similar, but omits the information on the surface molecules, for example: ‘B/Panama/45/90’.

As you will see later, accurate identification of different strains of flu is crucial if we are to control epidemics by vaccination programmes.

2.3 Genomic diversity of influenza

The genome of flu viruses consists of around 14 000 nucleotides of negative-sense single-stranded RNA. Compare this number to the approximately 3 billion nucleotides found in the human genome or the 150 billion nucleotides of the genome of the marbled lungfish (the largest genome known in vertebrates).

The genome of influenza viruses is segmented, into eight distinct fragments of RNA containing 11 genes and encoding approximately 14 proteins (see Table 1 below). This structure has significance for the spread of the virus and the severity of disease symptoms.

Cases of influenza generally arise in two main ways: by provoking seasonal annual outbreaks or epidemics and, less commonly, through global pandemics. As you will see shortly, both of these phenomena occur as consequences of the fact that the virus uses RNA as its genetic template and that this RNA genome is segmented into discrete strands.

The genome of influenza virus. Note that a single RNA segment may encode for more than one protein due to alternative reading frames.
Gene name	RNA strand (segment number)	Function(s) of protein encoded by this gene
PB2 (polymerase basic 2)	1	A subunit of viral RNA polymerase involved in cleaving the cap structure of host cell mRNA and generating primers that are subverted for use in the synthesis of viral RNA.
PB1 (polymerase basic 1)	2	Core subunit of viral RNA polymerase. Required for polymerase assembly.
PB1-F2	2	Binds to components of the host mitochondria, sensitising the cell to apoptosis and contributing to pathogenicity.
PA (polymerase acidic)	3	A subunit of viral RNA polymerase which also has protease activity of unknown function.
HA (haemagglutinin)	4	Antigenic glycoprotein used for binding to (infecting) the host cell.
NP (nucleoprotein)	5	RNase resistant protein. Binds viral genomic RNA to form stable ribonucleoproteins and targets these for export from the host nucleus into the cytosol. Also involved in viral genome packaging and viral assembly.
NA (neuraminidase)	6	Cleaves sialic acid. Important for releasing viral particles from host cell.
M1 (matrix 1)	7	Binds viral genomic RNA and forms a coat inside the viral envelope in virions. Inside the host cell, it starts forming a layer under patches of the membrane rich in viral HA, NA, and M2 and so facilitates viral assembly and budding from the host cell.
M2 (matrix 2)	7	Transmembrane ion channel protein. Allows protons into the virus capsid, acidifying the interior, destabilising binding of M1 to the viral genomic RNA which leads to uncoating of the viral particle inside the host cell.
NS1 (non-structural 1)	8	Inhibits nuclear export of the host’s own mRNA, thereby giving preference to viral genomic RNA. Blocks the expression of some host inflammatory mediators (interferons) and interferes with T cell activation*.
NS2/NEP (non-structural 2/ nuclear export protein)	8	Mediates the export of viral genomic RNA from the host nucleus to the cytoplasm.

Footnotes

The influenza virus is a successful pathogen because it is constantly changing. How might having a segmented genome promote the evolution of new strains of influenza virus?

If a cell is infected with more than one strain of virus at the same time, then a new strain can be generated simply by mixing RNA strands from different viruses.

2.3.1 Creation of new viral strains

Part of the success of influenza as a pathogen is because segmented genome improves the virus’s potential to evolve into new strains through the combination of different RNA stands. This mixing of the genetic material from different viral strains to produce a new strain is termed genetic reassortment .

For instance, the virus that caused the 2009 H1N1 ‘swine flu’ pandemic comprises a quadruple reassortment of RNA strands from two swine virus, one avian virus, and one human influenza virus:

the surface HA and NA proteins derive from two different swine influenzas (H1 from a North American swine influenza and N1 from a European swine influenza)
the three components of the RNA polymerase derive from avian and human influenzas (PA and PB2 from the avian source, PB1 from the human 1993 H3N2 strain)
the remaining internal proteins derive from the two swine influenzas (MacKenzie, 2009).

This does not necessarily mean that all four viruses infected the same animal at once. The new strain was likely the result of a reassortment of two swine influenza viruses, one from North America and one from Europe. The North American virus may itself have been the product of previous reassortments, containing a human PB1 gene since 1993 and an avian PA and PB2 genes since 2001. The presence of avian influenza RNA polymerase genes in this virus was especially worrying, since the avian polymerase is thought to be more efficient than human or swine versions, allowing the virus to replicate faster and thus making it more virulent. Similar avian RNA polymerase genes are what make H5N1 bird flu extremely virulent in mammals and what made the 1918 human pandemic virus so lethal in people.

This mixing of genes from two or more viruses (whether from the same host species or from different species) can cause major changes in the antigenic surface proteins of a virus, such that it is no longer recognised by the host’s immune system. This antigenic shift is described in more detail in Section 3 (specifically, Box 2).

In contrast to the major genetic changes caused by reassortment, influenza viruses also undergo constant, gradual, genetic changes due to errors made by their RNA polymerases.

2.4 Infection and replication

Influenza RNA polymerase lacks the ability to recognise and repair any errors that occur during genome duplication, resulting in mistakes in copying its viral RNA about once in every 10 000 nucleotides. Because the influenza genome only contains approximately 14 000 nucleotides, this means that, on average, each new virus produced differs by 1 or 2 nucleotides from its ‘parent’.

The slow accumulation of random genetic changes, especially in the antigenic surface proteins, explains why antibodies that were effective against the virus one year may be less effective against it in subsequent years. This gradual change in the nature of viral antigens is known as antigenic drift .

The replication cycle of influenza is illustrated in Figure 5.

Complicated diagram showing a series of events from the replication cycle of a flu virus, from the virus entering a cell, releasing its contents, replicating, and these new virus particles budding and exiting the infected cell. Anti-clockwise, from the top left corner: (1) virus attaches to cell and is endocytosed; (2) cellular lysosomes fuse with endocytosed virus and viral RNA, and proteins are released into cell; (3) viral RNA moves to nucleus of the infected cell and is transcribed into viral mRNA, which is exported into cytosol to make new viral proteins; (4) viral proteins and viral RNA self-combine to make new viral particles that bud off the cell and are released to infect more host cells.

Influenza is spread in aerosol droplets that contain virus particles (or by desiccated viral nuclei droplets), and infection may occur if these come into contact with the respiratory tract. Viral neuraminidase cleaves polysaccharides in the protective mucus coating the tract, which allows the virus to reach the surface of the respiratory epithelium.

The haemagglutinin now attaches to glycophorins (sialic-acid-containing glycoproteins) on the surface of the host cell, and the virus is taken up by endocytosis into a phagosome. Acidic lysosomes fuse with the phagosome to form a phagolysosome and the pH inside the phagolysosome falls. This promotes fusion of the viral envelope with the membrane of the phagolysosome, triggering uncoating of the viral capsid and release of viral RNA and nucleoproteins into the cytosol.

The viral genomic RNA then migrates to the nucleus where replication of the viral genome and transcription of viral mRNA occur. These processes require both host and viral enzymes. The viral negative-stranded RNA is replicated by the viral RNA-dependent RNA polymerase, into a positive-sense complementary RNA (cRNA), and these positive and negative RNA strands associate to form double-stranded RNA (dsRNA). The cRNA strand is subsequently replicated again to produce new viral genomic negative-stranded RNA. Some of the cRNA is also processed into mRNA for translation of viral proteins. The infection cycle is rapid and viral molecules can be detected inside the host cell within an hour of the initial infection.

The envelope glycoproteins (haemagglutinin and neuraminidase) are translated in the endoplasmic reticulum, processed and transported to the cell’s plasma membrane. The viral capsid is assembled within the nucleus of the infected cell. The capsid moves to the plasma membrane, where it buds off, taking a segment of membrane containing the haemagglutinin and neuraminidase, and this forms the new viral envelope.

Influenza virus budding from the surface of an infected cell is shown in Figure 6.

In this false-colour electron micrograph, the budding virus particles appear orange and their surrounding envelopes appear green. One of the buds has a short stalk which indicates that virus particle is about to pinch off from the host cell membrane. Each virus is about 100 nanometres in diameter.

From the description above, identify a process or element in the replication cycle which is characteristic of the virus, and which would not normally occur in a mammalian cell.

The replication of RNA on an RNA template with the production of double-stranded RNA would never normally occur in a mammalian cell. Double stranded RNA is therefore a signature of a viral infection. Significantly, cells have a way of detecting the presence of dsRNA, and this activates interferons: molecules involved in limiting viral replication.

2.5 Cellular pathology of influenza infection

Flu viruses can infect a number of different cell types from different species. This phenomenon is partly because the cellular glycoproteins which are recognised by viral haemagglutinin are widely distributed in the infectious agent.

What is the term for the property of viruses that allows them to only replicate in particular cell types?

This property is viral tropism. Hence we can say that flu viruses have a broad tropism.

A second reason why the virus can infect a variety of cell types is that the replication strategy of flu is relatively simple: ‘infect the cell, replicate as quickly as possible and then get out again’. This is the cytopathic effect of the virus. Cell death caused directly by the virus can be distinguished from cell death caused by the actions of the immune system as it eliminates infected cells.

The effects of cell death

Cell death impairs the function of an infected organ and often induces inflammation , a process that brings white cells (leukocytes) and molecules of the immune system to the site of infection. In the first instance, the leukocytes are involved in limiting the spread of infection; later they become involved in combating the infection, and in the final phase they clear cellular debris so that the tissue can repair or regenerate.

The symptoms of flu experienced by an infected person are partly due to the cytopathic effect of the virus, partly due to inflammation and partly a result of the innate immune response against the virus. The severity of the disease largely depends on the rate at which these processes occur.

In most instances, the immune response develops sufficiently quickly to control the infection and patients recover.
If viral replication and damage outstrip the development of the immune response then a fatal infection can occur.

In severe flu infections, the lungs may fill with fluid as the epithelium lining the alveoli (air sacs) is damaged by the virus. The fluid is ideal for the growth of bacteria, and this can lead to a bacterial pneumonia, in which the lungs become infected with one or more types of bacteria such as Haemophilus influenzae . Damage to cells lining blood vessels can cause local bleeding into the tissues, and this form of ‘fulminating disease’ was regularly seen in post-mortem lung tissues of people who died in the 1918 pandemic.

3 Patterns of disease

In humans, pigs and horses, flu viruses circulate through populations at regular intervals. The disease is endemic in tropical regions for all of these host groups (i.e. it is continually present in the community). In temperate latitudes, infections are usually seasonal or epidemic, with the greatest numbers occurring in the winter months (Figure 7). Epidemics also occur sporadically in sea mammals and poultry, and in these species high mortality is typical.

Graph showing epidemic patterns of flu in the USA.

In this graph, the horizontal axis is marked in years from 1994 to 1997. The vertical axis is labelled number of isolates per week and is marked from zero to 900 at intervals of 100. The data show that there were three separate epidemics, which occurred over the three successive winters, and in increasing order of severity. The peak numbers of isolates were as follows: in 1994/5, there were 370; in 1995/6, there were 630; and in 1996/9, there were nearly 900.

In most years, flu in humans affects a minority of the population, the disease course is not very severe and the level of mortality is not great. In such years the influenza virus is slightly different from the previous year due to antigenic drift, which results in the accumulation of genetic mutations that cause the molecules present on the surface of the virus change progressively. In this scenario, the virus is not significantly different from the previous year so that the host’s immune system can more easily mount an effective response than it could to a completely new strain.

However, at irregular intervals the virus undergoes an antigenic shift. This process only occurs in influenza A viruses, typically every 10–30 years, and it is associated with severe pandemics, serious disease and high mortality (see Box 2).

In Section 2.3 you read that strains of influenza are differentiated and designated using a simple system of numbers and letters that depend on their surface antigens. More commonly, however, strains responsible for pandemics are often given a common name according to the area in the world from which they were thought to originate, or the species they mainly affected before becoming transferred to humans (see Table 2). Evidence suggests, however, that in the twentieth century the major flu pandemics all originated in China, with the exception of the 1918 pandemic, which first occurred in the USA.

Major flu pandemic strains of the twentieth century.
Year	Designation	Common name
1900	H3N8	(none)
1918	H1N1	Spanish flu
1957	H2N2	Asian flu
1968	H3N2	Hong Kong flu
1977	H1N1	Russian flu
1997	H5N1	Avian flu

Box 2 The rise of H5N1 – an example of antigenic shift

In 1997, a new strain of influenza A, H5N1, was identified in Hong Kong. The strain was rife in chickens and a few hundred people had become infected. Mortality in these individuals was very high, (6 of 18 died), and so there was serious concern that it marked the beginning of a new pandemic. The authorities in Hong Kong responded by a mass cull of poultry in the region and about 1.5 million chickens were slaughtered. H5N1 did not spread easily from person to person and no further cases were reported in people following the slaughter.

Whether the H5N1 outbreak was an isolated incident of a strain spreading from chicken to humans, or whether it was the start of a major pandemic which was nipped in the bud, cannot be known. Subsequent analysis showed that the high virulence of the new strain could partly be related to the new variant of haemagglutinin (H5), and partly to a more efficient viral polymerase. This outbreak clearly demonstrates the way in which bird influenza can act as a source of new viral strains, and shows that such new strains may be very dangerous to humans.

Since the discovery of the influenza virus in the 1930s it has been possible to isolate and accurately identify each of the epidemic strains, but, as earlier strains of virus have now died out, it has been necessary to infer their identity by examining the antibodies in the serum of affected people.

Antibodies and the ability of the immune system to respond to a strain of flu are much more persistent than the virus itself. It is thus possible to analyse antibodies to determine which types of haemagglutinin and neuraminidase they recognise long after the virus itself has gone. One can then deduce which type of influenza virus that person contracted earlier in their life (as explained in Section 5.2).

3.1 Tracking the emergence of new strains

Influenza is one of several diseases monitored by the WHO Global Alert and Response (GAR) network (WHO, 2011a), comprising 110 ‘sentinel’ laboratories in 82 countries. The organisation’s surveillance and monitoring of the disease then forms part of their Global Influenza Programme (GIP), and they use data gathered from participating countries to:

provide countries, areas and territories with information about influenza transmission in other parts of the world to allow national policy makers to better prepare for upcoming seasons
provide data for decision making regarding recommendations for vaccination and treatment
describe critical features of influenza epidemiology including risk groups, transmission characteristics, and impact
monitor global trends in influenza transmission
inform the selection of influenza strains for vaccine production (WHO, 2011b).

The influenza data from the sentinel laboratories is fed into a global surveillance programme, started by the WHO in 1996, called FluNet (WHO, 2011c), which is one of the tools that facilitates the actions described above.

Activity 1 Using FluNet

Use the link below to visit the WHO’s FluNet web page and locate and view the chart showing the global circulation of flu (in the section marked ‘View charts’) to find out which flu subtypes are currently the major ones in circulation in the human population.

Link to WHO FluNet web page

At the time of writing (2011), Influenza A (H5N1) and influenza B (unknown lineage) are the two main types globally. FluNet also breaks this information down into geographic areas and countries so, if you wish, you can see what subtypes are circulating where you live.

Typically a flu vaccine contains material from the main influenza A strains and an influenza B strain, so that an immune response is induced against the most likely infections. Usually the scientists predict correctly and immunised people are effectively protected against the current strains (>90% protection). However, the prediction is occasionally incorrect, or a new strain develops during the time that the vaccine is being manufactured. In this case the vaccine generally provides poor protection.

What can you deduce about immunity against flu infection from the observations on vaccination above?

The immune response is strain-specific. If you are immunised against the wrong strain of flu, then the response is much less effective and you are more likely to contract the disease.

3.2 Immune responses to influenza

The immune system uses different types of immune defence against different types of pathogen. The responses against flu are typical of those which are mounted against an acute viral infection, but different from the responses against infection by bacteria, worms, fungi or protist parasites.

When confronted with an acute viral infection, the immune system has two major challenges:

The virus replicates very rapidly, killing the cells it infects. Since a specific immune response takes several days to develop, the body must limit the spread of the virus until the immune defences can come into play.
Viruses replicate inside cells of the body, but they spread throughout the host in the blood and tissue fluids. Therefore, the immune defences must recognise infected cells (intracellular virus) and destroy them. But the immune system must also recognise and eradicate free virus in the tissue fluids (extracellular virus) in order to prevent the virus from infecting new cells.

The kinds of immune defence that the body deploys against flu are briefly considered in the next section.

3.2.1 Summary of the response

How does the body act quickly to limit viral spread?

When a virus infects a cell of the body, the molecular machinery for protein synthesis within the cell is usurped as the virus starts to produce its own nucleic acids and proteins. The cell detects the flu dsRNA and other viral molecules and releases interferons, which bind to receptors on neighbouring cells and cause them to synthesise antiviral proteins. If a virus infects such cells they resist viral replication, so fewer viruses are produced and viral spread is delayed.

Also, in the earliest stages of a virus infection the molecules on the cell surface change. Cells lose molecules that identify them as normal ‘self’ cells. At the same time they acquire new molecules encoded by the virus. A group of large, granular lymphocytes recognise these changes and are able to kill the infected cell. This function is called ‘natural killer’ cell action and the lymphocytes that carry it out are termed NK cells.

Non-adaptive and adaptive responses

The actions of both interferons and NK cells in combating infection by influenza occur early in an immune response, and are not specific for the flu virus. These defences occur in response to many different kinds of viral infection, and they are part of our natural, or non-adaptive, immune responses.

Note that immunologists use the term non-adaptive to indicate a type of response that does not improve or adapt with each subsequent infection. This is quite different to its use in evolutionary biology, where it means ‘not advantageous’. Such non-adaptive immune responses slow the spread of an infection so that specific, or adaptive, immune defences can come into play.

The key features of an adaptive immune response are specificity and memory. The immune response is specific to a particular pathogen, and the immune system appears to ‘remember’ the infection, so that if it occurs again the immune response is much more powerful and rapid. Because an immune response is highly specific to a particular pathogen it often means that a response against one strain of virus is ineffective against another – if a virus mutates then the lymphocytes that mediate adaptive immunity are unable to recognise the new strain.

There are two principal arms of the adaptive immune system, mediated by different populations of lymphocytes. One group, called T-lymphocytes, or T cells (which develop in the thymus gland, overlying the heart), recognises antigen fragments associated with cells of the body, including cells which have become infected. A set of cytotoxic T cells (Tc) specifically recognises cells which have become infected and will go on to kill them. In this sense they act in a similar way to NK cells. However they differ from NK cells in that Tc cells are specific for one antigen or infectious agent, whereas NK cells are non-specific.

The second group of lymphocytes are B cells (that differentiate in the bone marrow), which synthesise antibodies that recognise intact antigens, either in body fluids or on the surface of other cells. Activated B cells progress to produce a secreted form of their own surface antibody. Antibodies that recognise the free virus act to target it for uptake and destruction by phagocytic cells.

Therefore the T cells and NK cells deal with the intracellular phase of the viral infection, while the B cells and antibodies recognise and deal with the extracellular virus.

The two reactions described above are illustrated in Figure 8.

The first part of the diagram shows an antibody molecule binding to the virus and preventing it from entering the cell. The next part shows a virus entering and multiplying within a cell, causing the cell to release interferon. When the interferon reaches a neighbouring uninfected cell, it makes that cell resistant to infection. Also shown are a natural killer cell and a cytotoxic T cell. Either of these can bind to an infected cell via specific receptors on the cell surface, and kill that cell.

You might ask why it takes the adaptive immune response so long to get going. The answer is that the number of T cells and B cells that recognise any specific pathogen is relatively small, so first the lymphocytes which specifically recognise the virus must divide so that there are sufficient to mount an effective immune response. This mechanism is fundamental to all adaptive immune responses.

Activity 2 Influenza mini-lecture

Some of the themes that we have discussed up to now are presented in Video 1: a mini-lecture on influenza by David Male of The Open University. Watch the videos and then attempt the questions below

Transcript: Video 1 Influenza mini-lecture.

Influenza is a viral disease which generally starts with an infection of the upper respiratory tract and develops with systemic symptoms including fever and lassitude over the course of 1–2 weeks. Although it is debilitating, most people make a full recovery. However it may be fatal for older people and those with weaker immune systems, particularly if the virus disposes them to concurrent bacterial infections such as pneumonia.

The disease is caused by a group of myxoviruses, influenza A, B and C, although the most serious infections are caused by influenza A, and the following discussion refers to influenza A. The virus is seen in this transmission electron micrograph with proteins projecting from the viral envelope. Very many different variants of influenza have been identified since the virus was first discovered in 1935, and the variants are responsible for the different infections which occur in successive years. This is the reason that we can suffer from flu several times during our lives – in effect we become infected on each occasion with a different strain of virus, which our immune system has not encountered before and to which we are not immune.

Look at the overall structure of influenza A. The myxoviruses are all enveloped, that is to say that they have an outer membrane or envelope, which has been derived from the plasma membrane of an infected host cell. Two major viral proteins are present in the envelope, namely the haemagglutinin and the neuraminidase. Neuraminidase is an enzyme which cleaves sialic acid residues on glycoproteins and this protein performs an important function, in allowing the virus to bud off from the infected cell and spread through the body. The haemagglutinin is also essential for viral infection. It binds to carbohydrate groups present on glycophorins, molecules which occur on the surface of cells of the body. Binding of haemagglutinin to the surface of host cells is the first step in infection. Since the glycophorins are widely distributed on different cell types, influenza is able to cause widespread infection. As we shall see later, the antibody response against the haemagglutinin of the virus is critical in protecting us against on-going infection, although antibodies to the neuraminidase can also contribute to immunity. Within the viral envelope, the viral capsid is formed from the ‘M-protein’, which contains the virus’ genetic material, RNA, nucleoproteins, and a number of enzymes needed for replication.

The viral genome consists of 8 separate strands of RNA. Because the genome is fragmented in this way, it means that the different strains of virus can re-assort their genes relatively easily, and this is an important source of new viral strains.

Look now at the epidemic pattern of influenza over a number of years. The graph shows the number of isolates of different strains of influenza, in laboratories in the USA between 1995 and 1997. You can see that in temperate latitudes the infection rates follow a seasonal pattern, with more people developing the disease in the winter months. Examination of the structure of the haemagglutinin in successive years shows that minor mutations occur in the primary structure between the virus strains prevalent in each year. Although these do not affect the ability of the haemagglutinin to bind to host cells, the change is sufficient to prevent antibodies specific for a previous strain from binding to the new strain’s haemagglutinin. In effect, last year’s antibodies are unable to protect us from this year’s strain of flu.

The structure of the viral haemagglutinin can be seen in this model, which shows the backbone of the chain of amino acids. We will look at the way in which a neutralising antibody binds to an epitope on the haemagglutinin. The epitope is formed by amino acid residues in the loops at the exposed part of the molecule. Three loops which contribute residues to the epitope are highlighted here by space-filling the residues. Two domains of the heavy chain of the neutralising antibody are shown in yellow. The constant and variable domains are clearly visible, and the three hypervariable loops which contribute to the binding site are picked out in colour. You can see how the epitope and the heavy chain are complementary in shape. To complete the picture, we will add the light chain to the model. In this case, it is clear that the light chain contributes very little to the antibody combining site. When the space-filling model is completed, you can see that the residues forming the epitope are buried in the centre of the binding site and it is precisely these residues which are most likely to mutate between one viral strain and another. This progressive but limited change in the structure of the haemagglutinin is called genetic drift. Occasionally, perhaps once every 10–20 years, a major new strain of influenza appears which is radically different from those of previous years. Such a change is called genetic shift. The appearance of such new strains is associated with a worldwide serious epidemic of flu, called a pandemic. For example the pandemic strain of ‘Spanish flu’ which developed in 1918, had a different haemagglutinin and neuraminidase from the previously dominant strain, and this outbreak is thought to have caused the deaths of 20 million people world-wide. The picture shows a ward at the time. This epidemic particularly affected young fit people. One doctor wrote ‘it is only a matter of hours until death comes. It is horrible.’

The origin of new pandemic strains has been much debated, but it appears most likely that a human strain of flu exchanges genetic material with an animal strain of flu for example from ducks, or pigs. Such a reassortment of genes could occur if two different flu viruses simultaneously infect the same cell, and produce new viruses containing some gene segments from each type – remember that the flu virus has a segmented genome which allows this to occur.

The major pandemic strains are distinguished according to which haemagglutinin they have and which neuraminidase. So, for example in 1957 the dominant strain H1, N1 changed both its haemagglutinin and neuraminidase, and the new dominant strain H2N2 persisted until 1968. At present, (that is, in 2001) there are two dominant strains of influenza A in circulation H1N1 and H3N2.

One of the problems of producing vaccine for flu is that we do not know what next year’s major strain will be, and there is only a limited amount of time available before an epidemic spreads. The map shows the way in which the epidemic of Asian flu spread in 1957 from its origin in China in February, through South-East Asia by April and from there to all parts of the world by the end of the year. The figures on the map indicate the months in which the virus was isolated in different areas.

Nowadays, laboratories throughout the world track the appearance of new variants, and aim to identify the current circulating strains and any potentially new pandemic strains. Having decided the composition of the vaccine, there are just a few months to prepare it for the next flu season. Have a look at the current vaccine, it contains examples of the two major strains of influenza A H1N1 and H3N2 which are circulating and vaccine for the main current strain of influenza B. As there is insufficient time and resource to produce vaccine for everyone, the vaccine is usually recommended for older people and high risk groups, such as health professionals.

In addition to the antibody response, cytotoxic T cells are important in clearing virally-infected cells. The cytotoxic T cells recognise peptide fragments of several of the viral proteins, including the internal proteins such as the M-protein nucleoproteins and polymerases which are genetically stable. The bar chart shows the ability of lymphocytes from a single donor to kill cells which have been transfected with a single flu antigen. This is a measure of the prevalence of cytotoxic T cells for each of the proteins. Most of the cytotoxicity is directed against internal proteins shown on the green bars. Clones of cytotoxic cells against internal proteins usually recognise several of the major strains of flu. In contrast, those which recognise the external proteins are often, but not always strain-specific.

Even when a cytotoxic T cell recognises the same antigen as an antibody, it usually recognises a different portion. For example cytotoxic T cells specific for the haemagglutinin often recognise internal fragments of the antigen rather than the external epitopes recognised by antibodies. Moreover, since cytotoxic T cells recognise antigen presented by MHC molecules, and since MHC molecules are different in each individual, the T cells in each individual recognise different parts of the antigen. These bar charts show the response of two individuals against peptides from the haemagglutinin. T cells from the first person respond to four different regions of the molecule, with highly antigenic peptides centred on residues 100, 180, 300 and 400. T cells from the second individual recognise different regions of the haemagglutinin.

There is some evidence that individuals with specific MHC haplotypes may be more efficient than others at recognising and destroying influenza-infected cells.

In summary, influenza A gives us an example of extreme genetic variability, where successive dominant strains of flu emerge. The new strains are not susceptible to control by antibodies in the host population, and so individuals may suffer from repeated infections. Indeed the general immunity in the host population provides the selective pressure for the emergence of the new strains.

Draw a labelled diagram of the structure of influenza A.
How do pandemic strains of influenza A come about?

Your diagram should look like Figure 4 .

Pandemic strains of influenza A normally arise by simultaneous infection of a non-human host (typically poultry or pigs) with two or more strains of influenza A. Reassortment of the eight viral segments from each virus allows the generation of a new hybrid virus type, with a completely novel surface structure that has never been seen before by a host immune system (antigenic shift).

4 Antiviral treatments

Two classes of antiviral drugs are used to combat influenza: neuraminidase inhibitors and M2 protein inhibitors.

Why are antibiotics not used to combat influenza?

Influenza is a virus. Antibiotics only work against bacteria.

Neuraminidase inhibitors

Recall from Section 2.1 that neuraminidase is an enzyme that is present on the virus envelope and cleaves sialic acid groups found in the polysaccharide coating of many cells (especially the mucus coating of the respiratory tract). Neuraminidase is used to clear a path for the virus to a host cell and facilitates the shedding of virions from an infected cell. Inhibition of neuraminidase therefore helps prevent the spread of virus within a host and its shedding to infect other hosts.

The two main neuraminidase inhibitors currently in clinical use are zanamivir (trade name Relenza) and oseltamivir (trade name Tamiflu). These are effective against influenza A and B, but not influenza C which exhibits a different type of neuraminidase activity that only cleaves 9-O-acetylated sialic acid.

M2 inhibitors

Recall from Table 1 that the influenza M2 protein forms a pore that allows protons into the capsid, acidifying the interior and facilitating uncoating.

Drugs such as amantadine (trade name Symmetrel) and rimantadine (trade name Flumadine) block this pore, preventing uncoating and infection. However, their indiscriminate use in ‘over-the-counter’ cold remedies and farmed poultry has allowed many strains of influenza to develop resistance. Influenza B has a different type of M2 protein which is largely unaffected by these drugs.

5 Diagnosis of influenza

Many diseases produce symptoms similar to those of influenza; in fact, ‘flu-like’ is a term that is frequently used to describe several different illnesses. Since influenza spreads rapidly by airborne transmission and is a life-threatening condition in certain vulnerable groups, it is important that cases of the disease are identified as quickly as possible, so that preventative measures may be taken.

Most viral infections are not treated, although antiviral drugs such as zanamivir are used for potentially life-threatening cases or where the risk of transmission is high (as occurs during a pandemic).

Which sites in the body should be sampled for diagnosis?

The influenza virus infects the respiratory tract and is spread by coughing and sneezing, so specimens should be taken from the nose, throat or trachea.

In practice, the best specimens are nasal aspirates or washes, but swabs of the nose or throat may be used if they are taken vigorously enough to obtain cells. Ideally, samples should be taken within three days of the onset of illness, and all specimens need to be preserved in a transport medium and kept chilled until they reach the clinical microbiology laboratory.

5.1 Initial identification of influenza infection

Oral swabs or nasal aspirates are initially screened for the presence of a variety of respiratory viruses. This is done by extracting RNA from the sample and subjecting it to a reverse-transcription polymerase chain reaction (RT-PCR) as described below:

Initially the RNA sample is reverse transcribed into complementary DNA (cDNA), using a commercially-available reverse transcriptase enzyme.
The cDNA is then used in a standard PCR reaction to detect and amplify a short sequence of nucleotides specific to the virus. Multiple DNA sequences, each specific for a different type of virus, can be amplified in the same reaction, provided that these sequences are of different lengths.
Each of the different amplified sequences is separated from the others when the entire sample is subjected to gel electrophoresis (an analytical technique in which molecules of different sizes move at various rates through a gel support in an applied electric field, thus making it possible to identify specific molecules.)

The polymerase chain reaction (PCR) technique is illustrated in Video 2.

Transcript: Video 2 PCR technique.

Polymerase chain reaction, or PCR, uses repeated cycles of heating and cooling to make many copies of a specific region of DNA. First, the temperature is raised to near boiling, causing the double-stranded DNA to separate, or denature, into single strands. When the temperature is decreased, short DNA sequences known as primers bind, or anneal, to complementary matches on the target DNA sequence. The primers bracket the target sequence to be copied. At a slightly higher temperature, the enzyme Taq polymerase, shown here in blue, binds to the primed sequences and adds nucleotides to extend the second strand. This completes the first cycle.

In subsequent cycles, the process of denaturing, annealing and extending are repeated to make additional DNA copies.

After three cycles, the target sequence defined by the primers begins to accumulate.

After 30 cycles, as many as a billion copies of the target sequence are produced from a single starting molecule.

Typically, nucleotide sequences specific to five types of virus are searched for in each sample: influenza A, influenza B, respiratory syncytial virus (Baltimore group V, (–)ssRNA virus, and a major cause of respiratory illness in young children), adenoviruses and enteroviruses. Those samples that test positive for influenza in the RT-PCR reaction are inoculated into cells in culture. Sufficient virus for a limited number of tests can be produced from such cultures within 24 hours, but they are often maintained for up to a week.

5.2 Determining the subtype of influenza

Immunofluorescence.

Confirmation of a case of influenza is usually achieved by performing tests on some of the inoculated cultured cells using reference fluorescent-labelled antisera provided by the WHO. A reference antiserum is a sample serum known to contain antibodies specific for the molecule to be assayed (in this case, haemagglutinin or neuraminidase). These antisera are prepared using purified haemagglutinin and neuraminidase and are monospecific, each antibody reacting only with one epitope e.g. H1 or H3.

For the test, an antibody is added to a sample of inoculated cells. Following a wash step, if the antibody remains bound to the cells then they fluoresce under appropriate illumination, indicating the presence of viral antigen on the cell surface. This diagnostic technique can identify influenza virus on infected cells in as little as 15 minutes. A positive result not only confirms the RT-PCR data, but gives additional information on the subtype of the virus.

Further PCR analyses

Standardised RT-PCR protocols exist to look for the presence of different haemagglutinin and neuraminidase subtypes, chiefly H1, H3, H5, N1 and N2. (Poddar, 2002). If the PCR analysis indicates a dangerous strain of influenza A e.g. H5N1, then it is instantly sent to a WHO reference laboratory for further tests.

Haemagglutination assays

Influenza has haemagglutinins protruding from its viral envelope, which it uses to attach to host cells prior to entry. These substances form the basis of a haemagglutination assay, in which viral haemagglutinins bind and cross-link (agglutinate) red blood cells added to a test well, causing them to sink to the bottom of the solution as a mat of cells. If agglutination does not occur, then the red blood cells are instead free to roll down the curved sides of the tube to form a tight pellet.

A related test called a haemagglutination-inhibition assay (HAI), incorporates antibodies against different subtypes of viral haemagglutinin. The antibodies bind and mask the viral haemagglutinin, preventing it from attaching to and cross-linking red blood cells.

A HAI assay can be set up in one of two ways: either a known reference antibody is added to an unknown virus sample, or known reference viral haemagglutinin is added to a sample of patient serum containing antibodies against influenza. This second version of the HAI assay can therefore be used long after the infection has passed, when virions are no longer present.

Haemagglutination and HAI assays have the advantage that they are simple to perform and require relatively cheap equipment and reagents. However, they can be prone to false positive or false negative results, if the sample contains non-specific inhibitors of haemagglutination (preventing agglutination) or naturally occurring agglutinins of red blood cells (causing agglutination).

If a confirmed influenza A isolate reacts weakly or not at all in HAI then this indicates an unknown variant of influenza A and the sample is immediately sent to a WHO reference laboratory for further tests.

Neuraminidase inhibition assay

Typing influenza isolates in terms of their neuraminidase makes use of the enzyme activity of this glycoprotein. The neuraminidase inhibition assay is performed in two parts. The first part determines the amount of neuraminidase activity in a patient influenza sample, as outlined in Figure 9a. A substrate (called fetuin) that is rich in sialic acid residues is added to a sample of the influenza virus, and the viral neuraminidase enzyme cleaves the substrate to produce free sialic acid.

Addition of a substance that inactivates the neuraminidase stops the reaction, and a chromogen (a colourless compound that reacts to produce a coloured end-product) that turns pink in the presence of free sialic acid is added. The intensity of the pink colour is proportional to the amount of free sialic acid and can be measured using a spectrophotometer.

This assay of neuraminidase activity allows the appropriate amount of virus sample to be determined, and this quantity is then used in the second part of the assay. If too much or too little virus is used, the resulting changes, and therefore the neuraminidase, may be undetectable.

In the second part of the assay (Figure 9b), viral samples from the patient are incubated with anti-neuraminidase reference antisera. Each of the reference antisera used for this test has antibodies that bind one particular neuraminidase variant, e.g. N1 or N2.

How can these antisera be used to type the neuraminidase variant?

If the antibodies bind the neuraminidase in the patient’s sample they inhibit its activity. This means that the patient’s neuraminidase cannot cleave the sialic acid from its test substrate fetuin, so no colour change will occur when the chromogen is added. Conversely, if the antibodies in the reference antiserum do not bind the neuraminidase in the patient’s sample, then the enzyme will remain uninhibited and the pink colour will be produced as before.

Part (a) of the diagram shows the sequence of obtaining a positive reaction in the neuraminidase inhibition assay. A patient sample containing influenza virus is added to the reaction well of a microtitre plate. Fetuin substrate is added, which is cleaved by viral neuraminidase into free sialic acid. A reagent is added that changes colour, dependent upon the amount of sialic acid present in the solution. Part (b) of the diagram shows how two different antibodies against neuraminidase can give two possible test outcomes for the patient sample from part (a). The diagram on the left shows what happens when the antibody binds to the neuraminidase and inactivates it (left side), while the right side diagram shows what happens when the antibody does not bind that type of neuraminidase. Fetuin and then the colour-change reagent are then added to both test wells. When the antibody fails to recognise the neuraminidase (right side) fetuin is cleaved by neuraminidase and gives a colour reaction. When the antibody recognises the neuraminidase (left side) its activity is blocked, fetuin is not cleaved and no colour reaction occurs.

6 Conclusion

As you reach the end of this free course you should consider some of the important points that the study of flu raises.

A single pathogen can produce different types of disease in different people. Genetic variation in a pathogen can also affect the type of disease it produces. To understand this we need to know something of the genetic and social differences in the host population, and of the diversity of the pathogen.
The symptoms of a particular disease may be produced by different pathogens or by a combination of pathogens. To understand this requires some knowledge of pathology and cell biology.
Some diseases, such as flu, affect humans and several other animal species, whereas others are more selective in their host range. The basic biology of different pathogens underlies these differences.
Flu is a disease that can be contracted several times during a lifetime, but many other infectious diseases are only ever contracted once. To understand this we need to look at how the immune system reacts to different pathogens, and how responses vary depending on the pathogen.
Outbreaks of flu occur regularly, but some epidemics are much more serious than others. This requires an understanding of aspects of virology, immunology, evolutionary biology and epidemiology.

7 Questions for the course

The following questions allow you to assess your understanding of the content of this course. Each one relates to one or more of the intended learning outcomes of the study.

If you are unable to answer a question, or do not understand the answer given, then reread the relevant section(s) of the course and try the question again.

(This question relates to case study learning outcome (LO) 2.)

Why would Robert Koch have been unable to demonstrate that influenza viruses cause the disease influenza, according to his own postulates?

Koch’s second postulate states that the pathogen can be isolated in pure culture on artificial media. Viruses can only multiply within host cells, so Koch would have been unable to isolate the virus using artificial media. (Much later, eggs and live cells in tissue culture came to be used for growing flu virus, but this was long after Koch’s death, and they do not strictly conform to the original postulate.)

(This question relates to LO2.)

List the various structural components of an influenza A virus and note where each of these elements is synthesised within an infected cell.

Viral RNA is synthesised in the nucleus of the infected cell. The M-protein and other internal proteins are synthesised on ribosomes in the cytoplasm. The capsid is then assembled in the nucleus. The haemagglutinin and neuraminidase are synthesised on ribosomes on the endoplasmic reticulum. The envelope is derived from the host cell’s own plasma membrane.

(This question relates to LO2 and LO4.)

It is very uncommon for a strain of influenza that infects other animals to infect people; nevertheless such strains are very important for human disease. Why is this?

Animal strains of influenza act as a reservoir of genes that may recombine with human influenza viruses to produce new strains that can spread rapidly in humans. Such pandemic strains frequently produce serious diseases with high mortality.

(This question relates to LO2 and LO3.)

Which immune defences are able to recognise and destroy virally-infected host cells?

Cytotoxic T cells and NK cells are able to recognise and destroy virally-infected host cells.

(This question relates to LO4 and LO5.)

Why do most people suffer from influenza several times in their lives?

The virus mutates regularly (antigenic drift); also new strains are occasionally generated by recombination (antigenic shift). Since the immune response is generally specific for a particular strain of virus, new strains are not susceptible to immune defences which have developed against earlier strains.

Faculty and Disclosures

NAPNAP Disclaimer Participants have an implied responsibility to use the newly acquired information to enhance patient outcomes and their own professional development. The information presented in this activity is not meant to serve as a guideline for patient management. Any medications, diagnostic procedures, or treatments discussed in this publication should not be used by clinicians or other health care professionals without first evaluating their patients' conditions, considering possible contraindications or risks, reviewing any applicable manufacturer's product information, and comparing any therapeutic approach with the recommendations of other authorities.

Respiratory Syncytial Virus Bronchiolitis: A Case Study

View abbreviations used in this activity.

Case Presentation

"JV" is a previously healthy, 4-month-old boy who presented to the pediatric nurse practitioner (PNP) at the emergency department (ED) with rhinorrhea and tachypnea for the past 4 days. A fever that developed during the night prompted his mother to bring him to the ED. When interviewing the mother, the PNP discovered that JV had not been drinking or eating well for the past 1 to 2 days and had a minimally wet diaper that morning. He has had no vomiting or diarrhea. He has had no cough, but his mother reported that when he breathes, he sounds “funny” and his chest looks funny. He has been recently exposed to other sick children at his daycare center.

In reviewing JV's general wellness, the PNP discovered that he was born at 34 weeks and 5 days prematurely. His birth weight was 2.6 kg (5.73 lb). He was hospitalized in the special care nursery for 1 week with an oxygen requirement for several days. He was discharged home with no medications or other therapies. He usually consumes 30 ounces of breastmilk/day. He usually has 4 to 6 wet diapers per day; his stools are brown and he has soft stool every day. He rolls over from front to back. His height, weight, and head circumference are all at the 50 th percentile. His immunizations are up to date to 4 months, and he has not received immunoprophylaxis with palivizumab.

JV lives with his married parents, a 4-year-old sister, and a pet dog in an apartment. He and his sister attend daycare 5 days/week. There are no smokers at home, although the neighbors smoke. There is a family history of asthma in the mother.

JV undergoes a physical examination by the PNP (Table).

Table. Physical Examination Findings

, 91% on room air

Based on the examination findings, the PNP orders oxygen 2 L per nasal cannula to treat the desaturation, placement of a peripheral intravenous catheter followed by a fluid bolus for dehydration, albuterol via nebulizer for the wheezing, and a diagnostic respiratory viral panel. After the fluid bolus, the infant's physical examination findings are unchanged, and the bolus is repeated with improvement. The oxygen brings his saturations up to 93%. His wheezing is unchanged, but the work of breathing appears slightly improved after the albuterol nebulizer treatment.

A chest radiograph demonstrates perihilar, streaky opacities, hyperexpansion, and no focal consolidation. The decision is made to admit JV to an inpatient unit with the diagnosis of bronchiolitis. While awaiting a bed on the inpatient unit, JV develops an increased oxygen requirement and is transitioned to face mask oxygen at a fraction of inspired oxygen of 0.35.

JV is transferred to the ward and is evaluated by the provider team. He is found to have moderate work of breathing, poor aeration, and wheezing. The team discusses using a bronchodilator to improve his wheezing. Information from the emergency department (ED) is reviewed and it is discovered that JV's wheezing did not improve with the albuterol therapy. A racemic epinephrine nebulizer treatment is given instead, with limited improvement of his condition. At this time, the results of the respiratory viral panel are available and indicate that JV has respiratory syncytial virus (RSV) infection as the cause of his bronchiolitis.

JV's therapeutic plan is as follows: intravenous fluids for hydration, nothing per mouth, oxygen support, cardiac and respiratory monitoring, ventilation monitoring with a noninvasive device, antipyretics for fever, and isolation to decrease the risk of spreading the RSV infection.

Approximately 24 hours after admission (day 5 of illness), JV experiences increases in his respiratory rate (74 breaths per minute), pulse (182 beats per minute), work of breathing, and a fever (39.4 degrees C [102.92 degrees F]). He is given an antipyretic. After 1 hour, his fever persists and his work of breathing, respiratory rate and pulse remain elevated. Now, his oxygen saturation has fallen to 90%. His supplemental oxygen is increased and a call is made to the rapid response team to assess him.

On arrival of the rapid response team, JV is lethargic with severe work of breathing and oxygen desaturation of 88%. His supplemental oxygen is increased. His lung examination demonstrates wheezing with poor aeration. A hypertonic saline nebulizer treatment is given, with some improvement in his distress.

A decision was made to transfer JV to the pediatric intensive care unit (PICU), where he was quickly connected to the cardiorespiratory monitor, pulse oximetry, and ventilation measurement device. His arterial carbon dioxide level was 54 mm Hg. He was placed on continuous positive airway pressure (CPAP) via a nasal mask at 5 cm H 2 O pressure. Approximately 30 minutes later, he remained tachypneic with severe work of breathing; the CPAP was increased to 8 cm H 2 O pressure and a helium-oxygen (heliox) gas mixture was added.

Discussion: Managing Bronchiolitis

In 2010, Al-Ansari and colleagues [1] studied the effectiveness of hypertonic saline (5% and 3%) compared with normal saline for the treatment of bronchiolitis in infants. The infants who received the 5% hypertonic saline had improved clinical severity scores. However, there was no impact on length of hospital stay. A systematic analysis of bronchodilators in the treatment of bronchiolitis in infants found no benefit, although some of the trials included in this analysis demonstrated an improvement in clinical severity scores. [2] Subsequently, a meta-analysis by Hartling and colleagues [3] demonstrated that epinephrine with or without corticosteroids had a positive impact on clinical severity score but not on length of stay.

The use of nasal CPAP combined with air or heliox delivery in infants and toddlers with bronchiolitis was studied by Martinón-Torres and colleagues. [4] They found that the use of CPAP with air decreased clinical severity scores and that there was additional improvement when heliox was used instead of air. A systematic review found that clinical severity scores were improved with the use of heliox in infants with bronchiolitis. [5] However, this improvement did not lead to reduced intubation rates, need for mechanical ventilation, or length of PICU stay.

Case Presentation, Continued

Because of the severity of JV's illness, the provider team in the PICU discussed the possibility of corticosteroids. A review of the literature revealed conflicting evidence for the use of corticosteroids and that corticosteroids have not been shown to decrease hospitalization in infants with RSV bronchiolitis. In addition, a trial of inhaled corticosteroids in infants who had had RSV bronchiolitis found no difference in wheezing 3 months posthospitalization. [6]

JV continued to require CPAP with heliox for several days and then began to improve. He responded to the nebulized hypertonic saline that he had received for several days and was able to tolerate enteral feeds by nasogastric tube. He was weaned from his supportive therapies and was transitioned to a standard nasal cannula on PICU day 4. On PICU day 5, he was transferred to the ward. He was weaned from supplemental oxygen and was prepared for discharge home with no therapies on hospital day 8.

Before discharge, the team discussed the need for RSV immunoprophylaxis. According to the American Academy of Pediatrics revised guidelines, JV should have had RSV immunoprophylaxis initiated at birth before his discharge from the hospital. [7] He met the age criteria (32 weeks 0 days to 34 weeks 6 days) with the risk factors of living with a sibling younger than 5 years and attending daycare. [7] The team contacted JV's primary care provider, gave a summary of his hospitalization, and requested that RSV immunoprophylaxis be considered for JV, henceforth.

Respiratory syncytial virus bronchiolitis is a common pediatric illness with thousands of children each year requiring hospitalization secondary to severe illness. While many of affected children never require hospitalization, some are sick enough to be hospitalized in the intensive care unit. The children requiring intensive care are typically young infants and those with comorbid conditions. While these children can be severely ill and require intubation and mechanical ventilation, most of the children recover and very few succumb to the disease.

Supported by an independent educational grant from MedImmune Inc.

Abbreviations

The material presented here does not necessarily reflect the views of Medscape, LLC, or companies that support educational programming on medscape.org. These materials may discuss therapeutic products that have not been approved by the US Food and Drug Administration and off-label uses of approved products. A qualified healthcare professional should be consulted before using any therapeutic product discussed. Readers should verify all information and data before treating patients or employing any therapies described in this educational activity.

Teaching Viruses and Epidemiology Online

This playlist can be used to teach about the biology of viruses and epidemiology in an online setting. The topics covered include the structures and transmission mechanisms of viruses, zoonotic diseases, viral outbreaks, viral evolution during an outbreak, and epidemiology.

By completing the resources in this playlist, students will be able to:

List the ways in which viruses can differ from each other.
Identify different components and characteristics of viruses and their role in infection.
Calculate the size of a virus relative to a human cell.
Use information collected in case studies to distill complex, real-world data, and perform basic calculations to make decisions on the spread of an infectious disease.
Analyze and interpret data from a scientific figure.
Explain the term “zoonotic disease” and discuss some of the global patterns in mammals that carry these diseases.
Use appropriate scientific terms, including “reservoir” and “spillover,” in describing a disease outbreak.
Analyze and interpret sequence data to explain how viruses evolve over time during an outbreak.

This playlist can be used in AP/IB Biology and undergraduate college courses.

Virus Explorer

In this Click & Learn, students explore the diversity of viruses based on structure, genome type, host range, transmission mechanism, and vaccine availability.

To use this resource as part of this playlist, have students explore the Click & Learn and complete the associated worksheet. The extension activity at the end of the worksheet is optional; you may want to assign it if students don’t have a strong understanding of relative size.

Patterns of Zoonotic Disease

In this Data Point activity, students analyze a published scientific figure from a study on the global distribution of zoonotic pathogens and their host species.

To use this resource as part of this playlist, use the questions in the “Educator Materials” to guide a class discussion. The full scientific paper is also available from the “Materials” box of this resource’s webpage; it can be used to give the students an opportunity to practice reading primary literature.

Illustration of antibodies from the activity

Epidemiology of Nipah Virus

In this activity, students analyze evidence, perform calculations and make predictions based on real-world data about a viral outbreak. Part of the activity involves watching the related video Virus Hunter: Monitoring Nipah Virus in Bat Populations (resource 4 in this playlist).

To use this resource as part of this playlist, have students complete the “Student Handout,” watching the video when instructed.

You can supplement this activity by having students research the COVID-19 outbreak in Wuhan, China using this paper or in another region citing their references. They can write a mini-case study (using Part 1 of this activity as a template) to demonstrate the knowledge they’ve gained.

Virus Hunter: Monitoring Nipah Virus in Bat Populations

This video follows scientists working in Bangladesh as they test fruit bat populations to determine whether they are infected with Nipah virus, a potentially deadly human pathogen.

To use this resource as part of this playlist, refer to the notes accompanying the “Epidemiology of Nipah Virus” activity (resource 3 in this playlist).

Image from the activity of a DNA sequence

Ebola: Disease Detectives

In this activity, students analyze DNA sequences of Ebola viruses to track the virus’s spread during the 2013–2016 Ebola outbreak in West Africa. Part of the activity involves watching the related video Think Like a Scientist: Natural Selection in an Outbreak (resource 6 in this playlist) .

To use this resource as part of this playlist:

Have students complete up through Part 1 of the “Student Worksheet,” watching the video when instructed. It is recommended to provide this section of the worksheet separately, since Part 2 gives away some answers.
The worksheet asks students to sort cards of DNA sequences. Students can do this online without printing cards by analyzing the “Sequence Sheet” PDF and writing down the sequence numbers for each grouping.
After students finish Part 1, have them complete Part 2.

You can supplement this activity by having students compare and contrast methods used to track Ebola, Nipah, and the COVID-19 outbreak they may have researched in resource 3 of this playlist.

Think Like a Scientist: Natural Selection in an Outbreak

This video focuses on the front lines of the 2013–2016 Ebola outbreak in West Africa and explains how scientists monitored the evolution of the virus by analyzing its genome.

To use this resource as part of this playlist, refer to the notes accompanying the “Ebola: Disease Detectives” activity (resource 5 in this playlist).

Age Structure of Ebola Outbreaks

In this Data Point activity, students analyze a published scientific figure from a study that investigated demographic patterns in Ebola outbreaks from the Democratic Republic of the Congo.

To use this resource as part of this playlist, use the questions in the “Educator Materials” to guide a class discussion. The full scientific paper is also available under “Primary Literature” in the “Details” section from this resource’s webpage; it can be used to give the students an opportunity to practice reading primary literature.

You can supplement this activity by having students research demographic patterns in another outbreak, such as COVID-19 or Nipah. Based on their research, they can create a similar figure representing the age structure of the outbreak they chose.

Log in using your username and password

Search More Search for this keyword Advanced search
Latest content
Global health
BMJ Journals

Sulaiman S Bharwani 1 ,
Qudsia Shaukat 2 ,
Ratna Basak 2
1 Department of Pediatrics, UAE University, Faculty of Medicine and Health Sciences, Al Ain, United Arab Emirates
2 Department of Pediatrics, Al Ain Hospital Affiliate of Vienna Medical University, Al Ain, United Arab Emirates
Correspondence to Dr Sulaiman S Bharwani, sulaiman.bharwani{at}gmail.com

This report describes a 10-month-old infant who presented with generalised tonic clonic seizures following 2 days of vomiting, diarrhoea and a low-grade fever. The patient was moderately dehydrated and the blood investigations were remarkable for hyponatraemia (126 mEq/l), leukocytosis (19.4 × 10 3 /l (46% lymphocytes)), thrombocytosis (637 × 10 3 /l), hypoalbuminaemia (albumin 1.9 g/dl) and elevated C reactive protein (96 mg/l). Stool was positive for white and red blood cells but the cultures for bacteria were negative. Rotavirus antigen in stool was positive. There was microscopic haematuria without proteinuria and the nasogastric aspirate was coffee ground. Generalised oedema with pleural and peritoneal effusions ensued requiring drainage, correction of fluid and electrolytes imbalance and albumin infusions. Over the next 72 h, the patient descended into shock and disseminated intravascular coagulopathy which required packed red blood cells and fresh frozen plasma transfusions. By day 12 the patient was clinically and biochemically normal.

https://doi.org/10.1136/bcr.04.2011.4126

Statistics from Altmetric.com

Request permissions.

If you wish to reuse any or all of this article please use the link below which will take you to the Copyright Clearance Center’s RightsLink service. You will be able to get a quick price and instant permission to reuse the content in many different ways.

Rotavirus is the most frequent cause of childhood diarrhoea worldwide. While the rotavirus vaccines have recently made some headway, the international burden keeps shifting to the low to mid-income countries where it remains the leading cause of infant mortality. 1 Rotavirus typically affects infants, who characteristically present to the hospital emergency with low-grade fever, vomiting and watery stools with mild to moderate dehydration. Providing electrolytes and water replacement while resuming the child’s feeding remain the main objectives of the care givers. Some children are admitted if they do not tolerate oral rehydration therapy. The diagnosis is often confirmed with the stool enzyme immunoassay (EIA) for rotavirus antigen and helps isolate the cases when admitted to the hospital to limit nosocomial transmission. Extraintestinal complications of rotavirus infection have been said to occur rarely 2 3 and often lead to higher morbidity and mortality. Rotavirus-induced central nervous system (CNS) involvement has been associated with seizure, encephalopathy and death. 4 Likewise shock and disseminated intravascular coagulation (DIC) are rare but potentially lethal 5 complications associated with the rotavirus infection. 6 In an 11-year surveillance study conducted in a Swedish population, rotavirus infection attributed complications occurred in 16.5% of children with community acquired rotavirus gastroenteritis and 1.9% of nosocomial acquired rota infection. These complications consisted of severe dehydration resulting in intensive care (1.7%), death (0.1%), hypertonic dehydration (9.1%), seizures (4.0%) and encephalitis with abnormal EEG (1.7%). 3 This case report emphasises the importance of recognising the rare but serious complications of a common enteric pathogen. The course of illness points to the versatility of the virus in altering the course of an otherwise benign gastroenteritis.

Case presentation

A previously healthy 10-month-old female infant presented to a hospital emergency room (ER) with two brief (5 min) and consecutive episodes of generalised tonic clonic convulsions after a 2-day bout of vomiting, diarrhoea and low-grade fever. Upon arrival to ER, her blood pressure was 102/54 mm Hg, heart rate was 150 beats/min, respiratory rate was 34 breaths/min, body temperature was 37.8°C and oxygen saturation was 94% on room air. She was lethargic and had dry mucous membranes. The anterior fontanelle was depressed and the capillary refill was delayed (3 s).The pupils were equal and reactive to light with normal fundoscopic examination and there was no neck stiffness. Random blood sugar was 121 mg/dl. After initial stabilisation (hydration, correction of electrolyte imbalances and seizure control), CT of the brain was done and reported as normal. The blood tests revealed hyponatraemia (Na 126 mEq/l), hypoproteinaemia (total protein 4.2 g/dl, albumin 1.9 g/dl), and leukocytosis (white blood cell (WBC) 19.4 × 10 3 /l (46% lymphocytes)), thrombocytosis (637 × 10 3 /l) and elevated C reactive protein (CRP, 96 mg/l). Urine was positive for blood (red blood cell (RBC) 30/10 6 ). Blood, urine and cerebrospinal fluid (CSF) were sent for culture and broad spectrum antibiotics – ceftriaxone and vancomycin – were administered intravenously empirically for sepsis. 7 Intravenous albumin infusions were also started at this time followed by a loop diuretic as needed.

Over the next 24 h, the patient developed generalised oedema with ascites and pleural effusion. Due to the laboured breathing, dyspnoea, hyperpnoea and continued acidosis, the patient was transferred to the intensive care unit where parecentesis and thoracocentesis were performed and a chest tube was left in place to drain. Endotracheal intubation was not needed. Stool was positive for RBC and WBC but the gram stain was negative. Stool EIA was however positive for rotavirus antigen. Cultures of urine, stool, blood and cerebrospinal fluid (unremarkable chemistry-protein, glucose and cell count within normal limits) were reported negative for bacterial and fungal growth.

On day 4 post admission, low-dose intravenous methylprednisolone was started due to persistent hypoalbuminaemia, increased oxygen requirements and risk of septic shock. 8 On day 6, the patient became tachycardiac and hypotensive and the blood results showed neutropaenia (WBC 3.25 × 10 3 ), thrombocytopaenia (82 × 10 3 ), anaemia (haemoglobin 8 g/dl) and coagulopathy (D-dimer elevated to 2055 ug/l, prothrombin time rose to 16 s and partial prothrombin time went up to 53 s). Intravenous ceftazidime was substituted for ceftriaxone to broaden the coverage to include Pseudomonas aeruginosa . The patient received fresh frozen plasma (FFP) and packed red blood cells (PRBC) transfusions.

The cultures from the pleural and peritoneal effusions (transudate) were negative for bacterial and fungal growth. Endoscopy and colonoscopy were visually normal. The duodenal biopsies showed some patchy areas of short and broad villi and diffuse oedema but no significant inflammation/ulceration or mucosal damage ( figure 1 ). Gastric and oesophageal biopsies were normal. Colonic mucosa was mildly oedematous with no significant inflammation ( figure 2 ). The patient showed complete clinical and biochemical recovery 12 days after the hospital admission ( figures 3 – 5 ) and remained well upon her follow-up outpatient visit 2 months later.

Download figure
Open in new tab
Download powerpoint

Villous blunting in the duodenal biopsy sample (400 ×).

Mild oedema in colon biopsy sample (400 ×).

Serum albumin level from day 0, 3, 5 and 10.

Blood platelet count (× 10 3 ) on day 0, 5, 7, 10 and 13.

D-dimer assay in ug/l on day 7, 10 and 13.

Investigations

▶ Stool RIA was positive for rotavirus antigen but bacterial cultures were negative

▶ Initial blood tests indicated elevated CRP, hyponatraemia and hypoproteinaemia

▶ Blood tests on day 6 revealed a DIC like picture

▶ Random blood glucose was normal

▶ CT scan of the brain and EEG was reported to be normal

▶ Duodenal biopsy showed patchy areas of broad and flattened villi and oedema.

Differential diagnosis

▶ Extraintestinal complications of ROTA virus gastroenteritis

▶ Unidentified bacterial sepsis, shock and DIC.

Correction of fluid and electrolyte imbalance, albumin, FFP and PRBC transfusions, pleural tap and peritoneal drainage and nutrition support.

Outcome and follow-up

Complete clinical and biochemical recovery.

Although plausible by deductive reasoning from the literature, 9 elevated CRP attributed to rota virus gastroenteritis without concomitant bacteraemia or bacterial infection has never been reported. Systemic inflammatory response syndrome (SIRS) can occur with viral infections and has been described due to norovirus, rotavirus and astrovirus in the neonates. 10 Rotavirus associated seizures and encephalopathy 11 4 as well as protein loosing enteropathy 12 and shock 6 13 are less recognised and much less understood manifestations. Although two cases of DIC associated with rotavirus have been reported, it is difficult to undermine the contribution of hypovolemic shock and metabolic derangements in those cases. 13 Moreover, CRP was not measured in either of them and neither of them had undergone colonoscopy to rule out colonic injury for certain. The case underscores our limited understanding of the alterations in the host immunity behind these unusual presentations of a common enterovirus infection.

This is an infant with rotavirus gastroenteritis and sepsis (SIRS with infection or suspected infection), and negative blood, urine, stool and CSF cultures. Seizures, protein loosing enteropathy and DIC as complications of rotavirus infection are rare individual events and the combination in a single patient, not documented in recent literature. Elevated CRP (>80 mg/l) occurs in 5% of viral infections, 9 but has never been reported with rotavirus infection. The diagnosis in this case was based on rotavirus antigen identified in the stool of the patient upon initial presentation. Had we not sent the stool for the RIA on day 1, or had we sent it later during the hospitalisation, the case would have either remained hitherto riddled in the former scenario or labelled nosocomial in the case of the latter. In any event we would have exposed other hospitalised children to rotavirus infection.

Learning points

▶ Diagnosis of rotavirus is very important in sick children who need hospital admissions in order to isolate and prevent nosocomial outbreaks.

▶ CRP could be elevated in rotavirus infection without bacteraemia.

▶ The CNS complications of rotavirus can be fatal and hyponatraemic seizures can be an initial presentation.

▶ Rapid fluid shifts, hypoproteinaemia, DIC and SIRS can occur with rotavirus gastroenteritis.

Fischer Walker CL ,
Friberg IK ,
Taniguchi K ,
Johansen K ,
Hedlund KO ,
Zweygberg-Wirgart B ,
Kashiwagi Y ,
Kawashima H ,
Pazdiora P ,
Carneiro NB ,
Diniz-Santos DR ,
Goldstein B ,
Markovitz BP ,
Goodman DM ,
Watson RS ,
Eis-Hübinger AM ,
Yassin AF ,
DiFazio MP ,
Freedman S ,
Matsubayashi N
Limbos MA ,
Lieberman JM

Competing interests None.

Patient consent Obtained.

Read the full text or download the PDF:

Comment Comments
Save Article Read Later Read Later

Viruses Finally Reveal Their Complex Social Life

April 11, 2024

An illustration shows two hands composed of viral particles lightly touching.

Far from solitary particles, viruses engage in social behaviors within cells and hosts.

Carlos Arrojo for Quanta Magazine

Introduction

Ever since viruses came to light in the late 1800s, scientists have set them apart from the rest of life. Viruses were far smaller than cells, and inside their protein shells they carried little more than genes. They could not grow, copy their own genes or do much of anything. Researchers assumed that each virus was a solitary particle drifting alone through the world, able to replicate only if it happened to bump into the right cell that could take it in.

This simplicity was what attracted many scientists to viruses in the first place, said Marco Vignuzzi , a virologist at the Singapore Agency for Science, Research and Technology Infectious Diseases Labs. “We were trying to be reductionist.”

That reductionism paid off. Studies on viruses were crucial to the birth of modern biology. Lacking the complexity of cells, they revealed fundamental rules about how genes work. But viral reductionism came at a cost, Vignuzzi said: By assuming viruses are simple, you blind yourself to the possibility that they might be complicated in ways you don’t know about yet.

For example, if you think of viruses as isolated packages of genes, it would be absurd to imagine them having a social life. But Vignuzzi and a new school of like-minded virologists don’t think it’s absurd at all. In recent decades, they have discovered some strange features of viruses that don’t make sense if viruses are lonely particles. They instead are uncovering a marvelously complex social world of viruses. These sociovirologists, as the researchers sometimes call themselves, believe that viruses make sense only as members of a community.

Granted, the social lives of viruses aren’t quite like those of other species. Viruses don’t post selfies to social media, volunteer at food banks or commit identity theft like humans do. They don’t fight with allies to dominate a troop like baboons; they don’t collect nectar to feed their queen like honeybees; they don’t even congeal into slimy mats for their common defense like some bacteria do. Nevertheless, sociovirologists believe that viruses do cheat, cooperate and interact in other ways with their fellow viruses.

The field of sociovirology is still young and small. The first conference dedicated to the social life of viruses took place in 2022, and the second will take place this June. A grand total of 50 people will be in attendance. Still, sociovirologists argue that the implications of their new field could be profound. Diseases like influenza don’t make sense if we think of viruses in isolation from one another. And if we can decipher the social life of viruses, we might be able to exploit it to fight back against the diseases some of them create.

Under Our Noses

Some of the most important evidence for the social life of viruses has been sitting in plain view for nearly a century. After the discovery of the influenza virus in the early 1930s, scientists figured out how to grow stocks of the virus by injecting it into a chicken egg and letting it multiply inside. The researchers could then use the new viruses to infect lab animals for research or inject them into new eggs to keep growing new viruses.

In the late 1940s, the Danish virologist Preben von Magnus was growing viruses when he noticed something odd. Many of the viruses produced in one egg could not replicate when he injected them into another. By the third cycle of transmission, only one in 10,000 viruses could still replicate. But in the cycles that followed, the defective viruses became rarer and the replicating ones bounced back. Von Magnus suspected that the viruses that couldn’t replicate had not finished developing, and so he called them “incomplete.”

In later years, virologists named the boom and bust of incomplete viruses “the von Magnus effect.” To them, it was important — but only as a problem to solve. Since no one had seen incomplete viruses outside of a lab culture, virologists figured they were artificial and came up with ways to get rid of them.

“You have to eliminate these from your lab stocks because you don’t want them to interfere with your experiments,” said Sam Díaz-Muñoz , a virologist at the University of California, Davis, recalling the common view within the field. “Because this is not ‘natural.’”

Researchers in the 1960s observed that incomplete viral genomes were shorter than those of typical viruses. That finding strengthened the view of many virologists that incomplete viruses were defective oddities, lacking the genes needed to replicate. But in the 2010s, inexpensive, powerful gene-sequencing technology made it clear that incomplete viruses were actually abundant inside our own bodies.

In one study, published in 2013, researchers at the University of Pittsburgh swabbed the noses and mouths of people sick with the flu. They pulled out the genetic material from influenza viruses in the samples and discovered that some of the viruses were missing genes. These stunted viruses came into existence when infected cells miscopied the genome of a functional virus, accidentally skipping stretches of genes.

Other studies confirmed this discovery. They also revealed other ways that incomplete viruses can form. Some kinds of viruses carry garbled genomes, for example. In these cases, an infected cell started copying a viral genome only to reverse partway through and then copy the genome backward to its starting point. Other incomplete viruses form when mutations disrupt the sequence of a gene so that it can no longer make a functional protein.

Merrill Sherman/ Quanta Magazine

These studies demolished the old assumption that von Magnus’ incomplete viruses were only an artifact of lab experiments. “They’re a natural part of virus biology,” Díaz-Muñoz said.

Discovering incomplete viruses in our own bodies has inspired a new surge of scientific interest in them. Influenza is not unique: Many viruses come in incomplete forms. They make up the majority of viruses found in people sick with infections such as respiratory syncytial virus (RSV) and measles.

Scientists have also come up with new names for von Magnus’ incomplete viruses. Some call them “defective interfering particles.” Others call them “nonstandard viral genomes.”

Díaz-Muñoz and colleagues have another name for them: cheaters.

A Viral Grift

Incomplete viruses can typically get into cells, but once inside, they cannot replicate on their own. They lack some of the genes essential for hijacking their host’s protein-making machinery, such as the one for a gene-copying enzyme known as a polymerase. In order to replicate, they have to cheat. They have to take advantage of their fellow virus.

Fortunately for the cheaters, cells are often infected by more than one viral genome. If a functional virus shows up in a cheater’s cell, it will make polymerases. The cheater can then borrow the other virus’s polymerases to copy its own genes.

In such a cell, the two viruses race to make the most copies of their own genome. The cheater has a profound advantage: It has less genetic material to replicate. The polymerase therefore copies an incomplete genome more quickly than a complete one.

Their edge grows even larger over the course of an infection, as incomplete viruses and functional ones move from cell to cell. “If you’re half as long, that doesn’t mean you get a two-times advantage,” said Asher Leeks , who studies social evolution in viruses as a postdoc at Yale University. “That can mean you get a thousand-times advantage or more.”

Other cheater viruses have working polymerases, but they lack the genes for making protein shells to enclose their genetic material. They replicate by lying in wait for a functional virus to show up; then they sneak their genome into the shells it produces. Some studies suggest that cheater genomes may be able to get inside shells faster than functional ones.

Asher Leeks’ research into multipartite viruses, which must all be present in a cell to replicate, has shown that what might look like viral cooperation may have evolved from cheating. “In viruses, conflict is dominant,” he said.

Nora Pyenson

Whichever strategy an incomplete virus uses to replicate, the result is the same. These viruses don’t pay the cost of cooperation, even as they exploit the cooperation of other viruses.

“A cheater does poorly on its own, it does better in relation to another virus, and if there are a lot of cheaters, there’s no one to exploit,” Díaz-Muñoz said. “From an evolutionary perspective, that’s all you need to define cheating.”

The last part of that definition poses a puzzle. If cheaters are so amazingly successful — and, indeed, they are — they ought to drive viruses to extinction. As generations of viruses burst out of old cells and infect new ones, cheaters ought to get more and more common. They should keep replicating until the functional viruses disappear. Without any functional viruses left, the cheaters can’t replicate on their own. The entire population of viruses should get sucked into oblivion.

Of course, viruses such as influenza are clearly escaping this swift extinction, and so there must be more to their social lives than a death spiral of cheating. Carolina López , a virologist at Washington University School of Medicine in St. Louis, believes that some viruses that look like they’re cheating may actually play a more benign role in viral societies. Instead of exploiting their fellow viruses, they cooperate, helping them thrive.

“We think of them as part of a community,” López said, “with everybody playing a critical role.”

Burnout Prevention

López’s initiation into the world of sociovirology started in the early 2000s as she studied Sendai virus, a pathogen that infects mice. Researchers had known for years that two strains of Sendai virus behaved differently. One, called SeV-52, was good at escaping the notice of the immune system, allowing the virus to cause a massive infection. But mice infected with another strain, SeV-Cantell, mounted a swift, powerful defense that helped them quickly recover. The difference, López and her colleagues found, was that SeV-Cantell produced a lot of incomplete viruses.

How were incomplete viruses triggering the mice’s immune systems? After a series of experiments, López and her colleagues established that incomplete viruses cause their host cells to activate an alarm system . The cells produce a signal called interferon, which lets neighboring cells know an invader has arrived. Those cells can prepare defenses against the viruses and prevent the infection from spreading like wildfire through the surrounding tissue.

This phenomenon wasn’t a quirk of Sendai virus, nor of the mouse immune system. When López and her colleagues turned their attention to RSV), which sickens over 2 million people in the United States every year and causes thousands of deaths, they found that incomplete viruses produced in natural infections also triggered a strong immune response from infected cells.

This effect puzzled López. If incomplete viruses were cheaters, it didn’t make sense for them to provoke a host to cut an infection short. Once the immune system destroyed the functional viruses, the cheaters would be left without any victims to exploit.

Lopez found that her results made sense if she looked at the viruses in a new way. Instead of focusing on the idea that the incomplete viruses were cheating, López began to think about them and the functional viruses as working together toward the shared goal of long-term survival. She realized that if functional viruses replicated uncontrollably, they might overwhelm and kill their current host before transmission to a new host could take place. That would be self-defeating.

“You need some level of immune response for just keeping your host alive long enough for you to move on,” López said.

That’s where the incomplete viruses come in, she said. They might rein in the infection so that their host has a chance to pass viruses onto the next host. In that way, the functional and incomplete viruses might be cooperating. The functional viruses produce the molecular machinery to make new viruses. Meanwhile, the incomplete viruses slow the functional viruses down to avoid burning out their host, which would end the entire community’s infectious run.

In recent years, López and her colleagues have found that incomplete viruses can curb infections in a number of ways. They can trigger cells to respond as if they were under stress from heat or cold, for example. Part of a cell’s stress response shuts down the protein-building factories to save energy. In the process, it also halts the production of more viruses.

In new research published in February, Christopher Brooke reported that an infected cell can produce hundreds of cryptic proteins that are encoded by incomplete viral genomes and new to science.

Fred Zwicky

Christopher Brooke , a virologist at the University of Illinois Urbana-Champaign, agrees with López that viruses exist in communities. What’s more, he suspects that incomplete viruses have other jobs in cells that he and his fellow scientists have yet to figure out.

Brooke is looking for evidence of these jobs in influenza viruses. A complete influenza virus has eight gene segments, which typically make 12 or more proteins. But when infected cells produce incomplete viruses, they sometimes skip the middle of a gene and stitch the beginning to the end. Despite this drastic change, these altered genes still produce proteins — but new proteins that may have new functions. In a study published in February, Brooke and his colleagues discovered hundreds of these new proteins in flu-infected cells. Because these proteins are new to science, the researchers are trying to figure out what they do. Experiments on one of them suggest that it latches on to polymerase proteins made by intact viruses and blocks them from copying new viral genomes.

For now, however, scientists are largely ignorant of what incomplete viruses accomplish by producing so many strange proteins. “My limited imagination isn’t going to touch a fraction of what’s possible,” Brooke said. “This is raw material for the virus to play with.” But he doubts that the incomplete viruses producing all these strange proteins are cheaters.

“If they really were acting as pure cheaters, I would predict that there would be substantial selective pressure to minimize their production,” Brooke said. “And yet we see them all the time.”

Blurred Lines

Sociovirologists are now trying to figure out just how much cheating and cooperation are going on in the viral world. Scientists who study animal behavior know how hard this can be. An individual may cheat in some situations and cooperate in others. And it’s also possible for a behavior that looks like cooperation to evolve through selfish cheating.

Leeks agrees that incomplete viruses may be productive parts of the viral community. But he thinks it’s always important to consider the possibility that even when they look like they’re cooperating, they are still actually cheating. Evolutionary theory predicts that cheating will often arise in viruses, thanks to their tiny genomes. “In viruses, conflict is dominant,” Leeks said.

In fact, cheating can produce adaptations that look like cooperation. One of Leeks’ favorite examples of this hidden conflict is the nanovirus, which infects plants such as parsley and fava beans. Nanoviruses replicate in an astonishing way. They have eight genes in total, but each viral particle has just one of the eight genes. Only when all nanovirus particles, each carrying one of the eight different genes, are infecting the same plant at once can they replicate. The plant cells make proteins from all eight genes, along with new copies of their genes, which then get packaged into new shells.

You might look at nanoviruses and see a textbook case of cooperation. After all, the viruses have to work together for any of them to have a chance to replicate. The arrangement is reminiscent of a beehive’s division of labor, in which the insects split the work of gathering nectar, tending to larvae and scouting new locations for the hive to move to.

But Leeks and his colleagues have charted how nanoviruses — and other so-called multipartite viruses — may have evolved through cheating.

Imagine that the ancestor of nanoviruses started off with all eight genes packaged in one viral genome. The virus then accidentally produced incomplete cheaters that had only one of the genes. That cheater will thrive, as the fully functional viruses copy its gene. And if a second cheat evolves, carrying a different gene, it will get the same benefit of exploiting the intact viruses.

When Leeks and his colleagues built a mathematical model for this evolutionary scenario, they found that viruses can readily break apart into more cheats. They will keep breaking apart until none of the original viruses that could replicate on their own are left. Nanoviruses may now depend on each other for survival, but only because their ancestors freeloaded off each other. Underneath the façade of cooperation lies viral cheating.

Sorting out the nature of virus societies will take years of research. But solving the mystery may bring a tremendous payoff. Once scientists understand the social behavior of viruses, they may be able to turn viruses against one another.

Turning the Tables

In the 1990s, evolutionary biologists were able to help inform the development of antiviral medicines. When people with HIV took a single antiviral drug, the virus quickly evolved the ability to evade it. But when doctors instead prescribed medicines that combined three antivirals, it became much harder for the viruses to escape them all. The chance that a virus could gain mutations to resist all three drugs was astronomically small. As a result, HIV drug cocktails remain effective even today.

Sociovirologists are now investigating whether evolutionary biology can again help in the fight against viruses. They are looking for vulnerabilities in the way viruses cheat and cooperate, which they can exploit to bring infections to a halt. “We see it as turning the tables on the virus,” Vignuzzi said.

Vignuzzi and his colleagues tested this idea in mice with Zika virus. They engineered incomplete Zika viruses that could ruthlessly exploit functional ones. When they injected these cheaters into infected mice, the population of functional viruses inside the animals quickly collapsed. The French company Meletios Therapeutics has licensed Vignuzzi’s cheater viruses and has been developing them as a potential antiviral drug for a variety of viruses.

At New York University, Ben tenOever and his colleagues are engineering what might be an even more effective cheater from influenza viruses. They’re taking advantage of a quirk of virus biology: Every now and then, the genetic material from two viruses that infect the same cell will end up packaged into one new virus. They wondered if they could create a cheating virus that could readily invade the genome of a functional influenza virus.

Could incomplete viruses be used in medicine? Ben tenOever’s cutting-edge research has produced a nasal spray of cheater virus that equipped mice to survive a fatal strain of influenza. However, because this cheater virus can spread between animals, the chances of regulators approving such an approach for human medicine seems low.

Marcel Indik Photography

The NYU team harvested incomplete viruses from influenza-infected cells. From this batch, they identified a super-cheater that was remarkably good at slipping its genes into fully functional influenza viruses. The resulting hybrid virus was bad at replicating, thanks to the cheater’s disruption.

To see how this super-cheater would perform as an antiviral, tenOever and his colleagues packaged it into a nasal spray. They infected mice with a lethal strain of influenza and then squirted the super-cheater into the animals’ noses. The super-cheater virus was so good at exploiting functional viruses and slowing their replication that the mice managed to recover from the flu within a couple weeks. Without help from the super-cheaters, the animals died.

The researchers got even better results when they sprayed the super-cheaters into the noses of mice before they got infected. The super-cheaters lay in wait inside the mice and attacked the functional flu viruses as soon as they arrived.

Then tenOever and his colleagues moved to ferrets for their experiments. Ferrets experience influenza infections more like humans do: In particular, unlike with mice, influenza viruses will readily spread from a sick ferret to a healthy one in an adjacent cage. The scientists found that the nasal spray quickly drove down the number of flu viruses in infected ferrets, just as they saw in mice. However, the scientists got a surprise when they looked at the viruses that the infected ferrets passed to healthy animals. They transmitted not only normal viruses but also super-cheaters stowed away inside their protein shells.

That finding raises the tantalizing possibility that super-cheaters might be able to stop the spread of a new strain of influenza. If people received sprays of super-cheater viruses, they could rapidly recover from infections. And if they did pass on the new virus strain to others, they would also pass along the super-cheater to stop it. “It’s a pandemic neutralizer,” tenOever said.

That’s true in concept, at least. TenOever would need to run a clinical trial in humans to see if it would work as it does in animals. However, regulators have had qualms about approving such an experiment, he said, as that would not simply be giving people a drug that would work on viruses in their own bodies, but also one that could spread to others, whether they consented to it or not. “That seems to be the kiss of death,” tenOever said, for his hopes of turning the science of social viruses into medicine.

Díaz-Muñoz thinks that it’s right to be cautious about harnessing sociovirology when we still have so much to learn about it. It’s one thing to create medicines from inert molecules. It’s quite another to deploy the social life of viruses. “It is a living, evolving thing,” Díaz-Muñoz said.

Get highlights of the most important news delivered to your email inbox

Comment on this article

Quanta Magazine moderates comments to facilitate an informed, substantive, civil conversation. Abusive, profane, self-promotional, misleading, incoherent or off-topic comments will be rejected. Moderators are staffed during regular business hours (New York time) and can only accept comments written in English.

We use cookies for security purposes, to improve your experience on our site and tailor content for you. Our Privacy Statement explains how we use cookies.

The following form allows you to search all of BT.

Practice management
Managing your business

Case studies – malware attacks

As our lives increasingly move online, cybersecurity is an important consideration for all businesses, including financial advice businesses. For many financial advisers understanding how to protect sensitive client information from cyber attacks is becoming an important part of sound practice management.

A cyber attack is essentially an attempt by hackers to damage or destroy a computer network or system. One of the ways they can do this, is by installing malware (also known as malicious software)on your computer that allows unauthorised access to your files and can allow your activity to be watched without you knowing. Cyber criminals can then steal personal information and login details for secure websites to commit fraudulent activities.

In this article we discuss steps financial advisers can take to protect themselves from cyber attacks and explore different scenarios that demonstrate what a cyber attack can look like and how it can be prevented.

How can financial advisers improve their cyber security?

Turn on auto-updates for your business operating system – such as windows or Apple’s ios, and be sure to keep computer security up to date with anti-virus and anti-spyware, as well as a good firewall.
Back up important data – to an external hard drive, to a USB or a cloud to protect your business from lost data.
Enable multi-factor authentication – start using two or more proofs of identity such as a PIN, passphrase, card or token, or finger print before access is enabled.
Implement premissions on a ‘need to know’ basis – your employees don’t need to access everything. Be selective about what permissions are allowed to which staff.
Conduct regular employee cyber training. Show staff how to ‘recognise, avoid, report, remove and recover’. Your employees can be your defence against cyber crime. Reward staff for their efforts; and
Always be cautious of the below when receiving emails: - requests for money, especially urgent or overdue - Bank account changes - Attachments, especially from unknown or suspicious email addresses - Requests to check or confirm login details

Case studies - malware attacks

Protect yourself and your business

Cyber security assessment tool

The Department of Industry, Science, Energy and Resources has developed a tool to help you identify your business' cyber security strengths and areas where your business can improve. This tool will ask you a series of questions about how you manage your cyber security risks and based on your answers, you will receive a list of recommendations to action. You can download the recommendations as a PDF and access the tool here.

Scenario 1 – Advisory practices attacked by a trojan virus

Scenario 2 - Adviser subject to a malware attack causing account lock

Scenario 3 - opening email attachment causes all pcs in the office to shutdown, scenario 1 - advisory practices attacked by a trojan virus.

In this scenario, a number of advisory practices were subject to a targeted malware attack via a Trojan virus. This virus helped the cyber criminals access several advisers’ PCs and obtain the login details for systems that had been used.

This attempted fraud took place while the practice was closed over the Christmas holidays.

"We locked up the office that afternoon just before Christmas and went home. We were all looking forward to a nice long break, it’d been a busy year. We wouldn’t be back in the office until the New Year."

Transactions were submitted to the platform over the Christmas period using several advisers’ user IDs.

Direct credit (EFT) bank account details were edited to credit the cyber criminals' ‘mule’ Australian bank account. From this account the cyber criminals would be free to transfer the funds overseas.

Luckily for the practice, the fraud was uncovered before any funds were paid out.

"Even though we were on holiday, we all continued to check our transaction updates via the platform each day. We called the platform right away and they were able to stop the fraudulent payments in time."

Preventing this type of fraud

Be diligent about checking platform transaction updates sent by email or displayed online. Specifically look out for withdrawal requests, new accounts opened, asset sell downs and changes to contact details.
When taking annual leave, nominate a colleague to check platform transaction updates on your behalf in your absence.
Call us immediately if you suspect fraud or malware on your system. We’ll suspend your login ID to attempt to prevent further fraudulent transactions.
Bring in a tech specialist immediately to run and update security software and restore your systems back to normal.

A Melbourne advisory practice was the target of a malware attack, having found malware on their system which locked their access to the platform. The malware allowed the cyber criminal to gain access to an adviser’s login details for all systems he had used recently.

The cyber criminals now had access to every website or account that required a login. This included personal banking, platform desktop software, Xplan software and Facebook.

The next time the adviser tried to log in to his platform desktop software, he was locked out.

He rang our account executive team to report his access was locked. He couldn’t login, even though he was using his correct user name and password.

The platform reset his password. The next day when the adviser tried again to login, he was locked out of the system again.

It became obvious that the adviser’s user ID had been compromised. At this point, the user ID was deleted.

Where you have had your platform access locked or you suspect fraud or malware on your system call us immediately as part of your reporting response so we can suspend your login ID to attempt to prevent further fraudulent transactions. Bring in a tech specialist immediately to run and update security software and restore your systems back to normal.

Be on the lookout for requests to check and confirm login details.
Increase the strength of your identifiers and ensure two or more proofs of identity are required before access to company systems is enabled.
Use virus protection software to prevent hackers from accessing your information and to help protect you if you click on a suspicious link or visit a fake website.
Schedule regular training for employees so that they can better detect malicious links or avoid downloading content from untrustworthy sources.

A staff member in an advisory practice opened a file attached to an email received one morning.

It turned out the attachment contained a ‘worm’ that infected not only the staff member’s PC, it also spread to all other PCs in the practice network.

This malware caused all PCs in the office to shut down.

The adviser needed to use the platform software that day to ensure his clients participated in a Corporate Action that was closing the following day.

With help from their Business Development Manager, the office worked through the issue so they were able to log into the platform software to complete this critical work from a home laptop that hadn’t been infected with the virus.

Never open attachments in emails if you don’t know or trust the source.
Ensure your office network is protected with up-to-date anti-virus software.
Call us immediately if you suspect fraud or malware on your system. We’ll suspend your login ID to attempt to prevent any further criminal activity.
Bring in a tech specialist immediately to run and update security software and restore your systems back to normal.

Whitepaper: The critical trends impacting the future of US Wealth Advisory

Technology and advice landscapes, the power of perspective.

Skip to main content
Skip to search
Skip to footer

Products and Services

Cisco Security

Master your goals. innovate. we'll tackle threats..

Get powerful security across all your networks, cloud, endpoints, and email to protect everything that matters, from anywhere.

If it's connected, you're protected

Hacker working at multiple computer screens

Cisco Security “The Hacker”

More connected users and devices creates more complexity. Cisco Security Cloud makes security easier for IT and safer for everyone anywhere security meets the network.

Deliver smarter, stronger security

Protect your organization across a multicloud environment, while simplifying security operations, improving scalability, and driving data-informed outcomes, powered by Cisco Talos.

Unlock better user experiences

Create a seamless experience that frustrates attackers, not users, by granting access from any device, anywhere, and adding more proactive security controls.

Deliver cost-effective defenses

Improve ROI by consolidating vendors, reducing complexity and integrating your security.

Strengthen security resilience

Unified, end-to-end protection maximizes value, minimizes risk, and closes security gaps everywhere to defend against evolving threats. Protect access, apps, and innovation across your network to secure your future.

Cisco Secure Firewall

Better visibility and actionable insights across networks, clouds, endpoints, and email allows users to respond confidently to the most sophisticated threats at machine scale.

Featured security products

Cisco hypershield.

A new groundbreaking security architecture that makes hyperscaler technology accessible to enterprises of all sizes and delivers AI-native security for modern data centers and cloud.

Cisco Secure Access (SSE)

A converged cybersecurity solution, grounded in zero trust, that radically reduces risk and delights both end users and IT staff by safely connecting anything to anywhere.

Detect the most sophisticated threats sooner across all vectors and prioritize by impact for faster responses.

Cisco Multicloud Defense

Gain multidirectional protection across clouds to stop inbound attacks, data exfiltration, and lateral movement.

Secure applications and enable frictionless access with strong MFA and more. Establish user and device trust, gain visibility into devices, and enable secure access to all apps.

Cisco Identity Services Engine (ISE)

Simplify highly secure network access control with software-defined access and automation.

Security Suites delivered by Cisco Security Cloud

Cisco User Protection Suite

Get secure access to any application, on any device, from anywhere. Defend against threats targeting users and deliver seamless access for hybrid work.

Cisco Cloud Protection Suite

Secure your apps and data with a powerful, flexible framework for a hybrid and multicloud world.

Cisco Breach Protection Suite

Secure your business by investigating, prioritizing, and resolving incidents through unified defense and contextual insights from data-backed, AI-powered security.

Customer stories and insights

Global partnerships fight to end child exploitation together.

"Marriott has long championed human rights and human trafficking awareness. Combating CSAM is an important extension of that work. The IWF provided the level of rigor we needed in a URL list, and Cisco's security technology provided the means to easily apply it."

Abbe Horswill, Director, Human Rights and Social Impact

Company: Marriott International

The NFL relies on Cisco

"From securing stadiums, broadcasts, and fans to protecting the largest live sporting event in America, the right tools and the right team are key in making sure things run smoothly, avoiding disruptions to the game, and safeguarding the data and devices that make mission-critical gameday operations possible."

Add value to security solutions

Cisco Security Enterprise Agreement

Instant savings

Experience security software buying flexibility with one easy-to-manage agreement.

Services for security

Let the experts secure your business

Get more from your investments and enable constant vigilance to protect your organization.

Sharpen your security insights

Cisco Cybersecurity Viewpoints

Set your vision to a more secure future with Cisco Cybersecurity Viewpoints. With specialized content from podcasts to industry news, you'll walk away with a deeper understanding of the trends, research, and topics in our rapidly changing world.

Latest News
Entertainment
Money Matters
Writer's Archive
Oped Opinion Newspost Editorial
Magazines Instep Money Matters YOU US TNS

Pakistan reports first monkeypox case of 2024

Health ministry issues advisory and guidelines to stop spread of monkeypox.

Test tubes labelled Monkeypox virus positive are seen in this illustration taken May 23, 2022. — Reuters

Pakistan on Thursday detected the first case of monkeypox of 2024 among a Khyber Pakhtunkhwa (KP) citizen who flew back home from Saudi Arabia — just a day after the National Command and Operation Centre (NCOC) issued an alert to stop the potential spread of diseases via foreign travellers.

Officials from the federal health ministry said that the young man belongs to Dir and is currently residing in Mardan. The infected man was detected with Mpox following his return from the kingdom on August 3, they added.

The health ministry's officials further said that they collected more samples of people who came in contact with the affected man. Subsequently, the ministry also ordered the Border Health Services to commence strict monitoring of all entry points.

Taking further measures to stop its spread, an important session was held at the Health Ministry under the chair of DG Health in which advisory and guidelines were issued regarding Mpox.

The provinces have been directed to appoint focal persons to monitor and report developments regarding the detection of the disease.

It is noteworthy to mention here that the World Health Organisation (WHO) declared the recent spread of monkeypox a global emergency a day ago.

In the past year, Pakistan has confirmed nine cases of Mpox, all among travellers returning from the Middle East and other countries. Tragically, one patient, who was co-infected with HIV and Mpox, later died in Islamabad.

During the special session of the NCOC on Mpox, it was noted that around 15 African countries are currently reporting Mpox cases, with a total of 2,030 confirmed cases. Four countries — Burundi, Kenya, Rwanda, and Uganda — previously unaffected by Mpox, have reported cases since mid-July 2024.

According to NIH officials, the WHO reported that from January 1, 2022, through June 30, 2024, a cumulative total of 99,176 laboratory-confirmed cases of Mpox, including 208 deaths, were reported from 162 countries across all six WHO regions.

In June 2024 alone, 934 new cases were reported, with most cases coming from the African Region (61%), followed by the region of the Americas (19%) and the European region (11%).

The WHO has noted a decline in reporting, which means recent trends in Mpox cases should be interpreted with caution. WHO continues to encourage all countries to ensure that Mpox is a notifiable disease and to report cases, including when no cases have been detected (known as ‘zero-reporting’).

Study reveals 'dad jokes' boost parent-child relationships

Pakistan put on alert amid rise in monkeypox cases globally, Zika virus in India

This revolutionary AI tech can identify unseen heart attack threats

Consistent eight-week vegan diet may help to reduce biological age

New study links daily strawberry consumption to improved heart health

Consumption of cocoa shows no effects on triglycerides, body weight, cholestrol in new research

Medical experts recommend consumption of variety of nutrient-dense foods over multivitamins for longevity

Deceased patients include six male and three female citizens, according to data

No heatstroke-related death occurred at Civil Hospital today, says additional medical superintendent

Apparel & Accessories: New UX Benchmark with 5,500+ Performance Scores and 4,700+ Best Practice Examples self.__wrap_n!=1&&self.__wrap_b(":R95lb396:",1)

At Baymard we’ve just released a new UX benchmark of 10 apparel and accessories sites.

This follows from our large-scale user testing research on apparel and accessories sites, and adds to our existing e-commerce UX benchmark.

10 Apparel & Accessories UX Case Studies

The 10 sites have been manually assessed across 500+ research-based UX parameters relevant to Apparel & Accessories, resulting in 5,500+ weighted UX performance scores and 4,700+ worst and best practice examples from apparel and accessories sites.

You can explore the 10 in-depth Apparel & Accessories UX case studies using the below links:

87 page designs: mobile, desktop, app

98 page designs: desktop, mobile, app

88 page designs: desktop, mobile, app

59 page designs: mobile, desktop

58 page designs: desktop, mobile

45 page designs: desktop, mobile

51 page designs: desktop, mobile

88 page designs: mobile, desktop, app

76 page designs: mobile, desktop, app

Apparel & Accessories UX Performance

Each of the 10 apparel and accessories sites’ 5,500+ UX performance scores, along with the scores for the 17 other apparel and accessories sites in the benchmark, are summarized in the interactive scatterplot below — showing you how they perform collectively and individually:

A publicly available overview of the research and benchmark can be found on our Apparel & Accessories research overview page.

Note that this benchmark includes an initial subset of apparel-specific guidelines. As our Apparel & Accessories research study is ongoing, more apparel-specific guidelines are currently being added to our catalog, and subsequently, our Apparel & Accessories UX benchmark will be updated with this new data by late fall 2024.

Getting access: all 5,500+ UX performance scores, 4,700+ best practice examples, and the UX insights from researching the Apparel & Accessories industry are available immediately and in full within Baymard Premium . (If you already have an account open the Apparel & Accessories study.)

If you want to know how your apparel or accessories desktop site, mobile site, or app performs and compares, then learn more about getting Baymard to conduct a Apparel & Accessories UX Audit of your site or app.

Authored by Anders Nielsen on August 13, 2024

Apparel E-Commerce: Visually Group and Clearly Label Size Filter Options

5 UX Best Practices for Apparel E-Commerce (94% Get One or More Wrong)

83% of Apparel Sites Don’t Provide Sufficient Sizing Information — 10 Best Practices on Sizing

Provide Images of Accessory, Apparel, and Cosmetic Products on a Human Model

Apparel and Accessories Sites: Prioritize Investment in Category Navigation and Curated Paths over Search

See all 93 ‘ Mobile Web ’ , articles

User Experience Research, Delivered Weekly

Join 37,000+ UX professionals and get a new UX article every week.

IMAGES

(PDF) RNA Viruses: A Case Study of the Biology of Emerging Infectious
Microbiology Notes "Viruses"
case study.docx
Viruses case study Case study answers
CASE Study Covid 19
Virus infections

COMMENTS

11 real and famous cases of malware attacks
Check out 11 real cases of malware attacks. 1. CovidLock, ransomware, 2020. Fear in relation to the Coronavirus (COVID-19) has been widely exploited by cybercriminals. CovidLock ransomware is an example. This type of ransomware infects victims via malicious files promising to offer more information about the disease.
Famous computer viruses: A look at cyberthreats
Jaschan's motivations behind these viruses remain unclear but may have been driven by a desire to outpace even the notorious MyDoom virus. 6. Anna Kournikova virus. The Anna Kournikova virus, named after the famous tennis player, exploited her popularity to trick unwitting users.
11 infamous malware attacks: The first and the worst
2. Brain virus (1986) Creeper was designed to leap across computer networks, but for most of the 1970s and '80s that infection vector was in limited simply because most computers operated in ...
Computer Virus Examples (2024): The 9 Worst Attacks Ever
Computer Virus Examples. 1. Morris Worm (1988) In the late 1980s, the digital world witnessed one of its first major security crises with the emergence of the Morris Worm. This incident, a landmark in the history of cyber threats, unfolded rapidly and with startling impact.
RNA viruses: a case study of the biology of emerging infectious
Summary. There are 180 currently recognised species of RNA virus that can infect humans and, on average, 2 new species are added every year. RNA viruses are routinely exchanged between humans and other hosts (particularly other mammals and sometimes birds) over both epidemiological and evolutionary time: 89% of human-infective species are ...
Identifying and prioritizing potential human-infecting viruses from
Our second case study used coronaviruses to explore the ability of our combined genome feature-based model to distinguish different virus species within the same family and different genomes within a single virus species. ... For example, for viruses which are not classified in a scheme which includes subfamilies, the next level downstream ...
A World of Viruses
Viruses do not only infect humans. They are, in fact, ever present in our world, occupying nearly all organisms, and found in virtually every type of habitat, even in the air we breathe and the deepest depths of the ocean. They are also ancient, predating some of the earliest forms of life. Scientists believe they are at least as old as the ...
RNA Viruses: A Case Study of the Biology of Emerging Infectious
RNA viruses are routinely exchanged between humans and other hosts (particularly other mammals and sometimes birds) over both epidemiological and evolutionary time: 89% of human-infective species are considered zoonotic and many of the remainder have zoonotic origins. Some viruses that have crossed the species barrier into humans have persisted ...
(PDF) RNA Viruses: A Case Study of the Biology of ...
On: Thu, 07 Apr 2016 16:39:31. RNA Viruses: A Case Study of. the Biology of Emerging. Infectious Diseases. MARK E. J. WOOLHOUS E, KYLE ADAIR, and LIA M BRIERLEY. Centre for Immunity, Infection ...
Case study-based time-course analysis of symptoms of respiratory
Introduction. Human respiratory syncytial virus (RSV) is a single stranded RNA virus, a member of the family Pneumoviridae and genus Orthopneumovirus, and comprises two subgroups, A and B.Many studies have been published world wide regarding clinical features of RSV infection in pediatric, elderly, and immune-compromised adult populations in detail to demonstrate the clinical significance of ...
Hybrid Epidemics—A Case Study on Computer Worm Conficker
There are many real examples. Mobile phone viruses can spread via Bluetooth communication with any nearby devises (local, ... Moore D, Shannon C, Claffy KC. Code-Red: a case study on the spread and victims of an internet worm. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment. IMW. ACM; 2002. pp. 273-284.
Influenza: A case study: View as single page
1 Background to the case study. Influenza is a myxovirus belonging to the family of viruses known as Orthomyxoviridae. The virus was originally confined to aquatic birds, but it made the transition to humans 6000-9000 years ago, coinciding with the rise of farming, animal husbandry and urbanisation.
Interactive Case Study for Natural Selection in an Outbreak
Description. This interactive video explores how two scientists tracked the 2013 Ebola outbreak in West Africa. Geneticist Pardis Sabeti investigated the evolution of the virus over time, whereas epidemiologist Lina Moses investigated the societal factors that contributed to the outbreak. Their experiences illustrate some of the factors that ...
Respiratory Syncytial Virus Bronchiolitis: A Case Study
Approximately 24 hours after admission (day 5 of illness), JV experiences increases in his respiratory rate (74 breaths per minute), pulse (182 beats per minute), work of breathing, and a fever (39.4 degrees C [102.92 degrees F]). He is given an antipyretic. After 1 hour, his fever persists and his work of breathing, respiratory rate and pulse ...
(PDF) Trojan Horse Malware
Senesh N. Wijayarathne. Sri Lanka Institute of Information T echnology (SLIIT), Malabe, Sri Lanka. [email protected]. ABSTRACT. This study mainly focuses on Trojan Horse V iruses. This ...
Major Cases
Major cyber crime cases over the years. Melissa Virus. A few decades ago, computer viruses were still relatively new notions to most Americans, but the fast-moving and destructive Melissa virus ...
Teaching Viruses and Epidemiology Online
Identify different components and characteristics of viruses and their role in infection. Calculate the size of a virus relative to a human cell. Use information collected in case studies to distill complex, real-world data, and perform basic calculations to make decisions on the spread of an infectious disease.
RNA Viruses: A Case Study of the Biology of Emerging Infectious
RNA Viruses: A Case Study of the Biology of Emerging Infectious Diseases. Authors: Mark E. J. Woolhouse, Kyle Adair, ... For example, a level 4 virus may arrive at that state directly, simply by exposure to the virus from a nonhuman reservoir. This is known as an "off-the-shelf" virus. Alternatively, it may initially enter the population as ...
A 10-month-old with rotavirus gastroenteritis ...
This report describes a 10-month-old infant who presented with generalised tonic clonic seizures following 2 days of vomiting, diarrhoea and a low-grade fever. The patient was moderately dehydrated and the blood investigations were remarkable for hyponatraemia (126 mEq/l), leukocytosis (19.4 × 103/l (46% lymphocytes)), thrombocytosis (637 × 103/l), hypoalbuminaemia (albumin 1.9 g/dl) and ...
Viruses Finally Reveal Their Complex Social Life
For example, if you think of viruses as isolated packages of genes, it would be absurd to imagine them having a social life. ... In a study published in February, ... You might look at nanoviruses and see a textbook case of cooperation. After all, the viruses have to work together for any of them to have a chance to replicate. The arrangement ...
Intro to viruses (article)
A virus is a tiny, infectious particle that can reproduce only by infecting a host cell. Viruses "commandeer" the host cell and use its resources to make more viruses, basically reprogramming it to become a virus factory. Because they can't reproduce by themselves (without a host), viruses are not considered living.Nor do viruses have cells: they're very small, much smaller than the cells of ...
Hepatitis B virus: Case studies
INTRODUCTION. The management of hepatitis B virus (HBV) infection is complex and depends upon multiple factors including clinical variables (eg, the presence or absence of liver inflammation and/or cirrhosis), the patient's immunologic response to infection (eg, hepatitis B e antigen status), virologic factors (eg, HBV DNA level and genotype ...
Evolution of viruses (article)
The short answer to these questions is that viruses evolve.That is, the "gene pool" of a virus population can change over time. In some cases, the viruses in a population—such as all the flu viruses in a geographical region, or all the different HIV particles in a patient's body—may evolve by natural selection.Heritable traits that help a virus reproduce (such as high infectivity for ...
Case studies
Scenario 1 - Advisory practices attacked by a Trojan virus. In this scenario, a number of advisory practices were subject to a targeted malware attack via a Trojan virus. This virus helped the cyber criminals access several advisers' PCs and obtain the login details for systems that had been used. This attempted fraud took place while the ...
Mpox risk to UK low but medics on alert
UK health chiefs say they are making plans in case a new type of mpox virus is detected in the country - but they emphasise the risk is low. ... for example. Common symptoms often include a skin ...
Cisco Security Products and Solutions
Read the full case study. The NFL relies on Cisco "From securing stadiums, broadcasts, and fans to protecting the largest live sporting event in America, the right tools and the right team are key in making sure things run smoothly, avoiding disruptions to the game, and safeguarding the data and devices that make mission-critical gameday ...
Pakistan reports first monkeypox case of 2024
Pakistan on Thursday detected the first case of monkeypox of 2024 among a Khyber Pakhtunkhwa citizen who flew back home from Saudi Arabia — just a day after the National Command and Operation...
Apparel & Accessories: New UX Benchmark with 5,500+ Performance Scores
The 10 sites have been manually assessed across 500+ research-based UX parameters relevant to Apparel & Accessories, resulting in 5,500+ weighted UX performance scores and 4,700+ worst and best practice examples from apparel and accessories sites. You can explore the 10 in-depth Apparel & Accessories UX case studies using the below links:

11 real and famous cases of malware attacks

Table of Contents

Check out 11 real cases of malware attacks

2. LockerGoga, ransomware, 2019

3. Emotet, trojan, 2018

4. WannaCry, ransomware, 2017

5. Petya, ransomware, 2016

6. CryptoLocker, ransomware, 2013

7. Stuxnet, worm, 2010

8. Zeus, trojan, 2007

9. MyDoom, worm, 2004

10. ILOVEYOU, worm, 2000

11. Melissa, virus, 1999

How to fight malware attacks

1. Cybersecurity awareness

2. Technology to fight malware

Our Network

11 infamous malware attacks: The first and the worst

1. Creeper virus (1971)

2. Brain virus (1986)

3. Morris worm (1988)

4. ILOVEYOU worm (2000)

5. Mydoom worm (2004)

6. Zeus trojan (2007)

7. CryptoLocker ransomware (2013)

8. Emotet trojan (2014)

9. Mirai botnet (2016)

10. Petya ransomware/NotPetya wiper (2016/7)

11. Clop ransomware (2019-Present)

Related content

More from this author

Show me more

Thousands of NetSuite stores leak sensitive data due to access control misconfiguration

MIT delivers database containing 700+ risks associated with AI

CSO Executive Sessions: Guardians of the Games - How to keep the Olympics and other major events cyber safe

CSO Executive Session India with Dr Susil Kumar Meher, Head Health IT, AIIMS (New Delhi)

CSO Executive Session India with Charanjit Bhatia, Head of Cybersecurity, COE, Bata Brands

Cybersecurity Insights for Tech Leaders: Addressing Dynamic Threats and AI Risks with Resilience

Computer Virus Examples (2024): The 9 Worst Attacks Ever

Computer Virus Examples

2. ILOVEYOU (2000)

3. Code Red and Code Red II (2001)

4. Mydoom (2004)

5. Stuxnet (2010)

6. CryptoLocker (2013)

7. Bad Rabbit (2017)

8. WannaCry (2017)

9. Shlayer (2018)

Author: Tibor Moes

A World of Viruses

Studying the Invisible

Viral Alliances

American Chestnut

Save citation to file

Add to My Bibliography

RNA Viruses: A Case Study of the Biology of Emerging Infectious Diseases

Similar articles

Related information

LinkOut - more resources

Other Literature Sources

Case study-based time-course analysis of symptoms of respiratory syncytial virus infections followed by acute sinusitis in otherwise-healthy adults

Francois Marie Ngako Kadji

Sho Hashimoto

Introduction

Case presentation

Confirmation of RSV infection

Diagnosis of acute sinusitis

Additional case

Acknowledgements

Hybrid Epidemics—A Case Study on Computer Worm Conficker

Introduction

Epidemic spreading mechanisms

Hybrid epidemics

Previous works on hybrid epidemics

Our recent study on critically hybrid epidemics

Computer Worm Conficker

Our Model of Conficker

Inferring Conficker Parameters From Data

Step One: Inferring node status at a given time

Step Two: Inferring new infections caused by each spreading mechanism