Learning Objectives

By the end of this chapter, you will be able to:

  • Define malware.
  • Differentiate between a virus, a worm, and a Trojan horse.
  • Describe the threat of ransomware and other malware types.
  • Recognize how malware spreads and the symptoms of infection.
  • Identify the primary methods of protection against malware.

What is Malware?

Malware, short for malicious software, is any software intentionally designed to cause damage to a computer, server, client, or computer network. Malware is a general term that includes many different types of threats.

Types of Malware

  • Virus: A piece of code that attaches itself to a legitimate program. When the program is run, the virus runs too, and it can replicate itself to infect other programs.

  • Worm: A standalone program that can replicate itself and spread to other computers over a network, without needing to attach to another program.

  • Trojan Horse: A program that disguises itself as something useful or harmless, but contains malicious code. It tricks the user into installing it.

  • Ransomware: A type of malware that encrypts a user’s files and demands a ransom payment in exchange for the decryption key.

  • Spyware: Malware that secretly gathers information about a person or organization and sends it to another party.

flowchart TB
  M[Malware]
  M --> V[Virus: attaches to host program]
  M --> W[Worm: spreads over network]
  M --> T[Trojan: disguised as useful software]
  M --> R[Ransomware: encrypts files for ransom]
  M --> S[Spyware: secretly collects data]

Figure 1: Malware Types Taxonomy

  • Adware: Shows unwanted advertisements and pop-ups, often bundled with free software.

  • Keylogger: Records every key you press to steal passwords and card numbers.

  • Botnet: A network of infected computers (“bots”) controlled remotely by an attacker, often used to send spam or flood websites.

Virus vs Worm vs Trojan

Aspect Virus Worm Trojan horse
Needs a host file Yes No (standalone) No (pretends to be a useful program)
Self-replicates Yes, when the host runs Yes, automatically over networks No
How it spreads Infected files, USB drives Network weaknesses, email User downloads and installs it
Main effect Corrupts or deletes files Consumes bandwidth, spreads fast Opens a backdoor, steals data

How Malware Spreads

  • Opening infected email attachments or clicking malicious links.
  • Downloading cracked software, games, or movies from untrusted sites.
  • Plugging in infected USB drives.
  • Installing apps from outside official app stores (unknown APK files on Android).
  • Exploiting unpatched operating systems and software.
  • Fake “your computer is infected” pop-ups that trick users into installing scareware.

Symptoms of infection

  • The computer becomes unusually slow or crashes often.
  • Unexpected pop-ups, new toolbars, or changed browser homepage.
  • Files are missing, renamed, or encrypted with a ransom note.
  • Antivirus is disabled without your action.
  • Friends receive strange messages or emails from your account.

Protection Against Malware

The best way to protect against malware is to use antivirus software. Antivirus software can scan your computer for known malware, remove it, and help to prevent new infections. It is also important to keep your operating system and all of your software up to date with the latest security patches.

Other good practices:

  1. Back up important files regularly, with one copy offline or in the cloud — the best defense against ransomware.
  2. Do not open attachments or links from unknown senders.
  3. Avoid pirated software; download only from official sources and app stores.
  4. Scan USB drives before opening files.
  5. Use a firewall and standard (non-administrator) user accounts for daily work.
  6. Train staff to recognize phishing.

Case: WannaCry Ransomware (2017)

The WannaCry ransomware attack in May 2017 spread as a worm through a weakness in older, unpatched versions of Windows. It infected hundreds of thousands of computers in about 150 countries, encrypting files and demanding payment in Bitcoin. The UK’s National Health Service had to cancel appointments. Microsoft had released a patch two months earlier, so organizations that had updated their systems were protected — a clear lesson on the value of patching.

Business Scenario

A small accounting firm in Butwal finds that all its client files are encrypted with a ransom note on the screen, after a staff member opened an “invoice” attachment. Because the firm kept a nightly backup on an external drive stored offline, it wipes the computers, restores the files, and loses only one day of work instead of paying the attackers. It then installs updated antivirus on all PCs and trains staff about suspicious emails.

Summary

Malware is a broad category of malicious software that includes viruses, worms, Trojan horses, ransomware, spyware, adware, keyloggers, and botnets. Viruses attach to programs, while worms can spread on their own. Trojans disguise themselves as legitimate software. Ransomware holds your data hostage. Malware spreads through attachments, pirated software, USB drives, and unpatched systems. The most important defenses are up-to-date antivirus software, regular updates, backups, and caution about what you download and install.

Key Takeaways

  • Malware is software designed to cause harm.
  • A virus needs a host program; a worm is standalone.
  • A Trojan horse tricks you into installing it.
  • Ransomware encrypts your files and demands payment.
  • Antivirus software is the primary defense against malware.
  • Regular backups and software updates are essential against ransomware.

Discussion Questions

  1. What is the main difference between a virus and a worm?
  2. Why is ransomware such a dangerous and effective type of malware?
  3. Besides using antivirus software, what are some other good habits to practice to avoid malware infections?

Exam-Style Questions

Short answer

  1. Define malware. Name any four types.
  2. Differentiate between a virus and a worm.
  3. What is ransomware? How can a business protect itself from it?

Long answer

  1. Explain the different types of malware with examples.
  2. How does malware spread? Suggest measures an organization should take to protect itself against malware.