Malware is a catchall term for software that runs or resides on a computer without the consent of the user. It can be classified broadly according to its purpose, method of execution, and method of propagation. This section will cover the following topics:
- Adware
- Viruses
- Worms
- Spyware
- Trojans
- Rootkits
- Backdoors
- Logic bombs
- Botnets
Adware
Adware is malware that seeks to hijack the attention of the user, usually causing additional advertisements to appear, or replacing advertisements that might normally appear with a new one of the adware’s choosing. This is the closest to a gray area when it comes to malware. Adware can be installed without user consent, but it is often installed as part of a software package, as a condition of “free” software. Whether installed with the consent of the user or not, the adware itself can cause an increase in distracting advertisements and pop-ups.
Viruses
A virus is a form of malware with which people are most familiar. Because of the ubiquity of the term virus, many laymen use virus and malware interchangeably. A virus is not, however, simply any bad program. Most spyware and adware, for instance, are not properly designated as viruses. Viruses are a specific type of malware that modifies existing files in order to function. Another core attribute of a virus is its ability to self-replicate. Any self-replicating program that attaches itself to existing files and runs without user consent may be properly considered a virus.
Worms
Worms share an important attribute of viruses in that they are self-replicating and run without user consent. Unlike viruses, worms do not generally attach themselves to existing files, and they generally spread without requiring any user interaction. It is not uncommon for a worm to spread to every computer with a specific vulnerability on a network once a single computer is exposed and infected.
A helpful method for distinguishing between worms and viruses is to remember that worms are notable primarily for their ability to spread over networks and viruses are notable primarily for their ability to change files on a computer.
Spyware
Another common type of malware gathers information from a targeted system and reports the information it gathers back to the malware controller. This type of malware is known as spyware. Common uses for spyware include gathering data from an infected computer’s disk drives, monitoring user input, such as usernames and passwords, or monitoring network traffic, such as unencrypted HTTPS communications. Spyware can expose private computer use to all types of unauthorized monitoring.
Trojans
A Trojan is any malware that spreads by disguising itself as legitimate software. This makes these types of programs very similar to the fabled Trojan horse. An example of a Trojan would be a piece of malware that claims your PC may be infected with malware and offers to detect and clean it. The malware would not actually detect and remove real malware from the PC, but instead convince the user to install the Trojan malware instead.
It is not unusual for desirable pirated software to be modified from the original versions to include malware payloads. Any malware that disguises itself as legitimate software is properly classified as a Trojan.
Rootkits
A rootkit is a type of malware that can be extremely difficult to detect. This is because, unlike most malware, which runs as programs on top of the current operating system, rootkits function by inserting themselves between the operating system and the user environment, or by modifying the operation of the operating system itself.
Because rootkits function at such a low level, they are often able to hide their existence effectively from even a determined investigator, as they can simply change the information that is presented to an investigator. Rootkits are the most difficult type of malware to detect and remove. Ways of identifying rootkits are false positives from the anti-virus program as the rootkit surfaces and attempts to interact with the computer, and hooked processes (processes are executable code run in a computer’s RAM).
Backdoors
A backdoor is any piece of malware intended to increase the ease of access of an attacker to a system. Though the backdoor itself may not contain malicious code, it is often the precursor to a more serious attack. A backdoor will often function by opening holes in any anti-malware software installed on the targeted computer and alerting an outside host of the availability of a system for unauthorized access.
Logic Bombs
A logic bomb is malware with a destructive payload that is not activated immediately upon infection. The criteria for activation could be anything from a specific amount of time since infection or a certain number of “hops” of systems infected to a specific command from a control server. Logic bombs are dangerous because the prevention of damage is dependent on detecting them prior to their activation.
Logic bombs are often created for a specific purpose. As they are often single-use attacks, they are rarely detected by anti-malware software. An example of a logic bomb would be a simple script set to run in the event a user authorization fails. A disgruntled administrator might set a script to run in the event his primary user account is ever disabled, which would remove or modify information on the network.
Botnets
Another type of malware does not target the information on the computer, or the attention of the user, but, rather, the bandwidth and computing resources of the computer itself. This type of malware, which aims to control many individual PCs, is said to create a botnet. A computer in a botnet is often used to participate in DDoS attacks, as a mail relay to send spam e-mail, or for whatever other use the attacker wants to harness computer power for.
