Malware

Malware, or malicious software, is any program or file that is harmful to a computer user. Malware includes computer viruses, worms, Trojan horses and spyware. These malicious programs can perform a variety of functions, including stealing, encrypting or deleting sensitive data, altering or hijacking core computing functions and monitoring users' computer activity without their permission.

History of Malwares:

The term malware was first used by computer scientist and security research Yisrael Radai in 1990. However, malware existed long before this; one of the first known examples of malware was the Creeper virus in 1971, which was created as an experiment by BBN Technologies engineer Robert Thomas. Creeper was designed to infect mainframes on ARPANET. While the program did not alter functions, or steal or delete data, the program moved from one mainframe to another without permission while displaying a teletype message that read, "I'm the creeper: Catch me if you can." Creeper was later altered by computer scientist Ray Tomlinson, who added the ability to self-replicate to the virus and created the first known computer worm.

The concept of malware took root in the technology industry, and examples of viruses and worms began to appear on Apple and IBM personal computers in the early 1980s before becoming popularized following the introduction of the World Wide Web and the commercial internet in the 1990s.

How does Malware works:

Malware authors use a variety of means to spread malware and infect devices and networks. Malware can often spread via the internet through drive-by downloads, which automatically download malicious programs to users' systems without their approval or knowledge. These are initiated when a user visits a malicious website, for example. Phishing attacks are another common type of malware delivery; emails disguised as legitimate messages contain malicious links, or attachments can deliver the malware executable to unsuspecting users.

Types of Malware:

There are different types of malware that contain unique traits and characteristics.

A virus is the most common type of malware, and it's defined as a malicious program that can execute itself and spreads by infecting other programs or files.

A worm is a type of malware that can self-replicate without a host program. It typically spreads without any human interaction or directives from the malware authors.

A Trojan horse is a malicious program that is designed to appear as a legitimate program; once activated following installation, Trojans can execute their malicious functions.

Spyware is a kind of malware that is designed to collect information and data on users and observe their activity without users' knowledge.

Ransomware isdesigned to infect a user's system and encrypt the data. Once infected, the cyber Criminals demand a ransom payment (generally a virtual currency) from the victim in exchange for decrypting the system's data. Recently, ransomwares have made the news in the wake of world wide cyber attack by WannaCry ransomware cryptoworm . Such attacks have witnessed an abnormal rise since then.

More about Computer Virus

A computer virus is a self replicating computer program or a segment of code that inserts copies of itself into other programs, thus infecting them. As a result, the original programs cannot run smoothly, thereby totally disrupting the functioning of the computer.

When an infected program is run on a computer, the hidden virus is activated and attempts to inject itself into additional programs. This process is analogous to the biological process of virus spreading from cell to cell within an organism. Very much like the biological virus, a single computer virus can spread to any number of compatible computer systems if provided with a pathway for infection.

The virus infects a system through sharing of infected diskette or through communication links, like local area networks or programs transmitted from distant systems.

Some of the commonly destructive manifestations of a computer virus include erasure of recorded data, rendering of entire device drives unreadable, interfering with communication and breaking the security cordon of the host computer. The virus may also create other problems such as display of unusual messages or plotting the text backward. Some of the well known viruses are Pakistani Brain, Lehligh, Friday the 13, Christmas and Bloody.

How antivirus software works

Scanning software looks for a virus in one of two ways. If it’s a known virus (one that has already been detected in the wild and has an antidote written for it) the software will look for the virus’s signature — a unique string of bytes that identifies the virus like a fingerprint — and will zap it from your system. Most scanning software will catch not only an initial virus but many of its variants as well, since the signature code usually remains intact.

In the case of new viruses for which no antidote has been created, scanning software employs heuristics that look for unusual virus like activity on your system. If the program sees any funny business, it quarantines the questionable program and broadcasts a warning to you about what the program may be trying to do (such as modify your Windows Registry). If you and the software think the program may be a virus, you can send the quarantined file to the antivirus vendor, where researchers examine it, determine its signature, name and catalog it, and release its antidote. It’s now a known virus.

If the virus never appears again — which often happens when the virus is too poorly written to spread — then vendors categorize the virus as dormant. But viruses are like earthquakes: The initial outbreak is usually followed by aftershocks. Variants (copycat viruses that emerge in droves after the initial outbreak) make up the bulk of known viruses.

Within a few hours of when the Love Letter virus first appeared in the United States, a variant — VeryFunnyJoke — had already appeared, followed by more than 30 others during the next two months. And not all variants stem from mysterious writers. More than a few companies have been infected by variants created by a curious employee who fiddled with a virus he or she received, created a new strain of it, and unleashed it onto the company’s system—sometimes accidentally, sometimes not.

Computer viruses are the “common cold” of modern technology. They can spread swiftly across open networks such as the Internet, causing billions of dollars worth of damage in a short amount of time.

General virus types

• While there are thousands of variations of viruses, most fall into one of the following six general categories, each of which works its magic slightly differently:
• Boot Sector Virus: replaces or implants itself in the boot sector—an area of the hard drive (or any other disk) accessed when you first turn on your computer. This kind of virus can prevent you from being able to boot your hard disk.
• File Virus: infects applications. These executables then spread the virus by infecting associated documents and other applications whenever they’re opened or run.
• Macro Virus: Written using a simplified macro programming language, these viruses affect Microsoft Office applications, such as Word and Excel, and account for about 75 percent of viruses found in the wild. A document infected with a macro virus generally modifies a pre-existing, commonly used command (such as Save) to trigger its payload upon execution of that command.
• Multipartite Virus: infects both files and the boot sector—a double whammy that can reinfect your system dozens of times before it’s caught.
• Polymorphic Virus: changes code whenever it passes to another machine; in theory these viruses should be more difficult for antivirus scanners to detect, but in practice they’re usually not that well written.
• Stealth Virus: hides its presence by making an infected file not appear infected, but doesn’t usually stand up to antivirus software.