Last updated


Malware (a portmanteau for malicious software) is any software intentionally designed to cause damage to a computer, server, client, or computer network. [1] [2] By contrast, software that causes unintentional harm due to some deficiency is typically described as a software bug. [3] A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper and scareware.


Programs are also considered malware if they secretly act against the interests of the computer user. For example, at one point Sony music Compact discs silently installed a rootkit on purchasers' computers with the intention of preventing illicit copying, but which also reported on users' listening habits, and unintentionally created extra security vulnerabilities. [4]

A range of antivirus software, firewalls and other strategies are used to help protect against the introduction of malware, to help detect it if it is already present, and to recover from malware-associated malicious activity and attacks. [5]


Malware statics 2011-03-16-en.svg

Many early infectious programs, including the first Internet Worm, were written as experiments or pranks. [6] Today, malware is used by both black hat hackers and governments, to steal personal, financial, or business information. [7] [8]

Malware is sometimes used broadly against government or corporate websites to gather guarded information, [9] or to disrupt their operation in general. However, malware can be used against individuals to gain information such as personal identification numbers or details, bank or credit card numbers, and passwords.

Since the rise of widespread broadband Internet access, malicious software has more frequently been designed for profit. Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for illicit purposes. [10] Infected "zombie computers" can be used to send email spam, to host contraband data such as child pornography, [11] or to engage in distributed denial-of-service attacks as a form of extortion. [12]


Ransomware affects an infected computer system in some way, and demands payment to bring it back to its normal state. There are two variations of ransomware, being crypto ransomware and locker ransomware. [14] With the locker ransomware just locking down a computer system without encrypting its contents. Whereas the traditional ransomware is one that locks down a system and encrypts its contents. For example, programs such as CryptoLocker encrypt files securely, and only decrypt them on payment of a substantial sum of money. [15]



Infectious malware

The best-known types of malware, viruses and worms, are known for the manner in which they spread, rather than any specific types of behavior. A computer virus is software that embeds itself in some other executable software (including the operating system itself) on the target system without the user's knowledge and consent and when it is run, the virus is spread to other executables. On the other hand, a worm is a stand-alone malware software that actively transmits itself over a network to infect other computers and can copy itself without infecting files. These definitions lead to the observation that a virus requires the user to run an infected software or operating system for the virus to spread, whereas a worm spreads itself. [19]


These categories are not mutually exclusive, so malware may use multiple techniques. [20] This section only applies to malware designed to operate undetected, not sabotage and ransomware.


A computer virus is software usually hidden within another seemingly innocuous program that can produce copies of itself and insert them into other programs or files, and that usually performs a harmful action (such as destroying data). [21] An example of this is a PE infection, a technique, usually used to spread malware, that inserts extra data or executable code into PE files. [22]

Screen-locking ransomware

'Lock-screens', or screen lockers is a type of “cyber police” ransomware that blocks screens on Windows or Android devices with a false accusation in harvesting illegal content, trying to scare the victims into paying up a fee. [23] Jisut and SLocker impact Android devices more than other lock-screens, with Jisut making up nearly 60 percent of all Android ransomware detections. [24]

Encryption-based ransomware


Trojan horses




In spring 2017 Mac users were hit by the new version of Proton Remote Access Trojan (RAT) [33] trained to extract password data from various sources, such as browser auto-fill data, the Mac-OS keychain, and password vaults. [34]









Since the beginning of 2015, a sizable portion of malware has been utilizing a combination of many techniques designed to avoid detection and analysis. [41] From the more common, to the least common:

  1. evasion of analysis and detection by fingerprinting the environment when executed. [42]
  4. obfuscating internal data so that automated tools do not detect the malware. [44]





Security defects in software

Malware exploits security defects (security bugs or vulnerabilities) in the design of the operating system, in applications (such as browsers, e.g. older versions of Microsoft Internet Explorer supported by Windows XP [49] ), or in vulnerable versions of browser plugins such as Adobe Flash Player, Adobe Acrobat or Reader, or Java SE. [50] [51] Sometimes even installing new versions of such plugins does not automatically uninstall old versions. Security advisories from plug-in providers announce security-related updates. [52] Common vulnerabilities are assigned CVE IDs and listed in the US National Vulnerability Database. Secunia PSI [53] is an example of software, free for personal use, that will check a PC for vulnerable out-of-date software, and attempt to update it.


Anti-malware is a continuously growing threat to malware detection. [54] According to Symantec’s 2018 Internet Security Threat Report (ISTR), malware variants number has got up to 669,947,865 in 2017, which is the double of malware variants in 2016. [54]

Insecure design or user error

Early PCs had to be booted from floppy disks. When built-in hard drives became common, the operating system was normally started from them, but it was possible to boot from another boot device if available, such as a floppy disk, CD-ROM, DVD-ROM, USB flash drive or network. It was common to configure the computer to boot from one of these devices when available. Normally none would be available; the user would intentionally insert, say, a CD into the optical drive to boot the computer in some special way, for example, to install an operating system. Even without booting, computers can be configured to execute software on some media as soon as they become available, e.g. to autorun a CD or USB device when inserted.

Malware distributors would trick the user into booting or running from an infected device or medium. For example, a virus could make an infected computer add autorunnable code to any USB stick plugged into it. Anyone who then attached the stick to another computer set to autorun from USB would in turn become infected, and also pass on the infection in the same way. [55] More generally, any device that plugs into a USB port - even lights, fans, speakers, toys, or peripherals such as a digital microscope - can be used to spread malware. Devices can be infected during manufacturing or supply if quality control is inadequate. [55]

This form of infection can largely be avoided by setting up computers by default to boot from the internal hard drive, if available, and not to autorun from devices. [55] Intentional booting from another device is always possible by pressing certain keys during boot.


Over-privileged users and over-privileged code

In computing, privilege refers to how much a user or program is allowed to modify a system. In poorly designed computer systems, both users and programs can be assigned more privileges than they should have, and malware can take advantage of this. The two ways that malware does this is through overprivileged users and overprivileged code.[ citation needed ]



Use of the same operating system

Anti-malware strategies

As malware attacks become more frequent, attention has begun to shift from viruses and spyware protection, to malware protection, and programs that have been specifically developed to combat malware. (Other preventive and recovery measures, such as backup and recovery methods, are mentioned in the computer virus article). Reboot to restore software is also useful for mitigating malware by rolling back malicious alterations.

Anti-virus and anti-malware software

A specific component of anti-virus and anti-malware software, commonly referred to as an on-access or real-time scanner, hooks deep into the operating system's core or kernel and functions in a manner similar to how certain malware itself would attempt to operate, though with the user's informed permission for protecting the system. Any time the operating system accesses a file, the on-access scanner checks if the file is a 'legitimate' file or not. If the file is identified as malware by the scanner, the access operation will be stopped, the file will be dealt with by the scanner in a pre-defined way (how the anti-virus program was configured during/post installation), and the user will be notified.[ citation needed ] This may have a considerable performance impact on the operating system, though the degree of impact is dependent on how well the scanner was programmed. The goal is to stop any operations the malware may attempt on the system before they occur, including activities which might exploit bugs or trigger unexpected operating system behavior.

Anti-malware programs can combat malware in two ways:



Examples of Microsoft Windows antivirus and anti-malware software include the optional Microsoft Security Essentials [62] (for Windows XP, Vista, and Windows 7) for real-time protection, the Windows Malicious Software Removal Tool [63] (now included with Windows (Security) Updates on "Patch Tuesday", the second Tuesday of each month), and Windows Defender (an optional download in the case of Windows XP, incorporating MSE functionality in the case of Windows 8 and later). [64] Additionally, several capable antivirus software programs are available for free download from the Internet (usually restricted to non-commercial use). [65] Tests found some free programs to be competitive with commercial ones. [65] [66] [67] Microsoft's System File Checker can be used to check for and repair corrupted system files.

Some viruses disable System Restore and other important Windows tools such as Task Manager and Command Prompt. Many such viruses can be removed by rebooting the computer, entering Windows safe mode with networking, [68] and then using system tools or Microsoft Safety Scanner. [69]

Hardware implants can be of any type, so there can be no general way to detect them.

Website security scans

As malware also harms the compromised websites (by breaking reputation, blacklisting in search engines, etc.), some websites offer vulnerability scanning. [70] Such scans check the website, detect malware, may note outdated software, and may report known security issues.

"Air gap" isolation or "parallel network"

As a last resort, computers can be protected from malware, and infected computers can be prevented from disseminating trusted information, by imposing an "air gap" (i.e. completely disconnecting them from all other networks). However, malware can still cross the air gap in some situations. Stuxnet is an example of malware that is introduced to the target environment via a USB drive.

"AirHopper", [71] "BitWhisper", [72] "GSMem" [73] and "Fansmitter" [74] are four techniques introduced by researchers that can leak data from air-gapped computers using electromagnetic, thermal and acoustic emissions.


Grayware (sometimes spelled as greyware) is a term applied to unwanted applications or files that are not classified as malware, but can worsen the performance of computers and may cause security risks. [75]


Another term, potentially unwanted program (PUP) or potentially unwanted application (PUA), [77] refers to applications that would be considered unwanted despite often having been downloaded by the user, possibly after failing to read a download agreement. PUPs include spyware, adware, and fraudulent dialers. Many security products classify unauthorised key generators as grayware, although they frequently carry true malware in addition to their ostensible purpose.

Software maker Malwarebytes lists several criteria for classifying a program as a PUP. [78] Some types of adware (using stolen certificates) turn off anti-malware and virus protection; technical remedies are available. [45]



The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Internet Worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started itself running as a separate process. [81] This same behavior is used by today's worms as well. [82] [83]


Academic research

The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata. [85] John von Neumann showed that in theory a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses and confirmed Neumann's postulate and investigated other properties of malware such as detectability and self-obfuscation using rudimentary encryption. His 1987 doctoral dissertation was on the subject of computer viruses. [86] The combination of cryptographic technology as part of the payload of the virus, exploiting it for attack purposes was initialized and investigated from the mid 1990s, and includes initial ransomware and evasion ideas. [87]

See also

Related Research Articles

Adware, often called advertising-supported software by its developers, is software that generates revenue for its developer by automatically generating online advertisements in the user interface of the software or on a screen presented to the user during the installation process. The software may generate two types of revenue: one is for the display of the advertisement and another on a "pay-per-click" basis, if the user clicks on the advertisement. Some advertisements also act as spyware, collecting and reporting data about the user, to be sold or used for targeted advertising or user profiling. The software may implement advertisements in a variety of ways, including a static box display, a banner display, full screen, a video, pop-up ad or in some other form. All forms of advertising carry health, ethical, privacy and security risks for users.

Computer worm Standalone malware computer program that replicates itself in order to spread to other computers

A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. It often uses a computer network to spread itself, relying on security failures on the target computer to access it. It will use this machine as a host to scan and infect other computers. When these new worm-invaded computers are controlled, the worm will continue to scan and infect other computers using these computers as hosts, and this behaviour will continue. Computer worms use recursive methods to copy themselves without host programs and distribute themselves based on the law of exponential growth, thus controlling and infecting more and more computers in a short time. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

In computing terminology, a macro virus is a virus that is written in a macro language: a programming language which is embedded inside a software application. Some applications, such as Microsoft Office, Excel, PowerPoint allow macro programs to be embedded in documents such that the macros are run automatically when the document is opened, and this provides a distinct mechanism by which malicious computer instructions can spread. This is one reason it can be dangerous to open unexpected attachments in e-mails. Many antivirus programs can detect macro viruses; however, the macro virus' behavior can still be difficult to detect.

Spyware Malware that collects and transmits user information without their knowledge

Spyware is software with malicious behavior that aims to gather information about a person or organization and send it to another entity in a way that harms the user. For example, by violating their privacy or endangering their device's security. This behavior may be present in malware as well as in legitimate software. Websites may engage in spyware behaviors like web tracking. Hardware devices may also be affected. Spyware is frequently associated with advertising and involves many of the same issues. Because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.

Trojan horse (computing) Type of malware

In computing, a Trojan horse is any malware which misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.

Timeline of computer viruses and worms computer malware timeline

This timeline of computer viruses and worms presents a chronological timeline of noteworthy computer viruses, computer worms, Trojan horses, similar malware, related research and events.

Antivirus software Computer software to defend against malicious computer viruses


Linux malware includes viruses, Trojans, worms and other types of malware that affect the Linux operating system. Linux, Unix and other Unix-like computer operating systems are generally regarded as very well-protected against, but not immune to, computer viruses.

The compilation of a unified list of computer viruses is made difficult because of naming. To aid the fight against computer viruses and other types of malicious software, many security advisory organizations and developers of anti-virus software compile and publish lists of viruses. When a new virus appears, the rush begins to identify and understand it as well as develop appropriate counter-measures to stop its propagation. Along the way, a name is attached to the virus. As the developers of anti-virus software compete partly based on how quickly they react to the new threat, they usually study and name the viruses independently. By the time the virus is identified, many names denote the same virus.

Scareware is a form of malware which uses social engineering to cause shock, anxiety, or the perception of a threat in order to manipulate users into buying unwanted software. Scareware is part of a class of malicious software that includes rogue security software, ransomware and other scam software that tricks users into believing their computer is infected with a virus, then suggests that they download and pay for reakantivirus software to remove it. Usually the virus isn't real and the software is non-functional or malware itself. According to the Anti-Phishing Working Group, the number of scareware packages in circulation rose from 2,850 to 9,287 in the second half of 2008. In the first half of 2009, the APWG identified a 585% increase in scareware programs.

Norton AntiVirus Anti-virus software


Microsoft Defender

Microsoft Defender Antivirus is an anti-malware component of Microsoft Windows. It was first released as a downloadable free anti-spyware program for Windows XP, and was later shipped with Windows Vista and Windows 7. It has evolved into a full antivirus program, replacing Microsoft Security Essentials, as part of Windows 8 and later versions.

Mobile malware is malicious software that targets mobile phones or wireless-enabled Personal digital assistants (PDA), by causing the collapse of the system and loss or leakage of confidential information. As wireless phones and PDA networks have become more and more common and have grown in complexity, it has become increasingly difficult to ensure their safety and security against electronic attacks in the form of viruses or other malware.

WinFixer Rogue security software

WinFixer was a family of scareware rogue security programs developed by Winsoftware which claimed to repair computer system problems on Microsoft Windows computers if a user purchased the full version of the software. The software was mainly installed without the user's consent. McAfee claimed that "the primary function of the free version appears to be to alarm the user into paying for registration, at least partially based on false or erroneous detections." The program prompted the user to purchase a paid copy of the program.


Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims to convince them to pay for a fake malware removal tool that actually installs malware on their computer. It is a form of scareware that manipulates users through fear, and a form of ransomware. Rogue security software has been a serious security threat in desktop computing since 2008. Two of the earliest examples to gain infamy were BraveSentry and SpySheriff.

Kaspersky Anti-Virus

Kaspersky Anti-Virus is a proprietary antivirus program developed by Kaspersky Lab. It is designed to protect users from malware and is primarily designed for computers running Microsoft Windows and macOS, although a version for Linux is available for business consumers.


HitmanPro is a portable antimalware program, which aims to detect and remove malicious files and registry entries related to rootkits, trojans, viruses, worms, spyware, adware, rogue antivirus programs, ransomware, and other malware from infected computers.

Computer virus Computer program that modifies other programs to replicate itself and spread




  1. "Defining Malware: FAQ". Retrieved 10 September 2009.
  5. "Protect Your Computer from Malware". 11 October 2012. Retrieved 26 August 2013.
  7. "Malware". FEDERAL TRADE COMMISSION- CONSUMER INFORMATION. Retrieved 27 March 2014.
  10. "Malware Revolution: A Change in Target". March 2007.
  11. "Child Porn: Malware's Ultimate Evil". November 2009.
  12. PC World – Zombie PCs: Silent, Growing Threat.
  13. "Peer To Peer Information". NORTH CAROLINA STATE UNIVERSITY. Retrieved 25 March 2011.
  17. "Shamoon is latest malware to target energy sector" . Retrieved 18 February 2015.
  19. "computer virus – Encyclopædia Britannica". Retrieved 28 April 2013.
  20. "All about Malware and Information Privacy - TechAcute". 31 August 2014.
  23. "Rise of Android Ransomware, research" (PDF). ESET.
  24. "State of Malware, research" (PDF). Malwarebytes.
  27. "Trojan Horse Definition" . Retrieved 5 April 2012.
  28. "Trojan horse". Webopedia. Retrieved 5 April 2012.
  29. "What is Trojan horse? – Definition from" . Retrieved 5 April 2012.
  33. "Proton Mac Trojan Has Apple Code Signing Signatures Sold to Customers for $50k". AppleInsider.
  34. "Non-Windows Malware". Betanews. 24 August 2017.
  36. "". Retrieved 15 April 2010.
  37. Vincentas (11 July 2013). "Malware in". Spyware Loop. Retrieved 28 July 2013.
  41. "Evasive malware goes mainstream - Help Net Security". 22 April 2015.
  43. The Four Most Common Evasive Techniques Used by Malware. 27 April 2015.
  45. 1 2 Casey, Henry T. (25 November 2015). "Latest adware disables antivirus software". Tom's Guide. . Retrieved 25 November 2015.
  47. "Penn State WebAccess Secure Login". doi: 10.1145/3365001 . Retrieved 29 February 2020.
  48. "Malware Dynamic Analysis Evasion Techniques: A Survey". ResearchGate. Retrieved 29 February 2020.
  49. "Global Web Browser... Security Trends" (PDF). Kaspersky lab. November 2012.
  52. "Adobe Security bulletins and advisories". Retrieved 19 January 2013.
  55. 1 2 3 "USB devices spreading viruses". CNET. CBS Interactive. Retrieved 18 February 2015.
  58. "Malware, viruses, worms, Trojan horses and spyware". Retrieved 14 November 2020.
  60. "How Antivirus Software Works?" . Retrieved 16 October 2015.
  61. Souppaya, Murugiah; Scarfone, Karen (July 2013). "Guide to Malware Incident Prevention and Handling for Desktops and Laptops". National Institute of Standards and Technology. doi:10.6028/nist.sp.800-83r1.Cite journal requires |journal= (help)
  62. "Microsoft Security Essentials". Microsoft. Retrieved 21 June 2012.
  64. "Windows Defender". Microsoft. Archived from the original on 22 June 2012. Retrieved 21 June 2012.
  65. 1 2 Rubenking, Neil J. (8 January 2014). "The Best Free Antivirus for 2014".
  67. "Quickly identify malware running on your PC".
  68. "How do I remove a computer virus?". Microsoft. Retrieved 26 August 2013.
  69. "Microsoft Safety Scanner". Microsoft. Retrieved 26 August 2013.
  70. "Example Safe Browsing Diagnostic page" . Retrieved 19 January 2013.
  76. "Threat Encyclopedia – Generic Grayware". Trend Micro. Retrieved 27 November 2012.
  78. "PUP Criteria". Retrieved 13 February 2015.
  83. "Malware: Types, Protection, Prevention, Detection & Removal - Ultimate Guide". EasyTechGuides.
  84. "Beware of Word Document Viruses". Retrieved 25 September 2017.