Most personal computers are now connected to the Internet and to local area networks, facilitating the spread of malicious code. Today's viruses may also take advantage of network services such as the World Wide Web, e-mail, Instant Messaging and file sharing systems to spread, blurring the line between viruses and worms. Furthermore, some sources use an alternative terminology in which a virus is any form of self-replicating malware.

Some malware is programmed to damage the computer by damaging programs, deleting files, or reformatting the hard disk. Other malware programs are not designed to do any damage, but simply replicate themselves and perhaps make their presence known by presenting text, video, or audio messages. Even these less sinister malware programs can create problems for the computer user. They typically take up computer memory used by legitimate programs. As a result, they often cause erratic behavior and can result in system crashes. In addition, much malware is bug-ridden, and these bugs may lead to system crashes and data loss.

Malware, a portmanteau from the words malicious and software, is software designed to infiltrate or damage a computer system without the owner's informed consent. The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.[1]

Many computer users are unfamiliar with the term, and often use "computer virus" for all types of malware, including true viruses.

Software is considered malware based on the perceived intent of the creator rather than any particular features. Malware includes computer viruses, worms, trojan horses, most rootkits, spyware, dishonest adware, crimeware and other malicious and unwanted software. In law, malware is sometimes known as a computer contaminant, for instance in the legal codes of several American states, including California and West Virginia.[2] [3]

Malware is not the same as defective software, that is, software which has a legitimate purpose but contains harmful bugs.

Preliminary results from Symantec published in 2008 suggested that "the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications."[4] According to F-Secure, "As much malware [was] produced in 2007 as in the previous 20 years altogether."[5] Malware's most common pathway from criminals to users is through the Internet, by email and the World Wide Web.[6]

Adware or advertising-supported software is any software package which automatically plays, displays, or downloads advertisements to a computer after the software is installed on it or while the application is being used. Some types of adware are also spyware and can be classified as privacy-invasive software.

Advertising functions are integrated into or bundled with the software, which is often designed to note what Internet sites the user visits and to present advertising pertinent to the types of goods or services featured there. Adware is usually seen by the developer as a way to recover development costs, and in some cases it may allow the software to be provided to the user free of charge or at a reduced price. The income derived from presenting advertisements to the user may allow or motivate the developer to continue to develop, maintain and upgrade the software product. Conversely, the advertisements may be seen by the user as interruptions or annoyances, or as distractions from the task at hand.

Some adware is also shareware, and so the word may be used as term of distinction to differentiate between types of shareware software. What differentiates adware from other shareware is that it is primarily advertising-supported. Users may also be given the option to pay for a "registered" or "licensed" copy to do away with the advertisements.

Adware can also download and install PUPs to computers.

In computer virus terms, metamorphic code is code that can reprogram itself. Often, it does this by translating its own code into a temporary representation, edit the temporary representation of itself, and then write itself back to normal code again.[1] This procedure is done with the virus itself, and thus also the metamorphic engine itself undergoes changes. This is used by some viruses when they are about to infect new files, and the result is that the "children" will never look like their "parents". The computer viruses that use this technique do this in order to avoid the pattern recognition of anti-virus software: the actual algorithm does not change, but everything else might.

The main difference between metamorphic and polymorphic viruses is the fact that a polymorphic virus ciphers its original code to avoid pattern recognition, and a metamorphic virus changes its code to an equivalent one (i.e. the codes do essentially the same thing). This modification can be achieved using techniques like inserting NOP instructions, swapping registers, changing flow control with jumps or reordering independent instructions. Metamorphic code is usually more effective than polymorphic code. This is because the anti-virus, in order to detect it, will need to use some kind of emulation to analyze the code behavior.

Metamorphic code can also mean that a virus is capable of infecting executables from two or more different operating systems (such as Windows and GNU/Linux) or even different computer architectures. Often, the virus does this by carrying several viruses with itself. The beginning of the virus is then coded so that it translates to correct machine-code for all of the platforms that it is supposed to execute in [2]. It is possible in theory for a metamorphic virus to rewrite the temporary representation of itself into another set of instructions, intended for another computer architecture. The API would also have to be changed.

A computer worm is a self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

Many worms have been created which are only designed to spread, and don't attempt to alter the systems they pass through. However, as the Morris worm and Mydoom showed, the network traffic and other unintended effects can often cause major disruption. A "payload" is code designed to do more than spread the worm - it might delete files on a host system (e.g., the ExploreZip worm), encrypt files in a cryptoviral extortion attack, or send documents via e-mail. A very common payload for worms is to install a backdoor in the infected computer to allow the creation of a "zombie" under control of the worm author - Sobig and Mydoom are examples which created zombies. Networks of such machines are often referred to as botnets and are very commonly used by spam senders for sending junk email or to cloak their website's address.[1] Spammers are therefore thought to be a source of funding for the creation of such worms,[2][3] and worm writers have been caught selling lists of IP addresses of infected machines.[4] Others try to blackmail companies with threatened DoS attacks.[5]

Backdoors can be exploited by other malware, including worms. Examples include Doomjuice, which spreads better using the backdoor opened by Mydoom, and at least one instance of malware taking advantage of the rootkit and backdoor installed by the Sony/BMG DRM software utilized by millions of music CDs prior to late 2005.

n the context of computing and software, a Trojan horse, also known as a trojan, is a form of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow unauthorized access to the host machine. Therefore, a computer worm or virus may be a Trojan horse, given that open access up to intruders. The term is derived from the classical story of the Trojan Horse.

A program named "waterfalls.scr" serves as a simple example of a trojan horse. The author claims it is a free waterfall screen saver. When run, it instead unloads hidden programs, commands, scripts, or any number of commands without the user's knowledge or consent. Malicious Trojan Horse programs are used to circumvent protection systems in effect creating a vulnerable system to allow unauthorized access to the user's computer.

Types of Trojan horse payloads

Trojan horse payloads are almost always designed to cause harm, but can also be harmless. They are classified based on how they breach and damage systems. The six main types of Trojan horse payloads are:

• Remote Accessing
• Data Destruction
• Downloader
• Server Trojan(Proxy, FTP , IRC, Email, HTTP/HTTPS, etc.)
• Security software disabler
• Denial-of-service attack (DoS)

Some examples of damage are:

• Erasing or overwriting data on a computer
• Re-installing itself after being disabled
• Encrypting files in a cryptoviral extortion attack
• Corrupting files in a subtle way
• Upload and download of files
• Copying fake links, which lead to false websites, chats, or other account based websites, showing any local account name on the computer falsely engaging in untrue context
• Falsifying records of downloading software, movies, or games from websites never visited by the victim.
• Allowing remote access to the victim's computer. This is called a RAT (remote access trojan)
• Spreading other malware, such as viruses (this type of trojan horse is called a 'dropper' or 'vector')
• Setting up networks of zombie computers in order to launch DDoS attacks or send spam.
• Spying on the user of a computer and covertly reporting data like browsing habits to other people (see the article on spyware)
• Making screenshots
• Logging keystrokes to steal information such as passwords and credit card numbers
• Phishing for bank or other account details, which can be used for criminal activities
• Installing a backdoor on a computer system
• Opening and closing CD-ROM tray
• Playing sounds, videos or displaying images
• Calling using the modem to expensive numbers, thus causing massive phone bills
• Harvesting e-mail addresses and using them for spam
• Restarting the computer whenever the infected program is started
• Deactivating or interfering with anti-virus and firewall programs
• Deactivating or interfering with other competing forms of malware
• Randomly shutting off the computer
• Installing a virus
• Slowing down your computer
• Displaying pornographic sites