When it comes to security, people tend to play fast and loose with the terminology. But it's important to get your malware classifications straight because knowing how various types of malware spread is vital to containing and removing it.
Here's a quick malware bestiary. If nothing else, you'll have your malware terms right when you hang out with geeks.
[ Prove your security smarts in InfoWorld's malware IQ test, part 1 and part 2. | Find out how to block the viruses, worms, and other malware that threaten your business, with hands-on advice from expert contributors in InfoWorld's "Malware Deep Dive" PDF guide. | Keep up with key security issues with InfoWorld's Security Central newsletter. ]
A computer virus is what most of the media and regular end-users call every malware program reported in the news. Fortunately, most malware programs aren't viruses. A computer virus modifies other legitimate host files (or pointers to them) in such a way that when a victim's file is executed, the virus is also executed.
Pure computer viruses are fairly uncommon today, compromising less than 10 percent of all malware. That's a good thing: Viruses are the only type of malware that "infects" other files. That makes them particularly hard to clean up because the malware must be infected from the legitimate program. This has always been nontrivial in the best of times, and today it's almost impossible. The best antivirus programs struggle with doing it correctly and in many (if not most) cases will simply quarantine or delete the infected file instead.
Worms have been around even longer than computer viruses, all the way back to mainframe days. Email brought them into fashion in the late 1990s, and for nearly a decade, computer security pros were besieged by malicious worms that arrived as message attachments. One person would open a wormed email and the entire company would be infected in short order.
The distinctive trait of the worm is that it's self-replicating. Take the notorious Iloveyou worm: When it went off, it hit nearly every email user in the world, overloaded phone systems (with fraudulently sent texts), brought down television networks, and even delayed my daily afternoon paper for half a day. Several other worms, including SQL Slammer and MS Blaster, ensured the worm's place in computer security history.
What makes an effective worm so devastating is its ability to spread without end-user action. Viruses, by contrast, require that an end-user at least kick it off, before it can try to infect other innocent files and users. Worms exploit other files and programs to do the dirty work. For example, the SQL Slammer worm used a (patched) vulnerability in Microsoft SQL to incur buffer overflows on nearly every unpatched SQL server connected to the Internet in about 10 minutes, a speed record that still stands today.
Computer worms have been replaced by Trojan horse malware programs as the weapon of choice for hackers. Trojans masquerade as legitimate programs, but they contain malicious instructions. They've been around forever, even longer than computer viruses, but have taken hold of current computers more than any other type of malware.
A Trojan must be executed by its victim in order to do its work. Trojans usually arrive via email or are pushed on users when they visit infected websites. The most popular Trojan type is the fake antivirus program, which pops up and claims you're infected, then instructs you to run a program to clean your PC. Users swallow the bait and the Trojan takes root.
Trojans are hard to defend against for two reasons: They're easy to write (cyber criminals routinely produce and hawk Trojan-building kits) and spread by tricking end-users -- which a patch, firewall, and other traditional defense cannot stop. Malware writers pump out Trojans by the millions each month. Antimalware vendors try their best to fight Trojans, but there are too many signatures to keep up with.