The Virus and Malware Threat

Viruses and other forms of malicious software can infect an endpoint without the operator knowing. It is vital that they are removed as soon as possible.

A virus is a program that can copy itself and infect an endpoint, with potentially harmful results. A virus is a specific type of malware (malicious software). There are many other types of malware, however, including Trojans, worms, rootkits, and spyware. For a more detailed explanation of the main types of malware, see Malware Categories.

The term virus is often used to describe other types of malware that are not true viruses. Likewise, the term antivirus is often used to describe systems that protect endpoints from malware in general, and not just from viruses. AntiVirus provides broad protection against all types of malware.

One of the main characteristics of malware is that it is designed to infiltrate systems without the operator's consent. Once it infiltrates, malware remains on the endpoint – an unwanted and potentially dangerous guest.

The effect that malware has on an endpoint or network depends very much on the intent of the person or group that created it. Some types of malware can be hugely destructive, deleting files and spreading to other endpoints on the network. Other types can give unauthorized users access to the endpoint, enabling them to steal valuable information. Even when the effects are not so damaging, malware consumes system resources and reduces productivity. No matter how little damage a virus or malware seems to cause, it should be removed as soon as possible. There is always the possibility of it infecting another endpoint, or having a more damaging effect over time.

Malware Categories

Read about the main types of malicious software (malware) that can affect your endpoints and networks.

Malware Type	Description
Adware	Adware is a program that displays or downloads an advertisement, which would classify it simply as intrusive rather than destructive. Some adware programs also function as spyware as well.
Backdoor	A backdoor is a program that enables bypassing the normal authentication procedures to gain remote access to an endpoint. Some backdoors are implemented in a way which requires the endpoint user's intervention, like a Trojan. Other types of backdoor can be installed without any such intervention.
Backdoor Trojan	A backdoor Trojan combines aspects of two types of malware. The backdoor element does not damage the endpoint, but it sets it up for remote control and unauthorized use (which is, of course, very dangerous). The Trojan element indicates that it is installed unwittingly by the user. Some legitimate remote administration programs can be configured to act as backdoor Trojans. These programs should be identified as security risks.
Blended threat	A blended threat combines the characteristics of different types of malware, such as worms, viruses, and Trojans. It can also take advantage of specific server vulnerabilities. Blended threats can be quite dangerous because they use multiple techniques to spread through and damage a network.
Bot	A bot (short for robot) is a software agent that causes an endpoint to carry out an automated action, without the user's knowledge, and often for malicious purposes. For example, an endpoint could be used to target a Web server, inundating it with such a volume of requests that it cannot handle them and its normal service is disrupted, called a denial-of-service attack (DoS).
Botnet	A botnet is a network of endpoints that are infected with bot agents. Such networks can be harnessed to take part in distributed denial-of-service (DDoS) attacks, where multiple endpoints are used to send requests to overwhelm a Web server.
Dropper	A dropper is a program that surreptitiously installs some type of malware, such as a virus or backdoor. A single-stage dropper contains the malware within itself, and prevents detection by virus scanners. A two-stage dropper first installs itself, then downloads the malware to the target machine.
Keylogger	A keylogger (keystroke logger) tracks the keys pressed by a user and transmits them covertly to a remote location.
Macro virus	A macro virus is malicious code written in a macro language such as that used in Microsoft Word or Excel. It is resident in a document or template file rather than an executable. The macro program runs when the document is opened, spreading the macro virus to other documents and templates. The macro virus also spreads when new documents are created with an infected template.
Malware	Malware (malicious software) is the catch-all term used to describe all types of software designed to infiltrate or damage files, endpoints, or networks.
Rootkit	A rootkit is software that can be used to modify the host operating system so as to conceal the existence of malicious programs. For example, it can modify the display of running processes to conceal malicious ones from the user, and hide files and registry entries. The term originally comes from UNIX computing – a rootkit was a set of tools used by someone who had gained root (administrator) access. While it may sometimes have a legitimate purpose, rootkits are now most often used to conceal malware.
Spyware	Spyware is a type of malware that covertly collects information about endpoint users, including personal and business-related information and Internet browsing patterns.
Trojan	A Trojan (called after the Trojan horse of Greek legend) is a type of malware that conceals its purpose from the user, while posing as a useful or desirable program. Trojans are often downloaded from the Internet in the form of free or trial-version software. Once installed, some Trojans can cause severe damage to an endpoint such as deleting the file structure of the disk.
Virus	A virus is malicious code that infects an executable file (the host), and that spreads to other executables when the program is run. A virus can contain a payload that causes other, possibly malicious, actions. A virus needs human interaction to spread to other files and across networks.
Worm	A worm is a self-replicating type of malware. Unlike a virus, it is self- contained – it does not need to infect a host file. What's more, it does not require any outside intervention to spread through a network. A worm causes harm to the network by consuming network bandwidth while it is propagating. Some worms carry a payload that can cause additional damage such as deleting or encrypting files, or sending unwanted emails.