NWA-PCUG Newsletter Article, July 2012
MALWARE 101
Compiled by Charles Prince of Avast

Reviewed in the Journal of The Computer Club, Inc., in SunCity Center, FL and a thanks to Editor Ilona Merrit for transmitting it.

What is Malware?
Malware, short for malicious software, is software designed to secretly access a computer system without the owner’s informed consent. Malware includes computer viruses, worms, trojan horses, spyware, dishonest adware, scareware, crimeware, most rootkits, and other malicious and unwanted software or programs. Notice the use of words "informed consent" in above definition. This means malware is not defined based on its functionality only. For example, if you download and install a keylogger yourself for your own purpose, it might not classify as a malware.

What is Spyware?
Spyware is a type of malware that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. While the term spyware suggests software that secretly monitors the user’s computing, the functions of spyware extend well beyond simple monitoring. Spyware programs can collect various types of personal information, such as Internet surfing habits, sites that have been visited, etc.

Going by this logic, it would mean even the cookies that websites install can fall in this category. This is especially true for those cookies that record which websites we have visited, so that relevant ads can be shown to us. Of course, all the websites that install such cookies have a privacy policy sneaked somewhere that supposedly warns users about such cookies.

What is Adware?
Adware is quite specific to displaying unwanted ads. Adware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer. These advertisements can be in the form of a pop-up.

What is a Rootkit?
Rootkits are one of the most technically advanced malware. They are what people normally perceive as viruses. A rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. Once a rootkit is installed, it allows an attacker to mask the ongoing intrusion and maintain privileged access to the computer by circumventing normal authentication and authorization mechanisms. And here is the most scary part about Rootkits: Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. Detection methods include using an alternate, trusted operating system, behavioral-based methods, signature scanning, difference scanning, and memory dump analysis. Removal can be complicated or practically impossible, especially in cases where the rootkit resides in the kernel. Reinstallation of the operating system may be the only alternative.

Of course, there are some rootkit scanners that help detect rootkits. Check out free rootkit removers, GMER, and Trend Micro RootkitBuster. (The rootkit scanner in Avast is a custom version of GMER)

What is a Virus?
This is the most popularly used term by security software, but probably also the least understood one. A computer virus is a computer program that can copy itself and infect a computer. A true virus can spread from one computer to another (in some form of executable code) when its host is taken to the target computer; for instance because a user sent it over a network, the Internet or carried it on a removable medium such as a floppy disk, CD, DVD or USB drive.

The most important part of above definition is "can copy itself." This is what separates a virus from other types of malware listed above. And this is the feature that makes it most dangerous: Viruses can easily spread themselves to multiple computers. A single virus infection in a corporate network can cause havoc with the entire network. Do make sure you always have a good antivirus like Avast.

What is a Trojan Horse?
This is a less commonly used term, but the software that it represents is equally dangerous. A Trojan horse, or Trojan, is malware that appears to perform a desirable function for the user to run or install but instead facilitates unauthorized access of the user’s computer system. It is a harmful piece of software that looks legitimate. Users are typically tricked into loading and executing it on their systems.

What is a Worm?
The definition of Worm looks too similar to that of a Virus, but the definition also points out differences between both:

A computer worm is a self-replicating malware computer program. It uses a computer network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

Polymorphic malware :
To avoid detection, polymorphic malware constantly changes it’s own code, often using encryption with a variable key. This stealthy technique poses a problem for typical scanners.

There is one other category that some consider undesirable on their computers and most antivirus services will identify them. These programs are known as PUPS, short for Potentially Unwanted Programs, and include such things as keyloggers, ad supported programs, etc. Keyloggers are programs that record each keystroke on a computer. PUPS are programs that can be used for good reasons or bad reasons. Since antivirus services have no way of knowing how the PUP is being used, it detects and warns of the existing PUP.

AVOIDING MALWARE 102
The best way to prevent malware is to not use the Internet nor external devices such as USB drives, CDs, DVDs, memory cards, etc. Of course, almost no one is going to follow that advice. Even though hackers continue to get more cunning, you can tip the odds in your favor by practicing safe and sane computer habits.

Here are a few tips on avoiding malware.

Tip #1
- If you receive an unknown or unexpected email attachment, do not open it even if you trust the source it came from. Some malware is able to email itself to everyone it finds in an infected user’s email address book through use of an email program included in the malware itself. Once the malware attachment is opened by you, the trouble starts. In some cases, users do not recognize the problem until their ISP tells them they are sending out too many emails and it must be stopped or their account will be closed.

Tip #2
- Computer users are just as guilty of passing along malware as hackers are of distributing them. Do not forward email with attachments unknown to you or were unexpected by you.

Tip #3
- BitTorrent sites, Warez sites, and peer-to-peer networking clients are common ways of spreading infections. Avoid the use of these methods when at all possible.

Tip #4
- When attempting to download a legitimate program - an antivirus program, for example - use the program vender’s website. This will better assure you are getting the most recent version of the program and greatly reduce the possibility of getting a pirated version ... with malware included.

Tip #5
- Pirated software is a particularly popular source of malware. So, if your moral compass does not steer you toward the straight and narrow, the risk of malware infection should.

Tip #6
- Get into the habit of regularly checking for software updates. Almost every software program has an update utility or button. New exploits are being discovered almost daily in various Windows programs, QuickTime, web browsers, all Adobe programs and other common programs. But, the user does not have to go through too many programs updating them individually. The use of Secuna PSI (Personal Security Inspector) will check the most vulnerable of these programs and the use of FileHippo Update Checker will cover almost every other software program.

Click here to return to top



==================================================================