Not all "viruses" are viruses: malware terminology

Many people call malware a virus, but this is not accurate from a professional perspective. You may have heard of many words out of virus scope: malware, worms, Trojans, root access tools, keyboard record tools, spyware, and so on. What are the meanings of these words?

These terms are not only used between hackers, but are also widely used in news, network security issues, and technological news. Understanding them helps us understand the dangers.

Malware

"Malware" is short for "malware ". Many people use "viruses" to explain this type of software, but specifically, viruses are only one of them. Malware includes all the software that can cause harm. The following lists some common cases.

Virus

First, let's talk about viruses. A virus is a type of malware that can replicate itself and infect other files. Just like a virus in biology, the virus first infect cells and then uses them to continuously multiply.

Viruses can do many things. For example, it can hide itself, steal passwords, force pop-up advertisements, and restart the computer. These are not enough to be known as viruses. Viruses are known as viruses because of their reproductive power. When a virus runs on a computer, it will infect programs on the machine. If an infected program is run on another computer, the machine will also be infected. For example, a virus may be infected with a USB flash drive. When the USB flash drive is inserted into a computer and the infected program is run, the virus will be transmitted to the computer, then more program files will be infected. In this way, the infection will continue infinitely.

Worm

Worms are similar to viruses, but they are transmitted in different ways. Worms spread over the network, and viruses spread through infected files or manually moving virus files. The shock wave worm and the shock wave worm are typical examples. Are they in Windows? XP systems spread very fast. Why is Windows? There is no security protection system in the XP system, and system services are completely exposed on the network. The worm can enter the XP system service from the network, locate the system vulnerability, and start to infect the system. Then, the computer can be used to replicate itself. Although the default firewall in Windows has become rare for worms, there are other ways to spread them. For example, the worm virus can spread itself to all contacts through an infected user's email address book.

Like a virus, once a worm is successfully infected with a computer, it can achieve many goals. Its main purpose is to continue replication and propagation.

Trojan Horse

A Trojan horse can disguise itself as a normal file. When someone tries to open it after downloading it, the Trojan horse runs in the background and opens an entry that allows third-party access. Trojan horses can perform more tasks, such as monitoring computers and downloading malicious code to computers. It can also download a large number of malware to computers.

A Trojan Horse is characterized by its formation process. It first pretends to be a usable file. When running it, the Trojan horse will run in the background, and hackers will be able to access the computer. But it does not replicate itself and spread over the internet like viruses and worms. They may spread in pirated software.

Spyware

Spyware is also a type of malware that monitors users without their knowledge. Different spyware collect different data. Malware can be seen as spyware. For example, a Trojan Horse is a malicious spyware that can monitor users' keyboards to steal financial data.

More "legal" spyware will be bound with free software and monitor users' surfing habits. The writers of these software sell the collected data to advertisers for profit.

Advertising software

Forced advertisements are often stored in spyware. Any type of software may contain advertisements and prompts may pop up from time to time. Software containing advertisements in programs is generally not called malware. Malicious advertising software always arbitrarily embeds various advertisements in the system. They can generate pop-up ads so that users cannot do anything else. They can even put advertisements on the web pages that users are browsing.

After obtaining users' online habits, advertising software can more effectively pop up ads that interest users. In Windows, advertising software is generally accepted by users than other malware because it is bundled with normal software. For example, if you use the tool bar created in Oracle Java, You can regard it as an advertisement software.

Key record tool

The malware keyrecord tool also runs on the background, which records all keyboard operations. These operations include the user name, password, credit card number, and other sensitive data. Then various data will be sent to the hacker's server for analysis to find useful data.

Other malware can also use this function. Merchants can use this software to monitor business operations; both husband and wife can use this software to monitor each other.

Botnets

A botnet is a relatively large network with computers under the control of network developers. Every computer is infected with zombie programs by a special type of malware.

Once a zombie software is infected with a computer, it establishes a channel on the computer and Control Server and waits for the Controller to issue instructions. For example, it can carry out DDoS attacks. If the Controller wants to launch an attack on a website, all zombie computers will immediately attack the website. These tens of thousands of attacks can immediately paralyze the server.

BotNet makers sell the network portals to other manufacturers, and hackers can also make profits.

Root access permission Tool

The root access permission tool is a malware designed to obtain the highest permissions of the system and avoid security programs and user checks. For example, the tool can be loaded to the system before the system runs, and the system function can be modified to avoid security program detection. It can also be hidden in the task manager.

The core of the root access permission tool is that it can be hidden once it runs.

Ransomware

Ransomware is a malware that hijacks computers or files. After being hijacked, users are generally required to pay a ransom. Some ransomware is unavailable to computers first, and then a window pops up asking for money to continue using it. However, such software can be easily found by antivirus software.

Ransomware like CryptoLocker usually turns the file content into a bunch of passwords, and then asks to pay a ransom to restore the file. In the absence of file backup, this kind of software is very bad.

Most malware is driven by interests. ransomware is a typical example. Ransomware will not damage computers, but will not delete files, just for money. Hijack some files to get quick accounts.

What is anti-virus software called "anti-virus? Because most people treat malware as viruses. In fact, anti-virus software can not only defend against viruses, but also prevent various malware. To be precise, it should be called "anti-malware" or "protection software ".