Data Protection

Lessons

Senior 2 · ICT

Data Protection

5 lessons

Lesson 4 of 5

Harmful Programs and Where They Come From

18 min

Let's begin

Niyonzima prints his homework at a cyber café. When he plugs his flash drive into the school computer the next day, his folders have turned into shortcuts and his files seem to have gone. Something on the café's computer copied itself onto his flash drive. This lesson names the harmful programs that do this and shows how they reach a computer.

What is malware?

Malware (short for malicious software) is any program written on purpose to damage a computer, steal data or take control without the owner's permission. The main categories differ in how they spread and what they do.

Type	How it spreads	What it does
Virus	Attaches itself to another program or file (its host). It spreads only when a person runs or opens the infected file.	Copies itself into other files and can damage or delete data.
Worm	A standalone program that copies itself across a network by itself, with no host file and no user action.	Spreads very fast, slows networks and often carries other malware.
Trojan horse	Pretends to be useful software, such as a free game or a "cracked" program, so that the user installs it. It does not copy itself.	Once installed it secretly does harm, for example opening a back door for an attacker.
Spyware	Usually hides inside other software the user installs.	Secretly watches what you do, such as the websites you visit or even the keys you press, and sends it to someone else.
Rootkit	Installed by an attacker or by other malware.	Changes parts of the operating system to hide itself and other malware, so that antivirus programs and the Task Manager cannot see them.

You will also hear of ransomware, malware that locks or encrypts your files and demands payment to release them.

Signs that a computer may be infected

It becomes much slower, or crashes often.
Pop-up adverts appear, or the browser's home page changes by itself.
Files disappear, turn into shortcuts or will not open.
Programs you never installed appear, or the antivirus has been switched off.

Where malware comes from

1. The internet

Email attachments and links from unknown senders. Email is by far the most common way malware is delivered.
Downloads from unofficial websites, especially "free" versions of paid software, films and games.
Fake messages such as "Your computer is infected, click here to clean it".
Websites that download malware automatically when visited (drive-by downloads).
Worms that travel across networks to computers with missing security updates.

2. Storage media

Flash drives, memory cards and external hard disks that have been used on an infected computer, for example in a cyber café.
CDs and DVDs of unknown origin.

Worked example: name the malware

A program arrives on every computer in the school network overnight, although nobody opened anything. It spread by itself across the network: a worm.
Mutesi downloads a free "photo editor". It works, but her friends start receiving messages she never sent. It pretended to be useful and did harm in secret: a Trojan horse.
A document from a flash drive is opened, and afterwards other documents on the computer are infected too. It needed a host file and a person to open it: a virus.

A USB flash drive with its cap off. Flash drives that move between computers, for example between a cyber café and school, are one of the most common ways viruses spread. Photo: Dori, public domain, via Wikimedia Commons

Tip

One line each: a Virus needs a host, a Worm walks alone, a Trojan tricks, Spyware spies, a Rootkit hides at the root of the system.

✦

Practice

1

What is the key difference between a virus and a worm?

Show solutionHide solution

Solution: A virus needs a host file and spreads only when a person opens or runs that file. A worm is a standalone program that copies itself across a network with no user action.

2

Byiringiro notices that his browser's home page has changed and adverts keep appearing. Name two possible causes and one likely source.

Show solutionHide solution

Solution: Spyware or adware hidden in software he installed. A likely source is a free program downloaded from an unofficial website.

3

Why does antivirus software sometimes fail to find a rootkit?

Show solutionHide solution

Solution: A rootkit changes parts of the operating system to hide itself, so the tools that ask the system what is running are given false answers.

4

List two sources of malware from the internet and two from storage media.

Show solutionHide solution

Solution: Internet: email attachments from unknown senders; downloads from unofficial sites. Storage media: flash drives used in a cyber café; unknown CDs or DVDs.

Remember

Malware is software designed to harm, steal or take control.
Virus: needs a host and a user. Worm: spreads alone. Trojan: disguised. Spyware: watches you. Rootkit: hides.
Malware comes mainly from the internet (email, downloads, fake messages, networks) and from storage media (flash drives, memory cards, discs).

Sources and credits

Malware, Wikipedia contributors, Wikipedia, licensed under CC BY-SA 4.0. Adapted by Ganzaa.
USB flash drive.jpg, Dori, Wikimedia Commons, released into the public domain by its author.
The explanations, worked examples and practice items were written by Ganzaa.

This lesson adapts CC BY-SA material and is shared under CC BY-SA 4.0.

1What is malware?

2Signs that a computer may be infected

3Where malware comes from

Worked example: name the malware

Practice

What is malware?

Signs that a computer may be infected

Where malware comes from