Malware, short for malicious software, is any software intentionally designed to cause damage to a computer. There are different kinds of malware that can hurt computers, such as viruses, Trojan horses, spyware and ransomware. These programs can steal passwords, delete files, collect personal information, or even stop a computer from working at all. Computer security or anti-malware software is usually good at stopping malware from installing itself. When security software is not installed, malware can get into the computer. Getting rid of malware can be difficult, even when using programs designed to remove it.

The term "malware" refers only to software that is made for malicious purposes and works against users' expectations — and so does not include applications that may do unintended harm due to software bugs.

History

People first started writing malware in the 1970s and early 1980s. Computers were very simple then. They did not have any interesting information for malware to take. Instead, people wrote malware for fun^[1] or just to show that they could.^[2] Even the most common piece of malware from this time did not do damage to people's computers.^[3] In fact, malware was so rare that the word "malware" was not coined until 1990.^[4]

More people started using the computers in the late 1990s and early 2000s. Computers were getting more complex and faster.^[5] People saw that they could use malware to get useful information now, like passwords and credit card information. So, more programmers started writing malware. The number of malware programs on the Internet has grown very quickly ever since then the late 1990s and is still growing today.^[6] Experts think that 31.5% of the world's computers have some type of malware installed.^[7]

Purposes

The main reason people write malware is to hurt others and make money, usually by stealing or deleting important information. The Cryptolocker computer virus, for example, makes it so a person cannot use their own computer until they pay the malware writers for a software key to unlock it.^[8] Another virus, CIH, tries to make it so the victim can never use their files or turn on their computer again.^[9] Malicious keystroke logging software remembers everything a user types in and gives it to the malware author to read.^[10]

World governments have written malware to hurt their enemies. Experts think that the United States government made a virus named Stuxnet to stop an important place in Iran from working.^[11] The Chinese government probably used a virus to stop people from protesting its decisions.^[12]

How malware gets installed

There are a lot of ways malware can get onto someone's computer. One common way is through email attachments. These attachments are usually sent from other computers that already have malware on them.^[13] When someone downloads and opens the attachment, the virus installs and uses their computer to send itself to even more people.

Another way malware installs itself is when a victim gets malware just by going to a website with the malware hidden on it. This is called drive-by downloading. A user does not have to click anything for their computer to get infected from a drive-by download.^[14] This kind of malware attack is usually found on websites that are not used a lot or whose security methods are very old. However, even current websites that people use all the time can host drive-by downloads when someone hacks the site.

People who write malware also get their programs onto computers by attaching them to real programs that people want. This is most common with pirated programs. This is because the downloader was doing something illegal and cannot complain to the authorities without getting in trouble themselves.^[13] However, some non-piracy websites also put malware (or other unwanted programs that are almost as bad as malware) in a download with real, legal software in a process known as bundling.^[15] Computer security experts complain about websites that bundle real software with malware. Their complaints do not always stop the websites from bundling.^[15]

Kinds of malware

There are many different kinds of malware. Each acts a different way.

• Viruses are a kind of malware that need a user-run program to work.^[16] They cannot copy themselves or move from one computer to another without a program to host it. Viruses are very common in pirated programs.^[13] They can harm computers in many different ways, like deleting files and stealing passwords.^[16]

• Worms are a lot like viruses and can cause the same kinds of damage. However, they're able to move through the internet and copy themselves onto computers without help from a host program. This makes them more dangerous than a virus.^[16] Worms are usually found in emails and drive-by downloads.^[14]

• Trojan horses are a type of harmful software that masquerades as a regular, benign program or utility in order to persuade a victim to install it. A Trojan horse usually carries a hidden destructive function that is activated when the application is started. They need a user to agree to run a program to work and cannot copy themselves from one computer to another.^[17] However, trojan horses can make the same problems a normal virus can make. They can also allow the malware writer to control the victim's computer, install more malware, steal bank data, and more.^[17] For example, ransomware is a type of trojan horse that stops a victim from using their files until they pay the person who wrote the malware.^[8] Experts think that trojan horses are the most common type of malware in existence.^[7]

• Adware is a type of malware that earns the program authors money with advertising. These programs show users ads and force them to use websites that make money for the malware writers. Adware will also find personal information about the victim (such as their age, race, and job). This is so the malware authors can sell the information to other people.^[18] A user can usually uninstall adware easier than most malware. However, this is still difficult to do without a specially-designed program.^[19]

• Spyware is a more dangerous kind of adware that steals more information from a user. Spyware can steal someone's Internet traffic, account passwords, and anything they have typed into their computers. Spyware is also much harder to uninstall than adware is.^[20]

Why computers get malware

There are a few reasons why computers get programs a user didn't mean to install. One common reason is because of regular programs that have software bugs. Malware can use bugs, such as a buffer overflow, to make a program do something it was not designed to do.^[21] Malware can also get onto a computer if it tricks a user into putting it there themselves. This can happen when a user plugs in a USB flash drive that has a virus on it already.^[22] Malware also commonly uses social engineering to get users to run it, like pretending to be an important email attachment for work. Some malware even pretends to be an anti-malware program to get people to run it.^[23]

How malware is stopped

Since malware is such a big problem, many companies make programs to try to stop it. These anti-malware programs have a lot of different ways to find malware. One is static analysis, which looks at the source code of a program before it is run. Then, if the program is similar to malware the static analysis program has seen before, the anti-malware program will stop the code from running.^[24] Another way of finding malware is dynamic analysis. Dynamic analysis runs only part of a program it is checking. If this part of the program tries to do anything that could be bad or harmful, the anti-malware program will not let the program run.^[24]

Malware can also be stopped without a program. This can be done by not letting a computer connect to the Internet or other computers, called creating an air gap.^[25] However, these computers can still get malware if someone puts it there another way. One example is when someone plugs in a Universal Serial Bus (USB) drive that was already plugged into a computer with a virus.^[22]