REVIEW

MALICIOUS
SOFTWARE
State your experience
where your
computer/device got
infected with a virus
and what did you do?
 MALICIOUS
SOFTWARE
The term 'Malicious
Software' is the origin of
the word 'Malware,' and the
meaning remains the same.
MALICIOUS CODE
Malicious Software refers
to any malicious program
that causes harm to a
computer system or network.
Malicious Malware Software
attacks a computer or
network in the form of
viruses, worms, trojans,
spyware, adware or rootkits
 MALICIOUS
SOFTWARE
ATTACK
An attacker inserts
malicious code into a
user's system to disrupt or
disable the operating
system or any other
application and destroy the
important information
stored.
TYPES OF
MALICIOUS
SOFTWARE
 COMPUTER VIRUS
A computer virus is malicious software that
self-replicates and attaches itself to other
files/programs. It can execute secretly when the
host program/file is activated.
COMPUTER VIRUS (TWO TYPES)
• Non-resident Virus
• Resident Virus
 NON-RESIDENT VIRUS
Non-resident viruses are any viruses that do not
live in the computer’s memory.

A non-resident virus is capable of infecting

executable files when programs are not running.
 NON-RESIDENT VIRUS
After they reach the host,
they immediately start
searching for other hosts
that could be infected;
once found they infect
these targets and finally
transfer control to the
application program which
they infected.
 RESIDENT VIRUS
A resident virus — or memory-resident virus —
works by latching itself onto the computer’s
memory, thus granting it the freedom to attack
any file or application on the device (including
the anti-virus software).
 RESIDENT VIRUS

Resident viruses
can come from
corrupted drives or
disks, or from
suspicious links or
downloads.
WORMS
A computer worm is a
self-replicating computer
virus. It uses a network to
send copies of itself to other
nodes and do so without any
user intervention.
WORMS DO NOT
Delete system's files, modify
existing files, install Trojan
horses, record or transmit
decrypted passwords, capture
super user privileges.
 I LOVE YOU VIRUS
COMMON NAME:
LOVE LETTER

TYPE: COMPUTER WORM

OPERATING SYSTEM:
MICROSOFT

AFFECTED: WINDOWS

WRITTEN IN:
VBSCRIPT
I LOVE YOU
VIRUS
 I LOVE YOU VIRUS
ILOVEYOU, sometimes referred to as Love Letter, was
a computer worm that attacked tens of millions of
Windows personal computers on and after 6 May 2000
local time in the Philippines when it started
spreading as an email message with the subject line
"ILOVEYOU" and the attachment "LOVE-LETTER-FOR-
YOU.txt.vbs".
WHO WAS RESPONSIBLE FOR CREATING
AND DISTRIBUTING IT?
Young Filipino computer programmer named
Onel de Guzman
WORMS

Jerusalem, the first

known computer worm, was
discovered in 1987.
MORRIS WORM
was launched in 1988
by Robert Morris, an
American student who
wanted to discover
how big the internet
really was.
MORRIS WORM
To do this, he launched a few dozen lines of
code, but he didn’t know that the code was
riddled with bugs that would cause a variety of
problems on affected hosts.

The result was thousands of overloaded computers

running on UNIX and a financial damage ranging
between $10 million and $100 million.
STORM WORM
An email worm launched in 2007.

Victims would receive emails with a fake news

report about an unprecedented storm wave that had
already killed hundreds of people across Europe.
STORM WORM
More than 1.2 billion of these emails were sent
over the course of ten years in order to create
a botnet that would target popular websites.
Experts believe that there are still at least a
million infected computers whose owners don’t
know that they are part of a botnet.
SQL SLAMMER
unique, it didn’t utilize any of the traditional
distribution methods.
SQL SLAMMER
It generated many random IP addresses and sent
itself out to them, hoping they weren’t protected
by antivirus software.

Soon after it hit in 2003, over 75,000 infected

computers were unknowingly involved in DDoS
attacks on several major websites.
RANSOMWARE
Ransomware is a type of malware that locks and
encrypts a victim's data, files, devices or
systems, rendering them inaccessible and unusable
until the attacker receives a ransom payment.
TROJAN HORSES
a malicious program that
is designed as
authentic, real and
genuine software.
TROJAN HORSE PERCENTAGE
WHAT TROJANS CAN DO?
• Erase or overwrite data on a computer
• Spread other viruses or install a backdoor.
In this case the trojan horse is called a
'dropper.'
• Setting up networks of zombie computers to
launch DDoS attacks or send Spam.
WHAT TROJANS CAN DO?
• Logging keystrokes to steal information
such as passwords and credit card numbers
(known as a key logger)
• Phish for a bank or other account details,
which can be used for criminal activities.
• Or simply to destroy data
• Mail the password file.
HOW CAN YOU BE INFECTED?
• Websites: You can be infected by visiting a
rogue website.
• Instant message: Many get infected through
files sent through various messengers.
• E-mail: Attachments on e-mail messages may
contain Trojans. Trojan horses via SMTP.
HOW CAN YOU BE INFECTED?
• The Trojan horse is typically a Windows
executable program file and must have an
executable file extension such as .exe, .com,
.scr, .bat, or .pif.

With file extensions hidden, the user would only

see 'Readme.txt' and could mistake it for a
harmless text file.
How does it get in?
• Downloading a file
• Installing a program
• Opening an attachment
• Opening bogus Web pages
• Copying a file from someone else
ADWARE
Adware is not exactly
malicious but they do
breach the privacy of
the users for malicious
purpose.
ADWARE
They display ads
(a pop-up window
appears) on the
computer’s desktop or
inside individual
programs.
ADWARE
Adware can get onto
people’s mobile or cell
phones through apps in
popular categories like
entertainment and gaming.
SIGNS THAT YOU MAY BE INFECTED
WITH UNWANTED ADWARE INCLUDE:
Computer adware infection signs
• An unexpected change in your
web browser home page
• Web pages that you visit are
not displaying correctly
• Being overwhelmed with pop-
up ads — sometimes even if
not browsing the internet
SIGNS THAT YOU MAY BE INFECTED
WITH UNWANTED ADWARE INCLUDE:
Computer adware infection signs
• Slow device performance
• Device crashing
• Reduced internet speeds
• Redirected internet searches
• Random appearance of a new
toolbar or browser add-on
SIGNS THAT YOU MAY BE INFECTED
WITH UNWANTED ADWARE INCLUDE:
Mobile adware infection signs
• Your phone is slow
• Apps take longer to load
• Your battery drains quickly
• Your phone has apps you
don’t remember downloading
SIGNS THAT YOU MAY BE INFECTED
WITH UNWANTED ADWARE INCLUDE:
Mobile adware infection signs
• There is unexplained data
usage and higher-than-
expected phone bills
• There are numerous ad
pop-ups
HOW TO REMOVE ADWARE?
• Create a backup of the data
• Download or update your
security software
• Uninstall programs that are
not in use
• Use an adware and cleanup
application to run a scan
SPYWARE
Spyware is a type of
malware that perform
certain tasks
including watching and
tracking user actions
and collecting
personal data.
SPYWARE
Spyware programs generally install themselves on
the user's computer and provide profit to the
third party by collecting data of the user
without his awareness.

Moreover, spyware steals passwords and personal

information of the users by running in
background in the system.
SPYWARE TYPES
SPYWARE TYPES
SPYWARE TYPES
SPYWARE TYPES
SPYWARE TYPES
SPYWARE TYPES
 ROOTKIT
A rootkit is a
malicious software
that alters the
regular functionality
of an OS on a
computer in a
stealthy manner.
WHY ARE ROOTKITS SO DANGEROUS?
They’re sneaky: rootkit infections can spread
through deceptive threat vectors like corrupt
downloads, spam emails, and exploit kits.

They’re stealthy: Unlike other types of malware,

a deeply concealed rootkit will not display many
symptoms.
WHY ARE ROOTKITS SO DANGEROUS?
They’re capable: A few experts call rootkits the
Swiss Army Knives of malware because they have
multiple capabilities.
 TYPES OF ROOTKITS
Bootloader rootkit
When you turn on a computer, its bootloader
loads the operating system.

A bootloader rootkit infiltrates this

mechanism, infecting your computer with the
malware before the operating system is ready
to use.
 TYPES OF ROOTKITS
Firmware rootkit
All devices, from mobile phones to washing
machines, can have firmware.

A firmware rootkit is challenging to find

because it hides in firmware, where
cybersecurity tools usually don’t look for
malware.
TYPES OF ROOTKITS
Kernel Rootkit
A kernel rootkit can be catastrophic because it
attacks a core component of your computer and
gives a threat actor significant control over a
system.
Application rootkit
may modify your regular files with rootkit code,
giving the rootkit’s author access to your
machine every time you run the infected files.
TYPES OF ROOTKITS
Memory rootkit
reside on your computer's RAM and can slow down
your machine while performing malicious tasks.

You can usually clear a memory rootkit by

restarting your computer, as a simple restart
clears your machine’s memory of all processes.
HOW ARE ROOTKITS
DETECTED AND REMOVED?
#1 System crashes:
A rootkit that infects your computer's
bootloader, hard drive, BIOS, or applications
may cause system crashing software conflicts.
HOW ARE ROOTKITS
DETECTED AND REMOVED?
#2 Software Malfunctions: Are you noticing
slowdowns, mysterious settings changes, or web
browser malfunctions? A rootkit can be
responsible for such issues.
HOW ARE ROOTKITS
DETECTED AND REMOVED?
#3 Antivirus crash: Should your antivirus
deactivate without cause, try an anti-rootkit
scan to search for malware. Afterwards,
reinstall your cybersecurity software.
 • https://www.techtarget.com/searchsecurity/definition/
worm
• https://softwarelab.org/what-is-a-computer-worm/
• https://www.malwarebytes.com/computer-worm
• https://www.spiceworks.com/it-security/security-
general/articles/what-is-adware/
• https://www.kaspersky.com/resource-
center/threats/adware

REFERENCES • https://www.spiceworks.com/it-security/security-
general/articles/what-is-adware/
• https://www.geeksforgeeks.org/difference-between-
adware-and-spyware/
• https://softwarelab.org/what-is-spyware/
• https://sectigostore.com/blog/spyware-examples-4-
real-life-examples-that-shook-2021/
• https://gridinsoft.com/spyware
• https://www.malwarebytes.com/rootkit
• https://www.fortinet.com/resources/cyberglossary/root
kit