What is the difference between malware and viruses?

Many people mistakenly think malware and viruses are the same. This mix-up usually comes from the term “anti-virus,” which since 1970’s has been used by marketers to describe various anti-malware products. Regardless of history, the misconception exists, and it is widely held.

In reality, however, malware and viruses are distinct concepts.

Malware is a broad term for software designed to harm a system or network.
A virus, on the other hand, is a type of malware with unique characteristics, similar in category to ransomware, trojans, or spyware.

Let’s explore the differences between malware and viruses:

How is a computer virus different from malware?

A virus, in the context of cybersecurity, is a specific type of malware designed to replicate itself and spread to other computers. It often attaches itself to a host file or program and executes its code when the user launches the infected file. The primary characteristic of a virus is its ability to self-replicate and propagate, often leading to harmful effects such as corrupting or altering data, slowing down systems, or completely disabling functionality.

How is malware different from a virus?

The term “malware” (short for “malicious software”) is a broader category that encompasses various forms of harmful software, including viruses, but also other types such as trojans, worms, ransomware, spyware, and adware. Each type of malware has distinct characteristics and modes of operation:

Trojans: Disguised as legitimate software, trojans deceive users into installing them. Once activated, they can steal information or cause damage.
Ransomware: Encrypts the user’s data and demands payment for the decryption key.
Worms: Similar to viruses in their self-replicating nature, worms spread across networks without needing to attach to a host file.
Spyware: Secretly gathers information about a user or organization without their knowledge.
Adware: Automatically delivers advertisements, often in an intrusive manner.

Difference in operation of malware vs. viruses

Being a subset of malware, viruses have disticinct behaviours. Here’s a breakdown of how their attack types, vectors, operation, and outcomes differ:

Attack vectors

Malware attack vectors are diverse and can include phishing emails, malicious web downloads, exploitation of software vulnerabilities, USB drives, and even through legitimate software updates (in case of supply chain attacks).

Viruses mostly spread through file sharing, such as email attachments or downloading infected files from the internet. They can also propagate through network connections or infected storage devices like USB drives.

Operation

Malware operation depends on the malware type. For instance, trojans disguise themselves as legitimate software to deceive users, while ransomware actively seeks to encrypt data for extortion.

Viruses primaryly insert malicious code into other executable files. They become active when the infected file is executed and often perform actions like corrupting data, logging keystrokes, or utilizing system resources for unauthorized purposes.

Outcomes

Malware outcomes can range from data theft, financial loss, system damage, to espionage and disruption of operations. Some malware like spyware focuses on data exfiltration without necessarily damaging the system.

Viruses often cause system malfunction, data corruption, performance degradation, and can facilitate unauthorized access to system resources. The intent is often disruption and damage rather than stealthy operations.

Famous examples and brief history of viruses

Viruses have been a part of the computing landscape since the early days of personal computers. Historically, they were often created as experiments or pranks, but over time, their development became more malicious and financially motivated. Here are some notable examples of viruses:

Creeper (1971): Often cited as the first computer virus, Creeper was an experimental self-replicating program created for the ARPANET. It wasn’t malicious; it simply displayed a message, “I’m the creeper, catch me if you can!”

Elk Cloner (1982): Created by a high school student, Elk Cloner is considered one of the first viruses to spread in the ‘wild,’ outside a laboratory setting. It infected Apple II operating systems via floppy disks and displayed a poem on infected computers.

ILOVEYOU (2000): A highly destructive worm and virus, it spread via email with the subject line “ILOVEYOU.” It overwrote user files and caused billions of dollars in damage worldwide.(Read about the history of ILOVEYOU)

MyDoom (2004): Often cited as one of the most damaging viruses ever, Mydoom spread via email and peer-to-peer networks. It caused widespread Internet slowdowns and opened backdoors on infected machines. (Read about creation and operation traits of MyDoom)

Stuxnet (discovered in 2010): A more recent example, Stuxnet was a highly sophisticated virus targeted at Iran’s nuclear facilities. It is notable for being one of the first viruses known to have been used for cyber warfare, specifically designed to damage industrial control systems.