- 2069 Bhadra (old course) · 8 marks
Malicious programs, taxonomy, virus stages
Short answer
Malware is classified by whether it needs a host program and whether it replicates; examples include trapdoor, logic bomb, Trojan horse, virus, worm, and zombie/bot. A virus passes through four stages: dormant, propagation, triggering, and execution. In propagation it copies itself, and in execution it delivers the payload.
Explain malicious program with its taxonomy and different stages of viruses?
A malicious program (malware) is software written to damage, disrupt, steal from or gain unauthorised access to a computer system, usually without the owner's knowledge. It threatens the confidentiality, integrity and availability of data.
Taxonomy of malicious programs
Malicious programs are first divided by whether they need a host program (a fragment that cannot run on its own) or are independent (self-contained programs that the operating system can run). They are then divided by whether they replicate.
Malicious programs
/ \
Need host program Independent
/ | | \ / \
Trap- Logic Trojan Virus Worm Zombie/
doors bombs horse Bot
(no replication) (replicate) (replicate)
| Type | Needs host | Replicates | Meaning |
|---|---|---|---|
| Trapdoor (back door) | Yes | No | Secret entry point that bypasses normal authentication |
| Logic bomb | Yes | No | Code that "explodes" when a condition is met (date, a record deleted) |
| Trojan horse | Yes | No | Looks useful but carries a hidden harmful function |
| Virus | Yes | Yes | Attaches itself to a program or file and copies itself when the host runs |
| Worm | No | Yes | Spreads by itself across the network, mostly through e-mail or vulnerabilities |
| Zombie / bot | No | Yes (spreads) | Compromised machine controlled remotely, used for DDoS and spam |
Other forms often listed: spyware, adware, ransomware, rootkit and keylogger.
Stages (phases) of a virus
A typical virus passes through four stages in its life.
- Dormant phase: The virus is idle. It waits for an event such as a date, another program being run, or disk capacity reaching a limit. Not every virus has this phase.
- Propagation phase: The virus places a copy of itself into other programs or system areas (for example the boot sector). Each infected program now contains a clone of the virus and can spread it further.
- Triggering phase: The virus is activated by a system event, for example a counter reaching a number or a specific date, to perform its intended function.
- Execution phase: The payload is delivered. This may be harmless (a message on the screen) or damaging (deleting files, corrupting the disk).
Common virus types
- Parasitic virus: attaches to executable files.
- Memory-resident virus: stays in main memory and infects each program that runs.
- Boot sector virus: infects the master boot record and loads at start-up.
- Stealth virus: hides from antivirus software.
- Polymorphic virus: changes its signature on every infection.
- Macro virus: lives in documents (Word, Excel macros).
Protection: keep the OS patched, use updated antivirus, do not open unknown attachments, take regular backups and use a firewall.
✓ Answer checked by Claude Opus 5.5 (high effort)
Related questions
- Computer program and programming · Computer Programming, chapter 2