---
title: "Malicious programs, taxonomy, virus stages"
subject: "Internet and Intranet"
chapter: 5
key: "semester_8/internet_and_intranet:malicious-program-taxonomy-virus"
source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/malicious-program-taxonomy-virus
site: BCT Engineering
---

# Malicious programs, taxonomy, virus stages

Internet and Intranet · Chapter 5: Designing Internet Systems and Servers

- Asked in: 2069 Bhadra (old course), 8 marks
- Video: [Malware and its types l Virus, Worms, Trojan, Ransomware, Adware and Spyware Explained in Hindi](https://www.youtube.com/watch?v=eaVBvrhwbk0) — 5 Minutes Engineering
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/malicious-program-taxonomy-virus
- Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-5

## Question

Explain malicious program with its taxonomy and different stages of viruses?

## Short answer

Malware is classified by whether it needs a host program and whether it replicates; examples include trapdoor, logic bomb, Trojan horse, virus, worm, and zombie/bot. A virus passes through four stages: dormant, propagation, triggering, and execution. In propagation it copies itself, and in execution it delivers the payload.

## Answer

A **malicious program (malware)** is software written to damage, disrupt, steal from or gain unauthorised access to a computer system, usually without the owner's knowledge. It threatens the confidentiality, integrity and availability of data.

#### Taxonomy of malicious programs

Malicious programs are first divided by whether they need a **host program** (a fragment that cannot run on its own) or are **independent** (self-contained programs that the operating system can run). They are then divided by whether they **replicate**.

```text
          Malicious programs
          /                \
   Need host program     Independent
   /      |     |    \        /     \
Trap-  Logic  Trojan Virus  Worm   Zombie/
doors  bombs  horse                 Bot
 (no replication)  (replicate)  (replicate)
```

| Type | Needs host | Replicates | Meaning |
|---|---|---|---|
| Trapdoor (back door) | Yes | No | Secret entry point that bypasses normal authentication |
| Logic bomb | Yes | No | Code that "explodes" when a condition is met (date, a record deleted) |
| Trojan horse | Yes | No | Looks useful but carries a hidden harmful function |
| Virus | Yes | Yes | Attaches itself to a program or file and copies itself when the host runs |
| Worm | No | Yes | Spreads by itself across the network, mostly through e-mail or vulnerabilities |
| Zombie / bot | No | Yes (spreads) | Compromised machine controlled remotely, used for DDoS and spam |

Other forms often listed: spyware, adware, ransomware, rootkit and keylogger.

#### Stages (phases) of a virus

A typical virus passes through four stages in its life.

1. **Dormant phase**: The virus is idle. It waits for an event such as a date, another program being run, or disk capacity reaching a limit. Not every virus has this phase.
2. **Propagation phase**: The virus places a copy of itself into other programs or system areas (for example the boot sector). Each infected program now contains a clone of the virus and can spread it further.
3. **Triggering phase**: The virus is activated by a system event, for example a counter reaching a number or a specific date, to perform its intended function.
4. **Execution phase**: The payload is delivered. This may be harmless (a message on the screen) or damaging (deleting files, corrupting the disk).

#### Common virus types

- **Parasitic virus**: attaches to executable files.
- **Memory-resident virus**: stays in main memory and infects each program that runs.
- **Boot sector virus**: infects the master boot record and loads at start-up.
- **Stealth virus**: hides from antivirus software.
- **Polymorphic virus**: changes its signature on every infection.
- **Macro virus**: lives in documents (Word, Excel macros).

**Protection:** keep the OS patched, use updated antivirus, do not open unknown attachments, take regular backups and use a firewall.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. How are malicious programs first divided in the taxonomy?
   A. By whether they need a host program or are independent
   B. By operating system
   C. By file size
   D. By who wrote them
   Answer: A. First by host-dependence, then by whether they replicate. (Key point: Taxonomy basis)

2. Which statement is correct?
   A. A virus is independent and a worm needs a host
   B. Both need a host and do not replicate
   C. A virus needs a host program and replicates; a worm is independent and spreads itself over the network
   D. Neither replicates
   Answer: C. Viruses attach to hosts; worms spread on their own through e-mail or vulnerabilities. (Key point: Worm vs virus)

3. What is a logic bomb?
   A. A secret entry point bypassing authentication
   B. Code that triggers when a condition such as a date is met
   C. A remotely controlled machine
   D. A program that looks useful but is harmful
   Answer: B. A logic bomb 'explodes' when a set condition is met; it needs a host and does not replicate. (Key point: Logic bomb)

4. What happens in the propagation phase of a virus?
   A. It waits for a date
   B. It displays the payload
   C. It is detected
   D. It copies itself into other programs or system areas
   Answer: D. During propagation, each infected program gets a clone of the virus. Dormant waits; execution delivers the payload. (Key point: Virus stages)

## Related in other subjects

- [Computer program and programming](https://www.bctengineer.com/question.md?key=semester_1%2Fcomputer_programming%3Adefine-program-programming) — Computer Programming, chapter 2