C. Computer Environments and Systems · Computer Environments and Systems

Malware: Viruses, Worms, Trojans, Spyware and More

C2.2About 65 minutes

Learning goals

I can describe how viruses, worms, Trojan horses, spyware, adware, ransomware and malicious macros work and spread.
I can recognize common ways malware gets onto a computer, including phishing and disguised files.
I can list warning signs that a computer may be infected and the first steps to take.
I can write a short Python program that flags risky file names.

Words to know

malware
Malicious software: any program written to harm a computer, steal data or take control without permission.

virus
Malware that attaches itself to a host file or program and spreads when that file is run or shared.

worm
Malware that copies itself from computer to computer over a network on its own, without a host file.

Trojan horse
Malware disguised as something useful or fun, which the user is tricked into installing.

spyware
Malware that secretly watches what you do (keystrokes, websites, passwords) and sends it to someone else.

adware
Software that floods you with unwanted ads, often changing browser settings; it may also track you.

ransomware
Malware that encrypts or locks your files and demands payment to unlock them.

malicious macro
Harmful code hidden in the macros (small automated scripts) of a document or spreadsheet.

phishing
A message that pretends to be from a trusted source to trick you into clicking a link, opening an attachment or giving away information.

A free game skin that was not free

A student in Grade 10 found a website promising free skins for a popular game. The download was called skins_installer.exe. Nothing seemed to happen when he ran it. A week later, his gaming account was stolen, and his browser kept opening ad pages by itself.

He had installed malware (malicious software). This lesson explains the main kinds, how each one spreads and how to spot the signs. The next lesson, Building a System Protection Plan, turns that knowledge into a plan to keep a computer safe.

The main types of malware

Virus. Attaches its code to a host file (a program or document). When someone runs the host, the virus runs too and copies itself into other files. It needs a person to run or share the infected file.
Worm. A stand-alone program that copies itself across networks on its own, often through a security hole in software that has not been updated. Worms can spread to thousands of computers very quickly.
Trojan horse. Named after the wooden horse in the ancient Greek story. It looks useful (a free game, a "video player", a cracked program) but hides a harmful part. Trojans do not copy themselves; they rely on tricking you into installing them. Many open a "back door" that lets an attacker control the computer.
Spyware. Secretly watches what you do and sends it to someone else. A keylogger records every key you press, including passwords.
Adware. Floods you with unwanted ads and pop-ups, may change your browser's home page or search engine, and often tracks your browsing. Some adware is bundled with free programs.
Ransomware. Encrypts your files (scrambles them with a secret key) and demands payment, often in cryptocurrency, for the key. Paying does not guarantee you get your files back. Good backups are the best defence.
Malicious (malevolent) macros. Office documents can contain macros, small programs that automate tasks. Attackers hide malware in macros and send the document by email, hoping you click Enable Content. Macro-enabled files often end in .docm or .xlsm, and many office programs now block macros in files from the internet.

Three ways malware spreads. A virus rides inside a host file, a worm spreads by itself across a network, and a Trojan horse tricks the user into installing it.

How malware gets in

Most malware needs your help. The common doors are:

Phishing emails, texts and direct messages with harmful links or attachments.
Downloads from unofficial sites: "free" versions of paid software, game cheats, fake browser updates.
Disguised files, such as photo.jpg.exe. Windows hides known extensions by default, so this shows up as photo.jpg.
Unpatched software: worms and attackers use known security holes in programs that have not been updated.
Infected USB drives plugged into many computers.
Fake pop-ups that say "Your computer is infected! Call this number" or "Click to clean." These are scams.

A phishing email with its warning signs labelled. Real companies do not threaten you with 24-hour deadlines or ask for your card number by email. (Example made up for this lesson.)

Warning signs of an infection

The computer suddenly becomes very slow, or the fan runs hard when you are not doing anything.
Pop-ups and new toolbars appear; the browser's home page or search engine changes on its own.
Programs crash or files go missing or are renamed with strange extensions.
Friends get messages you did not send.
Security software is turned off and will not turn back on.

First steps if you suspect malware: disconnect from the internet (turn off Wi-Fi), do not type any passwords, tell a parent, teacher or IT person, run a full scan with up-to-date security software, and, from a different, clean device, change important passwords. If files were encrypted, restore them from a backup made before the infection.

risky = [".exe", ".bat", ".cmd", ".scr", ".js", ".vbs", ".docm", ".xlsm"]

files = ["report.docx", "photo.jpg.exe", "budget.xlsm", "notes.txt", "invoice.pdf.scr"]

for name in files:

parts = name.lower().split(".")

ext = "." + parts[-1]

warning = "ok"

if ext in risky:

warning = "CAUTION: can run code"

if len(parts) > 2:

warning = "DANGER: disguised with a double extension"

print(name, "->", warning)

A simple risky-file checker. It looks at the last extension (the one that really decides the file type) and warns about double extensions. Real security software is far more thorough, but the idea of checking extensions is the same. Output (one line each): report.docx -> ok / photo.jpg.exe -> DANGER: disguised with a double extension / budget.xlsm -> CAUTION: can run code / notes.txt -> ok / invoice.pdf.scr -> DANGER: disguised with a double extension

Worked example

Example 1: Name that malware

Identify the type of malware in each case.

(a) After opening an email attachment called Invoice.docm and clicking Enable Content, files on the computer are encrypted and a note demands $500. (b) A program spreads to every unpatched computer on a school network overnight, with nobody opening anything. (c) A "free screen recorder" works, but also sends the user's browsing history to an unknown server.

(a) The attachment carried a malicious macro (the .docm file and Enable Content are the clues), which installed ransomware (encrypted files plus a payment demand).
(b) Spreading over a network on its own, without a host file or a user, is a worm.
(c) It pretended to be useful (a Trojan horse) and secretly reports activity (spyware). One piece of malware can fit more than one category.

(a) a malicious macro delivering ransomware; (b) a worm; (c) a Trojan horse carrying spyware.

Worked example

Example 2: Spot the phish

A text says: "Canada Post: Your package is on hold. Pay the $1.99 redelivery fee within 12 hours: canadapost-redelivery.info". List the warning signs and the right response.

Urgency: "within 12 hours" pressures you to act without thinking.
A look-alike web address: the real site would be on Canada Post's own domain, not canadapost-redelivery.info.
A request for payment details in a text message, for a tiny amount (scammers want your card number, not the $1.99).
Response: do not click. Check the tracking number on the company's real website or app. Delete the message, and report it if you like (the Canadian Anti-Fraud Centre collects reports of scams).

Urgency, a fake address and a request for payment details mean it is a phishing scam; check through the official site instead of the link.

Just for fun

One of the first self-copying programs, Creeper (1971), was a harmless experiment that hopped between computers on ARPANET, an early ancestor of the internet, printing "I'M THE CREEPER: CATCH ME IF YOU CAN." Someone then wrote Reaper to chase it down and delete it, which makes Reaper a very early ancestor of antivirus software.

Hands-on activity

Malware detective (no real malware needed)

You need: a computer with Python, and your own email inbox or spam folder (with a grown-up if you like). Do not open attachments or click links in suspicious messages; you only look at them.

Run the risky-file checker. Add three file names of your own (for example game_mod.zip, schedule.xlsm, cute_cat.png.js) and predict the output before running it.
Improve the program: also warn about .zip files ("check what is inside before opening").
Look in a spam or junk folder for one phishing message. Without clicking anything, list its warning signs, like the labelled example above.
Make a one-page poster for younger students called "How malware gets in," with one tip for each type of malware.

What to look for: correct predictions (cute_cat.png.js is DANGER, schedule.xlsm is CAUTION, game_mod.zip is ok until step 2), a working .zip warning (for example, an elif ext == ".zip": branch), and at least three real warning signs in the phishing message.

Your turn

What is the main difference between a virus and a worm?

Why is a Trojan horse called that?

What does ransomware do, and what is the best protection against losing files to it?

What does a keylogger record?

A document asks you to click "Enable Content" to see it. Why should you be careful?

Give three warning signs of a phishing email.

What would the checker print for setup.bat?

More practice: warm-up

What does the word malware come from?

Which type of malware shows unwanted ads?

Which file extension is a Windows program?

Which type of malware secretly watches what you do?

What is phishing?

More practice: on your own

Explain why holiday_photo.jpg.exe is dangerous even though it says "jpg".

Why are worms especially dangerous on networks with old, unpatched computers?

A pop-up says "VIRUS DETECTED! Call 1-800-... now." What is it, and what should you do?

Your friend's computer suddenly shows ads everywhere and the browser's search engine changed. Which type of malware is likely, and what are two first steps?

Change the checker so it prints only the file names that are not ok. What one change to the code does this?

Challenge

The checker marks report.final.docx as ok, but report.final.exe as DANGER. Is the second one really a disguise? Suggest a better rule.

Explain why paying a ransomware demand is risky, even if you really need the files.

Explain how one email could involve three kinds of malware from this lesson.

Check your understanding

Quiz

Which type of malware spreads across a network on its own, without a host file?

A "free" program you installed works but secretly lets a stranger control your computer. This is a...

Which file is most likely to be a disguised program?

What does ransomware do?

Which is a common sign of a phishing message?

What is a malicious macro?

In the risky-file checker, what is printed for notes.txt?

For parents and teachers

Big idea: Expectation C2.2 asks students to describe procedures to safeguard data and programs from malware (viruses, Trojan horses, worms, spyware, adware, malevolent macros) and to devise a protection plan. This lesson covers the first half: what malware is and how it gets in. The next lesson builds the plan.

How to help: Look through your own spam folder together (without clicking anything) and spot warning signs. Talk about scam texts your family has received. Make a family rule: no installing "free" versions of paid programs or game cheats, and ask before entering a password after clicking a link.

Common difficulties:

Confusing a virus with a worm (host file and user action versus self-spreading over a network).
Thinking malware only comes from "sketchy" sites. Phishing often looks very professional.
Believing pop-up "virus alerts" in a browser; these are scams.
Not knowing that the last extension decides the file type.

If your teen ever thinks a device is infected, the first step is to disconnect it from Wi-Fi and get help; there is no shame in it, and quick action limits the damage.