Malware (マルウェア) is the umbrella term for malicious software: programs written to harm computers or the people who use them.
Malware (umbrella term)
Computer virus
Worm
Trojan horse
Bot
Ransomware
Spyware and other types
Malware comes in many types that differ in how they get in and what damage they cause, and every type covered in this unit is one kind of malware. Antivirus software finds malware mainly by matching against a definition file (定義ファイル, also called a pattern file) that lists the traits of known malware, so keeping up with new types depends on updating that file.
AnalogyJust as the word “illness” covers everything from colds to food poisoning, malware is a word that covers every individual malicious program.
How to rememberThe “mal” at the front is the English prefix mal- (bad), the same one found in malfunction.
Exam points
ExamMalware (マルウェア) is not the name of one specific type; it is the umbrella term for software written with malicious intent.
ExamAntivirus software is not something you install and forget: its definition files (定義ファイル) must be kept updated. Even when they are current, malware that is not yet known can slip through.
ExamThe OS AutoRun feature (オートラン, also 自動実行), which runs a program on an external storage device as soon as the device is connected, can open the door to malware infection.
A computer virus (コンピュータウイルス) is malware that attaches its own code to other programs or files and uses them as a foothold to spread infection.
Attaches to a host file
Host is opened or run
Copies itself into other files
Causes harm such as destruction
When certain conditions are met, it causes harm such as destroying data.
4 / 4
A virus cannot run on its own; it starts running only when the file it has attached to, its host (a document file or program), is opened or run. Some viruses get in by exploiting a vulnerability (脆弱性), a weakness in the design or build of an OS or application, and in that case applying the security patch (セキュリティパッチ) that closes the weakness prevents infection.
AnalogyA biological virus cannot multiply until it gets inside a cell, and a computer virus likewise cannot multiply without a host file.
How to rememberThe word virus comes from a Latin word meaning “poison.”
Exam points
ExamUpdating definition files does not remove a vulnerability (脆弱性), a weakness in the software itself. To block viruses that exploit one, you also apply the security patch (セキュリティパッチ) that fixes it.
ExamInfection is not limited to programs on a PC; it can reach the firmware (ファームウェア) that runs inside a device.
ExamA virus that uses the macro feature of word-processing or spreadsheet software to infect that software's data files is called a macro virus (マクロウイルス).
A worm (ワーム) is malware that needs no host: it copies itself and spreads to other computers over a network.
Infects one machine
Looks for other connected devices
Sends in a copy of itself
Each copy repeats the process
Each copy repeats the same steps, so the infection spreads quickly.
4 / 4
A worm runs as an independent program in its own right. Because it can keep sending out copies with no human action, it can reach large numbers of devices in a short time and sometimes puts a heavy load on the network.
AnalogyPicture a double that opens the door to the next room on its own, makes a copy of itself there, and then heads for the room after that.
How to rememberWorm is English for a crawling creature. Picture it moving around on its own body, with no host to lean on.
Exam points
ExamA worm (ワーム) sends copies of itself to other computers on a network and spreads the infection under its own power.
A Trojan horse (トロイの木馬) is malware disguised as useful software so that users install it, after which it carries out unauthorized actions behind the scenes.
Distributed disguised as handy software
User installs and runs it
Secretly destroys data or steals information
Behind its visible features, it destroys data, steals information, and so on.
3 / 3
It gets in when users themselves install or run it. What it does once inside varies: destroying data, stealing personal information, or planting a backdoor (バックドア) that lets attackers in from outside.
AnalogyIt is like a gift box whose contents have been swapped: the person who receives it carries it into the house with their own hands.
How to rememberThe name comes from the Trojan War in Greek myth, where the enemy itself hauled a giant wooden horse full of hidden soldiers into the city.
Exam points
ExamA Trojan horse (トロイの木馬) poses as a useful program, gets the user to install or run it, and then destroys data or leaks information.
Mix-upSpreading by sending out copies of itself is what a worm (ワーム) does; a Trojan horse (トロイの木馬) gets in through disguise and generally does not replicate itself.
A bot (ボット) is malware that lets an attacker remotely control an infected computer from outside.
Attacker
Command server
Many bot-infected devices
Mass attacks on a target, spam
Following the instruction, they flood a target with traffic or send spam.
4 / 4
An infected device waits for orders from a command server (指令サーバ) set up by the attacker and acts on them once they arrive. A group of many infected devices driven by the same orders is called a botnet (ボットネット); because botnets are used for mass attacks on a particular site (DDoS attacks, DDoS攻撃) and for sending spam in bulk, the infected side ends up taking part in the attack without realizing it.
AnalogyPicture a whole troupe of puppets all moved at once by the hands of the person pulling the strings.
How to rememberBot is short for robot, a name drawn from the image of a machine that does what it is told.
Exam points
ExamA bot (ボット) infects large numbers of PCs, acts on commands that arrive over the network, and launches coordinated (mass) attacks on a target site or sends spam.
ExamMeasures that prevent infection block the routes malware uses to get in, which is a different aim from measures that limit damage after theft or infection. For keeping a bot (ボット) out, the former is what works.
Ransomware (ランサムウェア) is malware that makes files or a PC unusable by encrypting the files or locking the PC, then demands money (a ransom) in exchange for restoring them.
Infects a PC
Encrypts files or locks the screen
Demands money to undo it
Safeguard: restore from backup
Paying does not guarantee recovery, so the real safeguard is restoring from a backup taken in advance.
4 / 4
The attacker's main goal is to hold the locked-up data hostage and collect money. Paying the demand does not guarantee recovery, so the way to prepare is to take regular backups (バックアップ) and keep them somewhere an infected PC cannot overwrite.
AnalogyIt is like someone changing every lock in your house without asking and then saying, “Pay up if you want the keys.”
How to rememberRansom is English for the money paid to free a hostage. Ransom + software gives ransomware.
Exam points
ExamRansomware (ランサムウェア) is after money: it encrypts files or locks a PC to make them unusable, then demands payment to undo it.
ExamA RAT (remote access tool) is a tool attackers use to control an infected device remotely. Its aim is to operate the device or obtain information, which sets it apart from ransomware (ランサムウェア), whose aim is money.
Malware is the umbrella term for malicious software, and specific types such as viruses and bots are each one part of it.
The basic defenses are keeping the antivirus software's definition files up to date and closing software vulnerabilities with security patches.
Infection does not only come through email attachments; it can also enter through the AutoRun feature of external storage media, and it can even reach a device's firmware.
A bot turns infected devices into tools for harming others, while ransomware holds data hostage for money; the type of damage after infection is also a clue to which kind you are facing.