Virus and Antivirus

🦠 What Is a Computer Virus?

• Definition: A computer virus is a type of malicious software (malware) that attaches itself to files or programs and spreads when those files are executed.
• Characteristics:
  • Needs a host file or program to run.
  • Can replicate and spread to other files or systems.
  • Often causes damage: corrupting files, stealing data, slowing down systems.
• Examples of virus behavior:
  • Displaying unwanted messages.
  • Deleting or altering files.
  • Consuming system resources.
  • Opening backdoors for hackers.

🦠 Malware

• Definition: Malware is the broad term for all types of malicious software designed to harm, exploit, or steal data from computers and networks.
• Classification principle: Malware is categorized by function or behavior.

Common Types of Malware

1. Viruses → attach to files/programs, spread when executed.
2. Worms → self‑replicating, spread across networks without a host file.
3. Trojan Horses → disguised as legitimate software, trick users into installing.
4. Spyware → secretly collects user information (keystrokes, browsing habits).
5. Adware → forces unwanted ads, often tracks user behavior.
6. Rootkits / Toolkits → hide malware presence, allow remote control with high privileges.
7. Ransomware → encrypts files, demands payment for decryption.
8. Keyloggers → record keyboard input to steal credentials.

🧩 Virus

• Definition: A virus is a specific type of malware that requires a host file or program to spread.
• Classification principle: Viruses are categorized by infection method or technical characteristics.

Common Types of Viruses

1. File Infector Virus → attaches to executable files.
2. Macro Virus → spreads via document macros (Word, Excel).
3. Boot Sector Virus → infects disk boot sectors.
4. Resident Virus → hides in memory, infects files during execution.
5. Multipartite Virus → spreads through multiple channels (files + boot sector).
6. Polymorphic Virus → changes its code each time it replicates.
7. Metamorphic Virus → rewrites its own code completely.
8. Web Scripting Virus → exploits browser or website script vulnerabilities.

🛡️ What Is Antivirus?

• Definition: Antivirus software is designed to detect, prevent, and remove viruses and other malware.
• Functions:
  • Detection: Scans files/programs for virus signatures or suspicious behavior.
  • Prevention: Blocks execution of malicious code.
  • Removal: Quarantines or deletes infected files.
  • Real‑time protection: Monitors system activity continuously.

🧩 Types of Threats Antivirus Protects Against

• Viruses: Malicious code that attaches to files and spreads.
• Worms: Self‑replicating programs that spread across networks.
• Trojan horses: Malware disguised as legitimate software.
• Spyware: Secretly collects user data.
• Adware: Displays unwanted ads.
• Ransomware: Encrypts files and demands payment for decryption.

⚙️ How Antivirus Works

1. Signature‑based detection: Compares files against a database of known malware.
2. Heuristic analysis: Identifies suspicious behavior or code patterns.
3. Sandboxing: Runs programs in a safe environment to observe behavior.
4. Machine learning/AI: Modern antivirus uses AI to detect new, unknown threats.

🔗 Relationship Between Virus and Antivirus

• Virus: The threat — malicious code that spreads and harms systems.
• Antivirus: The defense — software that identifies and neutralizes those threats.
• Analogy:
  • Virus = disease.
  • Antivirus = medicine + immune system.