Malware, short for malicious software, is software to help hackers disrupt users computer operation, gather sensitive information, or gain unauthorized access to a computer system. While it is often software, it can also appear in the form of script or code. 'Malware' is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or code.

Malware includes computer viruses, worms, trojan horses, spyware, adware, most rootkits, and other malicious programs. In law, malware is sometimes known as a computer contaminant, for instance in the legal codes of several U.S. states, including California and West Virginia.

Malware is not the same as defective software, which is software that has a legitimate purpose but contains harmful bugs that were not noticed before release. Sometimes, malware is disguised as genuine software, and may come from an official company website. An example would be software used for useful purposes that also includes tracking software to gather marketing statistics for advertising.

Therefore, some security programs may find "potentially unwanted programs" or "PUP". Though a computer virus is malware that can reproduce itself, the term is sometimes used erroneously to refer to the entire category. An example of a computer virus which is not a malware, but is benevolent is Fred Cohen's compression virus.

Proliferation[link]

Preliminary results from Symantec published in 2008 suggested that "the release rate of malicious code and other unwanted programs may be exceeding that of legitimate software applications." According to F-Secure, "As much malware [was] produced in 2007 as in the previous 20 years altogether." Malware's most common pathway from criminals to users is through the Internet: primarily by e-mail and the World Wide Web.

The prevalence of malware as a vehicle for Internet crime, along with the challenge of anti-malware software to keep up with the continuous stream of new malware, has seen the adoption of a new mindset for individuals and businesses using the Internet. With the amount of malware currently being distributed, some percentage of computers will always be infected. For businesses, especially those that sell mainly over the Internet, this means they need to find a way to operate in spite of this. The result is a greater emphasis on back-office protection systems designed to protect against advanced malware operating on customers' computers.

On March 29, 2010, Symantec Corporation named Shaoxing, China, as the world's malware capital. A 2011 study from the University of California, Berkeley, and the Madrid Institute for Advanced Studies published an article in ''Software Development Technologies'', examining how entrepreneurial crackers are helping enable the spread of malware by offering access to computers for a price.

Microsoft reported in May 2011 that one in every 14 downloads from the Internet may now contain malware code according to the Wall Street Journal. Social media, and Facebook in particular, are seeing a rise in the number of tactics used to spread malware to computers.

Purposes[link]

Many early infectious programs, including the first Internet Worm, were written as experiments or pranks. They were originally intended to be used for amusement purposes rather than for malicious ones. In some cases, the perpetrator did not realize how much harm his or her creations would do.

Today, malware is used primarily to steal sensitive personal, financial, or business information for the benefit of others. Malware is sometimes used broadly against corporations to gather guarded information, but also to disrupt their operation in general. Malware is often used against individuals to gain similar personal information such as social security numbers, bank or credit card account information, and so on. Left un-guarded, personal and networked computers can be at considerable risk against these threats. (These are most frequently counter-acted by various types of firewalls, anti virus software, and network hardware).

Hostile intent related to the disruption of operation of users can be found in programs designed to data loss. Many DOS viruses, and the Windows ExploreZip worm, were designed to destroy files on a hard disk, or to corrupt the file system by writing invalid data to them. Network-borne worms such as the 2001 Code Red worm or the Ramen worm fall into the same category.

Since the rise of widespread broadband Internet access, malicious software has been designed increasingly for profit (such as forced advertising). Since 2003, the majority of widespread viruses and worms have been designed to take control of users' computers for black-market exploitation. Infected "zombie computers" are used to send email spam, to host contraband data such as child pornography, or to engage in distributed denial-of-service attacks as a form of extortion.

Another strictly for-profit category of malware has emerged, called spyware. These programs are designed to monitor users' web browsing, display unsolicited advertisements, or redirect affiliate marketing revenues to the spyware creator. Spyware programs do not spread like viruses; they are generally installed by exploiting security holes. They can also be packaged together with user-installed software, such as peer-to-peer applications.

Infectious malware: viruses and worms[link]

The best-known types of malware, ''viruses'' and ''worms'', are known for the manner in which they spread, rather than any other particular behavior. The term ''computer virus'' is used for a program that has infected some executable software and, ''when run'', causes the virus to spread to other executables. Viruses may also contain a payload that performs other actions, often malicious. On the other hand, a ''worm'' is a program that ''actively'' transmits itself over a network to infect other computers. It too may carry a payload.

These definitions lead to the observation that a virus requires user intervention to spread, whereas a worm spreads itself automatically. Using this distinction, infections transmitted by email or Microsoft Word documents, which rely on the recipient opening a file or email to infect the system, would be classified as viruses rather than worms.

Some writers in the trade and popular press misunderstand this distinction and use the terms interchangeably.

Capsule history of viruses and worms[link]

Before Internet access became widespread, viruses spread on personal computers by infecting the executable boot sectors of floppy disks. By inserting a copy of itself into the machine code instructions in these executables, a virus causes itself to be run whenever a program is run or the disk is booted. Early computer viruses were written for the Apple II and Macintosh, but they became more widespread with the dominance of the IBM PC and MS-DOS system. Executable-infecting viruses are dependent on users exchanging software or boot-able floppies, so they spread rapidly in computer hobbyist circles.

The first worms, network-borne infectious programs, originated not on personal computers, but on multitasking Unix systems. The first well-known worm was the Internet Worm of 1988, which infected SunOS and VAX BSD systems. Unlike a virus, this worm did not insert itself into other programs. Instead, it exploited security holes (vulnerabilities) in network server programs and started itself running as a separate process. This same behaviour is used by today's worms as well.

With the rise of the Microsoft Windows platform in the 1990s, and the flexible macros of its applications, it became possible to write infectious code in the macro language of Microsoft Word and similar programs. These ''macro viruses'' infect documents and templates rather than applications (executables), but rely on the fact that macros in a Word document are a form of executable code.

Today, worms are most commonly written for the Windows OS, although a few like Mare-D and the Lion worm are also written for Linux and Unix systems. Worms today work in the same basic way as 1988's Internet Worm: they scan the network and use vulnerable computers to replicate. Because they need no human intervention, worms can spread with incredible speed. The SQL Slammer infected thousands of computers in a few minutes.

Concealment: Trojan horses, rootkits, and backdoors[link]

Trojan horses[link]

For a malicious program to accomplish its goals, it must be able to run without being detected, shut down, or deleted. When a malicious program is disguised as something normal or desirable, users may willfully install it without realizing it. This is the technique of the ''Trojan horse'' or ''trojan''. In broad terms, a Trojan horse is any program that invites the user to run it, concealing harmful or malicious code. The code may take effect immediately and can lead to many undesirable effects, such as deleting the user's files or installing additional harmful software.

One of the most common ways that spyware is distributed is as a Trojan horse, bundled with a piece of desirable software that the user downloads from the Internet. When the user installs the software, the spyware is installed as well. Spyware authors who attempt to act in a legal fashion may include an end-user license agreement that states the behavior of the spyware in loose terms, which users may not read or understand.

Rootkits[link]

Once a malicious program is installed on a system, it is essential that it stays concealed, to avoid detection. Techniques known as ''rootkits'' allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read.

Some malicious programs contain routines to defend against removal, not merely to hide themselves, but to resist attempts to remove them. An early example of this behavior is recorded in the Jargon File tale of a pair of programs infesting a Xerox CP-V time sharing system:

:Each ghost-job would detect the fact that the other had been killed, and would start a new copy of the recently stopped program within a few milliseconds. The only way to kill both ghosts was to kill them simultaneously (very difficult) or to deliberately crash the system.

Backdoors[link]

A backdoor is a method of bypassing normal authentication procedures. Once a system has been compromised, one or more backdoors may be installed in order to allow easier access in the future. Backdoors may also be installed prior to malicious software, to allow attackers entry.

The idea has often been suggested that computer manufacturers preinstall backdoors on their systems to provide technical support for customers, but this has never been reliably verified. Crackers typically use backdoors to secure remote access to a computer, while attempting to remain hidden from casual inspection. To install backdoors crackers may use Trojan horses, worms, or other methods.

Malware for profit: spyware, botnets, keystroke loggers, and "Ransom" Malware[link]

During the 1980s and 90s, it was usually taken for granted that malicious programs were created as a form of vandalism or prank. Since then, a greater share of malware programs have been written with a profit motive (financial or otherwise) in mind.

Spyware programs are commercially produced for the purpose of gathering information about computer users. Some examples being pop-up ads or altering web-browser behavior for the financial benefit of the spyware creator. For instance, some spyware programs redirect search engine results to paid advertisements. Others, often called "stealware" by the media, overwrite affiliate marketing codes so that revenue is redirected to the spyware creator instead of the intended recipient.

Another way that financially motivated malware creators can profit from infecting computers is to directly use the infected computers to work for them. The infected computers are used to send out spam messages (as proxies). A computer in this state is often known as a zombie computer. The advantage for spammers of using infected computers is anonymity, which can protect the spammer from prosecution. Spammers have also used infected PCs to target anti-spam organizations with attacks designed to stop their intervention (i.e. distributed denial-of-service attacks). In order to coordinate the activity of many infected computers, attackers sometimes use coordinating systems known as ''botnets''. In a botnet, the malware or malbot logs in to an Internet Relay Chat channel or other chat system.

Data-stealing malware[link]

Data-stealing malware is a web threat that divest victims of personal and proprietary information with the purpose of monetizing stolen data through direct use or underground distribution. Content security threats that fall under this umbrella include keyloggers, screen scrapers, spyware, adware, backdoors, and bots. The term does not refer to activities such as spam, phishing, DNS poisoning, SEO abuse, etc. However, when these threats result in file download or direct installation, as most hybrid attacks do, files that act as agents to proxy information will fall into the data-stealing malware category.

Characteristics of data-stealing malware[link]

Does not leave traces of the event

The malware is typically stored in a cache that is routinely flushed

The malware may be installed via a drive-by-download process

The website hosting the malware as well as the malware is generally temporary or rogue

Frequently changes and extends its functions

It is difficult for antivirus software to detect final payload attributes due to the combination(s) of malware components

The malware uses multiple file encryption levels

Thwarts Intrusion Detection Systems (IDS) after successful installation

There are no perceivable network anomalies

The malware hides in web traffic

The malware is stealthier in terms of traffic and resource use

Thwarts disk encryption

Data is stolen during decryption and display

The malware can record keystrokes, passwords, and screenshots

Thwarts Data Loss Prevention (DLP)

Leakage protection hinges on metadata tagging, not everything is tagged

Miscreants can use encryption to port data

Examples of data-stealing malware[link]

Bancos, an info stealer that waits for the user to access banking websites then spoofs pages of the bank website to steal sensitive information.

Gator, spyware that covertly monitors web-surfing habits, uploads data to a server for analysis then serves targeted pop-up ads.

LegMir, spyware that steals personal information such as account names and passwords related to online games.

Qhost, a Trojan that modifies the Hosts file to point to a different DNS server when banking sites are accessed then opens a spoofed login page to steal login credentials for those financial institutions.

Data-stealing malware incidents[link]

Albert Gonzalez (not to be confused with the U.S. Attorney General Alberto Gonzalez) is accused of masterminding a ring to use malware to steal and sell more than 170 million credit card numbers in 2006 and 2007—the largest computer fraud in history. Among the firms targeted were BJ's Wholesale Club, TJX, DSW Shoes, OfficeMax, Barnes & Noble, Boston Market, Sports Authority and Forever 21. A Trojan horse program stole more than 1.6 million records belonging to several hundred thousand people from Monster Worldwide Inc’s job search service. The data was used by cybercriminals to craft phishing emails targeted at Monster.com users to plant additional malware on users’ PCs. Customers of Hannaford Bros. Co., a supermarket chain based in Maine, were victims of a data security breach involving the potential compromise of 4.2 million debit and credit cards. The company was hit by several class-action law suits. The Torpig Trojan has compromised and stolen login credentials from approximately 250,000 online bank accounts as well as a similar number of credit and debit cards. Other information such as email, and FTP accounts from numerous websites, have also been compromised and stolen.

Controversy about assignment to spyware[link]

There is a group of software (Alexa toolbar, Google toolbar, Eclipse data usage collector, etc.) that send data to a central server about which pages have been visited or which features of the software have been used. However differently from "classic" malware these tools document activities and only send data with the user's approval. The user may opt in to share the data in exchange to the additional features and services, or (in case of Eclipse) as the form of voluntary support for the project. Some security tools report such loggers as malware while others do not. The status of the group is questionable. Some tools like PDFCreator are more on the boundary than others because opting out has been made more complex than it could be (during the installation, the user needs to uncheck two check boxes rather than one). However, PDFCreator is only sometimes mentioned as malware and is still a subject of discussions.

Vulnerability to malware[link]

In this context, as throughout, it should be borne in mind that the “system” under attack may be of various types, e.g. a single computer and operating system, a network or an application.

Various factors make a system more vulnerable to malware:

Homogeneity: e.g. when all computers in a network run the same operating system; upon exploiting one, one can exploit them all.

Weight of numbers: simply because the vast majority of existing malware is written to attack Windows systems, then Windows systems are more vulnerable to succumbing to malware attacks (regardless of the security strengths or weaknesses of Windows itself).

Defects: malware using defects in the operating system design.

Unconfirmed code: code from a floppy disk, CD-ROM or USB device may be executed without the user’s permission.

Over-privileged users: some systems allow all users to modify their internal structures. This was the standard operating procedure for early microcomputer and home computer systems, where there was no distinction between an ''Administrator'' or ''root'', and a regular user of the system.

Over-privileged code: some systems allow code executed by a user to access all rights of that user. Also standard operating procedure for early microcomputer and home computer systems.

Use of the same operating system[link]

An oft-cited cause of vulnerability of networks is consistent use of the same operating system. For example, Microsoft Windows or the Apple O.S. have such a large share of the market that concentrating on either could enable an exploited vulnerability to subvert a large number of systems. Instead, introducing diversity, purely for the sake of robustness, could increase short-term costs for training and maintenance. However, having a few diverse nodes would deter total shutdown of the network, and allow those nodes to help with recovery of the infected nodes. Such separate, functional redundancy could avoid the cost of a total shutdown.

Software bugs[link]

Most systems contain bugs, or loopholes, which may be exploited by malware. A typical example is the buffer-overrun weakness, in which an interface designed to store data, in a small area of memory, allows the caller to supply more data than will fit. This extra data then overwrites the interface's own executable structure (past the end of the buffer and other data). In this manner, malware can force the system to execute malicious code, by replacing legitimate code with its own payload of instructions (or data values) copied into live memory, outside the buffer area.

Originally, PCs had to be booted from floppy disks, and until recently it was common for this to be the default boot device. This meant that a corrupt floppy disk could subvert the computer during booting, and the same applies to CDs. Although that is now less common, it is still possible to forget that one has changed the default, and rare that a BIOS makes one confirm a boot from removable media.

Over-privileged users[link]

In some systems, non-administrator users are over-privileged by design, in the sense that they are allowed to modify internal structures of the system. In some environments, users are over-privileged because they have been inappropriately granted administrator or equivalent status. This is primarily a configuration decision, but on Microsoft Windows systems the default configuration is to over-privilege the user.

As privilege escalation exploits have increased this priority is shifting for the release of Microsoft Windows Vista. As a result, many existing applications that require excess privilege (over-privileged code) may have compatibility problems with Vista. However, Vista's User Account Control feature attempts to remedy applications not designed for under-privileged users, acting as a crutch to resolve the privileged access problem inherent in legacy applications.

Malware, running as over-privileged code, can use this privilege to subvert the system. Almost all currently popular operating systems, and also many scripting applications allow code too many privileges, usually in the sense that when a user executes code, the system allows that code all rights of that user. This makes users vulnerable to malware in the form of e-mail attachments, which may or may not be disguised.

Given this state of affairs, users are warned only to open attachments they trust, and to be wary of code received from untrusted sources. It is also common for operating systems to be designed so that device drivers need escalated privileges, while they are supplied by more and more hardware manufacturers.

Eliminating over-privileged code[link]

Over-privileged code dates from the time when most programs were either delivered with a computer or written in-house, and repairing it would at a stroke render most antivirus software almost redundant. It would, however, have appreciable consequences for the user interface and system management.

The system would have to maintain privilege profiles, and know which to apply for each user and program. In the case of newly installed software, an administrator would need to set up default profiles for the new code.

Eliminating vulnerability to rogue device drivers is probably harder than for arbitrary rogue executables. Two techniques, used in VMS, that can help are memory mapping only the registers of the device in question and a system interface associating the driver with interrupts from the device.

Other approaches are:

Various forms of virtualization, allowing the code unlimited access only to virtual resources

Various forms of sandbox or jail

The security functions of Java, in java.security

Such approaches, however, if not fully integrated with the operating system, would reduplicate effort and not be universally applied, both of which would be detrimental to security.

Anti-malware programs[link]

As malware attacks become more frequent, attention has begun to shift from viruses and spyware protection, to malware protection, and programs have been developed specifically to combat them.

Anti-virus and anti-malware software commonly hooks deep into the operating system's core or kernel functions in a manner similar to how malware itself would attempt to operate, though with the user's informed permission for protecting the system. Any time the operating system does something, the anti-malware software checks that the OS is doing an approved task. This commonly slows down the operating system and/or consumes large amounts of system memory. The goal is to preempt any operations the malware may attempt on the system, including activities which might exploit bugs or trigger unexpected operating system behavior.

Anti-malware programs can combat malware in two ways: # They can provide real time protection against the installation of malware software on a computer. This type of spyware protection works the same way as that of antivirus protection in that the anti-malware software scans all incoming network data for malware software and blocks any threats it comes across. # Anti-malware software programs can be used solely for detection and removal of malware software that has already been installed onto a computer. This type of anti-malware software scans the contents of the Windows registry, operating system files, and installed programs on a computer and will provide a list of any threats found, allowing the user to choose which files to delete or keep, or to compare this list to a list of known malware components, removing files that match.

Real-time protection from malware works identically to real-time antivirus protection: the software scans disk files at download time, and blocks the activity of components known to represent malware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many malware components are installed as a result of browser exploits or user error, using security software (some of which are anti-malware, though many are not) to "sandbox" browsers (essentially babysit the user and their browser) can also be effective in helping to restrict any damage done.

Website security scans[link]

As malware also harms the compromised websites (by breaking reputation, blacklisting in search engines, etc.), some companies offer the paid site scan service. Such scans periodically check the site, detecting malware, noticed security vulnerabilities, outdated software stack with known security issues, etc. The found issues are only reported to the site owner who can fix them. The provider may also offer the security badge that the owner can only display if the site has been recently scanned and is "clean".

Academic research[link]

The notion of a self-reproducing computer program can be traced back to initial theories about the operation of complex automata. John von Neumann showed that in theory a program could reproduce itself. This constituted a plausibility result in computability theory. Fred Cohen experimented with computer viruses and confirmed Neumann's postulate and investigated other properties of malware such as detectability, self-obfuscation using rudimentary encryption, and others. His 1988 Doctoral dissertation was on the subject of computer viruses.

Cohen's faculty advisor, Leonard Adleman (the A in RSA) presented a rigorous proof that, in the general case, algorithmically determined whether a virus is or is not present called the Turing undecidable. This problem must not be mistaken for that of determination within a broad class of programs that a virus is not present. This problem differs in that it does not require the ability to recognize all viruses.

Adleman's proof is perhaps the deepest result in malware computability theory to date and it relies on Cantor's diagonal argument as well as the halting problem. Ironically, it was later shown by Young and Yung that Adleman's work in cryptography is ideal in constructing a virus that is highly resistant to reverse-engineering by presenting the notion of a cryptovirus. A cryptovirus is a virus that contains and uses a public key and randomly generated symmetric cipher initialization vector (IV) and session key (SK).

In the cryptoviral extortion attack, the virus hybrid encrypts plaintext data on the victim's machine using the randomly generated IV and SK. The IV+SK are then encrypted using the virus writer's public key. In theory the victim must negotiate with the virus writer to get the IV+SK back in order to decrypt the ciphertext (assuming there are no backups). Analysis of the virus reveals the public key, not the IV and SK needed for decryption, or the private key needed to recover the IV and SK. This result was the first to show that computational complexity theory can be used to devise malware that is robust against reverse-engineering.

A growing area of computer virus research is to mathematically model the infection behavior of worms using models such as Lotka–Volterra equations, which has been applied in the study of biological virus. Various virus propagation scenarios have been studied by researchers such as propagation of computer virus, fighting virus with virus like predator codes, effectiveness of patching etc.

Behavioral malware detection has been researched more recently. Most approaches to behavioral detection are based on analysis of system call dependencies. The executed binary code is traced using strace or more precise taint analysis to compute data-flow dependencies among system calls. The result is a directed graph $G=(V,E)$ such that nodes are system calls, and edges represent dependencies. For example, $(s,t)\backslash in\; E$ if a result returned by system call $s$ (either directly as a result or indirectly through output parameters) is later used as a parameter of system call $t$. The origins of the idea to use system calls to analyze software can be found in the work of Forrest et al. Christodorescu et al. point out that malware authors cannot easily reorder system calls without changing the semantics of the program, which makes system call dependency graphs suitable for malware detection. They compute a difference between malware and goodware system call dependency graphs and use the resulting graphs for detection, achieving high detection rates. Kolbitsch et al. pre-compute symbolic expressions and evaluate them on the syscall parameters observed at runtime.

They detect dependencies by observing whether the result obtained by evaluation matches the parameter values observed at runtime. Malware is detected by comparing the dependency graphs of the training and test sets. Fredrikson et al. describe an approach that uncovers distinguishing features in malware system call dependency graphs. They extract significant behaviors using concept analysis and leap mining. Babic et al. recently proposed a novel approach for both malware detection and classification based on grammar inference of tree automata. Their approach infers an automaton from dependency graphs, and they show how such an automaton could be used for detection and classification of malware.

Grayware[link]

Grayware (or Greynet) is a general term sometimes used as a classification for applications that behave in a manner that is annoying or undesirable, and yet less serious or troublesome than malware. Grayware encompasses spyware, adware, dialers, joke programs, remote access tools, and any other unwelcome files and programs apart from viruses that are designed to harm the performance of computers on one's network. The term has been in use since at least as early as September 2004.

Grayware refers to applications or files that are not classified as viruses or trojan horse programs, but can still negatively affect the performance of the computers on a network and introduce significant security risks to an organization. Often grayware performs a variety of undesired actions such as irritating users with pop-up windows, tracking user habits and unnecessarily exposing computer vulnerabilities to attack.

Spyware is software that installs components on a computer for the purpose of recording Web surfing habits (primarily for marketing purposes). Spyware sends this information to its author or to other interested parties when the computer is online. Spyware often downloads with items identified as 'free downloads' and does not notify the user of its existence or ask for permission to install the components. The information spyware components gather can include user keystrokes, which means that private information such as login names, passwords, and credit card numbers are vulnerable to theft.

Adware is software that displays advertising banners on Web browsers such as Internet Explorer and Mozilla Firefox. While not categorized as malware, many users consider adware invasive. Adware programs often create unwanted effects on a system, such as annoying popup ads and the general degradation in either network connection or system performance. Adware programs are typically installed as separate programs that are bundled with certain free software. Many users inadvertently agree to installing adware by accepting the End User License Agreement (EULA) on the free software. Adware are also often installed in tandem with spyware programs. Both programs feed off each other's functionalities: spyware programs profile users' Internet behavior, while adware programs display targeted ads that correspond to the gathered user profile.

Web and spam[link]

The World Wide Web is a criminals' preferred pathway for spreading malware. Today's web threats use combinations of malware to create infection chains. About one in ten Web pages may contain malicious code.

Wikis and blogs[link]

Attackers may use wikis and blogs to advertise links that lead to malware sites.

Wiki and blog servers can also be attacked directly. In 2010, Network Solutions was compromised and some hosted sites became a path to malware and spam.

Targeted SMTP threats[link]

Targeted SMTP threats also represent an emerging attack vector through which malware is propagated. As users adapt to widespread spam attacks, cybercriminals distribute crimeware to target one specific organization or industry, often for financial gain.

See also[link]

Browser hijacker

Computer crime

Computer insecurity

Cyber spying

Firewall (computing)

Identity theft

Industrial espionage

It risk

Malvertising

Play mp3.exe (trojan)

Privacy-invasive software

Security in Web applications

Social engineering (security)

Spy software

Targeted threat

Web security exploits

Web server overload causes

White-collar crime

References[link]

External links[link]

Home Computer Security - Carnegie Mellon Software Institute

OnGuard Online.gov – How to Secure Your Computer

Open Security Foundation Data Loss Database

Internet Crime Complaint Center

APWG Unified Cybercrime Response and Educatioin

Video: Mark Russinovich – Advanced Malware Cleaning

MalCon, International Malware Conference (convention), focused specifically on Malware development, research and containment.

Jamie Crapanzano (2003): "Deconstructing SubSeven, the Trojan Horse of Choice", SANS Institute, Retrieved on 2011-05-23

The commercialization of malware distribution: Pay per install

ar:برمجيات خبيثة az:Ziyankar proqram zh-min-nan:Pháiⁿ-thé bs:Malware ca:Malware cs:Malware da:Malware de:Schadprogramm et:Kurivara el:Κακόβουλο λογισμικό es:Malware eu:Malware fa:بدافزار fr:Logiciel malveillant ga:Bogearraí mailíseacha ko:악성코드 hy:Վնասակար ծրագիր hi:मैलवेयर hr:Zloćudni softver id:Perangkat perusak it:Malware he:נוזקה kn:ಮಾಲ್‌ವೇರ್ hu:Malware mk:Злонамерен програм ml:മാൽവെയർ ms:Perisian perosak my:မောလ်ဝဲလ် nl:Malware ja:マルウェア no:Malware nn:Malware pl:Złośliwe oprogramowanie pt:Malware ro:Software rău intenționat ru:Вредоносная программа sq:Malware simple:Malware sk:Malware sr:Малвер sh:Malware fi:Haittaohjelma sv:Malware ta:தீம்பொருள் th:มัลแวร์ tr:Kötücül yazılım (malware) bug:Malware uk:Шкідливий програмний засіб ur:مصنع‌خبیث vi:Phần mềm ác ý zh:恶意软件