Go straight to page content
JANET CSIRT
ja.net
the UK's education and research network
                  JANET CSIRT front page Reporting abuse E-mail including "spam" Scanning Denial of Service Security advice Very basic measures Security in detail Building safe networks Policies Legislation and regulation The threats to networks Viruses and worms Deliberate attacks Users of the network E-mail abuse About JANET CSIRT External relationships Training and courses Reports and statistics About JANET Contact JANET CSIRT

JANET CSIRT webmaster:
webmaster@csirt.ja.net
JANET(UK) privacy policy
Google Analytics notice
© The JNT Association 2007

Viruses and similar threats

Automated processes can result in unwanted software running on your computers in a number of ways. Such software is called a virus, a worm, a bot, a zombie, spyware, a trojan and other things from time to time according to current fashion and to one or more of its detailed characteristics.

In almost all cases any damage done is not specific to your network, and many of the symptoms you may see are related to the propagation of the software from one computer or network to another. All computers used in the Internet are continually exposed to attempts by all such software to spread to them; again, entry attempts are indiscriminate and occur without the target network having been specifically chosen.

Taxonomy

Definitions are not universally agreed, in many cases they overlap, and this list is by no means exhaustive. Nevertheless, it is sometimes helpful to distinguish between some of the abusive behaviours here.

Adware Software that once installed displays adverts without the user's consent.
Often combined with spyware. Most software of this kind tries to obfuscate its intentions and is difficult to remove.
Backdoor A program which once installed provides covert access to a system for an unauthorised third party.
Bot, zombie Software installed when a computer is compromised through some initial malware activity which receives commands from a remote malicious user unknown to the owner or legitimate user of the computer.
Botnet A collection of bots or zombies under the control of a single malicious user.
Thousands of computers all over the Internet may be controlled in this way, providing considerable computing and bandwidth resources for whatever undesirable purposes the controller chooses.
Dialer Software which dials a premium rate number without the permission of the computer's owner in order to run up profits for the people owning the premium rate lines.
Often a user is persuaded to install the software as a trojan.
Logger Software that covertly monitors and logs activity on a computer, typically capturing and saving key presses.
Similar to spyware, and often introduced as part of a trojan or rootkit.
Malware A generic term for any malicious software introduced to a computer without the knowledge and intention of its legitimate user.
Rootkit A program which subverts the operating system to hide its presence or its activity on the system.
Normally includes a backdoor facility.
Spyware Software that once installed (often as a trojan) monitors your computer usage, possibly obtaining account details and passwords, and sends the resulting information to a third party.
Often combined with adware. Most software of this kind tries to obfuscate its intentions and is difficult to remove.
Trojan [Horse] A malicious program installed by the action of a legitimate user, having persuaded them that it is benign or useful software.
Virus A self-replicating program which spreads by inserting itself into executable data.
It may be introduced into a system or propagated between systems as a worm or trojan.
Worm A self-replicating program which spreads by exploiting software vulnerabilities over a network, spreading itself from one system to the next.
No action by a user is required for a worm to spread in this way.

Symptoms

Symptoms of malicious software running on your computer include a slowing of performance and lack of resources, unusual system and network activity and unwanted web pages or adverts opening without solicitation.
A network manager can expect to see infected computers scanning their own networks and networks throughout the Internet, attempting connections to a great number of IP addresses on the same port as the unwanted software tries to propagate to further computers.

What to do