I.33 Viruses

⬆️ Back to: P-I.I. Introduction to Computing

🧭

Page Outline — click a heading to jump. Past-paper questions sit in the last section.

🎯

Exam pattern (2016–2026): 2019 Q2(c) virus parts and phases · 2024 Q2(b) virus vs trojan vs worm · 2024 MCQs Q9, Q12 · 2025 MCQ Q9. High priority.

---

CSS Computer Science (Optional) — Paper-I, Section-A, Topic I, p.73. Covers: Viruses.

Definition

• Malware ("malicious software"): any program designed to damage, disrupt, or gain unauthorized access to a computer system — viruses, worms, trojans, ransomware, and spyware are its main categories, each spreading and behaving differently.

Malware Categories

• Virus: a malicious program that attaches itself to a legitimate host file or program (e.g., an executable or a document macro) and lies dormant until the host is run, then replicates by inserting copies of itself into other files/programs.
  • How it spreads: requires user action — opening an infected attachment or running an infected program — to activate and spread.
  • Example: the Melissa virus (1999), spread via infected Word-document macros emailed to victims.
  • Impact: can corrupt or delete files and spread further once activated.
  • Defense: antivirus signature scanning and avoiding untrusted attachments.
• Worm: a standalone, self-replicating malicious program that spreads automatically across a network by exploiting vulnerabilities.
  • How it spreads: does not need to attach to a host file, and requires no user action.
  • Example: the Morris Worm (1988), one of the first worms to spread across the early Internet.
  • Impact: can rapidly overwhelm networks purely through self-propagation, consuming bandwidth and system resources.
  • Defense: timely security patching and network firewalls/intrusion detection.
• Trojan (Trojan Horse): malicious software disguised as, or bundled with, legitimate/desirable software to trick a user into voluntarily installing it.
  • How it spreads: unlike viruses and worms, it does not self-replicate — it relies entirely on deception, and once installed may open a "backdoor" for attackers or steal data.
  • Example: the Zeus trojan, historically bundled with pirated software to steal banking credentials.
  • Defense: installing software only from trusted sources.
• Ransomware: encrypts a victim's files (or locks them out of their system) and demands payment — often in cryptocurrency — for the decryption key.
  • How it spreads: delivered via a virus, worm, trojan, or phishing email as the initial infection vector.
  • Example: WannaCry (2017), which encrypted files on hundreds of thousands of computers worldwide and demanded Bitcoin payment, spreading itself worm-style through a Windows network vulnerability.
  • Impact: can cripple organizations (hospitals, businesses) by denying access to critical data.
  • Defense: regular offline backups so encrypted data can be restored without paying.
• Spyware: covertly monitors and collects a user's activity (keystrokes, browsing habits, credentials) and transmits it to a third party without consent.
  • Sub-type: a keylogger records every keystroke to capture passwords.
  • Example: spyware bundled with a "free" downloaded utility that silently harvests login credentials.
  • Impact: identity theft and financial loss.
  • Defense: anti-spyware tools and reviewing app permissions before installing.

Comparison Table

---

MCQ Traps

• A virus needs a host file and user action to spread; a worm self-replicates and spreads on its own across a network — the single most commonly confused pair in this section.
• Trojans do not self-replicate — that's what distinguishes them from both viruses and worms.
• Ransomware and spyware are defined by their purpose (extortion vs covert monitoring), not by their spreading mechanism — they can be delivered via virus, worm, or trojan methods.

✅ Self-Test Questions (with Answers)

Q1. Distinguish a virus, a worm, and a trojan by their spreading mechanism.

Ans: All three are categories of malware, but they are classified by how they propagate, and this is the most heavily examined distinction in the topic. A virus is a parasitic program that attaches itself to a legitimate host file or program — an executable, a boot sector, or a document macro — and lies dormant until that host is run. It cannot travel on its own: it requires user action, such as opening an infected attachment or running an infected program, and once activated it replicates by inserting copies of itself into other files. The Melissa virus (1999), spread through infected Word macros, is the standard example.

A worm is a standalone, self-replicating program that needs neither a host file nor any user action. It spreads automatically across a network by scanning for and exploiting unpatched vulnerabilities, which gives it exponential propagation — the Morris Worm (1988) and SQL Slammer (2003) are classic cases.

A trojan horse is malware disguised as, or bundled with, legitimate and desirable software so that the user installs it voluntarily. It spreads purely by deception and, critically, does not self-replicate at all; once installed it typically opens a backdoor or steals data, as with the Zeus trojan used to harvest banking credentials.

A useful summary: a virus needs a carrier and a careless click, a worm needs only a network and an unpatched hole, and a trojan needs only a convincing lie.

Q2. What does ransomware do, and how does it differ from spyware in purpose?

Ans: Ransomware encrypts the victim's files — or locks them out of the system entirely — and demands a payment, typically in cryptocurrency such as Bitcoin, in exchange for the decryption key. It is extortion by denial of access: the data is not usually stolen or destroyed, it is made unusable, and in security terms the attack targets availability. Modern "double extortion" variants additionally exfiltrate the data first and threaten publication if the ransom is refused. The attack is loud and deliberately visible — the victim is meant to know immediately, since the whole scheme depends on the demand being received.

Spyware covertly monitors and collects a user's activity — keystrokes, browsing history, credentials, screenshots, sometimes microphone or camera data — and transmits it to a third party without consent. Its purpose is surveillance and information theft, targeting confidentiality, and its success depends on remaining undetected for as long as possible. A keylogger is the common sub-type that records every keystroke to capture passwords.

The essential contrast is therefore between denying the owner access to their own data and quietly taking a copy of it.

Note for the exam that both are defined by purpose, not by spreading mechanism — either can be delivered via a virus, a worm, a trojan or a phishing email. WannaCry (May 2017) is the standard example, encrypting files on hundreds of thousands of machines worldwide, crippling parts of the UK's National Health Service, and spreading worm-style through a Windows SMB vulnerability. The single most effective defence against ransomware is regular offline or immutable backups, which allow restoration without paying.

Q3. Which malware type requires no host file and no user action to spread?

Ans: The worm. A worm is a standalone, self-replicating program: unlike a virus it does not need to attach itself to a host file or program, and unlike a virus or trojan it does not need the victim to open an attachment, run an executable or install anything. It propagates autonomously across a network by scanning for machines running vulnerable, unpatched software and exploiting that vulnerability directly to copy itself onto the new host, which then repeats the process. This gives worms exponential propagation and makes them the fastest-spreading malware class.

The classic illustration is the Morris Worm (November 1988), written by Robert Tappan Morris, which spread across the early Internet and disabled a significant share of the machines then connected — leading to the first conviction under the US Computer Fraud and Abuse Act and the creation of the first CERT (Computer Emergency Response Team). Later examples include Code Red and SQL Slammer (2003), which saturated networks within minutes, and WannaCry (2017), which combined ransomware payload with worm-style self-propagation through the EternalBlue SMB vulnerability in Windows.

Because worms exploit technical vulnerabilities rather than human error, the primary defence is not user awareness but timely security patching, supported by network firewalls, network segmentation and intrusion-detection systems.

Exam note: "No host file, no user action" is the standard MCQ phrasing that uniquely identifies a worm, and virus-versus-worm is the most frequently confused pair in this topic.

📜 Past-Paper Questions & MCQs (CSS 2016–2026)

2019 · Paper-I · Q2(c) · 5 marks

Q. What are the main parts and phases of a computer virus program?

Quick revision and exam-ready model

Quick revision — key points

• Virus attaches to a host and replicates
• Parts: infection mechanism, trigger and payload
• Phases: dormant, propagation, triggering, execution
• A worm differs because it does not need a host file

Exam-ready answer (5 marks)

Introduction: A computer virus is malicious code that depends on a host program or file for its infection and reproduction. Its structure can be explained through three main parts and four commonly taught phases.

A. Main parts

1. Infection mechanism: The component responsible for spreading copies into suitable host files or programs.
2. Trigger: A defined event or condition that activates its intended behaviour, such as a date or another system event.
3. Payload: The effects produced by the virus, which may include altering stored information or disrupting normal operations.

B. Phases of a computer virus

1. Dormant phase: The code remains inactive while awaiting suitable conditions; not every virus has this phase.
2. Propagation phase: Further copies are made in suitable hosts.
3. Triggering phase: The specified activation condition occurs.
4. Execution phase: The programmed effect takes place.

Example: A file-infecting virus may remain inactive until its host program runs, after which its programmed behaviour may be activated.

Conclusion: The infection mechanism, trigger and payload describe the virus's components, while the four phases describe its possible life cycle.

2024 · Paper-I · Q2(b) · 6 marks

Q. Discuss the difference between a computer virus, a trojan and a worm.

Quick revision and exam-ready model

Quick revision — key points

• Virus needs an infected host to replicate
• Worm spreads independently across systems
• Trojan disguises itself and need not replicate
• Compare propagation and prevention

Exam-ready answer — structured

Exam-ready comparison (6 marks)

Introduction: Viruses, worms and Trojan horses are three categories of malware distinguished by how they depend on host software, reproduce and reach computers.

Main explanation

1. Computer virus

• A virus infects a host file or program and reproduces when that host is activated.
• Example: A compromised executable file containing an infection.

2. Computer worm

• A worm is standalone malware that can replicate without attaching to a host file.
• It may spread between computers through network vulnerabilities.
• Example: A worm propagating across vulnerable systems.

3. Trojan horse

• A Trojan appears to be legitimate software but contains harmful functionality.
• It relies on deception rather than inherent self-replication.
• Example: A fake utility that secretly collects information.

Comparison

Protection and conclusion

• Apply security updates, trusted endpoint protection and careful software-download practices.
• In summary: a virus infects a host, a worm reproduces independently, and a Trojan deceives users.

MCQs

2024 P-I · Q9. Which of the following is considered as the world's first antivirus program?

• (A) Tinkered
• (B) Reaper ✅
• (C) Creeper
• (D) None of these
• Answer: (B) Reaper.
• Why: Creeper (1971) was the first self-replicating program (an experimental worm on ARPANET). Reaper was written to find and delete Creeper, so it is regarded as the first antivirus. "Tinkered" is not a known program.

2024 P-I · Q12. Which of the following malware types does not infect others and duplicate or clone itself?

• (A) Rootkits
• (B) Trojans ✅
• (C) Worms
• (D) None of these
• Answer: (B) Trojans.
• Why: a Trojan hides inside a useful-looking program and relies on the user to install it. It does not copy itself. Worms replicate across networks. (Rootkits also do not self-replicate, but they hide other malware, so the classic non-replicating answer here is the Trojan.)

2025 P-I · Q9. What is the main purpose of using Trojans?

• (A) To get passwords ✅
• (B) To delete data
• (C) To corrupt files
• (D) None of these
• Answer: (A) To get passwords.
• Why: the usual aim of a Trojan is to give the attacker a backdoor and to steal credentials and other data. Deleting or corrupting files is mainly the job of other malware such as viruses and wipers.