Lesson 4 — Beginner

Malware (Viruses, Worms, Trojans, Ransomware)

Malware (malicious software) attackers ka sabse purana hathiyar hai. Is lesson mein hum virus, worm, trojan aur ransomware ka farak samjhenge, wo failta kaise hai, aur practically kaise bachein — ye har exam aur interview ka guaranteed topic hai.

⏱ 14 min• Beginner• Cyber Threats

Malware kya hai

WHAT

Malware wo harmful software hai jo chupke se system mein aake nuksaan karta hai — data churana, damage karna, ya control lena. Malware ek umbrella term hai, virus uske andar ek type hai.

WHEN

Jab bhi pirated software chalu ho, update pending ho, unknown attachment khule, ya infected USB lage — malware ka chance hai.

WHERE

PC, laptop, phone, server, aur ab IoT devices (camera, router) bhi — jahan software hai wahan malware aa sakta hai.

Yaad rakho: Malware = intention (nuksaan), bug = galti (accidental). Dono ka farak exam mein poochha jaata hai.

Malware ke type — farak samjho

Virus      : khud ko COPY karke host file mein attach
             → chalne ke liye user/file ko chahiye, spread karta hai
Worm       : khud NETWORK se spread (host file ki zarurat nahi)
             → ek infection = poora network risk
Trojan     : useful dikh kar aata hai (game, cracked app, tool)
             → user khud install kar leta hai, phir control ban jaata
Ransomware : data ENCRYPT karke ransom mangta hai (Bitcoin)
Spyware    : chupke se activity record (keystroke, screen, location)
Adware     : annoying ads dikhata hai (kabhi kabhi spyware bhi)
Rootkit    : system ke andar chhupa, apne aap ko chhupata hai
Keylogger  : har key press likhta hai (password churaane ke liye)

Classic confusion: Virus = host file chahiye, Worm = khud network se, Trojan = useful dikhna zaroori. Ye teen line har exam mein aati hain — ratta maar lo, par mechanism samajh ke.

Malware failta kaise hai

Email attachment: invoice/jaankari dikh ke aaya file — kholte hi macro/hidden code chalu.
Download: pirated movie/software, fake "player update" jaisi sites.
USB/removable media: autorun ke through infected pendrive.
Drive-by download: koi site khulte hi background mein download (bina click).
Social engineering: "Ye file dekho, jaldi bhejo" — aksar human hi trigger hota hai.
Exploit kits: browser/OS ka unpatched flaw use karke andar aana.

Sabka common point: koi na koi "human moment" — click, install, ya ignore. Isliye awareness + updates dono chahiye.

Defense — practical checklist

Bachao formula (defense in depth):

1. UPDATES    : OS + browser + apps patched (exploit ka raasta band)
2. ANTIVIRUS  : real-time on, definitions updated, weekly full scan
3. BACKUP     : 3-2-1 rule — 3 copies, 2 media, 1 OFFLINE/immutable
                 (ransomware se sirf yahi bachata hai)
4. EMAIL      : attachment/link pe click se pehle sender verify
5. PRINCIPLE  : daily kaam ke liye admin account mat use karo
                 (least privilege — malware ko power nahi milegi)
6. BLOCK      : unknown USB autorun off, macro carefully

Ransomware response : backup restore > ransom payment (policy: pay nahi)

Ek hi nuskha jo sabse zyada bachata hai: Updated rehna. WannaCry jaisa attack unpatched machines mein ghusa — jinke updates chalu the wo safe rahe.

Exercise

Question: Virus ko apne failne ke liye host file chahiye — sahi ya galat? (sahi/galat)

Question: Ransomware kis cheez ko encrypt karke ransom mangta hai? (data/wifi/router)

Question: Useful dikh kar install hone wala malware kaunsa hai? (virus/trojan/worm)

Common mistakes

Virus aur worm ka farak ulta bolna: Virus = host file chahiye, worm = khud network se spread karta hai. Ye classic TCS/exam question hai.
Trojan ko virus samajhna: Trojan ek BEHAVIOR type hai — dikhne mein useful, andar kharab. Wo khud spread nahi karta, user hi install karwa leta hai.
Ransomware pehle backup nahi rakhta: Backup hi asli insurance hai. Offline/immutable backup ho toh attack ke baad bina ransom diye recover ho jaata hai.

Desi example: WannaCry 2017 — jab duniya ruki

2017 ka WannaCry ransomware Bharat mein bhi kai government offices aur hospitals ko paralyze kar gaya. Attack ek purane Windows flaw (EternalBlue) par tha — jinke updates pending the unhe nuksaan hua:

Vuln  : Windows SMB flaw (patch pending tha)
Bachao: MS17-010 update lagaya = safe
Lesson : patch ka matlab "boring update" nahi,
         emergency brake hai — lagao turant
Backup : offline tha toh data wapas mil gaya

Exam mapping (TCS / CUET / CEH)

TCS NQT: virus vs worm vs trojan — har session mein 1Q.
CUET: malware ke type + ransomware definition.
CEH Module 2: malware classification detail mein.
Trap: "Trojan spreads automatically like worm" — galat, user install karta hai.

Lesson complete?

Malware ke type clear. Agla lesson — Network Attacks — mein dekhenge server down karne aur traffic churaane wale attacks.