Which among the following is a malicious software?

Correct — C, Trojan Horse. The stem asks specifically for malicious software, so the answer has to be a program, and of the four options only the Trojan horse is one. A Trojan horse is a program that presents itself as something the user wants — a game, a utility, a codec, a cracked copy of a paid application — and carries a hidden hostile payload. It takes its name from the wooden horse of the Iliad for the same reason: the victim carries it inside the defences voluntarily. What it does once inside varies. It may open a back door for remote control, steal credentials, install further malware, or enlist the machine in a botnet. The feature that distinguishes it from the two other classic malware types is that it does not reproduce itself. A virus attaches itself to a host file or program and spreads when that host is run or copied; a worm is self-contained and spreads across a network without any user action at all; a Trojan does neither, and relies entirely on persuading a person to run it. That reliance on deception rather than propagation is why it remains one of the commonest delivery routes for ransomware and spyware. The other three options fail the stem in two different ways: hacking and password cracking are things people do, not programs, and a firewall is software but is defensive.

• (a)Hacking — An activity, not a piece of software — the practice of gaining unauthorised access to a system. Malicious software may be one of the tools used, but the word names the act.
• (b)Password Cracking — Also an activity — recovering passwords from stored hashes by dictionary, brute-force or rainbow-table methods. Tools exist for it, but the option names the technique rather than a malicious program.
• (d)Firewall — Software or hardware, but protective rather than malicious. A firewall filters traffic crossing a network boundary and is a defence against the very things the other options describe.

Malware is the general term for software written to damage a system, steal from it or take control of it. The three classical types are distinguished by how they spread. A virus attaches itself to a host program or file and is carried along when that host is executed or copied. A worm is a standalone program that propagates across a network by itself, needing no user action. A Trojan horse does not spread at all — it is disguised as something desirable so that the user installs it. Later families are named by what they do rather than how they travel: ransomware encrypts files and demands payment, spyware watches the user, adware injects advertising, and a rootkit hides an intruder's presence from the operating system.

Two habits solve nearly every question in this family. First, read the noun in the stem. 'Which is a malicious software' demands a program, so any option naming an activity is out before you consider anything else — that removes hacking and password cracking at once. Second, sort what remains into attack and defence: a firewall is a control, so only the Trojan horse survives. It is also worth being precise about the spreading mechanism, because the examiner rotates the three definitions. If a question says 'needs a host file' the answer is a virus; if it says 'self-replicating and spreads over a network on its own' the answer is a worm; if it says 'disguised as legitimate software' the answer is a Trojan horse. Note in passing that a Trojan is often the delivery vehicle rather than the final payload — the disguised program is what gets ransomware or a keystroke logger onto the machine, which is why the categories overlap in real incidents even though they are kept separate in examinations.

• A Trojan horse is malicious software disguised as a legitimate or desirable program, which the user installs voluntarily.
• Unlike a virus it does not attach itself to a host file, and unlike a worm it does not replicate or spread by itself.
• Typical payloads include back doors for remote access, credential theft, further malware installation and enrolment in a botnet.
• A virus needs a host program or file and spreads when the host is executed or copied; a worm is self-contained and spreads over a network without user action.
• Ransomware, spyware, adware and rootkits are named for what they do rather than how they propagate.
• Hacking and password cracking are activities; a firewall is a defensive control, not malware.

• Picking an option that names an activity when the stem asks for software.
• Calling a Trojan self-replicating; that is the virus and the worm, and it is the standard discriminator in this family of questions.
• Treating a firewall as an attack tool because it appears in a list of security terms.

As a which-one-is-malicious item like this one, as a definition question naming the spreading mechanism, or as a match between malware types and their descriptions.

• practice — not a real PYQ

  Which one of the following types of malware spreads across a network by itself, without needing any user action or a host file?

  • (a)Virus
  • (b)Worm
  • (c)Trojan horse
  • (d)Adware

  Answer(b) Worm — it is self-contained and self-propagating, whereas a virus needs a host file and a Trojan needs the user to install it.

• practice — not a real PYQ

  Malicious software that encrypts a user's files and demands payment for their release is known as which one of the following?

  • (a)Spyware
  • (b)Adware
  • (c)Ransomware
  • (d)Rootkit

  Answer(c) Ransomware — spyware watches the user, adware injects advertising and a rootkit hides an intruder's presence from the operating system.