Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a legitimate technical difference between malware and viruses? I have looked at the Wikipedia entries but I am not really seeing the difference.

Currently, I kind of feel like this is just Symantec's way of getting more money for products (features). But maybe someone involved more deeply in this area can explain this.

share|improve this question

4 Answers 4

up vote 6 down vote accepted

If you want to get into semantics (no pun intended) viruses are a subset of malware in the sense that they are (typically) malicious. What makes them stand out is that they spread themselves. Aside from that, technically there is no differentiation. Malware is malware in the sense that anything can be written to do whatever malicious activity the writer wants, at least within the confines of any vulnerability that is being exploited.

The modern term should really move away from "Virus" and solidify to "Malware". Virus still holds as a known term because of the history involved. The main mechanisms that allow most modern malware to function didn't exist back when viruses were the big thing. The only effective way they had to do anything was to spread themselves, and this was typically done via floppy disks. Today with the Internet and other large-scale networks it's trivial to reach a mass of people without having to write the code to self replicate.

For the purposes of marketing, the term "Virus" is something scary because the public knows the term and the history of damage they have done in the past 20 years. For the purposes of technology, there are numerous pieces of Malware that are much more dangerous than many viruses every dreamed of being.

Non-replicating malware can be a file on your machine just like a replicating virus, so a scanner should have the means to find either. A signature is a signature.

Long story short: IMHO it's marketing on Symantec's part. They're looking at breaking up products based on the entry points that malware uses to get into your system: email, web, file system, network shares, IM, etc. The more separate products they have, the more revenue. Technically, though, viruses ARE malware.

(And Peter Norton said that viruses would never be a threat to the computing population. chuckle)

share|improve this answer
    
Re: Peter Norton quote {{citation needed}} A quick googles didn't turn up anything relevant but I would be most interested to know which publication this came from. –  jscott May 7 '10 at 14:52
    
@jscott: yeah, believe me I'm looking for it because it's one of my favorite ironies of all time... Best thing I've found so far is this: securelist.com/en/threats/detect?chapter=109 –  squillman May 7 '10 at 14:56
    
To be fair, while it is a way of generating hype to call viruses separate from malware for AV companies, for marketers...what are they going to call it that the public would relate to? Malware means believing the public is smart enough to know what prefixes are and figure out what "bad software" means to them. Viruses are scary already! –  Bart Silverstrim May 7 '10 at 15:06
    
@Bart: I don't disagree with you, but there is also the trend in modern marketing of using scare tactics to promote your product. I don't buy into this. Marketers are also well-known to create their own terms for things. They have the power to shape how the public thinks, so the options are certainly there. –  squillman May 7 '10 at 15:35

Viruses are a subset of Malware which is the term used to describe any sort of malicious software. Malware might be a "registry cleaner" that also sends back any credit card info- certianly its not a virus but it's not the action that was consented to.

Yes, this is Symantec's way of trying to charge more money as an "antivirus only" program would be pretty worthless.

share|improve this answer

I differentiate them by intent - a virus being a program that has no purpose than to be malicious (e.g. delete files) and infect other files, malware being a program which has intent along the lines of "benefit the creator at the expense of the computer user" (e.g. a botnet, spam mailer etc.) - where trojans fit is largely a matter of semantics (a bad pun!).

As a side note, the secondary goal of a virus writer is to evade the most popular AV programs at the time of release; Symantec being is almost top of that list. I saw Symantec sail straight past a Mariposa Botnet infection which Microsoft Security Essentials detected and eliminated.

share|improve this answer

I think that as squillman suggests, virii are a subclass of malware. Their differentiating feature is self replication/infection, i.e. they attempt to spread themselves to other hosts, whereas other malware does not, it just does it's evIil without trying to spread to other hosts.

I think that virii are more scary than malware with a given capability. E.g. if you have malware A and it does something and virus B and it does the exact same thing, except it tries to reproduce itself then as a general rule (to which I can not currently think of an exception) the virus is more dangerous, as it does all that the malware does, but also tries to spread itself.

While marketing people do use the word virus because it is well known, I think it is still useful to be able to differentiate between malware and malware that tries to reproduce itself, so I think that while the term malware should be used in most cases, where appropriate (ie. self spreading malware) the word virus should still be used. Right tool for the job, so to speak.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.