Computer Virus, Antivirus and Firewall Notes

A computer virus is a malicious program that attaches itself to a legitimate file or program and spreads from one computer to another when that file is shared or run, often damaging data or slowing down the system. Viruses are one type of malware (malicious software), a broader term that also includes worms, trojans, ransomware and spyware. To protect computers, we use antivirus software, which detects and removes malware, and firewalls, which control the traffic entering and leaving a network. These topics are asked regularly in the computer awareness sections of IBPS PO, Clerk, SBI, RBI Assistant, insurance, SSC, railway and state exams. They are also relevant to UPSC GS Paper 3 under cyber security, especially after major ransomware attacks on hospitals and public institutions.

Quick Facts at a Glance

• VIRUS is often expanded as "Vital Information Resources Under Siege" (a popular backronym, not an official full form).
• First computer worm to spread widely on the Internet: the Morris Worm (1988).
• A virus needs a host file and human action to spread; a worm spreads by itself across networks.
• Antivirus detects malware mainly through signature-based and heuristic (behaviour-based) methods.
• Firewall: A security barrier, in hardware or software, that filters network traffic according to rules.

1. How a Computer Virus Works

A virus behaves somewhat like a biological virus. It cannot run on its own; it hides inside a host, such as a program file, document or the boot sector of a disk. When the user opens or runs the infected file, the virus code also runs. It then copies itself into other files (replication) and may carry out a harmful action, called its payload, such as deleting files, corrupting data, displaying messages or slowing the computer. Some viruses remain dormant until a trigger, like a particular date, activates them.

Common Signs of Infection

• The computer becomes unusually slow or crashes frequently.
• Unknown programs start automatically, or pop-up advertisements appear.
• Files go missing, become corrupted or change their names or sizes.
• The browser home page changes without permission.
• Friends receive strange emails or messages from your account.

2. Types of Viruses

3. Other Types of Malware

• Worm: A self-replicating program that spreads through networks without needing a host file or user action. Example: the Morris Worm (1988) and the ILOVEYOU worm (2000), which spread through email.
• Trojan horse: Malware disguised as useful software. It does not replicate, but it can open a "backdoor" for attackers. The name comes from the wooden horse of Greek legend.
• Ransomware: Encrypts the victim's files and demands payment (often in cryptocurrency) for the key. Example: WannaCry (2017), which affected organisations in over 150 countries.
• Spyware: Secretly collects information about the user, such as browsing habits or passwords.
• Keylogger: Records keystrokes to steal passwords and card numbers.
• Adware: Displays unwanted advertisements.
• Rootkit: Hides deep in the system to give attackers hidden control.
• Botnet: A network of infected computers ("bots" or "zombies") controlled by attackers, often used for spam or Distributed Denial of Service (DDoS) attacks.

4. Antivirus Software

Antivirus software protects computers by scanning files, memory and incoming data for malware and removing or isolating threats.

How Antivirus Detects Malware

• Signature-based detection: Compares files with a database of known malware "signatures" (unique code patterns). It is accurate for known threats but cannot detect brand-new ones until the database is updated. This is why regular updates are essential.
• Heuristic analysis: Examines the structure and code of files for suspicious features, helping detect new or modified malware.
• Behaviour-based detection: Watches what programs do, such as trying to encrypt many files quickly, and blocks suspicious activity.
• Sandboxing: Runs a suspicious file in an isolated environment to observe its behaviour safely.

Key Antivirus Terms

• Scan: Checking files for malware (quick scan or full scan).
• Quarantine: Isolating an infected file so it cannot harm the system.
• Real-time protection: Continuous monitoring of files as they are opened or downloaded.
• Definition update: Adding new malware signatures to the database.

Popular antivirus products include Microsoft Defender (built into Windows), Quick Heal (an Indian company), Norton, McAfee, Kaspersky, Bitdefender and Avast.

5. Firewall

A firewall acts like a security guard at the gate of a network. It monitors incoming and outgoing traffic and allows or blocks it according to predefined security rules. While antivirus software deals with malware already on a device, a firewall tries to stop unwanted access before it reaches the device.

Types of Firewalls

• Hardware firewall: A physical device placed between a network and the Internet, often built into routers; protects all devices in the network.
• Software firewall: Installed on an individual computer, such as Windows Defender Firewall.
• Packet-filtering firewall: Checks each data packet's source, destination and port against rules.
• Stateful inspection firewall: Tracks the state of active connections and allows only legitimate traffic that belongs to them.
• Proxy firewall (application-level gateway): Acts as an intermediary between users and the Internet, inspecting content at the application level.
• Next-generation firewall (NGFW): Combines traditional filtering with intrusion prevention, deep packet inspection and application awareness.

6. Antivirus vs Firewall

Both are needed together, along with safe user habits, for good protection. This layered approach is called defence in depth.

7. How to Prevent Malware Infections

1. Keep software updated: Updates fix security holes that malware exploits. WannaCry spread mainly through computers that had not installed an available Windows security patch.
2. Use trusted antivirus and keep it updated.
3. Enable the firewall on computers and routers.
4. Do not open unknown attachments or links, especially in unexpected emails, SMS or WhatsApp messages.
5. Download apps only from official stores and avoid pirated software, which often carries malware.
6. Use strong, unique passwords and enable two-factor authentication.
7. Take regular backups on an offline drive or secure cloud, so that ransomware cannot hold your data hostage.
8. Scan pen drives before opening files, and disable auto-run.

8. Malware and Cyber Security in India

India has faced significant malware incidents, including ransomware attacks on hospitals and government systems. The Indian Computer Emergency Response Team (CERT-In), under the Ministry of Electronics and Information Technology, is the national agency for responding to cyber incidents and issuing security advisories. Its 2022 directions require organisations to report certain cyber incidents within six hours. The Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) provides free tools to help citizens detect and remove malicious programs. The National Critical Information Infrastructure Protection Centre (NCIIPC) protects critical sectors such as power, banking and telecom. Citizens can report cyber crimes on cybercrime.gov.in or by calling the helpline 1930. These institutions are frequently asked in UPSC Prelims and are useful examples for GS Paper 3 answers on cyber security.

9. Practice Questions

1. Which malware disguises itself as useful software? Answer: Trojan horse.
2. Which type of virus changes its code to avoid detection? Answer: Polymorphic virus.
3. Which malware records keystrokes? Answer: Keylogger.
4. Which detection method uses a database of known malware patterns? Answer: Signature-based detection.
5. Which firewall type acts as an intermediary between users and the Internet? Answer: Proxy firewall.

Memory Trick: Malware Family

Remember the main malware types with "V-W-T-R-S": Virus needs a host, Worm walks alone, Trojan tricks you, Ransomware demands money and Spyware spies. For protection, remember "Update, Antivirus, Firewall, Backup, Be careful". Most exam questions on this topic can be answered by recalling these two lines and the difference between antivirus (cleans the device) and firewall (guards the gate).

Also remember that no single tool gives complete protection; safe habits are the most important layer of defence.

Related Notes

• Cyber Security Basics for Aspirants
• Cyber Security Notes for UPSC
• Internet and Networking Notes
• All Computer Knowledge Notes

Frequently Asked Questions

What is a computer virus?

A malicious program that attaches itself to files or programs and spreads when they are shared or run, often causing damage.

What is the difference between a virus and a worm?

A virus needs a host file and user action to spread; a worm spreads by itself across networks.

What is a Trojan horse?

Malware disguised as legitimate software that gives attackers access to the system; it does not replicate itself.

What is ransomware?

Malware that encrypts files and demands a ransom for the decryption key, such as WannaCry in 2017.

What is a macro virus?

A virus hidden in macros of documents or spreadsheets, such as Word or Excel files.

How does antivirus software detect viruses?

Mainly through signature-based detection, heuristic analysis and behaviour monitoring.

What does quarantine mean in antivirus?

Isolating an infected file so it cannot harm the system until it is cleaned or deleted.

What is a firewall?

A hardware or software system that monitors and controls network traffic according to security rules.

What is the difference between antivirus and firewall?

Antivirus removes malware from a device; a firewall blocks unauthorised network access.

What is a botnet?

A network of infected computers controlled remotely by attackers, often used for spam or DDoS attacks.

Which agency handles cyber security incidents in India?

CERT-In, the Indian Computer Emergency Response Team, under MeitY.

Which was the first widely known Internet worm?

The Morris Worm of 1988.