Malware

Malware is software or code intentionally used for an unauthorized harmful purpose, such as disclosing data, altering it or disrupting access to a computing system. Computer viruses and computer worms are types of malware, but self-replication is not required for every malicious program. The classification concerns purpose and behavior, not merely whether a computer program contains a bug.^[ref]

A useful distinction separates what a program does from how it spreads. Replication, unauthorized disclosure and destructive changes are different properties. A computer worm can disrupt a system through replication-related resource use; another malicious program might disclose data without producing copies of itself.

For an original classification example, suppose three hypothetical programs produce the same unexpected loss of a test file. One has an accidental defect, one implements an authorized deletion request, and one intentionally deletes data without authorization. The visible outcome alone does not establish that all three are malware. Intended function, authorization and behavior supply different evidence.

Likewise, finding a familiar byte sequence in a file is a detection clue rather than a complete behavioral explanation. Digital forensics connects observed artifacts with supported conclusions; a label by itself does not reconstruct an incident.

A computer virus is self-replicating code that propagates by becoming part of host computer programs or suitable files. Its replication depends on the host's execution context. This distinguishes it from a self-contained computer worm, although both are conventionally grouped as malware.^[ref]

Replication and any additional harmful effect are separate features. A computer virus can make unauthorized changes simply by incorporating itself into another host; a dramatic data-destruction effect is not necessary to recognize that replication mechanism.

For an original counting example, imagine ten archived copies of the same infected host file on an isolated storage medium. That is ten stored artifacts, not evidence of ten running processes or ten infected computers. Conversely, one executing host can affect more than one stored artifact. Counts of detected files, affected machines and active executions measure different things.

The biological analogy is useful only in a limited sense: a computer virus depends on a host context for reproduction, but its mechanism is computation and file modification. Digital evidence about copies and execution should support the particular incident claim being made, rather than treating every occurrence of a byte pattern as a separate observed infection event.