Malware vs Virus: Difference and the Section 43 Definitions

Popular speech calls every infection a virus; the law and the discipline are more precise. Malware, malicious software, is the genus: every program built to harm, steal or hijack. The virus is one species within it, defined by two traits, attachment to a host and operation on a trigger, and the IT Act is unusually helpful here, because the Explanation to s.43 defines both the wide term and the narrow one. Topic 85 surveyed the family; this note, as asked, is the dedicated comparison.

1. Genus and Species

Figure 1: The family and one member

• Malware. All software designed to damage, disrupt, spy on or seize computer resources, whatever its method: viruses and worms that replicate, trojans that deceive their way in, spyware and keyloggers that surveil, ransomware that encrypts and extorts, botnets that conscript machines, logic bombs that wait, and cryptojacking code that steals compute (Topic 85). The category is defined by purpose, not mechanism.
• Virus. The species defined by mechanism: code that attaches itself to a host, a file, a programme, a boot sector, and operates when the host is executed or another triggering event occurs, replicating copy by copy as infected hosts are shared. The oldest family name, now a minority of real-world malware, which is why virus is the wrong word for most modern incidents.
• The one-way inclusion. Every virus is malware; most malware is not a virus: ransomware needs no host file, a trojan does not self-replicate, spyware neither attaches nor spreads, the sentence that answers the comparison, and the reason precise answers say malware unless the host-and-trigger mechanism is actually present.

2. The Statute's Own Definitions

Figure 2: The s.43 Explanation

• Computer contaminant. The Explanation to s.43 defines it as any set of computer instructions designed to modify, destroy, record or transmit data or programmes residing within a computer resource, or by any means to usurp the normal operation of the computer, system or network: the statutory malware, wide enough for spyware, ransomware, botnet clients and logic bombs alike.
• Computer virus. Separately defined: any computer instruction, information, data or programme that destroys, damages, degrades or adversely affects performance, or attaches itself to another computer resource and operates when a programme, data or instruction is executed or some other event occurs in that resource, the attachment-and-trigger mechanism written into the Act.
• The consequences. s.43(c) makes introducing or causing to be introduced any computer contaminant or computer virus a contravention answering in compensation, no intent required; done dishonestly or fraudulently it is the s.66 offence, three years, with ransomware adding extortion, s.66F where essential services are struck, and CERT-In's six-hour reporting on the incident side (Topics 53, 58, 64)

3. Frequently Asked Questions

What is the difference between malware and a virus?

Malware is the genus: all software designed to damage, disrupt, spy on or seize computer resources, including viruses, worms, trojans, spyware, keyloggers, ransomware, botnets and logic bombs. A virus is one species within it, defined by its mechanism: it attaches itself to a host file or programme and operates when that host is executed or another triggering event occurs, spreading as infected hosts are shared. Every virus is malware, but most modern malware, ransomware, trojans, spyware, is not a virus because it lacks the host-and-trigger mechanism.

How does the IT Act deal with malware and viruses?

Through the Explanation to Section 43, which defines both terms: computer contaminant, any instructions designed to modify, destroy, record or transmit data or usurp the normal operation of a computer resource, and computer virus, code that harms performance or attaches itself to another resource and operates on execution or another event. Introducing either into a computer resource without permission is a Section 43(c) contravention answering in compensation, and becomes the Section 66 offence, up to three years, when done dishonestly or fraudulently, with extortion and Section 66F available for ransomware and attacks on essential services.

4. Related Topics

• Topic 53: Section 43. The contravention that houses both definitions.
• Topic 105: Virus vs Worm. The next distinction inside the family.