Types of malware, in plain terms
The short answer
“Malware” is an umbrella word for software written to act against the interests of the person whose device it runs on. The familiar labels — virus, worm, trojan, ransomware, spyware — describe two different things at once: how something spreads, and what it does once it arrives. A single piece of malicious software usually carries a label from each group, which is why the categories appear to overlap. They do.
Two questions, not one
The classification that causes the least confusion separates the method of arrival from the purpose. Virus, worm and trojan answer “how did this get here?” Ransomware, spyware, adware and the rest answer “what is it for?” A trojan that installs ransomware is both, and describing it as one or the other is simply describing a different aspect of it.
How it arrives
Virus
A virus attaches itself to an existing file or program and is carried along when that file is copied, shared or run. It needs a host and it needs a person to do something — open the document, run the program, plug in the drive. The name has become a generic term for all malicious software, which is why “antivirus” products deal with far more than viruses in the strict sense.
Worm
A worm needs neither a host file nor a person. It copies itself from one machine to another over a network, typically by exploiting a flaw in software that is listening for connections. Because nobody has to click anything, worms spread on a timescale that human response cannot match. The defence is unglamorous and effective: apply updates, because a worm relies on a flaw that in most cases has already been fixed by the vendor.
Trojan
A trojan arrives because someone installs it deliberately, believing it to be something else — a video player, a cracked copy of paid software, an invoice attachment, a tool that promises to speed up a slow computer. The deception is the delivery mechanism, and it is the most common one in circulation because it needs no technical flaw at all. It needs only a plausible story.
What it does
Ransomware
Ransomware encrypts files and demands payment for the key. Some variants also copy files out before encrypting them and threaten publication, which means paying for decryption does not necessarily end the matter. The single most effective preparation is a backup that the malicious software cannot reach: an external drive that is disconnected when not in use, or a cloud service with versioning, so that yesterday’s clean copy survives today’s encryption. The Australian Cyber Security Centre publishes ransomware guidance for individuals and small business, including on reporting an incident.
Spyware, including keyloggers and infostealers
Spyware observes. A keylogger records what is typed, including passwords entered before any encryption applies. An infostealer is more targeted: it harvests saved browser passwords, session cookies, cryptocurrency wallet files and stored payment details, sends them onward, and may then remove itself. Stolen session cookies are worth understanding, because they can allow an account to be entered without the password and, in some configurations, without a second factor — which is why signing out of sessions after an incident matters as much as changing the password.
Adware and potentially unwanted applications
Adware injects advertising, changes search settings or redirects browsing. A potentially unwanted application, usually abbreviated to PUA, is the grey zone: registry cleaners, driver updaters, toolbars, aggressive trial software bundled with something the person did want. Much of it is not illegal and some of it does something. Security products flag it separately from malicious software, and many let you choose whether to treat PUAs as threats at all.
Rootkits and bootkits
These hide at a level below the operating system’s own view of itself, so that the files and processes they protect do not appear in ordinary listings. They are uncommon on consumer devices and correspondingly serious. Removal generally means scanning from separate boot media, or rebuilding the machine from a known-good state.
Cryptominers
A cryptominer uses the device’s processor to mine cryptocurrency for someone else. It steals nothing and damages nothing directly; it consumes electricity, shortens battery life, makes fans run constantly and slows everything down. The symptom is a machine that is hot and sluggish with nothing visibly running.
Remote access tools
A remote access tool gives an operator interactive control of the device. The category matters here because the same commercial remote-support software used legitimately by IT departments is what a support scammer talks a victim into installing. The software is not malicious; the context is. This is covered in the entry on fake alerts and support scams.
Botnets
A botnet is not a purpose so much as a destination. Once a device is under external control, it can be rented out as one node among many: sending spam, guessing passwords against other people’s accounts, or contributing to attacks on unrelated targets. The owner of the device may notice nothing beyond occasional slowness, because the value of the device to the operator depends on it continuing to work normally. Home routers and internet-connected cameras are common members, which is why changing default passwords on that equipment is worth the ten minutes it takes.
Three things often called malware that are not
Phishing is a message designed to obtain credentials or payment. It usually carries no malicious code at all — the link leads to a convincing imitation of a sign-in page. A scanner may block the page as a known fraudulent site, but there is no file to detect.
Tracking by advertising networks is data collection, not malicious software. It is a privacy question governed by privacy law, and in Australia the Office of the Australian Information Commissioner is the relevant regulator.
A slow computer is most often a full disk, an ageing drive, too many programs starting at boot, or a browser carrying many extensions. Malicious software is one possible cause among several, and it is not the first one to check.
| Situation | Arrival label | Purpose label |
|---|---|---|
| A fake invoice attachment is opened and files are encrypted | Trojan | Ransomware |
| A cracked application quietly records banking logins | Trojan | Spyware |
| An unpatched network service is exploited automatically | Worm | Varies with the payload it carries |
| A free utility installs a search toolbar alongside itself | Bundled installer | Adware or PUA |
What to watch out for when reading about malware
- Threat counts without a source or a period. A large number is not evidence of anything on its own.
- Any page that claims to have identified an infection on your device from a web page. It has not; that is the scam pattern, not a diagnosis.
- Descriptions that treat “virus” and “malware” as identical when the distinction affects the advice being given.
- Advice to pay a ransom presented as a straightforward transaction. It funds the activity and guarantees nothing.
What reduces exposure across every category
- Install updates for the operating system, the browser and anything internet-facing. Worms and drive-by attacks depend on flaws that already have fixes.
- Install software from the platform’s own store or the developer’s own site, and treat cracked or repackaged software as the delivery mechanism it usually is.
- Keep at least one backup that is offline or versioned. This is the only measure that works after ransomware rather than before.
- Turn on multi-factor authentication where it is offered, and remember it protects the sign-in, not a session already stolen.
- Use a password manager so that a single stolen password does not open several accounts.
- Treat unexpected attachments and links as unverified until confirmed through a channel you chose yourself.