Categories
Malware types, and why the categories overlap
Virus, worm, trojan, ransomware, spyware. The names come from two different questions — how something spreads, and what it does — which is why one piece of code can honestly belong to several categories at once.
The confusion in this vocabulary is structural, not accidental. Virus, worm and trojan describe a method of arrival. Ransomware, spyware and adware describe a purpose. A trojan that installs ransomware is both, and a news report calling it either one is not wrong. Knowing which question a term answers makes the overlap stop being a contradiction.
The short version
How it arrives: a virus attaches to a host file, a worm spreads by itself across a network, a trojan persuades you to install it.
What it does: ransomware extorts, spyware watches, adware advertises, a botnet client rents your device out, a rootkit hides whatever else is present.
Categories of arrival
Virus
A virus attaches itself to an existing file or program and spreads when that host is run or copied. The biological metaphor is exact: it needs a host, and it travels with the host.
Viruses in this strict sense are now a modest part of the landscape — the era of sharing executable files on removable media is largely over, and the platforms have hardened. The word survives as a general label for all malicious software, including in the name of the product category itself, which is why a product called antivirus is not limited to viruses and never has been.
Worm
A worm needs no host file and no user action. It spreads over a network by finding other reachable machines and exploiting a flaw, or by using credentials it has obtained. Self-propagation is the entire distinction from a virus.
Because nobody has to click anything, worms have historically spread faster than any other category, and their damage has often come from the load of propagation itself rather than from a payload. The countermeasure is unexciting: apply patches, since a worm exploiting a flaw that has been fixed on your device finds nothing to enter through.
Trojan
A trojan is disguised as something wanted — a utility, a cracked application, a document, an update prompt. It does not spread by itself. It relies entirely on someone installing it.
This is the dominant arrival method now, because it targets the judgement of the person rather than a flaw in the software, and judgement cannot be patched. The three common disguises are worth recognising: a download of paid software offered free, an update prompt that appears on a web page rather than from the application itself, and an attachment that asks you to enable content before it will display.
A search for a video converter returns a download site that is not the developer's own. The installer runs, installs a working converter, and alongside it a browser extension that changes the default search engine and injects advertisements into pages. Arrival: trojan — it was installed deliberately, under a false impression of what it contained. Purpose: adware. A scanner may classify it as a potentially unwanted program rather than as malware, because the converter did work and a disclosure was technically present in the installer.
Categories of purpose
Ransomware
Ransomware encrypts files and demands payment for the key. Many current families add a second lever: copying the data first and threatening to publish it, so that restoring from a backup does not end the matter.
Detection here is mostly behavioural — a process that begins systematically rewriting documents is stopped on the strength of what it is doing. That protection is real and it is not a guarantee, which is why the Australian Cyber Security Centre puts a current, disconnected backup at the centre of its ransomware guidance, and explains there why paying is discouraged: it funds the activity and does not reliably return the data.
Spyware
Spyware collects information about a person without meaningful consent: keystrokes, browsing, location, messages, screenshots. A keylogger is the narrow form that records what is typed.
One variety deserves separate mention. Applications marketed for monitoring a partner or family member are installed by someone with physical access to the device and are often not classified as malicious by scanners, because they are commercial software that was, in a technical sense, installed deliberately. The eSafety Commissioner publishes guidance on this and on where to get help, and treats it as a safety matter rather than a software one.
Adware and potentially unwanted programs
Adware displays advertising, redirects searches, or injects advertisements into pages that did not carry them. It usually arrives bundled with something wanted and with a disclosure buried in an installer.
Whether a given program counts as unwanted is a judgement, and vendors draw the line differently — which is the whole explanation for why one product flags something another ignores. That is a difference in policy, not a difference in capability, and it is a common cause of unnecessary alarm when someone runs a second scanner alongside their existing one.
Botnet clients
Some malicious code exists only to make a device available to someone else: to send spam, to mine cryptocurrency, to generate traffic against a target, or to relay other traffic. An infected device may show nothing an owner would notice beyond a fan running more than it should, a slower connection, or a warmer phone.
Rootkits
A rootkit hides. It interferes with the operating system's reporting so that particular files, processes or connections do not appear in ordinary listings, concealing whatever else has been installed. Detecting one from inside the affected system is unreliable by definition — the system's answers cannot be trusted — which is why vendors provide rescue media that boots the machine from separate storage and examines the disk from outside.
The same code in two categories
| Example | Arrival | Purpose | Mechanism most likely to stop it |
|---|---|---|---|
| Cracked application carrying an encryptor | Trojan | Ransomware | Behavioural, once it starts rewriting files |
| Network service exploited remotely | Worm | Botnet client | Patching; a firewall on the exposed port |
| Attachment that asks to enable content | Trojan | Spyware or downloader | Heuristics; mail filtering; not enabling it |
| Bundled search hijacker | Trojan (bundled installer) | Adware | Vendor policy on unwanted programs |
Things routinely mistaken for malware
- A slow computer. Far more often a full disk, a browser with many tabs and extensions, a failing drive, or an ageing machine running current software. Infection is one possible cause among many, and not the most likely.
- Pop-up advertisements in a browser. Usually the site, not the device. A test is whether they appear on other sites and in other browsers; if not, nothing is installed.
- A warning page claiming a scan found infections. A web page cannot scan a device. This is scareware, and examples are worth reporting to Scamwatch.
- A telephone call about a virus on your computer. No vendor, telecommunications company or government department detects an infection on a home device and rings about it. The ACSC covers this pattern in its advice on recognising and reporting cybercrime.
- One scanner disagreeing with another. Expected. See the note on unwanted programs above, and on false positives.
If something does turn out to be present
The ACSC publishes step-by-step guidance for individuals, and ReportCyber is the Australian channel for reporting cybercrime. Where money has moved, the bank should be contacted immediately and the matter reported to Scamwatch. Where personal information held by an organisation has been exposed, the OAIC handles privacy complaints and administers the Notifiable Data Breaches scheme. Our reporting page sets out which body covers what.
For how the four detection mechanisms handle these categories in practice, see how antivirus detection works. For the terms used throughout, the glossary holds the definitions in one place.