Malware
Know the families
Malware questions reward precise definitions. Learn each type by what it does and how it spreads.
- Virus: attaches to a host file and needs a user action (opening the file) to run and replicate.
- Worm: self-replicating and spreads across networks without user action. The lack of user action is the key differentiator from a virus.
- Trojan: disguises itself as legitimate software; it does not self-replicate. Users install it willingly.
- Ransomware: encrypts or locks data and demands payment. Primarily an availability attack.
- Spyware / keylogger: secretly gathers information such as keystrokes or browsing habits.
- Rootkit: hides deep in the system to conceal other malware and maintain access.
- Adware: displays unwanted advertising; annoying rather than destructive, though sometimes bundled with worse.
- Botnet / zombie: a network of infected machines controlled remotely, often used for spam or denial-of-service attacks.
Traps
- A question describing automatic spread with no user interaction is a worm, even if it mentions email.
- A program that looks useful but opens a backdoor is a Trojan, not a virus.
- "Antivirus removes all malware" is false; rootkits and new strains may evade signature detection.
Defences to name: keep software patched, use reputable antivirus with updated signatures, avoid unknown attachments and downloads, disable autorun, and back up data offline so ransomware cannot reach the backups.
Rule of thumb: ask two questions - does it need the user to act, and does it copy itself? Virus: yes/yes. Worm: no/yes. Trojan: yes/no.
Worked example: A file called "invoice.pdf.exe" arrives by email. The double extension signals a disguised executable - a Trojan - and the correct response is not to open it and to report it.