Malware — Six Types

Syllabus & Goals 3 min

Cambridge 5.3 · Cyber security threats — malware Paper 1 · Computer Systems

By the end of this lesson you can:

1. Describe each type of malware: virus, worm, Trojan horse, spyware, adware, ransomware.
2. Distinguish similar types, especially virus vs worm and Trojan vs virus.
3. Identify the malware in a scenario and suggest how to prevent or recover from it.

Textbook: Chapter 5, §5.3.1 — Malware (pp. 191–194)

Recap / Warm-Up 5 min

Last lesson: brute force, interception, DDoS and hacking. Those attacks come from outside. Malware is different: it is software that gets inside a computer and does harm from there.

Quick starter

In the old story, soldiers hid inside a wooden horse given as a gift. Which type of malware is named after it, and why?

Key Concept 14 min

Malware (malicious software) is one of the biggest risks to the integrity and security of data. Cambridge examines six types.

1 · Virus

A virus is a program (or program code) that replicates (copies itself). It aims to delete or corrupt files, or make the computer malfunction — for example by deleting .exe files or filling the hard drive with useless data.

A virus needs an active host program (or an already-infected operating system). It does nothing until something triggers it to run. Viruses arrive in email attachments, on infected websites and in infected downloaded software.

2 · Worm

A worm is stand-alone malware that self-replicates. It aims to spread to other computers and corrupt whole networks. Unlike a virus, it does not need an active host and needs no action from the user to spread. It exploits security failures in networks. One person opening an infected attachment can infect a whole network — which makes worms more dangerous than viruses.

3 · Trojan horse

A Trojan horse is a program disguised as legitimate software with malicious instructions hidden inside. It replaces all or part of the genuine software. The user must run it, so it arrives as an email attachment or a download from an infected website.

A common trick is a fake anti-virus pop-up: "Your computer is infected — run our free trial now!". Once installed, a Trojan gives criminals access to personal data such as IP addresses and passwords. It often installs spyware (including key loggers) or ransomware. Firewalls are often useless against it, because the user chooses to run it.

4 · Spyware

Spyware gathers information by monitoring a user's activities and sends it back to the cybercriminal. It captures browsing activity and personal data such as bank account numbers, passwords and card details. Spyware that records key presses is called key-logging software. Anti-spyware can detect and remove it. Finding spyware is a warning sign: there is a gap in security that more dangerous malware could use.

5 · Adware

Adware floods the user with unwanted advertising. It may redirect the browser to advert-filled websites, show pop-ups, or sit in the browser toolbar redirecting searches. It is not always harmful, but it can highlight weaknesses in security, is hard to remove (anti-malware struggles to decide if it is harmful), and can hijack a browser.

6 · Ransomware

Ransomware encrypts the data on a user's computer and "holds it hostage" until a ransom is paid. Sometimes a decryption key is then sent. It may lock the screen. It often arrives through a Trojan horse or social engineering. It may encrypt at once, or wait to judge how much the victim can afford.

Summary of the six types

Worked Example 12 min

(a) Identify the malware with a decision tree

Scenario: "Alex downloads a free photo editor. It works, but every keystroke Alex types is secretly sent to an unknown server." Which malware is involved?

1. Does it copy itself? Nothing suggests it spreads — no. rules out virus and worm.
2. Disguised as genuine software? A "free photo editor" that hides extra code — yes: the delivery is a Trojan horse. it only got in because Alex chose to run it.
3. What does the hidden code do? Records keystrokes and sends them away — spyware (key logger). monitoring and sending data back is the definition of spyware.
4. Full answer: a Trojan horse that installed spyware / key-logging software. the textbook notes spyware is often installed via a Trojan — two marks are available for naming both.

(b) Build a 6-mark ransomware answer

Question: a school's files are encrypted and a message demands payment. Explain what has happened, how it probably happened, and how the school could have limited the damage. [6]

1. Name it: ransomware (1). the clues are "encrypted" and "demands payment".
2. What it did: encrypted the files so they cannot be used (1) and holds them hostage until a ransom is paid (1). two separate facts, two marks.
3. How it arrived: probably a Trojan horse / phishing email that a user opened (1). ransomware needs to be run; "how" needs a route in.
4. Limit the damage: keep regular back-ups so files can be restored without paying (1). the textbook calls back-ups the best defence.
5. Prevent it: staff training to avoid phishing / up-to-date anti-malware (1). prevention and recovery are different points — give one of each.

Try It Yourself 12 min

📝 Exam Practice 10 min

Recap & Key Terms 3 min

Viruses and worms both replicate, but only viruses need a host and a trigger. Trojans hide inside genuine-looking software. Spyware watches and reports; adware floods adverts; ransomware encrypts and demands payment. Back-ups beat ransomware; anti-malware and caution beat the rest.

Virus

A program that replicates itself to delete or corrupt files or cause malfunction; needs an active host.

Worm

Stand-alone malware that self-replicates and spreads through a network without an active host or user action.

Trojan horse

Malware designed to look like legitimate software but containing malicious code.

Spyware

Malware that monitors a user's activities and sends the data back to the cybercriminal.

Adware

Malware that floods the user with unwanted advertising.

Ransomware

Malware that encrypts a user's data and holds it hostage until a ransom is paid.

Homework 1 min

Task (≤ 15 min): make a revision grid for the six malware types with four columns: how it arrives, what it does, one real-world sign, one protection. Then answer: "Explain why worms are often more dangerous than viruses." [2]