Malware types, told apart by what they do rather than by what they are called

Why this matters

The malware categories are frequently taught as vocabulary, which makes them feel arbitrary. They are not: each name describes how the thing spreads or what it does, and that determines what you will see on the machine and what you have to do about it.

The exam asks in scenario form — a description of symptoms, and which type it is — so the useful way to learn this is by behaviour rather than by definition. A machine that is slow with no visible cause, a machine whose files have been renamed, and a machine whose security software will not start are three different categories, and each points at a different response.

The lesson

Viruses, worms and trojans, separated by how each one spreads

The three classic categories are separated by exactly one question: how does it get onto the next machine?

A virus attaches itself to something else — a file, a document, a boot sector — and spreads when that thing is run or opened by a person. It needs a human action to propagate.

A worm spreads by itself, over the network, using a vulnerability or weak credentials. No human action is needed, which is why worms produce sudden estate-wide incidents rather than one-machine problems. The symptom at the network level is unusual scanning traffic between internal machines.

A trojan does not spread at all. It arrives because someone chose to install it, believing it was something else — a cracked application, a codec, a "driver updater", a tool from a search advertisement. Its whole method is consent obtained under false pretences.

Why this matters in practice:

• A worm means the network is the problem: isolate first, and assume other machines are affected.
• A trojan means the user's software sources are the problem, and the same thing will happen again unless that changes.
• A virus in the classic sense is rarer today, but the spread-by-file pattern persists in malicious documents with macros.

Two more terms that describe delivery rather than type: a dropper installs the real payload after arriving, and a fileless infection lives in memory and in legitimate system tools rather than as a file on disk — which is specifically designed to defeat the scan-the-disk approach.

Ransomware, and why the backup question is answered before the incident

Ransomware encrypts the victim's files and demands payment for the key. It is the most commercially significant category and the one whose outcome is decided before it arrives.

What it looks like on a machine: files renamed with a new extension, a note in every folder, documents that will not open, and — on a network — the same happening to the file shares the user had access to, because it uses the user's own permissions.

Modern variants add exfiltration before encryption, so paying for a key does not address the copy the attacker took. This is why "we restored from backup" is no longer a complete answer to the incident, only to the outage.

Why the backup question is answered beforehand: once the files are encrypted, the options are restore from backup, or not. Everything else is negotiation. So the questions that decide the outcome are:

• Does a backup exist, and when did it last complete?
• Is it offline or immutable? A backup on a mapped drive or an always- connected external disk is encrypted along with everything else, and this is the single most common reason backups fail in this scenario.
• Has a restore ever been tested?
• How far back does it go? Ransomware often sits quietly for weeks, so the most recent backup may already contain it.

That list belongs to the backup objective at the end of this course, and this is where it earns its place. Paying is a decision for the organisation and its insurer, not for a technician, and it funds the next attack while guaranteeing nothing.

Keyloggers, spyware and adware, and the line between nuisance and theft

These three are grouped by what they take, and the line between them is consent and purpose.

Keyloggers record keystrokes. They exist as software and as hardware devices inline with the keyboard cable, which is why a physical inspection is part of investigating a machine where credentials keep being compromised. What they capture is everything: passwords, messages, card numbers. There is no benign version.

Spyware gathers information — browsing, documents, screenshots, location — and sends it somewhere. Some of it is criminal; some of it is commercial software sold as parental or employee monitoring, which does exactly the same thing with a licence agreement. The technical behaviour is identical and the distinction is consent.

Adware injects advertising, changes search providers, and redirects pages. It is usually installed alongside something the user wanted, via a bundled installer with a pre-ticked box. It is frequently dismissed as a nuisance, and that is a mistake for two reasons: it is proof that the machine's software sources are compromised, and the advertising networks it uses are themselves a common delivery route for worse things.

The line worth drawing for a user: anything that watches you and reports is a theft problem, not a performance problem. Adware that only slows the machine still demonstrates that something installs software on this machine without meaningful consent, and that is the finding — not the slowness.

Rootkits and boot-level persistence, and why the running system stops being a witness

A rootkit hides. That is its defining property, and everything difficult about this category follows from it.

It achieves that by installing below the level at which detection normally happens — in the kernel, in a driver, in the bootloader, or in firmware. From there it can intercept the operating system's own answers: the file it lives in is not listed, the process it runs is not shown, the network connection it makes is not reported.

Why the running system stops being a witness: every tool you would normally use — the file explorer, task manager, a scanner — asks the operating system. If the operating system has been modified to lie, the answers are worthless, and a clean scan proves nothing.

What follows practically:

• Detection has to come from outside. Boot from separate media, mount the disk from another machine, or use an offline scanning environment. That is the whole argument for the next lesson's approach.
• Behaviour at the network level is a better witness than the machine: traffic seen by the router that the machine denies making is strong evidence.
• Discrepancies are the classic signal — a file size reported differently by two tools, space missing that nothing accounts for.

And the honest conclusion, which is also the exam's: a confirmed rootkit means rebuild. Removal tools exist and sometimes work, and the standard advice is not to rely on them, because the thing you are asking to confirm the removal is the thing that was lying. For firmware-level persistence, even a rebuild may not be enough, and that is a specialist escalation rather than a bench job.

Cryptominers, botnets and the infections whose only symptom is a slow machine

The last group is united by not wanting to be noticed at all, which makes them the hardest to teach users to report.

Cryptominers use the machine's processor or graphics hardware to mine cryptocurrency for someone else. Symptoms: sustained high load, a hot and loud machine, poor battery life, and a slowdown that returns after a restart. On a laptop the electricity and the wear are the victim's cost. There is also a browser-based variant that runs only while a page is open, which is why the slowdown sometimes follows the browser rather than the machine.

Botnets enrol the machine into a network controlled by someone else, to be used for sending spam, attacking other systems, proxying traffic, or storing material. Symptoms are often nothing at all from the user's seat: the tell is at the network level — outbound connections to unusual places, traffic when nobody is using the machine, or the organisation's address appearing on a block list.

Why these matter more than their symptoms suggest:

• A machine in a botnet is under someone else's control, and mining today can become ransomware tomorrow. The access is the problem; the payload is a choice.
• The legal and reputational exposure of having your address used for attacks is real.

So the diagnostic habit: a machine that is slow with no process to blame, or busy when nobody is using it, is a security question and not a performance one. That framing is what stops this category being written off as an old computer, and it is exactly what the next lesson is about.