How Malware Works and Its Main Types

Leo plugs in a USB stick he found in the car park to see whose it is. It is a classic way for malicious software to arrive. Malware is any program designed to harm, spy or take control, and knowing its main kinds tells you what to protect and how.

The rule

Malware must get in, run, and stay. Block each step.

Nearly all malware needs three things:

1. Get in — an attachment, a download, a USB stick, a flaw in unpatched software.
2. Run — someone opens it, or a flaw lets it start by itself.
3. Stay and act — it hides, survives restarts and does its job.

The main types, named mostly by how they spread or what they do:

• Virus — attaches to other files and spreads when they are opened.
• Worm — spreads by itself across networks, through unpatched flaws, with no one clicking.
• Trojan — pretends to be something useful, like a free tool or a fake invoice.
• Ransomware — encrypts files and demands payment to unlock them.
• Spyware and keyloggers — secretly watch activity or record keystrokes, such as passwords.
• Botnet malware — quietly makes the machine part of a network controlled by criminals.

Many real samples combine types: a trojan that installs ransomware, for example.

The shortcut

Instead of memorising every family, map your defences onto the three steps: stop it getting in, stop it running, limit what it can do.

The trap is relying on antivirus alone. It catches a lot, but new malware can slip past, which is why the other steps exist.

Drills

Answer fast — trust the rule.

Remember

• Malware must get in, run, and stay. Block each step.
• Map defences to the steps: keep it out, stop it running, limit its reach, and notice it.
• Trap: trusting antivirus alone, and plugging in unknown USB sticks.