Malware Type Identifier

Malware is classified by behavior, not by damage. Two pieces of malware that both wipe a disk are still different types if one arrived attached to a spreadsheet and the other walked in across the network by itself, and that is why every definition in this activity is a description of how the thing operates rather than a description of what it costs you. Get the behavior right and the name follows; memorize the names alone and you will guess wrong the first time a scenario question describes one without labeling it. Start with the pair that trips up the most people. A virus and a worm both replicate, so replication cannot be what separates them. A virus inserts its code into a legitimate host — a program, a document, in the nastiest case the boot sector the machine reads before the operating system loads — and it does nothing at all until a user runs that host. It is a parasite, and it travels the way its host travels. A worm has no host. It is a standalone program whose primary function is copying itself, and it moves across networks and removable media with no user action at all, which is why worm outbreaks grow exponentially and virus outbreaks grow at the speed of people opening files. If the description mentions a file it attaches to, or a user who has to run something, it is a virus; if it spreads on its own, it is a worm. Trojan horses are the odd one out in the replication conversation, because they do not replicate. A Trojan's whole mechanism is consent: it looks like software you want, so you install it yourself, and the malicious function rides in behind that decision. This is why user training matters against Trojans in a way it does not against worms. Ransomware is the easiest to identify and the most expensive to meet. It encrypts the victim's files and sells the decryption key back, and the reason it dominates the current threat landscape is that it converts an intrusion directly into money without the attacker needing a buyer for stolen data. Note that ransomware is a payload, not a delivery method — a worm can carry it, a Trojan can carry it, and the type you name depends on which question you are answering. Rootkits are about privilege and concealment together. A rootkit gets an attacker into the restricted areas of an operating system or hardware, and, crucially, hides itself and everything else from the tools meant to find it. That second half is what makes a rootkit a rootkit rather than just an exploit, and it is what makes rootkit removal a reimaging job rather than a cleaning job. The last three overlap enough to be worth separating deliberately, because all of them run quietly and none of them announce themselves. Spyware is the general category: it watches what the user does and reports activity and collected data to a third party. A keylogger is a specific kind of spyware that records keystrokes, which is how attackers capture passwords and card numbers at the moment they are typed, before any encryption or masking applies. Adware is the commercial cousin: it serves unwanted advertisements to make money for whoever bundled it, and while it is the least destructive item on this list, it frequently arrives alongside or opens the door to something worse. Ask what each one takes — activity, keystrokes, or your attention — and the three sort themselves. Carry one habit out of this activity: when you meet a malware description in the wild or on an exam, do not look for the scariest word in it. Look for how it got in, whether it needs a host, whether it needs a person, and what it does once it is there. Those four questions name every type on this board.