Malware Types

Malware (short for *malicious software*) is any program written to damage, disrupt, spy on, or take control of a computer without the owner's permission. Learning the different families of malware is the foundation of defense: each type spreads differently and demands a different countermeasure, so correctly naming what you are facing tells you how to stop it. In cybersecurity we classify malware by two questions: how does it spread? and what does it do once it is inside? The nine types on this sheet are the classic categories every analyst is expected to recognize on sight.

Use this as your one-page comparison. Notice how the How it spreads column drives the Key defense column — the way something travels is what you attack.

The most-tested distinction in malware is virus vs. worm, and it comes down to how each one replicates. A virus is parasitic. It attaches its code to a *host* file or program and cannot run on its own. It spreads only when a human does something — opens the infected document, runs the program, plugs in the shared USB drive. Think of it as a stowaway that needs you to carry it aboard. A worm is a standalone program that needs no host and no human. It self-replicates and crawls across networks automatically, typically by exploiting an unpatched vulnerability, then repeats the process from every machine it reaches. That self-propagation is why a worm can infect thousands of hosts in minutes while a virus sits waiting for someone to click. The defensive takeaway: viruses are blunted by not running untrusted files and by antivirus scanning, while worms are blunted by patching promptly and by firewalls and network segmentation that limit how far they can travel.

A trojan (from the Trojan Horse) is malware disguised as something you *want* — a free game, a cracked app, a fake software update, a file named invoice.pdf.exe that is really a program. It does not self-replicate; it relies entirely on tricking the user into running it. Once executed, a trojan commonly opens a backdoor that gives the attacker remote access, or drops other malware such as spyware or a rootkit. Ransomware is the extortion family. It encrypts the victim's files (or locks the whole screen) and demands payment — usually in cryptocurrency — for the decryption key. It typically arrives through phishing attachments, exploited remote-desktop (RDP) logins, or worm-like spreading across a network. The single most effective defense is reliable, offline or immutable backups: if you can restore your data, the extortion loses its power.

This family is about surveillance and data theft. Spyware hides on a system and secretly collects information — browsing habits, credentials, files, screenshots — then ships it back to an attacker. It is often bundled with free downloads or dropped by a trojan. A keylogger is a focused form of spyware that records every keystroke to capture passwords, messages, and card numbers. Keyloggers can be software or a small hardware device plugged in line with the keyboard, which is why physical security matters too. Because a keylogger steals your password exactly as you type it, multi-factor authentication (MFA) is a strong defense — the stolen password alone is not enough to log in. Adware forces unwanted advertisements — pop-ups, injected banners, browser redirects — and frequently tracks your activity to target those ads. It is usually more nuisance and privacy risk than destroyer, but aggressive adware slows a machine and can open the door to worse infections. It most often sneaks in bundled with "free" software, so read installers carefully and decline the extras.

These two are about stealth and control. A rootkit is built to win deep, privileged access (the name comes from the Unix root account) and then hide — concealing its own files, processes, and network connections from the operating system and even from antivirus tools. Rootkits can live in user space, in the OS kernel, or in the boot process (bootkits). Because a rootkit can lie to the very tools you use to inspect the system, the surest cures are prevention (least privilege, secure boot, patching) and, once infected, scanning from a known-clean external boot medium or rebuilding the machine. A botnet is a network of many compromised computers — each one a bot or "zombie" — that an attacker controls remotely through a command-and-control (C2) server. The owners usually have no idea. Their machine quietly takes orders to send spam, mine cryptocurrency, or flood a target in a DDoS attack. Defenses focus on not becoming a bot in the first place (patching, antimalware) and on egress filtering — watching for and blocking the outbound C2 "phone-home" traffic that betrays an infected host.

Because malware tries to hide, defenders look for its side effects: unfamiliar processes, unexpected network connections, and files flagged by an up-to-date scanner. The read-only commands below inspect a Linux host without changing anything — a safe first look when you suspect a machine is compromised.

No single control stops every type, so professionals layer their defenses — *defense in depth* — so that when one layer fails, another still catches the threat. Map each habit below to the malware it counters: Patch and update everything promptly — closes the vulnerabilities worms and exploit-based attacks rely on. Run reputable antivirus/EDR with real-time scanning and current signatures — catches viruses, trojans, and spyware. Practice least privilege — do daily work as a standard user, not admin, so malware (especially rootkits) cannot easily seize deep control. Keep offline, tested backups — so ransomware cannot hold your only copy hostage. Filter email and downloads, disable Office macros, and install only from trusted sources — shuts down trojans and virus-laden attachments. Segment networks and use firewalls with egress filtering — slows worms and cuts off botnet command-and-control traffic. Require MFA and strong, unique passwords — so a keylogger's stolen credential is not enough by itself. Train users — most malware still arrives because a person was tricked into clicking, so awareness is a security control in its own right.

Using process-snapshot.csv, write ONE command for each question using pipes. The columns are pid,user,cpu_pct,mem_pct,started,command,connection, separated by commas. 1. Which process uses the most CPU? Give its PID and its cpu_pct value. ( sort -t, -k3,3 -nr, head -n 1 ) 2. How many processes list a network connection? A connection is an address:port value in the last column; - means none. ( cut -d, -f7, grep -c ':' ) 3. Malware often hides in a hidden folder, one whose name starts with a dot. Exactly two processes run from a path containing a hidden folder. What are their PIDs? ( grep '/\.' ) 4. Of those two hidden-folder processes, look at the one with the earlier started time. What remote address and port is it connected to? 5. Which user owns the most processes, and how many? Do not count the header row. ( tail -n +2, cut -d, -f2, sort, uniq -c, sort -nr ) The ps aux and ss -tunp session in the Detecting an Infection section above was captured on a different computer, so its PIDs, times, and addresses will not match this file. Look for the same warning signs in both: a script in a hidden folder, heavy CPU use, and an outbound connection to an unknown host.