Types of Malware Explained: Virus, Trojan, Spyware, Ransomware and More

When people say "virus" they often mean any type of malware. But different types of malicious software work very differently and understanding them helps you understand the threat better.

Virus

A program that attaches itself to legitimate files and replicates when the infected file is opened. Classic viruses spread through infected USB drives, email attachments and downloaded files. They can corrupt or delete files, display messages, or consume system resources. Less common than they once were, as criminals now favour more profitable attack types.

Trojan Horse

Software that appears legitimate but contains hidden malicious functionality. A Trojan might look like a free game, a software crack, or an invoice. Once installed, it can install additional malware, steal credentials, or provide the attacker with remote access to your system.

Spyware

Runs silently in the background monitoring your activity. Keyloggers record every key you press (including passwords). Screen capture spyware periodically screenshots your screen. Banking spyware specifically targets credentials entered on financial sites.

Adware

Displays unwanted advertising, typically through browser hijacking. Redirects searches, injects ads into web pages, or opens pop-up windows. Annoying rather than directly dangerous, but often bundled with more serious malware and may track your browsing activity.

Ransomware

Encrypts your files and demands payment for the decryption key. The most financially destructive type of malware for both individuals and businesses. Some variants also steal data before encrypting it, creating a double extortion threat.

Rootkit

Designed to maintain persistent access while hiding its presence from the operating system. A rootkit modifies the OS at a deep level so that the malware doesn't appear in process lists or file directories. Very difficult to detect and remove — often requires a complete system reinstall.

Botnet Malware

Turns your computer into part of a criminal's network of compromised machines. Used to send spam, conduct distributed denial of service attacks, or mine cryptocurrency — all using your electricity and internet connection. May have minimal noticeable impact on an individual machine.