The Malware Family

In everyday talk, almost any hostile program gets called a "virus." It is a handy word, but it hides a useful distinction: hostile software comes in several kinds, and they are told apart by two things — how they spread and what they do. A virus is only one branch of the family.

Four members come up again and again in security news: the virus, the worm, the trojan, and spyware. Once Olivia can tell them apart, a headline like "a worm spread across the hospital network" stops being a vague scary blob and starts saying something specific.

A simple way to keep them straight is to think of human illnesses. Some sicknesses need close contact to pass between people; some travel through the air on their own; some come hidden inside something you welcomed in; and some sit quietly and listen. Each malware type maps onto one of those — and then we will leave the illness picture behind and use the real terms.

What Is a Virus?

A virus is hostile code that attaches itself to a file or program — a document, an installer, an app. On its own it does nothing. It spreads only when a person runs or shares the infected thing: you open the file, the hidden code runs, and it tries to attach copies of itself to other files.

That dependence on a human is the defining trait. Like a cold that needs people to come into contact, a virus needs someone to carry it — to open, copy, or pass along the infected file. No click, no spread.

What Is a Worm?

A worm looks similar at first — it is hostile code that copies itself — but it has one crucial difference: it spreads by itself, across networks, with no human action at all. It finds other reachable computers, copies itself onto them, and from each new machine reaches out again.

This is why worms can explode across the internet astonishingly fast. Where a virus waits for a person to open something, a worm is more like an airborne illness — it travels on its own and infects whatever it can reach. That self-spreading, hands-off behavior is exactly what separates a worm from a virus.

What Is a Trojan?

A trojan does not force its way in or spread on its own. It gets in by disguise: it pretends to be something you want — a useful tool, a game, a free version of paid software — so that you install it willingly. The name comes from the ancient story of the wooden horse left as a gift, with soldiers hidden inside.

The disguise is the attack. There is no break-in to detect, because the user opened the door. A trojan is like poison hidden in a present: the danger is wrapped in something you were glad to accept.

What Is Spyware?

The first three are mostly about spreading. Spyware is defined by what it does: it hides on a device and quietly collects information — what you type, what is on your screen, where the device is — and sends that back to the attacker.

Spyware's whole goal is to stay unnoticed for as long as possible, because the longer it watches, the more it learns. It is like a hidden listening bug planted in a room: it does not announce itself, it just records and reports.

Why the Distinction Is Worth Keeping

So far: a virus needs a person to carry it, a worm carries itself, a trojan is invited in by disguise, and spyware hides and watches. Telling them apart is not pedantry — each type is caught and stopped differently, which the rest of this chapter and the defenses later in the course build on. Calling everything a "virus" flattens all of that into one word and loses the part that actually tells you what is going on.