Malware Taxonomy
Why is 'virus' the wrong word for most modern threats?
- Define malware
- Distinguish virus, worm, trojan, ransomware, spyware and adware
- Match malware types to typical symptoms and infection vectors
Overview
Malware is short for 'malicious software' — any program written to harm a device, steal data, or make money for an attacker. In everyday speech people call all malware 'a virus', but a true virus is only one small family. Knowing the differences between the main types helps you spot symptoms early and choose the right response.
Virus
A virus attaches itself to another program or file and spreads only when that host is run. Symptoms: files behave oddly, size changes.
Worm
A worm is a standalone program that copies itself across networks, often exploiting unpatched systems. Symptoms: slow network, unknown processes.
Trojan
A trojan pretends to be useful software (a game, a cracked app) but hides a payload. Symptoms: unexpected pop-ups, new toolbars, remote access.
Ransomware
Ransomware encrypts files and demands payment for the key. Symptoms: renamed files, a ransom note on the desktop.
Spyware & Adware
Spyware quietly collects data (keystrokes, browsing). Adware bombards you with adverts. Both usually arrive bundled with free downloads.
Malware Card Sort
- In pairs, receive 15 cards: 5 malware names, 5 symptoms, 5 vectors.
- Match name → symptom → vector into 5 triples.
- Justify one match to the class.
- What is the main difference between a virus and a worm?
Reveal answer
A virus needs a host program to spread; a worm spreads by itself over networks.
- Why is a trojan dangerous even though it does not self-replicate?
Reveal answer
It tricks the user into running it, giving attackers direct control.
- Give the safest immediate response to a ransomware note.
Reveal answer
Disconnect from the network, do not pay, report to IT, restore from backup.
Draw a table with columns Name / Symptom / Vector / First Response for each malware type.