Headlines call everything a "virus." Professionals don't — because the different species of malware spread differently, and how a thing spreads determines how you contain it. This is field-guide knowledge: learn the behaviours, and incident reports, vendor docs, and certification questions all snap into focus.
Classified by how they spread
- Virus — the original species, named for its biological parallel: code that attaches itself to a legitimate file or program and spreads when humans copy and run infected files. It needs a host and it needs help. Pure viruses are actually rare now; the word survives as the public's term for everything.
- Worm — the dangerous evolution: self-propagating, no host file, no human action needed. A worm scans the network for vulnerable machines, infects them, and each victim starts scanning too. That compounding is why worms cause history's fastest-moving incidents — and why "wormable" is the scariest adjective in a vulnerability report.
- Trojan — spreads by deception rather than self-replication: a program you install voluntarily because it appears legitimate — a cracked game, a fake invoice attachment, a counterfeit installer. The payload rides in on your own trust, which is why trojans remain the most common delivery mechanism of all.
Classified by what they do once inside
- Ransomware — encrypts your files and sells you the key. The dominant criminal business model of the era; modern crews also steal the data first and threaten publication (double extortion), which is why "we have backups" no longer ends the conversation.
- Spyware / infostealers — quietly harvest passwords, cookies, and keystrokes. Stealers matter enormously right now: the credentials they exfiltrate get sold in bulk and become the entry point for later, bigger attacks.
- Rootkits — burrow into the operating system's deepest layers to hide other malware from detection. Their existence is why serious incident response often ends in "wipe and reinstall" rather than "clean and hope."
- Botnet clients — enslave the machine into a remote-controlled army used for spam, DDoS attacks, or renting out to other criminals. Your computer isn't the target; it's the ammunition.
The categories combine, and modern attacks usually chain them: a trojan delivers a stealer, whose harvested credentials let attackers in to deploy ransomware. When you read an incident write-up, you're almost never looking at one species — you're looking at a food chain.
Why the taxonomy pays rent: response depends on species. A worm means isolate network segments now — it's still spreading. A trojan means finding what the user ran and what it dropped. A rootkit means rebuilding, not cleaning. Same headline word, "virus" — three completely different playbooks.