What Is Malware? Common Types and How to Protect Yourself

By
Harris
-
64

Key Points

  • Malware, short for malicious software, is code inserted into a system, usually covertly, to compromise the confidentiality, integrity or availability of data, apps or the operating system, according to NIST.
  • Common types include viruses, worms, Trojan horses and spyware; ransomware is another form that locks or steals files for payment.
  • CISA says most viruses, Trojan horses and worms are activated when someone opens an email attachment or clicks a link.
  • Anti-virus software relies on signatures of known malware, so CISA advises pairing it with prompt software updates, backups and a firewall.
  • If a home computer is infected, CISA’s first step is to disconnect it from the internet, then scan, clean and change passwords.

What is malware? It is any software or code built to do something harmful on your device without your permission, from spying on what you type to deleting files or giving a criminal remote control of your computer. The word is short for “malicious software,” and it covers a whole family of threats rather than a single program.

This explainer covers how federal agencies define malware, the main types, how infections start, warning signs and what to do if your computer has been hit. It relies on guidance from the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST) and the FBI.

What does malware mean?

NIST’s Computer Security Resource Center glossary collects several official definitions. One describes malware as a program inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity or availability of the victim’s data, applications or operating system, or of otherwise annoying or disrupting the victim.

Another NIST definition calls it software or firmware intended to perform an unauthorized process that has an adverse impact on a system, and lists viruses, worms, Trojan horses and other code-based entities that infect a host as examples. Spyware and some forms of adware are also counted as malicious code.

CISA uses the plain-language term “malicious code” for the same idea: unwanted files or programs that can harm a computer or compromise the data stored on it. Malware is defined by what it is designed to do, not by how it looks.

The main types of malware

Malware is usually sorted by how it spreads and what it does once running. These are the categories federal guidance describes most often.

Type How it works What it can do
Virus Copies itself into other programs or files and runs when the infected program is opened Damage or destroy files, or simply spread to other computers
Worm A self-contained program that spreads across networks without needing a host program or user action Use up memory and bandwidth, slow or freeze computers, open remote access
Trojan horse Looks like a useful program but hides a malicious function Install other malware or carry out harmful actions in the background
Spyware and adware Installed secretly to gather information or push ads Track browsing, show pop-ups, redirect searches, in extreme cases record keystrokes
Ransomware Encrypts or steals files and demands payment Lock people and organizations out of their own data

Viruses

NIST describes a virus as malicious software that spreads by modifying other programs to include a copy of itself, and that runs when the infected program is launched. CISA notes that today they spread primarily through email. Unlike worms, viruses often need a person to do something, such as opening an attachment or visiting a malicious web page, before they can spread.

Worms

A worm is a self-contained program that can copy itself through computer networks on its own. NIST notes that worms are often designed to use up resources such as storage space or processing time. CISA adds that worms can take up valuable memory and network bandwidth, which can cause a computer to stop responding, and can also give attackers remote access.

Trojan horses

Named after the hollow horse of Greek legend, a Trojan horse is a program that appears to have a useful function but also has a hidden, potentially malicious one, in NIST’s wording. CISA warns that Trojans often ride along with free software downloads or arrive as email attachments, so the user believes they are installing something legitimate.

Spyware

NIST defines spyware as software that is secretly installed into a system to gather information on individuals or organizations without their knowledge. CISA explains that the term overlaps with adware, which may flood you with pop-up ads, redirect your browser or monitor the sites you visit. More invasive versions can track exactly which keys you type, which is how passwords and card numbers get stolen.

Ransomware

Ransomware is a type of malware that locks up files and demands money to release them. LiveNewsWorld covers it in depth in our guide to ransomware and how to protect your devices.

How malware gets onto your device

Most infections start with a small action by the user. CISA says most viruses, Trojan horses and worms are activated when you open an attachment or click a link in an email message. If an email program allows scripting, simply opening a message can be enough. Other common routes CISA lists include:

  • Malicious email attachments, including from addresses you recognize
  • Malicious web pages and pop-up windows that prompt you to click
  • Free downloadable software and browser toolbars from sites you do not trust
  • Infected USB drives and other removable media, especially when AutoRun features are turned on
  • Malicious data files, such as a document, PDF, ZIP or image file, that exploit a weakness in the program used to open it

CISA notes that attackers frequently spread such files through email, social media and websites. When those flaws are not yet patched, they are known as zero-days, which we explain in how zero-day attacks work.

Warning signs of a malware infection

There is no single symptom that proves a device is infected. CISA says some infections destroy files or shut a computer down completely, while others only subtly change how it behaves. Its guidance on spyware lists signs that may point to a problem:

  • Endless pop-up windows
  • Being redirected to websites other than the one you typed
  • New, unexpected toolbars or icons appearing
  • Your browser’s home page or default search engine changing on its own
  • Random error messages
  • The computer suddenly running very slowly when opening programs or saving files

Your anti-virus software may also alert you. CISA also advises resisting alarmist emails that claim the “worst virus in history” has been detected, because these messages are usually hoaxes.

How anti-virus software helps, and where it falls short

Anti-virus software, sometimes called anti-malware software, scans files and memory for patterns that match the signatures of known malware. CISA recommends installing it from a reputable vendor, keeping its definitions current and running periodic full scans, along with automatic real-time scanning where available.

The agency is also clear about the limits. Because anti-virus tools rely on signatures, they can only detect malware with known characteristics, and new threats can circulate before vendors add them. CISA also cautions that running too much anti-virus software at once can slow a computer and reduce the software’s effectiveness. CISA notes that most packages perform similar functions and that installing any of them increases protection.

How to protect yourself from malware

CISA’s guidance on protecting against malicious code boils down to layered habits. No single step is enough on its own.

  • Keep software updated. Install patches so attackers cannot exploit known vulnerabilities, and turn on automatic updates where available. CISA’s Secure Our World campaign stresses installing all updates, especially for web browsers and antivirus software.
  • Be careful with links and attachments. Be wary of unexpected attachments, even from people you know, and check with the sender first.
  • Use an account with limited permissions. If you browse with a standard account instead of an administrator account, restricted permissions can keep malicious code from spreading.
  • Turn on a firewall. Many operating systems include one; make sure it is enabled.
  • Block pop-ups and disable AutoRun. Most browsers can block pop-up windows, and turning off AutoRun and similar auto-launch features stops infected drives from launching code automatically.
  • Back up your data. Regular backups to the cloud or an external drive mean an infection does not have to cost you your documents and photos.
  • Download carefully. Visit software makers’ sites directly instead of clicking ads or email links, and avoid free programs from sites you do not trust.
  • Watch your accounts. Look for unauthorized activity, especially on bank accounts, and contact the provider if something looks wrong.

What to do if you think you have malware

CISA’s guidance on recovering from viruses, worms and Trojan horses lays out a clear order of operations.

  1. Limit the damage. On a work device, contact your IT department immediately. On a home computer or laptop, disconnect from the internet so the malware cannot reach your data, send it to an attacker or attack other machines.
  2. Remove the malicious code. Update your anti-virus definitions if possible and run a full manual scan. If the software cannot remove the infection, you may need to reinstall or restore the operating system, which typically erases your files and installed programs.
  3. Patch everything. After a reinstall, apply all available updates before going back online for normal use.
  4. Change your passwords. Passwords may have been exposed during the infection, including ones saved in your web browser.
  5. Monitor and report. Keep an eye on financial accounts. If you lost money or data to a cyber-enabled crime, you can file a complaint with the FBI’s Internet Crime Complaint Center (IC3), which the FBI describes as the central hub for reporting cyber-enabled crime.

The IC3 also warns that scammers impersonate it. It says it does not work with non-law enforcement entities, such as law firms or crypto services, to recover lost funds, and it will never contact you directly for information or money.

Why malware matters beyond your own device

An infected computer is not only a personal problem. CISA notes that an attacker or virus can use one infected machine to attack other computers, and worms can spread across networks without anyone clicking anything. For coverage of major cyber incidents affecting Americans as they happen, follow the LiveNewsWorld U.S. News Live center.

The bottom line

Malware is any software designed to harm your device or steal from you, and it comes in many forms, from classic viruses and network worms to Trojan horses, spyware and ransomware. Many infections begin with a bad link, an unexpected attachment or an untrusted download. Keeping software updated, using reputable anti-virus protection, backing up files and slowing down before you click go a long way. If something does get through, disconnect first, clean the device and change your passwords.

Sources