Malware is the broad category for malicious software or code. A computer virus is one type of malware that attaches to other files or programs and replicates when they run. Ransomware, spyware, worms, trojans, downloaders, rootkits, and information stealers are malware too, but they are not necessarily viruses.
In everyday conversation, “virus” is often used for any infection. For investigation and defense, the distinction matters because propagation, impact, persistence, and containment differ.
The major categories
Virus
A virus typically inserts itself into another file or program and depends on execution of the infected host to spread. Traditional file-infecting viruses are less representative of many modern incidents than the popular term suggests.
Worm
A worm can spread between systems without attaching to a host file, often by abusing network exposure or a vulnerability. Rapid automated propagation makes segmentation and patching critical.
Trojan
A trojan pretends to be useful or expected software while performing malicious actions. Cracked software, fake updates, and fraudulent security tools are common delivery disguises. “Trojan” describes deception, not one specific payload.
Ransomware
Ransomware denies access to data or systems and demands payment. Modern operations may steal data before encryption, turning the event into both an availability incident and a breach.
Spyware and information stealers
These collect browser sessions, passwords, cryptocurrency wallets, messages, screenshots, or other data. An infected device can undermine strong account security because secrets are captured after legitimate decryption.
Rootkit and bootkit
These seek deep persistence or concealment in privileged operating-system or startup components. Remediation may require trusted recovery media or complete reinstallation.
Fileless and living-off-the-land activity
Some attacks rely heavily on legitimate scripting engines, administration tools, memory, scheduled tasks, or cloud features. “Fileless” does not mean no evidence exists; it means traditional file scanning alone is insufficient.
How infections commonly begin
- phishing attachments and deceptive links;
- fake updates or installers;
- malicious advertisements and compromised sites;
- unpatched applications or exposed services;
- unsafe browser extensions;
- pirated software;
- stolen remote-access credentials;
- supplier or software-distribution compromise;
- removable media.
Signs that deserve investigation
Unexpected security alerts, disabled protections, new extensions, unfamiliar processes, unexplained account logins, browser redirects, outbound traffic spikes, files changing extension, inaccessible data, newly created administrators, or messages sent without your knowledge can indicate compromise.
None is proof alone. Slow performance can have ordinary causes, while sophisticated malware may remain quiet.
What to do if you suspect malware
- Stop sensitive activity on the device.
- If active compromise or propagation is plausible, disconnect it from networks.
- For work equipment, contact the security team immediately.
- Preserve relevant alerts, filenames, times, and messages.
- Use trusted, updated security tools or professional responders.
- From a known-clean device, secure exposed accounts and revoke sessions.
- Reinstall or reimage when confidence in cleanup is insufficient.
- Restore data only from known-good backups.
- Identify and correct the initial access path before reconnecting.
Do not download a random “cleaner” from an advertisement. The FTC warns that scammers may advertise security software that is itself malware.[1]
Why naming the family is not enough
An antivirus label may identify a sample, but incident scope requires more questions: What executed? Which user and privileges? What credentials or sessions were accessible? Did the malware communicate externally? Was persistence created? Did it spread? What data left? Are backups trustworthy?
Erasing one file without answering those questions can leave the actual intrusion intact.
Prevention that works across categories
Keep systems and applications updated, install software only from trusted sources, limit administrator use, control scripts and macros, use strong account authentication, maintain tested backups, filter email and web content, monitor endpoints, and restrict unnecessary network paths.
No single tool prevents every technique. Layering reduces both likelihood and impact.
The bottom line
Every computer virus is malware, but most malware should not casually be called a virus. Classify what it does—how it arrives, executes, persists, spreads, steals, or disrupts—because those behaviors determine the response.
Sources
U.S. Federal Trade Commission, Malware: How to Protect Against, Detect, and Remove It. ↩︎
