Malware explained: viruses, trojans, worms, spyware and what to do about them

What malware is

“Malware” is short for malicious software. It covers any program written to damage a device, steal information, spy on the person using it or give someone else control. The word is a catch-all, and the individual types, such as viruses, worms and trojans, are different ways of delivering the harm.

What malware does varies widely. It can slow a device, show unwanted adverts, collect browsing habits, steal passwords and bank details, lock your files for ransom, wipe data, or quietly use your device to attack other people. Often the first sign is that something is just slightly off: a slower computer, a changed browser home page, or an account that behaves oddly.

The main types

These are the types you will hear about most. A single piece of malware can belong to more than one group.

• Viruses. Attach themselves to legitimate files or programs and copy themselves when you run those files. A virus needs a person to open or run something to get started.
• Worms. Spread by themselves across networks, usually through software flaws, without anyone clicking anything. That makes them dangerous, and it is why installing updates promptly matters.
• Trojans. Pretend to be something useful, such as a free tool, a game or an invoice, and rely on you installing it. Once inside, a trojan can open a hidden door for other malware, record keystrokes or steal data. Many people mix up trojans and viruses, but a trojan does not copy itself; it depends on being tricked into running.
• Ransomware. Locks or encrypts your files and demands payment, and often threatens to leak stolen data as well. See our ransomware guide.
• Spyware. Installs quietly and collects information such as passwords, banking details and browsing activity. It can arrive through malicious apps, links, websites or email attachments.
• Keyloggers. Record what is typed to capture passwords and other private details. Most are software that arrives through a bad link or attachment, though physical ones can be attached to a keyboard. Using a password manager, which fills in passwords for you, and two-factor authentication make a stolen password less useful.
• Rootkits. Give an attacker hidden control of a device and often switch off security tools. They are designed to stay invisible, which makes them one of the hardest types to detect and remove.
• Adware and unwanted programs. Show unwanted adverts and track browsing. Many are bundled inside free software installers. Some are only annoying, but malicious adverts can lead to worse infections.
• Botnet malware. Turns your device into one of thousands of “bots” controlled remotely, often used to flood websites with traffic or send spam. You may never notice.
• Fileless malware. Runs in a computer’s memory and abuses built-in tools instead of installing a file, which makes it harder for simple scanners to catch.
• Cryptojackers. Secretly use your device’s power to mine cryptocurrency for someone else, slowing it down and raising your power bill.
• Wipers. Destroy data outright instead of holding it for ransom. They are sometimes used to cover an attacker’s tracks.

How malware gets in

Nearly all malware relies on one of a handful of routes:

1. Email and messages. A malicious attachment or a link to a booby-trapped page. Try our phishing checker and link safety checker before you open anything unexpected.
2. Fake or risky downloads. Pirated software, “cracked” games, free tools from unofficial sites and fake update prompts.
3. Fake fixes. A page that tells you to paste a command or install something to “prove you are human” or to repair an error. See our ClickFix explainer.
4. Unpatched software. Known security holes that were never updated, particularly in browsers, operating systems and internet-facing devices.
5. Malicious adverts and websites. Pages and ads that try to push a download or exploit a flaw.
6. Infected removable drives. A USB drive can carry malware onto a computer. Our articles on Stuxnet and Agent.btz show how serious this can get.
7. Malicious apps from outside the official app stores.

Warning signs of an infection

• Your device suddenly runs slowly, overheats or the battery drains much faster than usual.
• Your browser home page, search engine or toolbars change without your say-so, or you see many pop-ups.
• New programs or browser extensions appear that you did not install.
• Security software is switched off and will not turn back on.
• Friends tell you they are getting strange messages from your accounts.
• Files are missing, renamed or will not open, or there is a ransom message.
• Unexpected data usage or network activity when you are not using the device.

None of these proves infection on its own, and many have ordinary causes. A cluster of them, or a sudden change, is a good reason to check.

If you think you are infected

1. Disconnect from the internet. Turn off Wi-Fi or unplug the network cable to stop data leaving or the malware spreading.
2. Do not enter passwords on the infected device. If it carries a keylogger or spyware, anything you type could be captured.
3. Run a full scan with reputable security software. Windows has a built-in scanner (Microsoft Defender, including an offline scan option). On Macs and phones, use the system’s own security tools or a well-known security app.
4. Remove what it finds, and remove any programs or browser extensions you did not install.
5. Update everything. Install all pending updates for your operating system and apps.
6. Change your passwords from a different, clean device. Start with email, then banking, then everything else. Turn on two-factor authentication.
7. Consider a clean reinstall if the infection is serious or you suspect a rootkit. Wipe the device and restore from a backup you trust. This is where an offline backup earns its place; see our backup guide.
8. Watch your accounts over the following weeks for unexpected activity, and use our first 24 hours checklist if money or identity details were involved.

How to stay protected

• Keep everything updated. Turn on automatic updates for your operating system, browser and apps. Updates close the holes that worms and other malware use.
• Install software from official sources only. Use the official app store or the developer’s own site. Avoid pirated software.
• Use security software and keep it switched on. The built-in tools in modern systems are a good baseline.
• Be cautious with attachments, links and “urgent” prompts, even from people you know, whose accounts may have been taken over.
• Never run a command or installer because a web page told you to as part of a CAPTCHA or “verification”.
• Use a standard user account for everyday use and an administrator account only for installing things. Malware does less damage if it does not start with full powers.
• Use two-factor authentication and a password manager, so a stolen password is not the end of the story.
• Back up regularly, with one copy disconnected.

Sources

• TechTarget: Common types of malware attacks and how to prevent themAccessed October 13, 2026

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.