Malware: definition, common types, history, prevention, and key distinctions

Common types and typical behavior

• Viruses — code that attaches to other programs or files and spreads when those hosts are executed. See more on viruses.
• Worms — self-replicating programs that propagate across networks without needing to modify host files.
• Trojan horses — software masquerading as legitimate applications that perform hidden malicious actions; often delivered by deceptive downloads or attachments. Related information: Trojan horses.
• Spyware and keyloggers — tools that collect keystrokes, screen contents, or usage patterns to harvest credentials and personal data. See spyware.
• Ransomware — software that encrypts files or otherwise denies access until a ransom is paid; a major vector for extortion. More on ransomware.
• Rootkits and bootkits — low-level code that hides the presence of other malware and resists detection.
• Botnets — collections of compromised devices controlled remotely for spam, distributed denial-of-service, or other campaigns.

Many varieties combine features: a Trojan may install a backdoor and then add the host to a botnet, or a worm may drop ransomware. Common characteristics include stealth, persistence (surviving reboots), evasion of security tools, and mechanisms for remote control or data exfiltration.

Malware has evolved alongside computing. Early experimental viruses and self-replicating code appeared in academic environments and hobbyist systems decades ago; by the 1980s and 1990s such programs became more widespread. High-profile incidents and the commercialization of the Internet accelerated development of organized criminal uses, professionalized toolkits, and nation-state capabilities. Over time delivery methods shifted from floppy disks and email attachments to web drive-by downloads, malicious advertising, social engineering, and supply-chain compromises.

Detection and prevention rely on layered defenses: signature-based scanners, heuristic and behavior analysis, network monitoring, timely operating system and application updates, and strong user practices (phishing awareness, least privilege, and backups). Security products and services—collectively described as computer security or anti-malware solutions—reduce risk but cannot guarantee complete protection. Removal can be difficult when malware embeds itself deeply or corrupts system components; in severe cases, rebuilding a system from known-clean backups is recommended.

It is important to distinguish deliberate malware from unintentional flaws. Software that causes harm due to coding errors or misconfiguration is generally categorized as a bug rather than malware. Legal definitions and forensic analysis focus on intent, capability, and observable behavior when classifying an incident. Understanding these differences matters for incident response, disclosure, and law enforcement.

Current trends include targeted extortion, supply-chain attacks, the growth of mobile and Internet-of-Things threats, and increasingly sophisticated evasion techniques. For individuals and organizations, maintaining layered defenses, regular backups, and a practiced incident response plan remain the most reliable ways to limit damage and recover when compromises occur.