Malware is not a single thing. The term covers a broad family of malicious software — each with a different mechanism, a different purpose, and different defences that work against it. Having malware types explained clearly matters because the response to ransomware is fundamentally different from the response to a keylogger, and preventing a rootkit requires different steps than preventing adware. For a broader walkthrough, our Complete Guide to Online Security and Privacy is a good next read.
This guide covers every major malware category you’re actually likely to encounter or defend against in a personal or small business context — what each type does, how it spreads, the damage it causes, and the specific defences that work against it.
The foundational three — viruses, worms, and trojans
Viruses are malicious code that attaches to legitimate files and replicates by infecting other files when the host file is executed. A virus requires human action — opening an infected file — to spread. True file-infecting viruses are less common in 2026 than in the pre-internet era, but antivirus software still uses “virus” terminology to describe file-based malicious code detection broadly.
Worms are self-replicating malware that spread across networks without requiring human action. They exploit software vulnerabilities to move from system to system automatically. WannaCry used the EternalBlue exploit as a worm propagation mechanism, spreading across networks of unpatched Windows systems in minutes. A single compromised device can propagate the infection to every accessible device on the same network — which is why network segmentation and keeping systems patched are specifically worm defences.
Trojans disguise themselves as legitimate software to gain execution — the name references the mythological horse. A trojan might be disguised as a cracked game, a useful utility, a fake system update, or a document with an embedded payload. Unlike viruses, trojans don’t self-replicate; they rely entirely on the user choosing to install or execute the disguised program. Among the most common types in corporate security because they’re frequently delivered through phishing emails — the user is the delivery mechanism. Defence: download software only from official sources, verify anything that requests elevated permissions.
Ransomware — the most financially damaging type
Ransomware encrypts the victim’s files and demands payment — typically cryptocurrency — for the decryption key. Without a clean backup, the victim’s options are paying the ransom (with no guarantee the key will be provided) or accepting permanent data loss.
The ecosystem has evolved significantly. “Ransomware-as-a-Service” (RaaS) allows non-technical criminals to deploy sophisticated ransomware built by developer groups, paying a percentage of successful ransoms. Double extortion ransomware not only encrypts files but exfiltrates sensitive data before encryption and threatens to publish it — creating payment pressure even for victims with clean backups. Triple extortion adds DDoS attacks as additional leverage.
Consumer-targeting variants have lower ransom demands (hundreds to low thousands of dollars) and more automated negotiation. The defences are identical for consumer and enterprise ransomware: offline backups that ransomware cannot reach because they’re disconnected, behavioural endpoint protection that can identify the encryption process and terminate it, and Windows Controlled Folder Access that prevents unauthorised applications from modifying files in protected folders. Our guide on protecting against ransomware covers the complete prevention and response framework.
All major malware types — comparison table
| Type | How it spreads | Primary damage | Key symptoms | Primary defence |
| Virus | Infected files, requires execution | File corruption, payload delivery | Files acting strangely after opening unknown files | Antivirus; don’t run unknown files |
| Worm | Self-propagating via network vulnerabilities | Network propagation, payload delivery | Unexpected network activity; other devices on network also infected | Patch systems; network segmentation |
| Trojan | Disguised as legitimate software | Backdoor, data theft, payload delivery | Antivirus disabled; unexpected background processes | Download from official sources; phishing awareness |
| Ransomware | Phishing, drive-by downloads, RDP exploits | Data loss, extortion | Files with unfamiliar extensions; ransom note appearing; inaccessible files | Offline backups; Controlled Folder Access |
| Spyware / Keylogger | Trojan delivery, phishing | Credential theft, surveillance | Credentials appearing in unexpected breach databases | Antimalware; strong 2FA |
| Adware / Browser hijacker | Bundled with free software | Unwanted ads, privacy exposure, performance | Browser redirects; new toolbars; changed homepage; ads outside browser | Ad blocker; Malwarebytes; browser reset |
| Rootkit | Exploitation of vulnerabilities; delivered by trojans | Persistent access, hides from detection | Antivirus stops working; system tools unavailable | Secure Boot; offline scanner (TDSSKiller) |
| Cryptominer | Drive-by downloads, cracked software | Performance degradation, high power consumption | High CPU/GPU usage with no active demanding application | Antimalware; Task Manager monitoring |
| Infostealer | Phishing, fake software, Discord/YouTube links | Credential theft, account takeover | Unexpected logins; session cookie theft; financial account anomalies | Antimalware; don’t save passwords in browser |
| Botnet agent | Delivered by other malware types | Device used for spam/DDoS/cryptomining | Unusual upload traffic; slow device when “idle” | Antimalware; network traffic monitoring |
Removal approach by type
Adware and PUPs: Malwarebytes Free scan → quarantine all findings → browser extension audit (remove unrecognised extensions) → browser settings reset → check installed programs for recent unwanted additions and uninstall. Adware is the most common type home users encounter and is typically addressed without Safe Mode.
Trojan and standard malware: Disconnect from internet → restart in Safe Mode → update Windows Defender definitions → run Windows Defender full scan → run Malwarebytes scan → run ESET Online Scanner → check startup items (Task Manager → Startup) and remove unfamiliar entries → restart and verify. Our guide on removing malware from Windows covers this sequence in detail.
Ransomware: Immediately power off the device (not restart) to stop the encryption process → do not reconnect to the network → check nomoreransom.org for a free decryptor for the specific variant → restore from clean offline backup → don’t pay before checking for decryptors. Time-critical: the time between ransomware execution and encryption completing can be minutes. Power off immediately if ransomware activity is suspected — files not yet encrypted can be saved by stopping the process.
Rootkit: Boot from a clean USB live environment → run Kaspersky’s TDSSKiller or Malwarebytes Anti-Rootkit from the live environment → if rootkit cannot be removed, reinstall Windows from clean installation media. Rootkits are the most difficult type to remove because they operate at or below the OS level and can survive normal antivirus removal attempts.
Cryptominer: Task Manager → check CPU/GPU usage with no active applications → identify the process consuming resources → terminate → locate and delete associated files → run full antimalware scan. Miners often disguise their process names as system processes — searching the exact process name online confirms whether it’s legitimate.
Emerging types worth knowing
Fileless malware operates entirely in system memory without writing any files to disk — it evades file-based antivirus scanning by using legitimate system tools (PowerShell, WMI) to execute malicious operations. Detected by behaviour-based endpoint protection rather than signature scanning. Windows Defender’s cloud-based behavioural analysis and tamper protection are specifically relevant here.
Infostealers (Redline, Raccoon, Vidar) are a rapidly growing category focused entirely on credential and data theft — capturing browser-saved passwords, session cookies, cryptocurrency wallet files, and authentication tokens, then exfiltrating them to attacker infrastructure. Sold as services in criminal forums, distributed through phishing, game cracks, and YouTube comment links. The consequence of an infostealer infection: treat all credentials used on the device as compromised. Change every password, rotate session tokens, and check for fraudulent activity on financial accounts.
Reviews from major security publications identify infostealers as the malware category with the most rapidly growing impact on everyday users in 2026 — a development directly relevant for anyone who stores credentials in a browser or uses the same device for both personal and financial activities.
Mobile malware targeting Android and iOS is growing as smartphones become primary computing devices. Android’s open installation model creates more exposure than iOS’s strict App Store review, but sophisticated campaigns have placed malicious apps in the Play Store itself. Types include banking trojans that overlay legitimate banking app interfaces to capture credentials, spyware silently accessing microphone, camera, and location, and SMS-intercepting malware that captures OTP codes for 2FA bypass.
Early symptom recognition — matching symptoms to type
Recognising a potential infection before any alert appears is often the first diagnostic step:
- High CPU/GPU usage with no active demanding application: cryptominer or botnet agent
- Browser redirects, new toolbars, changed homepage, pop-up ads outside the browser: adware or browser hijacker
- Antivirus software disabled or stops working: trojan or rootkit that disables defences as its first action
- Files with unfamiliar extensions, ransom note, inaccessible files: ransomware — power off immediately
- Unexpected logins on accounts you didn’t access: infostealer — credentials already exfiltrated and being used
- Significant upload traffic with no active sync or upload activity: data exfiltration by spyware or botnet agent
Matching symptoms to the type they suggest makes initial triage faster and the removal approach more effective. Social engineering delivery is the common thread across nearly all malware types — the vast majority of infections begin with a user action the attacker manipulated. Understanding each type’s typical delivery method helps avoid the delivery vector: adware through free software installers, ransomware through phishing email attachments, infostealers through fake cracked software and social media links, trojans through email attachments and social engineering. Avoiding the delivery vector prevents the infection regardless of which specific type it would have installed. Our guide on avoiding phishing scams covers the delivery-layer defence that applies across every malware type.
Prevention that applies across all types
Despite the diversity of malware types, the upstream prevention is consistent across all of them:
- Verified downloads from official sources only. The majority of malware is delivered through unofficial installers, cracked software, and “too good to be true” free versions of paid software. If a free version of paid software exists on a site other than the official vendor or a well-known legitimate platform, it’s likely delivering something alongside the software.
- Automatic OS and application updates. Worms, drive-by downloads, and exploit kits specifically target known vulnerabilities that patches have already addressed. An up-to-date system eliminates the majority of exploitation-based delivery vectors.
- Phishing awareness for every unexpected email and message. The human action that phishing exploits — clicking a link, opening an attachment, executing a download — is the delivery mechanism for ransomware, trojans, infostealers, and spyware. The single habit of verifying unexpected contacts through a separate channel before taking any action they request prevents the majority of malware delivery.
- Offline backups. The specific defence against ransomware that makes it a recoverable incident rather than a catastrophic one. A clean offline backup from before the infection means the choice isn’t “pay or lose everything” — it’s “restore and recover.”
- Antivirus/antimalware active and updated. Windows Defender with Enhanced Protection and real-time protection active, Malwarebytes for secondary scanning, and browser protection (uBlock Origin for blocking malicious ad networks) provide overlapping coverage that catches different categories of delivery.
How malware has evolved — context for 2026
The malware landscape of 2026 looks meaningfully different from 2015. The shift from opportunistic mass infections to financially motivated targeted attacks has concentrated the highest-damage incidents in ransomware and business email compromise. The commoditisation of malware-as-a-service has lowered the technical barrier to running sophisticated attacks, increasing the volume and sophistication of attacks against non-corporate targets. And the growth of infostealers — largely invisible during infection — has made credential theft the primary consequence of most malware infections rather than overt damage like file corruption or system crashes.
For home users, the practical implication is that the malware most likely to cause real harm is least likely to announce itself obviously. An infostealer that quietly exfiltrates all browser-saved passwords leaves no visible trace. A botnet agent that uses the device for spam and DDoS in the background causes nothing more than slightly elevated resource usage. This is why antimalware monitoring and periodic manual checks (Task Manager for unexpected resource usage, browser for unexpected extensions, installed programs for unexpected additions) remain useful habits even when no obvious infection has occurred.
The consistent upstream prevention — official software sources, current patches, phishing awareness, and active antimalware — addresses the delivery vectors that enable every major malware type. Getting these four controls right is more impactful than any response capability after an infection has occurred.
