Software deliberately designed to cause harm, steal data, or disrupt a system

Software with too many bugs to be usable

What makes a computer VIRUS distinctive among malware?

It attaches itself to a legitimate file or program and spreads when that file is shared or run

How does a WORM typically differ from a virus?

A worm spreads on its own across networks, without needing a host file or human action

A worm can only infect one single computer, ever

What does ransomware do?

Encrypts the victim's files and demands payment for the key to unlock them

Speeds up a computer in exchange for a fee

Automatically backs up files for free

Deletes itself after one use with no other effect

Why is a trojan called a trojan?

It disguises itself as legitimate, useful software to trick users into installing it

It was invented in ancient Greece

It only runs on one specific operating system

It always arrives by email attachment only

What is the single best defence against ransomware permanently destroying your files?

Regular, independent backups (kept disconnected or in the cloud) that ransomware on the device cannot reach

Turning the computer off and never using it again

Deleting the antivirus software

What is the main job of antivirus/antimalware software?

Detecting and blocking known malware patterns, and watching for suspicious behaviour

Deleting all files on the computer for safety

Select ALL good defences against malware.

Keeping software and the operating system updated

Not opening unexpected attachments or clicking suspicious links

Regular backups kept separate from the main device

Disabling all security software to make the computer run faster

Malware and Viruses

⏱ 8 min✏️ Quiz at the end

Software Built to Hurt

Most software is written to help you. Malware — malicious software — is the deliberate exception: code engineered to damage a system, steal information, spy on you, or hold your data hostage. It is not a single thing but a family, and knowing the family members helps you recognise and defend against each.

The Family Tree

Viruses need a host. A virus attaches itself to a legitimate file or program; when that host is opened or run, the virus activates — and typically copies itself into other files too, waiting for those to spread in turn (a shared document, a USB stick, an email attachment). Like its biological namesake, it cannot travel alone.

Worms cut out the middleman. A worm spreads by itself across networks, hunting for vulnerable, unpatched machines and hopping to them directly — no human needs to open anything. This is why worms can explode from one infected machine to thousands within hours: no waiting for a person to double-click.

Trojans (named for the Trojan Horse) rely on disguise rather than replication. A trojan poses as something wanted — a free game, a useful tool, a "codec" needed to watch a video — and the user installs the harm themselves, invited in through the front door. This is the malware family most closely tied to phishing and social engineering: the weakness exploited is trust, not a technical flaw.

Ransomware weaponises encryption itself — the very tool meant to protect you. It quietly encrypts the victim's files, then demands payment for the decryption key. The horror is precise: your files are not deleted, just locked with a key you don't have, by people who profit from your desperation.

Spyware hides and watches: logging keystrokes, capturing passwords, tracking activity, and quietly sending it all back to an attacker — the opposite of visible damage, which is what makes it dangerous for so long.

How It Gets In

Nearly every infection route traces back to one of two doors:

A software vulnerability — a bug in an operating system or app that lets malware run without permission. This is exactly why "update available" notifications matter: updates patch the exact holes malware is built to exploit, and delaying them leaves the door propped open.
A human decision — clicking a phishing link, opening an unexpected attachment, downloading "free" software from an untrustworthy source. Attackers increasingly find it easier to trick a person than to break an algorithm.

Notice how this splits the defence into two matching halves: patch the software, and be the human that doesn't fall for the trick.

Defence in Depth

No single measure stops everything, so real protection is layered — the security equivalent of redundancy in a data centre:

Keep everything updated — the single highest-value habit, closing known vulnerabilities before they're exploited
Antivirus/antimalware software — scans for known malware "signatures" and watches for suspicious behaviour (a document trying to encrypt thousands of files, for instance), blocking threats old and new
Caution with links and attachments — the human firewall, straight out of online safety
Backups, kept separate — a copy on a disconnected drive or in the cloud that ransomware on your live machine cannot reach and encrypt. This single habit turns ransomware from catastrophe into inconvenience: wipe the machine, restore from backup, and the attacker's leverage evaporates
Firewalls — controlling what network traffic can even reach your machine in the first place

Why This Isn't Paranoia

Malware isn't a rare curiosity — it is a global criminal industry, and ordinary people, schools, hospitals, and businesses are attacked constantly, often automatically and indiscriminately by tools scanning millions of machines for the weakest door. Understanding the mechanisms — host-riding viruses, self-spreading worms, disguised trojans, encryption-abusing ransomware — turns vague fear into specific, addressable habits, the same "security mindset" introduced in online safety: always asking how could this be exploited?

Try It Yourself

For each scenario, name the likely malware type and the single best defence: (1) a "free game" download that steals your passwords; (2) a school's shared files all suddenly encrypted with a payment demand; (3) an old, unpatched computer infected overnight with nobody clicking anything. Then check: does your own most-used device have automatic updates switched on?

Worked Example — Tracing an Infection From Start to Finish

Following one realistic infection end to end ties every idea in this lesson together. An employee receives an email with an attachment named "Invoice_2024.pdf.exe" — disguised, at a glance, to look like a harmless PDF:

Delivery — the email arrives, using the same pressure tactics as phishing: an urgent subject line, a plausible-looking sender
Installation — the employee, fooled by the disguised file extension, double-clicks it; this is a trojan, since the malware is invited in by posing as something legitimate
Execution — once run, the program encrypts every document on the shared network drive it can reach; this behaviour makes it specifically ransomware
Demand — a message appears demanding payment for the decryption key

Now trace which defences from this lesson would have mattered at which stage: caution with attachments would have stopped step 2 entirely; a properly configured firewall might have limited how far the ransomware could spread across the network in step 3; and backups kept separate from the network drive would mean step 4's ransom demand carries no real leverage at all — the files can simply be restored. Notice that no single defence covers every stage; this is precisely why "defence in depth" was introduced as a layered strategy rather than a single silver bullet.

Key Words

Malware — software designed to cause harm, deceive, or steal
Virus / worm — malware needing a host file to spread / malware spreading itself across networks
Trojan — malware disguised as legitimate, wanted software
Ransomware — malware that encrypts files and demands payment for the key
Vulnerability — a software flaw malware exploits to gain entry, closed by updates