Malware Family Tree: Viruses, Worms, Trojans, Ransomware & More Explained

What Is a Computer Virus

A computer virus is defined as malicious code that can self-replicate and spread to other programs or files. It resembles a biological virus in four ways: it requires a host program to parasitize, it can self-replicate, it spreads through various channels, and it may cause damage to the host.

Malware Family Tree

Malicious software is a large family; viruses are just one member. Here are the eight key members:

1. Virus

Characteristics: Parasitizes legitimate files and activates only when the infected file is executed.

Propagation: Spreads via files such as USB drives, downloaded files, or email attachments.

Analogy: Like someone coating a flyer with superglue; when you pick it up your hand sticks, and shaking hands with others spreads the glue.

2. Worm

Characteristics: Does not need a host file; it can run and spread independently.

Propagation: Automatically spreads through network vulnerabilities at high speed.

Analogy: A virus is a hitchhiking passenger; a worm is a locust with its own legs, devouring everything in its path.

Classic case: The 2001 Code Red worm infected 359,000 servers worldwide in 14 minutes.

3. Trojan Horse

Characteristics: Does not self-replicate; disguises itself as a legitimate program to trick users into installing it.

Analogy: The ancient Greek Trojan Horse—appears as a gift but hides soldiers inside.

Common behaviors: Stealing passwords, remote control of the victim's computer, stealing banking information.

4. Ransomware

Characteristics: Encrypts the victim's files and demands a ransom for decryption.

Analogy: Someone changes all the locks in your house and only gives you the key after you pay.

Classic case: The 2017 WannaCry ransomware exploited a Windows vulnerability, infecting hundreds of thousands of computers across more than 150 countries.

5. Spyware

Characteristics: Secretly monitors user activity in the background—websites visited, passwords typed, locations.

Analogy: Like a hidden camera installed in your home, watching your every move.

6. Adware

Characteristics: Constantly pops up advertisements, often bundled with installers.

Analogy: Someone constantly stuffing flyers into your hand while you walk; not directly harmful but annoying.

7. Rootkit

Characteristics: Hides itself and other malware from detection by antivirus software.

Analogy: A burglar who disables all your security cameras so you never notice them.

8. Botnet

Characteristics: Controls a large number of infected computers, forming a "zombie army" that obeys a central command.

Analogy: A commander controlling a group of hypnotized people to carry out malicious tasks simultaneously.

Common uses: Launching DDoS attacks, sending spam emails, mining cryptocurrency.

Malware Quick Reference

The following table summarizes the key attributes of each malware type:

Virus: Self-replicates: Yes. Propagation: File-based. Primary harm: File destruction, performance degradation.

Worm: Self-replicates: Yes. Propagation: Automatic network spread. Primary harm: Massive network resource consumption.

Trojan: Self-replicates: No. Propagation: Disguised as legitimate software. Primary harm: Information theft, remote control.

Ransomware: Self-replicates: No. Propagation: Delivered via other malware. Primary harm: File encryption for ransom.

Spyware: Self-replicates: No. Propagation: Bundled installation. Primary harm: Privacy monitoring.

Adware: Self-replicates: No. Propagation: Bundled installation. Primary harm: Intrusive pop-up ads.

Rootkit: Self-replicates: No. Propagation: Assists other malware. Primary harm: Conceals malicious activity.

Botnet: Self-replicates: Depends. Propagation: Network spread. Primary harm: Coordinated attacks.

Prevention Measures

Install antivirus software and keep it updated.

Update systems and software promptly to patch vulnerabilities.

Do not open email attachments or links from unknown sources.

Download software only from official channels ; avoid pirated software.

Regularly back up important data.

Use strong, unique passwords for different sites.

Exam Points (Software Qualification Exam)

Definition and characteristics of computer viruses.

Virus classification: file viruses, boot sector viruses, macro viruses, network viruses.

Malware classification: viruses, worms, trojans, ransomware, etc.

Transmission routes and prevention measures for computer viruses.

Summary

Malicious software forms a vast family, with viruses being the most classic member. From file-parasitic viruses to self-propagating worms, from deceptive trojans to file-locking ransomware—each has distinct attack methods. Understanding these threat characteristics is essential for effective self-protection.