Glossary

#malware #detection #backup #patch management

What is malware? Types, infection routes, and the basic defenses

Malware is software built to harm devices or data. The main types (virus, worm, trojan, ransomware, spyware, bot), how it spreads, and shared defenses.

Published 2026-07-02 Updated 2026-10-06 9 min read

On this page

Malware is the general term for malicious software that harms your devices or data. Here are the main types, and the defense that stays the same no matter which type it is (no attack steps).

The types of malware

There are a lot of names, but all you really need is a rough idea of which kinds exist — because, as below, the defense is shared.

Virus

Attaches to a legitimate file and, when run, replicates and spreads. Can't act on its own.

Worm

Self-replicates on its own and spreads automatically across the network. Explodes through unhardened networks.

Trojan

Poses as useful, legitimate software to get in, then acts maliciously in the background. You install it yourself.

Ransomware

Encrypts files and demands a ransom. Now usually paired with data theft — double extortion (→ dedicated article).

Spyware

Hides unnoticed and steals keystrokes, credentials, and browsing history.

Bot / botnet

Remote-controls infected machines and herds many together for attacks. Orders arrive from a C2 (→C2).

The main types of malware. However different they look, the defense is shared (prevention, detection, recovery).

In practice a single piece of malware often has several of these traits at once (e.g. it gets in as a trojan, acts as spyware to steal data, and finally drops ransomware). That's exactly why it's more useful to firm up your prevention / detection / recovery defenses than to spend time on "which type is this?"

How malware, viruses, ransomware and backdoors relate

These words get used side by side, but they aren't at the same level. Malware is the umbrella term; the other three are kinds or functions within it.

Term	What it means	How to tell
Malware	Umbrella term for malicious software	Includes all three below
Virus	Malware that spreads by attaching itself to other files	Can't run on its own; spreads when the host file runs
Ransomware	Malware that encrypts files and demands a ransom	Announces itself with a ransom note
Backdoor	A hidden way back in that bypasses authentication	Can be planted as malware, or created as a setting or account

The name "antivirus" survives for historical reasons; real products detect far more than viruses.

Main infection routes

Malware doesn't appear out of nowhere; it comes in through a predictable set of routes. Here are the high-level routes only (no specific techniques).

Attachments/macros

Phishing email attachments and Office-document macros. The most common route

Fake downloads

Distribution posing as legitimate software, or a tampered website

Unpatched flaws

A known vulnerability in internet-facing software gets exploited

USB / stray apps

Brought in via removable media or apps of unknown origin

In every case the route is a gap in people and operations — opening something carelessly, leaving software outdated, not checking where it came from. The defenses below block most of them.

Defense (the type differs, the work doesn't)

You don't need a separate countermeasure per type. Combine the three defenses that work against malware in general.

Prevent infection: updates, suspicious files, MFA

Update your OS and software regularly so known vulnerabilities aren't left unpatched. Don't open unexpected attachments, macros, or links. Protect key accounts with multi-factor authentication (MFA) so stolen credentials don't mean instant compromise (→ how to choose MFA).

Add a detection layer: antivirus / EDR

Block known threats with antivirus (including your OS's built-in), and where you need more, use EDR to watch behavior and catch unknown malware too (→ what EDR is). Detection isn't perfect, though — never rely on it alone.

Limit the damage: least privilege

Don't run everyday work as an administrator. Keeping privileges to the minimum means that even if something does execute, it can't spread far — one device or one account doesn't cascade to everything.

Be able to recover: backups

The final defense is a backup. Against ransomware especially, an offline / immutable copy plus regular restore tests is what decides the outcome (→ backup and recovery essentials).

Traditional antivirus (matching the known)

detects by matching a known malware "fingerprint" (signature)
lightweight and effective against widely-circulating threats
tends to miss unknown / freshly-made variants
often mistaken for "install it and you're safe"

EDR (watching behavior)

detects by suspicious behavior (odd encryption, outbound calls), not filename
notices unknown attacks and "abuse of legitimate tools"
leaves a record you can use to investigate and contain after an infection
still not a substitute for prevention (updates) and recovery (backups)

This site's view: memorizing types is not a defense strategy

Attackers keep changing the names and the looks. Chasing "this month's malware name" won't make your defense stronger. What works against every type is combining prevention, detection and recovery. This site applies the same principle to itself: we keep dependencies updated to prevent infection, machine-monitor CVEs to detect, and keep our setup reproducible so we can recover. Defending against malware isn't special; it's an extension of these basics.

Example: Emotet

One of the most damaging malware families in Japan was Emotet. JPCERT/CC (Japan's national CERT) warned about it repeatedly from around 2019, and after a pause, activity was seen again from November 2021.

What Emotet looked like (from JPCERT/CC's alerts)

Way in: Macro-enabled Word or Excel attachments, password-protected ZIP files, links in the email body. Infection happens when the user enables macros or opens the link
After infection: Steals email content and contacts from the device, then uses them to send more email posing as real business partners
How it spreads: The victim's partners and acquaintances receive what looks like a reply from a real person
Checking: JPCERT/CC published a checking tool, EmoCheck

The lesson from Emotet is that the basics work even when an email looks like a reply from someone you know: don't enable macros in attachments, and confirm unexpected attachments with the sender through another channel. Another example: in the Coincheck NEM theft, malware in emails sent to employees was reported as the first step of the intrusion.

How to check your own devices

Windows: protection history and scans

Open Settings, then Windows Security → Virus & threat protection. Check the protection history for detections, and run a full scan from Scan options. If nothing is found but you're still suspicious, run the Microsoft Defender Offline scan on the same screen to check the PC without starting Windows.

Look at what starts automatically and at extensions

Check the Startup apps tab in Task Manager and your browser's extension list for anything you didn't install. Disable and remove it if so.

Phones: apps and configuration profiles

On Android, run a Google Play Protect scan and remove apps from unknown sources. On iPhone, check Settings → General → VPN & Device Management for profiles you don't recognize.

Check your accounts too

Review sign-in history for email, social media and online banking, and check email auto-forwarding rules. Even after malware is gone from the device, stolen passwords keep working, so change them from a separate, safe device.

"I have antivirus, so I'm fine" isn't true

The most common mistake is relying entirely on one detection tool. Detection always misses a certain fraction, and once something gets past it, nothing else is protecting you.

What works is combining defenses: reduce the volume with prevention (don't open, do update), catch what's left with detection (antivirus / EDR), and undo the damage from whatever still gets through with recovery (backups). Not leaning on any single layer is where malware defense begins.

Sources (primary)

JPCERT/CC, "Alert on the renewed spread of Emotet infections" (Japanese) — jpcert.or.jp (infection routes, EmoCheck)
Microsoft Support, "Virus and threat protection in the Windows Security app" — support.microsoft.com (scans and the offline scan)

FAQ

QWhat's the difference between malware and a virus?

A virus is one type of malware. Malware is the umbrella term for all 'malicious software,' and it includes viruses, worms, trojans, ransomware, spyware, and bots. In everyday speech people call everything a 'virus,' but strictly a virus is the specific type that copies itself by attaching to other files, while malware is the general term that covers all of them.

QIs free antivirus enough?

For personal basics, the built-in protection your OS ships with (like Microsoft Defender on Windows) plus regular updates, backups, and least privilege already covers a lot. But antivirus mostly matches 'known bad' things, so novel or clever malware can slip past. Where you need stronger defense, EDR complements it by watching behavior and catching unknown attacks. Either way, don't rely on detection alone — pair it with prevention (updates, not opening suspicious files) and recovery (backups).

QI think I'm infected. What should I do?

First, don't panic-pay anything. The order is: (1) disconnect that device from the network to stop it spreading and calling out, (2) from a separate, safe device, change the passwords for email, banking, and key accounts and turn on multi-factor authentication, (3) restore from a clean backup or reset the device to get back to a known-good state, and (4) cut off the infection route you suspect (the attachment you opened, the app you installed, the USB you plugged in). For a device holding important data, consider bringing in a professional.

QWhat are the symptoms of a malware infection?

More often than not there are no obvious symptoms. Useful signs: apps, browser extensions or startup items you don't remember installing; your browser's search engine or home page changing on its own; contacts telling you they got strange email from you; or sign-in alerts for logins you didn't make. On the other hand, a big on-screen warning that 'your PC is infected' with a phone number is usually a fake warning (a tech support scam), not an infection itself.

QCan phones and Macs get malware?

Yes. It is less common than on Windows, but there are cases of malicious apps posing as legitimate ones, installs from outside the official stores, and abuse of iPhone configuration profiles. The defenses are the same: keep the OS updated, install apps only from official stores, and remove profiles or device-management apps you don't recognize.

QHow can I check whether I'm infected?

On Windows, open Windows Security, go to Virus & threat protection, review the protection history and run a full scan. If you are still suspicious, use the Microsoft Defender Offline scan, which checks the PC without starting Windows. Also look through your startup apps and browser extensions for anything you don't recognize.