Concepts · Entry 2

Malware types, defined

The categories a scanner is built to recognise, what separates one from another, and why a single piece of software often belongs to several at once.

Part of the Momentum Space knowledge base · Last reviewed 22 September 2026

Short answer

Malware categories describe two different things at once: how a program spreads, and what it does once it arrives. A worm and a trojan differ in how they travel. Ransomware and an information stealer differ in purpose. Most real samples combine a delivery method from the first group with a payload from the second.

Two questions, not one

The terms in this entry are often presented as a single list, which is where the confusion starts. They answer two separate questions. The first is how the code reached the device: did it copy itself, did it travel across a network on its own, or did a person install it believing it was something else? The second is what it was written to accomplish: extortion, credential theft, advertising revenue, quiet long-term access, or the use of someone else's processor.

A file can be described accurately as a trojan and as ransomware at the same time, and vendors' detection names usually encode both. Knowing which question a label answers makes vendor descriptions and detection names considerably easier to read.

How it arrives

Virus: Code that attaches itself to another file or program and runs when that host runs, copying itself into further hosts. The defining feature is that it needs a carrier and it needs the carrier to be executed. Classic file-infecting viruses are now a small part of what scanners encounter, although the word survives as the name of the whole industry.
Worm: Self-replicating code that spreads without a host file and usually without a person doing anything, typically by exploiting a flaw in a network-facing service. Worms are responsible for the fastest historical outbreaks because propagation speed is not limited by human action.
Trojan: Code that arrives disguised as something wanted: a cracked application, a document attached to a convincing email, a browser extension, a video player codec, an installer downloaded from a search advertisement. It does not replicate. It relies entirely on a person choosing to run it, which is why it remains the most common delivery route on consumer devices.
Dropper and loader: A small program whose only purpose is to fetch and install something larger. Splitting the work this way keeps the first file small and unremarkable, so that what a scanner sees at the moment of arrival carries little of the eventual payload.
Exploit kit: A toolkit hosted on a web server that tests a visiting browser for known unpatched flaws and delivers code through whichever one it finds. This is the route that requires no click beyond visiting a page, and it is also the route that patching closes most directly.

What it does once it is there

Ransomware: Encrypts files and demands payment for the key, frequently combined with copying the files first so that publication can be threatened as well. Recovery depends on backups that the ransomware could not reach, which in practice means backups that were offline or otherwise not writable from the infected device. The Australian Cyber Security Centre publishes ransomware guidance and operates the reporting route at cyber.gov.au.
Information stealer: Searches a device for saved browser passwords, session cookies, cryptocurrency wallet files, documents and messaging data, and sends them to an operator. Stolen session cookies matter because they can allow an account to be entered without the password and, in some configurations, without a second factor prompt. This category has grown quickly because the stolen material is resold rather than used directly.
Banking trojan: A specialised stealer that activates when a banking site or app is opened, overlaying a fake input screen or altering what is displayed so that a transfer goes somewhere other than where it appears to.
Spyware: A general term for software that observes a person's activity without their knowledge: keystrokes, screenshots, browsing, microphone or camera access.
Stalkerware: Monitoring software installed on a person's phone by someone with physical access to it, usually a partner or family member, and hidden from the device's owner. It is a safety matter rather than a purely technical one, and removing it can alert the person who installed it. The eSafety Commissioner publishes guidance written specifically for this situation, including advice on when not to remove it immediately.
Adware: Injects advertising into pages, redirects searches, or opens advertising windows. Rarely destructive, consistently intrusive, and often bundled with something the person did intend to install.
Cryptominer: Uses the device's processor to mine cryptocurrency for someone else. The symptoms are a hot, slow machine with a fan that runs constantly, and on a laptop, a battery that empties unusually fast.
Rootkit and bootkit: Code that hides itself by interfering with the operating system's own reporting, or by loading before the operating system starts. Because it compromises the layer that a scanner relies on for truthful answers, detection typically requires scanning from outside the running system, such as from bootable media.
Botnet client: Enrols the device in a network of compromised machines that a remote operator directs, for sending spam, relaying traffic or participating in attacks on third parties. The device's owner usually notices nothing.
Wiper: Destroys data outright. It may present itself as ransomware, but no key exists and payment achieves nothing.

The grey area

Between clean software and malware sits a band that vendors label potentially unwanted programs, potentially unwanted applications, riskware or greyware. These are not criminal tools. They are programs that a person did not clearly agree to install, or that behave in ways most people would decline if asked plainly.

Bundleware — additional software installed alongside something wanted, usually through a pre-ticked box in an installer.
Registry and system cleaners that report large numbers of problems and ask for payment to fix them.
Browser extensions that were installed for one purpose and later changed hands, acquiring data collection or advertising injection in an update.
Remote access tools that are legitimate administration software in one context and the instrument of a technical support scam in another.

Products differ in how they treat this band, and the difference is a configuration setting rather than a measure of quality. A scanner set to remove unwanted programs aggressively will occasionally remove something a person deliberately installed; one set conservatively will leave things that most people would rather not have. Neither default is wrong, and it is worth knowing which one a product has chosen.

Threats that involve no malware at all

A significant share of what people report as an infection involves no malicious file whatsoever, which is why it is worth stating plainly what a scanner is not positioned to stop.

No file, no detection

Phishing. A message that leads to a convincing copy of a login page. The page is a page; the loss happens when credentials are typed. Some products block known phishing addresses, which helps, but the technique renews its addresses constantly.
Technical support scams. A call or a web page claiming that a device is infected, followed by a request to install remote access software. The software installed is usually a legitimate product, which is precisely why it may not be blocked. Scamwatch describes current variants.
Business email compromise and invoice redirection. A real invoice with altered bank details. Nothing was infected; a payment simply went elsewhere.
Credential stuffing. Passwords exposed in an unrelated breach, tried against other services. The device was never touched.

This is the practical reason security guidance from the ACSC emphasises multi-factor authentication, updates and backups alongside any scanning product: the largest categories of consumer harm are not file-based.

Reading a detection name

When a product reports something, the name it displays is usually structured, and reading it saves a great deal of searching. A typical name combines a platform indicator, a category, a family name assigned by researchers, and a variant marker. The important parts are the category, which tells you what it was built to do, and the family, which is what to search for if you want an independent description of it.

Names are not standardised across vendors. The same file can carry three different family names from three products, and a generic name ending in something like gen or heur indicates the file was flagged by a general rule rather than matched exactly — which is also the category most likely to contain a false positive. How detection works explains why.