Viruses, worms, trojans and ransomware: what is the difference?

How it spreads

• Virus: attaches itself to other files or programs and spreads when they are shared and opened.
• Worm: spreads on its own across networks, finding and infecting other computers without anyone clicking anything. Often uses unpatched flaws.
• Trojan: pretends to be something useful, such as a free tool, an invoice or a game, so people install it themselves.

What it does

• Ransomware: encrypts files and demands payment to unlock them. Many groups now steal copies first and threaten to publish them.
• Spyware and keyloggers: watch what you do and type, including passwords.
• Infostealers: grab saved passwords, browser cookies and files in one go, then send them to criminals. A common first step in larger attacks.
• Remote access trojans: give an attacker control of the computer.
• Adware: floods you with ads or changes your browser settings. Annoying, and sometimes a sign of something worse.
• Wipers: destroy data outright.

Why the labels matter less than they used to

Modern attacks mix these together: a trojan arrives by email, steals passwords, spreads like a worm and finishes with ransomware. That is why modern protection watches what programs do. Comparing files against a list of known viruses is only a small part of it.