Two questions, not one list#
Students memorise malware terms as a flat list and then get confused when an exam question calls something both a trojan and ransomware. Both were correct. The terms were answering different questions.
Every piece of malware has:
- A propagation method. How did it get here and how does it reach the next machine?
- A payload. What does it actually do once it is running?
Virus, worm and trojan answer the first question. Ransomware, spyware, keylogger and rootkit mostly answer the second. So "a trojan that delivers ransomware" is not a contradiction, it is a complete description: arrived disguised, encrypts your files.
A virus needs a host and a human. A worm needs neither. That one sentence answers a surprising share of the malware questions on the exam.
How it spreads#
| Type | How it spreads | The giveaway in a question |
|---|---|---|
| Virus | Attaches itself to a file or program. Spreads when a person runs or shares that host. | Requires user action |
| Worm | Self-replicating and self-propagating across a network, with no host file and no user. | "Spread rapidly overnight with no user interaction" |
| Trojan | Does not self-replicate at all. Arrives disguised as something the user wants and is installed willingly. | "Downloaded what appeared to be a legitimate utility" |
The phrase "without user interaction" in a scenario is almost always pointing at a worm, and it is the fastest elimination you can make. A virus cannot do that by definition, and a trojan certainly cannot, because a trojan's whole method is convincing a person to install it.
Worms are also why patching is framed as urgent rather than routine. A worm typically exploits a known vulnerability to reach the next host, so the gap between a patch being released and being applied is the window it travels through.
What it does once it is running#
| Payload | What it does |
|---|---|
| Ransomware | Encrypts files and demands payment for the key. Modern strains also steal the data first and threaten to publish it, which is called double extortion and is why "we have backups" is no longer a complete answer. |
| Rootkit | Hides the attacker's presence by subverting the operating system itself, so the tools you would use to look are the tools being lied to. |
| Remote access trojan | Gives the attacker interactive remote control of the machine. |
| Keylogger | Records keystrokes to capture credentials. Can be software or a physical device in line with the keyboard. |
| Spyware | Gathers information about the user and their activity and sends it out. |
| Logic bomb | Dormant code that fires on a condition, such as a date or a name disappearing from the payroll system. Frequently an insider. |
| Bot | Enrols the machine into a botnet under an attacker's command-and-control infrastructure, for spam, denial of service or mining. |
Rootkits deserve extra attention because of what follows from the definition. If the operating system has been subverted, anything that operating system tells you is unreliable, including your antivirus scan. That is why the correct answers involve booting from separate trusted media, or rebuilding the machine entirely, rather than cleaning it in place.
Fileless malware, and why detection changed#
Traditional antivirus works largely by signatures, which are patterns recognised in a file on disk. That approach has an obvious gap: malware that never writes a file.
Fileless malware runs in memory and works through tools already present on the system, typically PowerShell, Windows Management Instrumentation or scripting hosts. Using the machine's own legitimate tools this way is called living off the land, and it is effective precisely because blocking PowerShell outright is not realistic for most organisations.
The consequence is testable. If the malware has no file, signature scanning has nothing to match, so the answer shifts to behaviour:
- Endpoint detection and response, which watches what processes actually do rather than what files contain.
- Application allow-listing, which permits only approved programs to run instead of trying to name every bad one.
- Script block logging, so PowerShell activity is recorded and can be reviewed.
If a question describes suspicious activity with no malicious file found on disk, that phrase is doing the work. It is pointing at fileless or living-off-the-land technique, and it eliminates every answer built on signatures.
Reading the scenario#
Malware questions almost always hide the answer in one clause. These are the ones worth recognising on sight:
| Phrase in the question | What it is pointing at |
|---|---|
| "spread without any user interaction" | Worm |
| "appeared to be a legitimate application" | Trojan |
| "activated when the employee record was removed" | Logic bomb |
| "the antivirus scan comes back clean but the behaviour continues" | Rootkit, or fileless |
| "no file was written to disk" | Fileless, living off the land |
| "files renamed with a new extension and a note demanding payment" | Ransomware |
| "beaconing to an external address at regular intervals" | Bot, calling command and control |
One more worth holding onto: for ransomware, the control that actually restores the business is tested, offline backups. Backups that are reachable from the network get encrypted along with everything else, which is the failure mode that turns an incident into a catastrophe.
Ask how it spread and what it did as two separate questions, because most malware names answer only one of them and the exam expects both.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
What is the difference between a virus and a worm?
A virus attaches to a host file or program and needs a person to run or share it in order to spread. A worm is self-replicating and self-propagating across a network, with no host file and no user action required. If a scenario says malware spread without user interaction, it is describing a worm.
Is a trojan a virus?
No. A trojan does not self-replicate at all, which is the defining feature of a virus. A trojan arrives disguised as something the user wants and is installed willingly. Trojans are often the delivery method for another payload, so "a trojan that installs ransomware" is a complete and correct description.
Why can antivirus miss a rootkit?
A rootkit subverts the operating system itself in order to hide, so the system calls your scanner relies on are being answered by code the attacker controls. The tools you would use to look are the tools being lied to. Reliable answers involve booting from separate trusted media or rebuilding the machine rather than cleaning it in place.
What is fileless malware?
Malware that runs in memory and never writes an executable file to disk, typically abusing tools already present such as PowerShell or Windows Management Instrumentation. Because there is no file, signature-based scanning has nothing to match, so detection shifts to behavioural controls like endpoint detection and response, application allow-listing and script block logging.
Do backups solve ransomware?
Only partly, and only if they are tested and offline. Backups reachable from the network get encrypted along with production data. Modern ransomware also steals data before encrypting it and threatens publication, which is called double extortion, and a restored backup does nothing about a threat to publish what was already taken.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.