Viruses, Worms, and Trojans

Malware (malicious software) is any software designed to disrupt, damage, gain unauthorized access to, or exfiltrate data from systems. The term encompasses many distinct categories that differ in how they spread, what they do, and what detection techniques they evade. Security+ tests your ability to differentiate between malware types by their propagation mechanism (how they spread), payload (what damage or action they perform), and persistence mechanism (how they survive reboots). The three foundational categories are viruses, worms, and Trojans.

A virus is malware that attaches itself to a legitimate host file and requires a human action (executing the infected file) to spread. When the infected file runs, the virus replicates by injecting its code into other executables, documents, or boot sectors. Virus types include file infectors (attach to .exe files), macro viruses (embed in Office documents and run when macros execute), boot sector viruses (infect the MBR and load before the OS), and polymorphic viruses (change their code signature with each infection to evade signature-based detection).

A worm is self-replicating malware that spreads independently across networks without requiring a host file or human action. Worms exploit network vulnerabilities or weak credentials to copy themselves to other systems. The 2003 SQL Slammer worm infected 75,000 systems in 10 minutes using a single UDP packet. The 2017 WannaCry ransomware spread as a worm via the EternalBlue exploit targeting SMBv1. Worms cause massive damage through network congestion and payload delivery at scale. Patching and network segmentation are the primary defenses.

A Trojan horse (or Trojan) is malware disguised as legitimate software. Unlike viruses and worms, Trojans do not self-replicate — they rely on the user to install them by believing they are something useful: a free game, a cracked application, a useful utility, a fake antivirus, or a software update. Once installed, the Trojan executes its malicious payload, which may include installing a backdoor, serving as a RAT (Remote Access Trojan), logging keystrokes, or downloading additional malware. Trojans are frequently used to establish initial access before deploying more damaging payloads.

The Security+ exam frequently tests the distinctions between these three categories. The critical differentiators: Viruses require a host file and human action to spread; they infect legitimate files. Worms are self-contained and self-propagating — they spread automatically over networks without attaching to other files or requiring user interaction. Trojans are not self-replicating and rely on deception — the user must be tricked into installing them. A piece of malware may combine characteristics (a worm that drops a Trojan payload), so focus on the dominant propagation mechanism when classifying.

Many Trojans and worms establish communication with a Command-and-Control (C2) server — a remote server the attacker uses to issue instructions to infected hosts. A large number of C2-connected hosts forms a botnet. Botnets are used for DDoS attacks, spam campaigns, cryptocurrency mining, and credential theft. C2 communication may use HTTP/HTTPS to blend with normal web traffic, DNS tunneling to hide in DNS queries, or peer-to-peer protocols that have no central server to take down. Detecting C2 traffic requires DNS monitoring, proxy logs, and network flow analysis for anomalous beaconing patterns.

Traditional antivirus relies on signature-based detection — comparing files against a database of known malware signatures (hashes or code patterns). Signatures are fast but fail against new or modified malware. Behavioral detection (used by EDR platforms) monitors program behavior in real time: creating child processes, modifying registry keys, injecting code into other processes, or contacting known-bad IPs. Heuristic analysis statically analyses code for malware-like patterns without requiring an exact signature match. Sandboxing executes suspicious files in an isolated environment to observe behavior safely.

A multipartite virus uses multiple infection vectors simultaneously — infecting both executable files and the boot sector, for example. This makes complete removal harder since cleaning only one vector leaves the other active for reinfection. Macro viruses infect document files by embedding malicious VBA (Visual Basic for Applications) macros in Microsoft Office documents. When the document is opened and macros are enabled, the virus runs. Macro viruses spread easily via email attachments. The primary defense is disabling macros by default and only allowing digitally signed macros from trusted publishers.

Preventing malware spread requires layered defenses. For viruses: disable macro execution, scan all file transfers (email gateway, web proxy, USB scanning), and maintain updated endpoint protection. For worms: patch promptly (most worm exploits target known CVEs), disable unnecessary network protocols (disable SMBv1), segment networks to limit lateral reach, and enforce strong authentication on all networked services. For Trojans: enforce application allowlisting, educate users on not installing unauthorized software, and verify software hashes before installation. Defense in depth catches what each individual control misses.

Drive-by downloads occur when visiting a malicious or compromised website silently installs malware without any user action beyond loading the page. Attackers exploit browser or plugin vulnerabilities (old Flash, Java, PDF reader) to execute malicious code. Watering hole attacks compromise legitimate websites that the target population frequently visits, planting drive-by download code to infect visitors. Rather than going directly after the target, the attacker 'poisons the watering hole' and waits for victims to come to it. Defenses include keeping browsers and plugins updated, using click-to-play for plugins, and deploying a web proxy that blocks known malicious sites.

When malware is detected, the response follows the NIST IR lifecycle. Containment: isolate the infected host immediately (remove from network or apply host-based firewall rules) to stop spreading. Eradication: reimaging is safer than attempting cleanup for serious infections; cleaning leaves risk of persistence mechanisms surviving. Evidence preservation: take a memory image and disk image before reimaging if forensics are required. Recovery: restore from clean backups, verify integrity, and monitor closely for signs of reinfection. Document indicators of compromise (IoCs) to improve future detection.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: viruses attach to host files and require user action to spread, using techniques like polymorphism to evade signature detection, worms self-propagate across networks without user action by exploiting vulnerabilities, causing rapid large-scale infection, and Trojans are disguised as legitimate software to trick users into installation, often establishing backdoors and C2 communication. Next up we explore ransomware and cryptolockers in detail.