Classic Malware Categories
Part I — Classic Malware Categories
Section titled “Part I — Classic Malware Categories”The malware types in this section represent the foundational categories that emerged between the 1980s and early 2000s. They laid the groundwork for all subsequent malware development and many of their core mechanisms remain in use today.
Risk: 🟠 High | Self-Replicates: ✅ Host-attached
A computer virus attaches its own code to legitimate host files or programs. When the infected file executes, the virus code runs, potentially causing damage and replicating to other files.
Notable: Elk Cloner (1982), Brain (1986), Melissa (1999), CIH (1998), ILOVEYOU (2000)
Risk: 🔴 Critical | Self-Replicates: ✅ Standalone
A computer worm is standalone malware that self-replicates and spreads across networks without needing a host file or user interaction.
Notable: Morris Worm (1988), Code Red (2001), SQL Slammer (2003), Conficker (2008), WannaCry (2017)
Risk: 🟠 High | Self-Replicates: ❌ No
A Trojan horse is malware disguised as legitimate, useful software. Unlike viruses and worms, Trojans do not self-replicate — they rely on social engineering.
Notable: Back Orifice (1998), Zeus/Zbot (2007), SpyEye (2009), Emotet (2014), Agent Tesla (ongoing)
Risk: 🟠 High | Self-Replicates: ❌ No
Spyware secretly monitors user activity and collects sensitive information — passwords, credit card numbers, browsing history, and keystrokes — without the user’s knowledge or consent.
Notable: CoolWebSearch (2003), Gator/eZula (2000s), FinFisher (2011), Pegasus (2016+), DarkHotel (2014+)
Risk: 🟡 Medium | Self-Replicates: ❌ No
Adware displays unwanted advertisements, redirects searches, and tracks browsing behaviour to generate revenue.
Notable: Gator/Claria (2000s), Conduit Toolbar (2000s), MacKeeper (2010s+), Genieo (2010s+), InstallCore (2010s+)
Risk: 🔴 Critical | Self-Replicates: ⚠️ Some variants
Ransomware encrypts victim’s files and demands payment for decryption. Modern variants use double extortion — exfiltrate data first, then threaten public release.
Notable: CryptoLocker (2013), WannaCry (2017), NotPetya (2017), LockBit (2019+), Cl0p (2019+)
Risk: 🔴 Critical | Self-Replicates: ❌ No
A rootkit modifies the operating system kernel or firmware to hide its presence — files, processes, network connections, registry keys — from standard OS tools.
Notable: NTRootkit (1999), Hacker Defender (2003), FU (2005), TDL4 (2010), ZeroAccess (2011), LoJax (2018)
Risk: 🟠 High | Self-Replicates: ❌ No
A keylogger records every keystroke typed on a device, capturing passwords, messages, emails, credit card numbers, and other sensitive input.
Notable: Zeus/Zbot (form grabber), SpyEye (form grabber), Agent Tesla, HawkEye, SnakeKeylogger
Risk: 🔴 Critical | Self-Replicates: ❌ No
A backdoor is a method of bypassing normal authentication to gain remote access to a system. Backdoors are the primary goal of most malware.
Notable: Back Orifice (1998), Gh0st RAT (2008), PlugX (2012+), Cobalt Strike (2012+), Sunburst (2020)