Malware and cyber defence, explained
Virus vs worm vs trojan: what is the difference?
A virus attaches itself to a file and spreads when people share and open that file. A worm spreads by itself across networks, with no one clicking anything. A trojan does not spread at all: it tricks you into installing it by pretending to be something you want. All three are kinds of malware.
See how each one spreads
The same small office network, three different kinds of malware. Step through each one and watch what moves the infection from one computer to the next.
1/4. A worm lands on one computer, through an unpatched flaw or a weak password.
The differences in one table
| Virus | Worm | Trojan | |
|---|---|---|---|
| Needs a host file | Yes | No | No, it is the file |
| Copies itself | Yes, into other files | Yes, to other computers | No |
| Needs a person to act | Yes, to open and share the file | No | Yes, to install it |
| How fast it spreads | As fast as people share files | Minutes to hours across a network | It does not spread |
| Main defence | Antivirus scanning, not opening unexpected files | Patching, firewalls, closing exposed services | Installing only from official sources |
| Famous example | Melissa (1999) | WannaCry (2017) | Zeus (2007) |
What is a computer virus?
A computer virus is code that inserts itself into another program or document and runs when that host runs. Like a biological virus, it cannot spread without a host. The Brain virus of 1986, considered the first for IBM PCs, travelled on floppy disks; the Melissa virus of 1999 travelled in Word documents and mailed itself to the first 50 people in each victim's address book. Pure file-infecting viruses are rare today, because software now arrives signed and checked, but macro viruses in Office documents still appear.
What is a computer worm?
A worm is malware that spreads from computer to computer by itself, by exploiting a flaw in software that is listening on the network, or by guessing weak passwords. Because each infected machine starts attacking others, worms grow exponentially. Code Red infected more than 359,000 web servers in under 14 hours in 2001. The defence is unglamorous and effective: install security updates, and do not expose services to the internet that do not need to be there. A patched machine simply cannot be infected by a worm that depends on the flaw the patch fixes.
What is a trojan?
A trojan (or trojan horse) is malware disguised as something legitimate, which you install yourself. It is named after the wooden horse in Greek legend that hid soldiers inside a gift. Trojans arrive as cracked software, fake updates, "free" versions of paid apps and email attachments. Once running, most open a backdoor, steal passwords and banking details, or download other malware. Because a trojan needs your cooperation, the best defence is knowing what a lure looks like: start with how to spot a phishing link.
Why the lines blur
Real malware mixes these behaviours. WannaCry was ransomware with a worm built in, which is why it spread to more than 200,000 computers in days. Emotet arrived as a trojan in email attachments, then spread through networks like a worm. When defenders describe malware, they describe each behaviour: how it got in, how it spreads, and what it does. The full list of behaviours is in types of malware, compared, and the biggest outbreaks of each kind are in the famous malware attacks timeline.
Questions people ask
Is a trojan a virus?
No. A virus copies itself into other files; a trojan does not copy itself at all. A trojan relies on you installing it. People call trojans viruses all the time, but security professionals keep the words apart because the defences differ.
Which is more dangerous, a worm or a virus?
A worm, usually, because it spreads without anyone doing anything and can infect a whole network in minutes. SQL Slammer infected most of its 75,000 victims within 10 minutes in 2003. A virus can only travel as fast as people share files.
Can antivirus remove a trojan?
Usually, yes. But a trojan has often installed other malware or given an attacker access by the time it is found, so after removing it you should change passwords from a clean device and check for anything else it left behind.