Malware

The taxonomy, briefly

• Virus. Code that attaches itself to a host program; runs when the host is run.
• Worm. Self-propagating, spreads from one machine to another without user action.
• Trojan. Pretends to be useful (or simply benign) to get itself executed.
• Ransomware. Encrypts files (or threatens to leak them) and demands payment.
• Rootkit. Hides itself and other malicious software from the OS, typically by tampering with the kernel or boot path.
• Spyware. Watches what you do, keystrokes, screen, microphone, and exfiltrates it.
• Adware. Annoying first, dangerous in volume.
• Bots. Run on compromised machines and take orders from a remote "command and control" server. Many bots make a botnet.

Real malware is usually two or three of these at once: a phishing trojan that drops a loader, which downloads ransomware, which uses worm-like spread on the LAN, while talking to a C2 server.

How it gets in

Almost all modern infections start with one of:

• Phishing. A user clicks a link or opens an attachment. The single most common entry point.
• Exploitation of a known unpatched vulnerability. Often on internet-exposed services or browsers; sometimes on internal systems weeks behind on updates.
• Compromised software supply chain. A trusted update or dependency is poisoned upstream (SolarWinds, XZ utils, npm package take-overs).
• Stolen credentials. The attacker logs in legitimately, then drops malware once inside.
• Removable media. Less common than it used to be, still occasionally how malware enters air-gapped environments.

Persistence

Getting in is only step one. Malware that survives a reboot has persistence. Common mechanisms:

• Registry run keys, Windows services, scheduled tasks.
• cron, systemd units, login items.
• Hooking the bootloader or installing a UEFI implant (rare, expensive, very persistent).
• Adding a malicious dependency to a build pipeline that you run anyway.

Persistence is also where malware tends to be loudest. Endpoint detection products (EDRs) watch these spots closely because legitimate software rarely needs to plant new ones at random.

What AV and EDR actually do

Classical antivirus is signature-based: it matches files against a database of known-bad hashes and patterns. Useful against commodity malware; blind to anything new or meaningfully repackaged.

EDR (Endpoint Detection and Response) goes further. It watches process behavior in real time and looks for suspicious patterns: a Word document spawning a PowerShell that downloads from the internet; a service injecting code into lsass; a sudden burst of file encryption. Better at catching novel malware; far more data to interpret.

Neither replaces:

• Keeping systems patched.
• Restricting admin rights and removing standing local-admin.
• Application allow-listing in high-value environments.
• Tested, offline backups (especially against ransomware).
• Phishing-resistant authentication for accounts that matter.

If you suspect infection

1. Disconnect the device from networks (Wi-Fi off, cable out).
2. Don't reboot, in-memory artifacts can help investigators.
3. Report to your IT/security team. If you don't have one and it's a personal device, take it to a reputable shop or wipe and reinstall from clean media.
4. Change important passwords from a different, known-clean device.
5. Watch for follow-on activity: unfamiliar logins, financial accounts, etc.