A helpdesk tech gets three tickets in ten minutes. The first user clicked a spreadsheet a coworker emailed and now the same file is attached to messages going out from the user's own mailbox. The second user did nothing at all, yet their machine is scanning the network and pegging a switch. The third user ran a "driver updater" they found online, and now someone they can't see is moving their mouse. Three infections, three completely different stories about how the code arrived and how it spreads.
Telling those stories apart is the whole point of this lesson. On the CompTIA Security+ SY0-801 exam this sits under objective 2.5, which asks you to analyze indicators of malicious activity given a scenario. Because it is a scenario objective, expect symptoms, logs or behavior rather than a request for a textbook definition, and be ready to name the malware and justify the choice. This lesson covers four of the best-known families: viruses, worms, trojans, and ransomware. The rest of objective 2.5's malware list, including spyware, keyloggers, rootkits, logic bombs and fileless techniques, is covered in the next two lessons.
Classify malware by propagation and payload, not by what it is called
The useful question for a Security+ scenario is not "is this a bad program" but "how did it get here, how does it spread, and what does it do once it runs." Those three axes separate the families cleanly, and a wrong answer is often a family that fails one of the three tests.
Propagation is the first split. Some malware needs a host file and a human to run it, some copies itself across a network with no help, and some simply pretends to be software you wanted. Payload is the second: the same delivery method can drop a credential stealer, a remote control tool, or a file encryptor. A good analyst reads the scenario for both. "The user opened an attachment and then it emailed itself to the user's contacts" tells you propagation. "An operator is running commands on the host" tells you payload.
Keep one caution in mind: these categories overlap in the real world. A worm can carry ransomware, a trojan can install a rootkit, and modern criminal tools are modular. A question usually emphasizes one behavior; answer to the behavior it emphasizes.
A virus spreads only through a host and a user action
A virus is malicious code that attaches to a host, a file or a boot record, and runs when that host is opened or executed. It cannot travel on its own. It needs two things: something to attach to, and a person to run the infected thing. Once it runs, it tries to attach copies of itself to other files so the infection spreads as those files are shared and opened.
The classic types still appear in answer lists. A file infector attaches to executables. A macro virus lives inside a document's macro code and runs when the document is opened and macros are enabled, which is why Office blocks macros from the internet by default. A boot sector virus infects the code that runs before the operating system loads. Some viruses are polymorphic, rewriting their own code on each infection so a simple signature can't match them, or metamorphic, rewriting their logic more thoroughly for the same reason.
On the exam, the tell for a virus is a human in the loop and a host file. If the scenario says a user opened, ran, enabled or double-clicked something and the infection then spread as files were shared, you are looking at a virus. Antivirus and endpoint protection, blocking macros, and user awareness are the controls, and they map to that human-plus-host weakness.