Virus vs worm vs Trojan, logic bomb and rootkit: Security+
A virus copies itself into other programs or files and usually needs a user to run them. A worm is a standalone program that copies itself and spreads on its own, often through a network service flaw. A Trojan does not copy itself; it looks harmless but has a hidden malicious purpose.
Virus, worm and Trojan
NIST SP 800-83 Rev. 1 sorts the classic types by how they spread. A virus self-replicates by inserting copies of itself into host programs or data files, and is often triggered by user interaction such as opening a file. Macro viruses infect application documents and document templates.
A worm is a self-replicating, self-contained program that usually runs without user intervention. A network service worm exploits a flaw in a network service to infect other hosts. Dozens of servers that nobody logged in to, all infected within an hour through a file-sharing flaw, points to a worm.
A Trojan horse is self-contained and does not replicate. It appears benign but has a hidden malicious purpose, and often delivers other attacker tools. A free file converter that works as advertised but quietly installs a remote access tool is a Trojan.
Logic bombs, rootkits, keyloggers and ransomware
NIST's glossary defines a logic bomb as code intentionally inserted into a software system that sets off a malicious function when specified conditions are met. The trigger, such as a developer's record being marked terminated, is what identifies it.
SP 800-83 lists attacker tools that malware delivers. A rootkit is a collection of files installed on a host to alter its standard functionality in a malicious and stealthy way. A keystroke logger monitors and records keyboard use and may send the data to another host. A backdoor listens for commands on a TCP or UDP port.
CISA describes ransomware as malware designed to encrypt files on a device, making them and the systems that rely on them unusable, followed by a demand for payment. CISA adds that ransomware actors often threaten to sell or leak stolen data if the ransom is not paid.
Why the categories overlap
SP 800-83 notes that many, if not most, malware instances today are blended attacks that use several infection or transmission methods. On the exam, pick the type that matches the detail the question stresses: self-copying into files, self-spreading, disguise, a trigger condition, or concealment.
Where the exam catches people
Believing a worm needs a user to open something: NIST says a worm usually executes itself without user intervention.
Believing a Trojan spreads itself: NIST defines it as non-replicating; it relies on someone installing it.
Believing a program that works as advertised cannot be malware: a Trojan does its visible job while carrying a hidden malicious purpose.
Believing a logic bomb is defined by the damage it does: it is defined by the condition that triggers it.
Believing ransomware only encrypts: CISA notes actors often also threaten to leak stolen data.