Distinguish viruses, worms and Trojan horses
Compare three forms of malware by how they arrive, spread and mislead users.
This sequence follows Cambridge IGCSE Computer Science 0478, 2026–2028 syllabus Version 6. It covers subject content sections 5.1–5.3 only. The separately published 2029–2031 syllabus is not mapped here. Practice is original, self-checked and does not award an official Cambridge grade. Full timed papers and human subject-teacher review remain outstanding.
Before you begin
- No programming language is required. Be comfortable with place value and multiplication; each lesson introduces the computer-science notation it uses.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What is malware?
What you will learn
- Explain how a virus uses a host file
- Explain worm self-replication
- Explain how a Trojan horse disguises its purpose
Malware types differ by their behaviour
A virus attaches to a file or program and spreads when that host is run or shared. A worm is malware that can copy itself and spread between devices, often across a network, without needing to attach to a host file.
Apply and check the rule
A Trojan horse disguises itself as useful or legitimate software so a user installs it. It may then carry out harmful actions. These are different ways malware operates; each can damage, steal or disrupt data depending on its payload.
Pause and explain
Which type can self-replicate across a network without attaching to a host file?
Worked example
A fake game installer appears legitimate but secretly installs harmful software. Which malware type describes the disguise?
Show the worked solution
- The user believes the program is useful.
- Its hidden purpose is harmful.
- A Trojan horse uses this disguise to encourage installation.
Answer Trojan horse.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
Match virus, worm and Trojan horse to their defining behaviour.
Give me a hint
Focus on host, self-copying and disguise.
Compare my reasoning
- Virus: attaches to a host file or program.
- Worm: copies itself and can spread between devices.
- Trojan horse: disguises malicious software as legitimate.
Virus attaches to a host; worm self-replicates; Trojan horse disguises itself.
Look for these in your work
- Virus behaviour
- Worm behaviour
- Trojan behaviour
A malicious program spreads when an infected document is shared and opened. Which type best fits, and why?
Give me a hint
Look for the host file that carries the code.
Compare my reasoning
- The code is attached to a document.
- It spreads when the host is shared or executed.
- This matches a virus.
A virus, because it attaches to a host document and spreads when that file is shared and opened.
Look for these in your work
- Host identified
- Activation path
- Type selected
A user says every malware program that spreads is a virus. Correct the classification using a worm and a Trojan horse as comparisons.
Give me a hint
Use how each one spreads or gets installed.
Compare my reasoning
- A virus attaches to a host file.
- A worm copies itself and may spread over a network without a host file.
- A Trojan horse relies on disguise to persuade the user to install it.
Not all spreading malware is a virus: worms self-replicate without a host file, while a Trojan horse gets installed by deception.
Look for these in your work
- Virus boundary
- Worm distinction
- Trojan distinction
Common mistakes
- Saying a worm must attach to a host program
- Saying a virus always spreads without a user running or sharing its host
What can you explain now?
Which malware type disguises itself as legitimate software?
Compare with the explanation
Trojan horse
The user is tricked into installing a program with a hidden harmful purpose.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How do a virus, worm and Trojan horse differ?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.