Distinguish spyware, adware and ransomware
Identify the monitoring, advertising and extortion behaviours of three malware types.
Section 5 · The internet and its uses
Exam scope and assessment notes
This sequence follows Cambridge IGCSE Computer Science 0984, 2026–2028 syllabus Version 4. It covers subject content sections 5.1–5.3 only. The separately published 2029–2031 syllabus is not mapped here. Practice is original, self-checked and does not award an official Cambridge grade. Full timed papers and human subject-teacher review remain outstanding. Cambridge states that 0984 has the same 2026–2028 subject content as 0478, with 9–1 grading. In June and November, Cambridge lists 0984 in Administrative zone 3 and for centres in Oman and the UAE. Confirm availability for your centre and exam series with Cambridge International. The separately published 2029–2031 syllabus changes to Python 3 only and removes pseudocode; this 2026–2028 route does not cover those changes.
Before you begin
- No programming language is required. Be comfortable with place value and multiplication; each lesson introduces the computer-science notation it uses.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What does spyware aim to do?
What you will learn
- Explain how spyware monitors activity
- Explain adware's unwanted advertising
- Explain ransomware's restriction or encryption demand
Malware can target privacy, attention or access
Spyware secretly monitors a user's activity or collects information. Adware displays or promotes unwanted advertisements, sometimes while also tracking behaviour.
Apply and check the rule
Ransomware restricts access to data or a device, commonly by encrypting files, then demands payment to restore access. Paying does not guarantee recovery. These behaviours can overlap with other malware, but the names describe the threat's main action.
Pause and explain
A program secretly records browsing activity. Which type best describes it?
Worked example
A user's files become encrypted and a message demands money for a decryption key. Identify the malware and its aim.
Show the worked solution
- The program prevents normal access to files.
- It demands payment for restoration.
- This is ransomware.
Answer Ransomware restricts access to files and demands payment; recovery is not guaranteed even if the user pays.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
Classify each behaviour: secretly records browsing, forces unwanted adverts, encrypts files and demands money.
Give me a hint
Match the action rather than guessing from the delivery route.
Compare my reasoning
- Secret monitoring is spyware.
- Unwanted advertising is adware.
- File encryption followed by a payment demand is ransomware.
Spyware; adware; ransomware.
Look for these in your work
- Monitoring type
- Advertising type
- Extortion type
Why should a school back up important work to a protected location as well as use anti-malware?
Give me a hint
Consider the limit of prevention.
Compare my reasoning
- Anti-malware can reduce the chance of known threats running.
- A new or missed threat can still cause damage.
- A protected backup can help restore work if files become unavailable.
Anti-malware reduces risk, while a separate protected backup can support recovery if ransomware or another failure damages files.
Look for these in your work
- Prevention benefit
- Residual risk
- Recovery control
A ransomware note promises files back after payment. Explain why the school should not assume payment solves the problem, and identify a safer recovery measure.
Give me a hint
A criminal's promise is not enforceable.
Compare my reasoning
- Payment does not guarantee a working decryption key or deleted copies.
- The school should isolate affected devices and follow its response plan.
- Restore from a clean, tested backup after the threat is removed.
Payment does not guarantee recovery. The school should isolate affected devices, seek appropriate support and restore from a verified clean backup when safe.
Look for these in your work
- Promise limitation
- Containment
- Recovery
Common mistakes
- Saying adware only shows harmless ads
- Promising that paying ransomware always restores files
What can you explain now?
Which malware commonly encrypts files and demands payment?
Compare with the explanation
Ransomware
It restricts access and makes an extortion demand.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
State the main behaviour associated with spyware, adware and ransomware.
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.