What is Malware?

Malware comes in many forms, and a single attack can chain them together: once a Trojan lands, its next move is typically to contact the attacker's server and download a second infection, often ransomware. Most strains aim to steal private information or extort money, but some instead spy on the user, disrupt the system, or hijack its resources for botnets or cryptomining.

Types of malware

Each type is named for how it behaves, not what it steals. The main types:

• Virus: attaches its code to legitimate files and spreads when those files are opened or shared.
• Worm: copies itself across networks with no user action needed.
• Trojan: disguises itself as legitimate software to trick you into installing it.
• Ransomware: encrypts your files and demands payment for the key.
• Spyware: secretly records what you type and browse; keyloggers, which capture every keystroke, are one common form.
• Adware (in its malicious forms): floods your screen with unwanted ads and often arrives bundled with other threats.
• Scareware: fake security alerts that pressure you into paying for a bogus fix.
• Rootkit: buries itself in the operating system to hide other malware from detection.
• Cryptominer: hijacks your processor to mine cryptocurrency for the attacker.
• Wiper: erases the contents of a computer or server outright.

Malware vs. viruses

A virus is one type of malware: a program that spreads by copying its own code into other files and programs. Malware is the umbrella term for the whole family, viruses included. Every virus is malware, but not every piece of malware is a virus; ransomware and Trojans, for example, don't self-replicate at all. When someone says their computer "has a virus," they usually mean malware of some kind.

How malware spreads

Many infections start with a trick rather than a technical feat. The usual routes are phishing emails carrying malicious attachments or links, hacked or fake websites that push downloads, free software bundles with extras hidden inside, infected USB drives, and unpatched security holes in software you already run.

Websites get infected through two doors of their own: outdated software, meaning a CMS core, plugin, or theme with a known hole, and stolen logins, whether phished from an admin or guessed by a brute-force attack.

Signs of a malware infection

On a computer or phone, watch for sudden slowdown, a fan running at full speed, pop-up ads, crashes, a browser homepage or toolbar you didn't choose, an antivirus that turns itself off, or files you can no longer open.

On a website, the signs are different: visitors redirected to spam pages, files or admin users you don't recognize, a "This site may harm your computer" warning under your listing in Google, or a security alert from your host.

Some signs are decisive on their own. An admin user you didn't create, an antivirus that's been switched off, or a security warning from Google or your host means investigate immediately. Nonspecific symptoms like a slowdown can have ordinary causes, so rule those out first, but run a scan anyway if the behavior persists.

Malware on websites

Your website can catch malware just like your laptop. Attackers use a compromised site to send spam, redirect visitors to scam pages, host phishing forms, or fold your hosting account into a botnet that runs DDoS attacks. The consequences depend on what's detected: Google Safe Browsing may flag a compromise it finds, browsers may then show visitors a warning page instead of your homepage, search visibility can suffer, and a host may suspend an account that threatens others.

If your site is hosted at DreamHost, the DreamShield add-on scans it daily, detects and blocks malware, and alerts you by email and in your panel, including when the site lands on Google's Safe Browsing threat list. Each plan covers a single domain, and it protects only sites fully hosted on a DreamHost plan.

How to remove malware from your website

Contain the damage first, then work through the cleanup in order:

1. Isolate the site: take it offline or put it in maintenance mode so it stops exposing visitors, save a copy of the infected site for later investigation, and ask your host for help if you need it.
2. Scan the site to find the infected files, using your host's malware scanner or a security plugin.
3. Quarantine flagged files before you delete them, or restore the whole site from a backup you've verified is clean.
4. Close the entry point: update the CMS core, plugins, and themes, and remove any plugins or admin users you don't recognize.
5. Rotate every password from a clean device: hosting panel, SFTP, database, and site admin accounts.
6. Once the site is clean, request a review in Google Search Console so the Safe Browsing warning comes down.

DreamShield identifies and disables the threats it finds, but some of this stays yours, like deleting quarantined files and resetting compromised passwords. For a hands-off cleanup, Hacked Site Repair from DreamHost's Pro Services does the whole job for you. And if Google is already warning visitors away, our guide to fixing "The site ahead contains malware" walks through the recovery step by step.

How to defend against malware

Layer your defenses, because each one blocks a different thing. Antivirus software catches known malicious files before they run. A firewall blocks unauthorized connections to your computer or server. Neither catches everything: brand-new or heavily disguised malware can slip past antivirus tools before their detections catch up.

That's why updates matter so much. Keeping your operating system, applications, and CMS software up to date closes the security holes malware uses to get in, and automatic updates do it while you sleep. Add unique passwords with two-factor authentication (2FA) on every account, and keep a clean backup somewhere the malware can't reach. An isolated, tested backup won't prevent an infection, but it limits the data you lose and shortens the recovery when one gets through.