Malicious code (malware) — AQA GCSE Computer Science

Verified courseTeaching note checked against the official specification.

Malicious code, or malware, is software intentionally written to cause damage, gain unauthorized access, or steal data from computer systems. Key types assessed in AQA GCSE Computer Science include viruses, worms, Trojans, ransomware, spyware, and adware, alongside prevention methods like anti-malware and firewalls.

Malicious code (malware) explained

This statement stresses that malware is an umbrella term, so it names a whole family of hostile or intrusive software rather than a single product.

Read the full explanation

The two key ideas are variety (many different forms exist) and purpose (each form is hostile or intrusive). Examples of the family include viruses, worms, trojans and ransomware, but the definition does not depend on listing them. A strong answer explains that the shared feature is intent to harm or intrude, while the forms differ in how they spread and what they do. For instance, some forms attach to other files and spread when those files run, while others spread across a network on their own; both still sit under the umbrella. Avoid treating the term as one specific program or as a synonym for a single type.

Read the Malicious code (malware) study guideFull revision notes for AQA GCSE Computer Science

Your focus

Explain that malware is an umbrella term for many forms.
Identify the shared hostile or intrusive purpose of those forms.
Recognise that different forms behave differently while belonging to the same category.

Which command word is this?

Give clear reasons or mechanisms showing how something works or why a choice is made; must use connectives such as 'because', 'which leads to', or 'therefore'.

Malicious code (malware) exam tips

Topic Overview

Malicious software (malware) represents any code designed with hostile intent to compromise, disrupt, steal, or damage data and computer systems. In AQA GCSE Computer Science, students must understand the technical characteristics, propagation methods, and operational objectives of viruses, worms, Trojans, ransomware, spyware, and adware.

Understanding malware forms the bedrock of cyber security topic 3.4. By exploring how vulnerabilities are exploited, learners gain insight into the technical and procedural defensive strategies—such as patch management, firewalls, user permissions, and user education—necessary to secure modern computer networks.

Key Concepts

→Distinction between self-replicating malware (worms, viruses) and non-replicating malware (Trojans, ransomware).
→Mechanisms of infection: Host files and user execution (viruses) versus standalone network exploitation (worms).
→Spyware functions, including keyloggers capturing credentials and transmitting them to a malicious actor.
→Ransomware encryption techniques locking user data and extorting financial payment for decryption keys.
→Technical and administrative countermeasures, including anti-malware software, access control lists, firewalls, and regular patch updates.

Marking Points

States that malware is an umbrella or collective term.
Explains that it covers a variety of different forms of software.
Identifies the shared feature as hostile or intrusive behaviour.
Recognises that individual forms differ in how they operate while sharing that purpose.

Examiner Tips

💡Use the phrase 'umbrella term' and then explain what it covers.
💡Give the shared purpose (hostile or intrusive) before any examples.
💡If examples are requested, name a few forms and say they all belong to the same family.
💡Use precise vocabulary: write 'replicates itself across a network' rather than 'moves around the internet'.
💡When asked for prevention methods, differentiate between preventative technical tools (firewalls, anti-virus) and administrative policies (staff training, offline backups).
💡Do not confuse social engineering attacks (e.g. phishing) with the malware payloads they deliver (e.g. Trojans or spyware).

Common Mistakes

Defining malware as one specific type of program; correct this by describing it as a category covering many forms.
Listing types without explaining the shared hostile or intrusive purpose; correct this by stating the common feature.
Assuming all malware spreads in the same way; correct this by noting the forms differ in behaviour.
Believing all malware replicates itself: Trojans, spyware, and adware generally do not self-replicate, relying instead on user execution, bundled installers, or phishing.
Thinking anti-virus software provides permanent protection: Signatures must be constantly updated to recognise zero-day threats and new variants.
Assuming paying a ransom guarantees data retrieval: Decryption keys are rarely guaranteed, and paying funds further cybercriminal activity.

Revision Plan

1Day 1-2: Create a comparison table detailing the 6 core malware types (definition, replication method, and damage caused).
2Day 3-4: Practise distinguishing between viruses and worms using past exam scenarios.
3Day 5: Map each malware type to at least two specific prevention or mitigation techniques.
4Day 6-7: Complete timed exam-style questions from AQA Paper 2 and review mark schemes for exact keyword requirements.

Exam Question Types

📋Identification questions: Matching short descriptions or scenarios to the correct malware type (e.g. 1-2 marks).
📋Comparative short-answer questions: Explaining the technical differences between two forms of malware (e.g. 2-4 marks).
📋Scenario-based mitigation questions: Recommending technical or human-factor defences to protect a business against a specific attack (e.g. 4-6 marks).

Command Word Expectations (AQA)

Explain

Give clear reasons or mechanisms showing how something works or why a choice is made; must use connectives such as 'because', 'which leads to', or 'therefore'.

State

Provide a concise name or brief fact without elaboration or justification.

Discuss

Explore multiple perspectives or solutions (e.g. technical defences vs. human behaviours), presenting balanced points supported by technical examples.

How Students Lose Marks (Examiner Pitfalls)

Pitfall: Confusing how viruses and worms spread, specifically regarding human intervention and host files.

❌ Weak Answer (Loses Marks):A worm is just like a virus because it duplicates itself on the computer to delete files.

Example improved answer:A virus attaches itself to an executable file and requires a user to run the file to replicate and spread. In contrast, a worm is a standalone program that replicates automatically across networks without user action or a host file.

Examiner Tip: Always explicitly state that viruses need human activation/a host file, whereas worms replicate independently across network vulnerabilities.

Pitfall: Stating that a Trojan spreads across a network by replicating itself.

❌ Weak Answer (Loses Marks):A Trojan spreads by replicating itself inside system files until the network crashes.

Example improved answer:A Trojan misleads users of its true intent by disguising itself as legitimate software. Unlike viruses and worms, Trojans do not replicate themselves; they rely on users being tricked into installing them.

Examiner Tip: Never write that a Trojan replicates or self-propagates. Point out that it relies on social engineering or deception to be installed.

Step-by-Step Worked Solutions

Question: An employee downloads an attachment titled 'Invoice_March.exe' from an unknown email. The program encrypts all local data files and displays a message demanding payment in cryptocurrency for the decryption key. State the type of malware described and explain two measures the company could implement to prevent this attack.

1.Step 1: Identify the malware type from the clue 'encrypts all local data files and displays a message demanding payment'. This matches the definition of ransomware.
2.Step 2: Propose the first preventive measure focusing on email filtering or human action (e.g. anti-malware email scanners or staff training on phishing).
3.Step 3: Propose the second preventive measure focusing on technical controls (e.g. running regular offline backups to prevent loss or restricting user permissions to block execution of .exe files).
4.Step 4: Combine points with technical justifications tailored to AQA criteria.

Final Answer: The malware is ransomware. Measure 1: Implement user access controls to restrict employees from executing unapproved executable (.exe) files. Measure 2: Maintain regular, secure offline backups of all critical data so files can be restored without paying the ransom.

Question: Explain the difference between spyware and adware in terms of their purpose and impact on a user.

1.Step 1: Define spyware's main purpose (monitoring user activity without consent, e.g. keylogging to capture passwords) and its impact (breach of privacy, identity theft).
2.Step 2: Define adware's main purpose (displaying unwanted advertisements to generate revenue for its author) and its impact (annoyance, degraded system performance, browser redirection).
3.Step 3: Structure a comparative explanation using linking phrases such as 'whereas' to highlight the contrast clearly.

Final Answer: Spyware secretly monitors user actions (such as keystrokes or browsing history) and transmits this sensitive data to third parties, resulting in data theft and privacy invasion. In contrast, adware is designed to display unwanted advertisements or redirect browser traffic to generate advertising revenue, primarily impacting system performance and user experience rather than stealing private credentials.

Active Recall Memory Test

What key property distinguishes a worm from a computer virus?

Key Fact: A worm is standalone and self-replicates across networks without needing a host file or user action, whereas a virus must attach to a host file and requires human execution.

What is the primary function of a keylogger?

Key Fact: A keylogger is a type of spyware that secretly records all keystrokes typed by a user to capture sensitive data such as usernames and passwords.

How does a Trojan gain access to a computer system?

Key Fact: It disguises itself as legitimate or harmless software, deceiving the user into downloading and installing it.

Frequently Asked Questions

What is the difference between malware and a virus?

Malware is an umbrella term that covers any form of hostile or intrusive software, including ransomware, adware, and Trojans. A virus is simply one specific subcategory of malware that reproduces by inserting its code into another valid program and relies on user execution to spread.

Can an antivirus program detect all types of malware?

No. While modern anti-malware suites use both signature matching and heuristic behaviour monitoring, they cannot always detect zero-day exploits. These are newly created threats whose signatures have not yet been analysed or added to security databases.

Why is a Trojan not classified as a worm?

Trojans and worms have fundamentally different propagation methods. A worm is capable of autonomous self-replication across a network without user assistance, whereas a Trojan cannot replicate itself at all and depends on social engineering to trick a user into running it.

How does ransomware encrypt files so quickly?

Ransomware uses high-performance cryptographic algorithms (such as AES) built into modern operating systems or hardware. It traverses the file directory, reading user documents, encrypting the data stream with a public key, writing the encrypted output, and deleting the original unencrypted files.

Malicious code (malware) explained

Your focus

Which command word is this?

Malicious code (malware) exam tips

More AQA GCSE Computer Science topics

Cookies on MasteryMind