Malware: Viruses, Worms, and Trojans

Active learning helps students grasp malware mechanics because the abstract concepts of self-replicating code and social engineering become concrete through hands-on modeling. Our activities let students observe propagation, make predictions, and test defenses, turning passive reading into active problem-solving that sticks.

• Secondary 3
• Computing
• 4 activities
• 30 min–45 min

Learning Objectives

1. Compare the propagation methods of viruses, worms, and Trojan horses, identifying key differences in their spread mechanisms.
2. Explain how malware, including viruses, worms, and Trojans, compromises computer systems by detailing specific attack vectors and impacts.
3. Analyze the potential consequences of malware infections, predicting outcomes ranging from data loss to system failure.
4. Classify different types of malware based on their behavior and infection strategies.

Case Study Analysis

⏱ 35 min·Pairs

Simulation Lab: Malware Spread Models

Provide diagrams of networks; pairs label virus, worm, and Trojan paths with markers. Step 1: Simulate virus by passing 'infected' files between devices. Step 2: Model worm autonomous spread across all nodes. Step 3: Discuss Trojan user-triggered entry.

Prepare & details

Compare the propagation methods of viruses, worms, and Trojan horses.

Facilitation Tip: During the Simulation Lab, circulate to ask guiding questions that connect propagation speed to network topology, not just results.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 45 min·Small Groups

Case Study Dissection: Real Infections

Distribute anonymized case reports on famous malware. Small groups identify type, propagation, compromise method, and consequences in 10 minutes. Groups present findings to class for comparison.

Prepare & details

Explain how malware can compromise a computer system.

Facilitation Tip: For the Case Study Dissection, assign roles so each student analyzes one infection type, ensuring all perspectives are covered in the final discussion.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 30 min·Whole Class

Prediction Challenge: Infection Scenarios

Present hypothetical scenarios like email attachments or USB drives. Whole class votes on malware type and outcomes, then debates predictions using evidence from prior lessons.

Prepare & details

Predict the potential consequences of a malware infection.

Facilitation Tip: In the Prediction Challenge, require students to include a specific vulnerability (e.g., open port 445) in their scenarios to focus on technical causes.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 40 min·Individual

Trojan Hunt: Safe Analysis

Use isolated virtual machines with sample (safe) Trojans. Individuals examine file properties and behaviors, noting deception tactics before reporting to pairs.

Prepare & details

Compare the propagation methods of viruses, worms, and Trojan horses.

Facilitation Tip: During the Trojan Hunt, provide checksum tools so students compare file hashes to spot tampering firsthand.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Teaching This Topic

Teach malware by making students the attackers first, then the defenders. Start with simulations that let them experience spread dynamics, then use case studies to ground those observations in real events. Avoid lectures on definitions alone; focus on how malware interacts with systems. Research shows experiential learning improves retention for technical topics like this.

What to Expect

Successful learning looks like students distinguishing malware types by their spread patterns, explaining infection consequences with evidence from simulations, and proposing layered defense strategies. They should justify choices with technical details, not just opinions.

Watch Out for These Misconceptions

Common Misconception

During Simulation Lab: Malware Spread Models, watch for statements like 'All malware spreads the same way.'

What to Teach Instead

Use the lab's propagation timelines to pause and ask groups to compare worm speed across networks versus virus attachment to files. Have them annotate their models with labels for each malware type.

Common Misconception

During Case Study Dissection: Real Infections, watch for statements like 'Antivirus software stops every malware infection.'

What to Teach Instead

During the case review, highlight antivirus logs showing undetected infections. Ask students to map why detection failed, linking to zero-day exploits and update gaps in their analysis sheets.

Common Misconception

During Prediction Challenge: Infection Scenarios, watch for statements like 'Worms need user action to spread.'

What to Teach Instead

Use the challenge's scenario templates to insert a worm that spreads without clicks, then ask students to revise their predictions based on the template's network vulnerability details.

Assessment Ideas

Quick Check

After Simulation Lab: Malware Spread Models, present three infection scenarios and ask students to identify malware types and justify their answers using propagation patterns from their lab data.

Discussion Prompt

During Case Study Dissection: Real Infections, pose the question: 'Given that worms spread automatically, why do viruses still cause major outbreaks?' Facilitate a discussion where students compare user reliance in viruses to network vulnerabilities in worms, using case study evidence.

Exit Ticket

After Trojan Hunt: Safe Analysis, have students write one sentence explaining how a Trojan deceives users and one sentence describing a potential consequence of a virus infection, referencing the files they analyzed.

Extensions & Scaffolding

• Challenge: Ask students to design a malware that evades detection in the Simulation Lab, explaining their evasion technique in a written report.
• Scaffolding: Provide a partially completed Trojan Hunt worksheet with file names to analyze, reducing cognitive load for struggling students.
• Deeper exploration: Invite a cybersecurity professional to discuss zero-day exploits and how antivirus software adapts to new threats.

Key Vocabulary

Malware	Short for malicious software, this is any software intentionally designed to cause damage to a computer, server, client, or computer network.
Virus	A type of malware that attaches itself to legitimate files or programs and requires user action, such as opening an infected file, to spread.
Worm	A standalone malware program that replicates itself and spreads across computer networks, often exploiting security vulnerabilities without requiring user interaction.
Trojan Horse	Malware disguised as legitimate or desirable software, which, when executed, allows attackers to gain unauthorized access or cause harm.
Payload	The part of malware code that performs the malicious action, such as deleting files, stealing data, or encrypting a system.