Definitions vary, but I once wrote these notes for the definition in a security policy. It is probably more broad than what some people would write.

    Malware
    -------
    - Any software that actively attempts to do any of the following:
	- Do harm to the system, applications or data
	- Deliberately weakens system security
	    - By changing system or user security settings
	    - Contains or installs backdoors
	    - Downloads updates as executables
	    - Use executables to wrap otherwise readable data
	    - Expects higher or more privileges than is needed by it's function.
	- Circumvent the wishes or intention of the user
	    - Makes it self the default application for file-types that already have an application assigned to them
	    - Inserts itself into other applications against the users expectation (eg. as a plugin)
	    - Uses the privileges of other applications to circumvent system policy
	- Hide its activity from inspection
	    - Anti-debugging, and other rootkit like behaviour
	- Use "dark patterns" to trick the user into performing or agreeing to some action
	    - Installs toolbars, etc.
	- Compromise the privacy of the user
	    - Phones home, access data irrelevant to it's function
	- Resists removal