Which of the following is a software that displays unwanted, sometimes…

Concept — a malware family is defined by the one behaviour that makes it that family. For some families the defining behaviour is the payload the code carries out once it is running on a host — collecting user data, delivering advertisements, replicating itself across machines — while for others it is the method of entry, as with a program that gets itself installed by posing as something legitimate. Identifying a described program therefore means matching the behaviour that the description singles out to the family whose defining trait is exactly that behaviour.

Application. The description here fixes on one observable effect: the program renders unwanted, intrusive pop-up advertisements on the user’s computer or phone. Advertising delivery is the defining behaviour of adware — the term is a contraction of "advertising-supported software" — and such a program is monetised per advertisement impression and per click, so putting advertisements in front of the user is the program’s purpose rather than an incidental side effect. The described software is therefore Adware.

Contrast with the other families.

• Spyware — the defining behaviour is covert monitoring and exfiltration: keystrokes, browsing history, and stored credentials are collected and sent to a remote operator. It is built to escape notice, so deliberate on-screen output would work against its purpose.

• Worm — the defining behaviour is autonomous self-replication: the code copies itself to other machines over a network without user action, and its characteristic effects are spread, bandwidth consumption, and host slowdown.

• Trojan Horse — the defining trait is the method of entry rather than any one payload: the program poses as legitimate or useful so that the user installs it, after which any concealed payload (backdoor, credential theft, downloader for further malware) may run.

Cross-check. A reliable discriminator is whether the program needs the user to see its output. A program funded by advertising has to put its advertisements in front of the user to earn anything, so visible output is the point of it. None of the other three families gains anything from being displayed: spyware is deliberately hidden, a Trojan horse keeps its real payload concealed behind a decoy shell, and a worm’s spread is a network effect that needs no display at all — conspicuous or not, it does not work by showing the user anything. The description’s emphasis on advertisements that "appear on your computer or mobile phone" is a visible-by-design effect, which fixes the family as Adware.