"Malware" is a general term for all categories of harmful software, including software that doesn't try to spread itself, but only does things that the user would rather it didn't.
A "worm" is a self-propagating program that can spread without outside help. An example would be a program that looks for an unsecured SSH server, uploads itself, and then runs itself on the newly-infected system.
A "virus" is not self-propagating. Instead, it piggybacks on another program, only executing when the infected program is run. An example would be a program that runs on a computer, looking for USB thumb drives; when it finds one, it modifies every program on that drive to contain a copy of itself.
Email, the Internet, and the design of modern operating systems makes the boundary between "worm" and "virus" a bit fuzzy. Is a program that depends on a bug to add its code to an already-running program for initial infection, but runs on its own afterwards, a worm or a virus?