What Counts as Malware
Malware is any software that is hostile, intrusive, or annoying in its operation, performing actions without the knowledge or consent of the system's owner. Criminals have adopted it for a huge range of purposes - stealing victim information or committing other harmful acts. The category is broad: viruses, worms, Trojans, spyware, adware, scareware, ransomware, and more. Over time malware has evolved beyond simple annoyance to actively steal or destroy information, e.g. via keystroke loggers.
Mnemonic - The Malware Family: "VW SASTR"
V-W-S-A-S-T-R = Viruses, Worms, Spyware, Adware, Scareware, Trojans, Rootkits/Ransomware. Say it like "VW's a star" - the whole malware lineup from the slides.
Watching, Annoying, Scaring, and Extorting
Spyware
Software designed to collect and report information on a user's activities without knowledge/consent. It can collect browsing habits, keystrokes, software usage, and general computer usage.
Methods of Infection
- P2P networks
- Social media
- Freeware / bundling with software
- Browser defects
- Email attachments
- Physical access
Adware
Software specifically designed to display ads on a user's system as pop-ups or nag screens; often bundled with spyware.
Scareware
Malware designed to trick victims into purchasing and downloading useless (or actively dangerous) software by scaring them into thinking they're infected/at risk.
Ransomware
Designed to hold the user's data hostage - either sending data to the attacker, or encrypting large volumes of files. The victim must pay a ransom in exchange for the decryption key.
Defending Against Ransomware
- Install and maintain anti-malware software; keep it updated
- Apply the latest patches for the OS and all software
- Back up data, stored on a device not connected to the network
- Restrict files from running in data folders
- Don't use RDP (Remote Desktop)
Mnemonic - Ransomware Defense: "PAB-RD"
P-A-B-R-D = Patch everything, Anti-malware kept updated, Back up offline, Restrict data-folder execution, Don't use RDP. If you remember these 5, you've covered the whole ransomware-defense slide.
Malware Targets (General)
The Original Malware
A virus is the oldest piece of malware - the term is often used loosely to refer to all malware. Technically, a virus is a piece of code/software that spreads from system to system by attaching itself to other files. It activates when the file is accessed, and upon activation, carries out whatever attack the author wrote (e.g. destroying or corrupting data).
Types of Viruses
Mnemonic - 5 Virus Types: "Lucky People Make Monkey Hoaxes"
Lucky People Make Monkey Hoaxes = Logic bomb, Polymorphic, Multipartite, Macro, Hoax. A silly sentence for a silly-sounding but exam-critical list.
Virus Prevention
Self-Sufficient and Fast-Spreading
A worm is a self-replicating piece of software combining the convenience of computer networks with the power of malware.
- Does not require a host program - it's self-contained
- Does not require user intervention to spread
- Replicates rapidly
- Consumes bandwidth and resources
- Can transmit information from a victim system
- Can carry a payload, such as a virus
Needs a host file to attach to and needs the file to be opened/executed to activate.
Self-contained, self-replicating, spreads on its own with no user action needed.
Stopping Worms
Patch Operating Systems
Doesn't protect against a zero-day exploit, where a hole can be exploited immediately upon discovery.
Education
Teach users how to open email safely and not respond to phishing messages.
Antivirus
Detect and remove known worm signatures/behaviors.
Firewalls
Block the network traffic worms rely on to propagate.
Disguised as a Gift
A Trojan hides malicious functionality inside something that looks legitimate. The slides break Trojans down by their type/purpose.
Mnemonic - Trojan Types: "Really Sneaky Devils Fake Destruction, Denying, Proxying"
R-S-D-F-D-D-P = Remote access, Security disablers, Data sending, FTP, Destructive, DoS, Proxy. Seven purposes, one horse.
How Trojans Get Onto a System
Attach to Another File
The Trojan is bundled with something that looks harmless.
Retrieved and Executed
An unsuspecting victim downloads and runs the file.
Grants Access / Acts
The Trojan grants the attacker access, or performs some other malicious action on the attacker's behalf.
Trojan Functions
- Data theft
- Installation of software
- Downloading or uploading of files
- Modification or deletion of files
- Installing keystroke loggers
- Viewing the system user's screen
- Consuming computer storage space
- Crashing the victim's system
Trojan Targets
Known Symptoms of an Infection
The slides list a long, very specific set of weird behaviors that indicate a Trojan/virus infection. These make great exam trivia - the exact wording matters.
Physical / Display Symptoms
- CD/DVD drawer opens and closes on its own
- Screen flips, inverts, or changes settings by itself
- Windows color settings or screen saver settings change
- Documents print with no explanation
- Browser redirects to a strange/unknown webpage
- Right and left mouse buttons reverse function
- Mouse pointer disappears or moves unexplainably
- Start button and/or taskbar disappears
Account / System Symptoms
- Chat boxes appear on the infected system
- ISP reports the victim's computer is running port scans
- People chatting seem to know detailed personal information
- System shuts down by itself
- Account passwords are changed without user action
- Legitimate accounts are accessed without authorization
- Unknown purchase statements appear on credit card bills
- Ctrl+Alt+Del stops working
- After reboot, a message states other users are still connected
Exam Trivia Note
These symptom lists appear almost verbatim on exams as multiple-select questions - don't just skim them, know that they're all "known symptoms of a Trojan/virus infection," not random IT complaints.
Detection of Trojans and Viruses
netstat reveals currently open ports and active connections - unusual open ports/connections are a classic Trojan tell. Antivirus scans for known signatures, and vulnerability scanners look for the underlying weaknesses that let malware in.
How Trojans Get Built and Delivered
Wrappers
Attackers merge the intended malicious payload with a harmless-looking executable to create a single combined executable. This new file is posted somewhere it's likely to be downloaded, and the victim thinks they're getting the legitimate program.
Trojan Construction Kits
Pre-built toolkits that let low-skill attackers assemble custom Trojans. Named examples: Senna Spy and various stealth tools.
Backdoor Categories
Watching Keys, Redirecting Traffic
Keystroke Loggers
Typically implemented as hardware or software. Software keyloggers install just like any other Trojan (examples: IKS Software Keylogger, Ghost Keylogger). Hardware keyloggers physically plug into a USB or PS/2 port between the keyboard and the computer.
Port Redirection
Communications are redirected to ports other than their original destination - done by having a piece of software listen on specified ports; when packets arrive, the traffic is forwarded on to another system. Netcat is the classic tool: a simple command-line utility (Linux/UNIX/Windows) that reads TCP/UDP connection data and performs port redirection as configured.
Mnemonic - Netcat's Nickname
Netcat is often called the "Swiss Army knife" of networking - remember it for TCP/UDP connections and port redirection specifically.
Exam Tips & Tricks
Virus vs Worm
Virus needs a host file and user action to activate; worm is self-contained, self-replicating, no user action needed.
5 Virus Types
Logic bomb, polymorphic, multipartite, macro, hoax - "Lucky People Make Monkey Hoaxes."
Patching Doesn't Stop Zero-Days
Patching OSes protects against known worm exploits, NOT zero-day exploits.
Ransomware Defense = No RDP
The slides specifically call out avoiding Remote Desktop Protocol as a ransomware defense.
Wrappers Combine Two Files
A wrapper merges a malicious payload with a legitimate-looking executable into one file.
netstat Reveals Open Ports
One of the three named detection methods for Trojans/viruses, alongside antivirus and vulnerability scanners.
Netcat = Port Redirection Tool
A simple cross-platform CLI utility for reading TCP/UDP connections and redirecting ports.
Hoax ≠ Real Virus
A hoax tricks the user into acting even though there's no actual infection or threat - it's social engineering, not code.
Quick Reference - Everything at a Glance
| Topic | Key Point |
|---|---|
| Malware (Definition) | Hostile/intrusive/annoying software acting without owner's knowledge or consent |
| Spyware | Collects/reports user activity (browsing, keystrokes, usage) without consent |
| Spyware Infection Vectors | P2P, social media, freeware/bundling, browser defects, email attachments, physical access |
| Adware | Displays ads (pop-ups/nag screens); often paired with spyware |
| Scareware | Tricks victims into buying/downloading useless or dangerous software |
| Ransomware | Holds data hostage via exfiltration or encryption; demands ransom for decryption key |
| Ransomware Defense | Anti-malware, patching, offline backups, restrict data-folder execution, avoid RDP |
| Malware Targets | Credit card data, passwords, insider information, data storage |
| Virus | Oldest malware type; attaches to files, activates on file access |
| Logic Bomb | Triggers on a specific date or event |
| Polymorphic Virus | Changes shape to dodge antivirus detection |
| Multipartite Virus | Infects via multiple vectors: boot sector + executables |
| Macro Virus | Infects/operates via macro language (e.g. Office documents) |
| Hoax | Not a real virus; tricks users into acting despite no real threat |
| Virus Prevention | Education + antivirus/anti-malware + applying updates |
| Worm | Self-replicating, self-contained, no user intervention, consumes bandwidth |
| Stopping Worms | Patch OS, user education, antivirus, firewalls |
| Trojan Types | Remote access, security disablers, data sending, FTP, destructive, DoS, proxy |
| Trojan Delivery | Attach to file → victim retrieves/executes → grants attacker access/action |
| Trojan Functions | Data theft, install software, up/download files, modify/delete files, keylogging, screen viewing, crashing systems |
| Trojan Targets | Financial data, passwords, insider information, stored data |
| Infection Symptoms | CD tray opens, screen flips, browser redirects, mouse/taskbar anomalies, password changes, port scans reported by ISP |
| Detection Methods | netstat (open ports), antivirus, vulnerability scanners |
| Wrappers | Merge malicious payload with a harmless executable into one file |
| Trojan Construction Kits | Pre-built tools for assembling Trojans, e.g. Senna Spy |
| Backdoor Types | Password-cracking, process-hiding, rootkits, services backdoor |
| Keyloggers | Hardware (USB/PS2 plug-in) or software (e.g. IKS, Ghost Keylogger); records keystrokes |
| Port Redirection | Redirects traffic to different ports; classic tool is Netcat (TCP/UDP) |