-
What is malware?
-
Malware is harmful software designed to damage, disrupt, or gain unauthorized access to computers or networks.
-
What is a malware vector?
-
A vector is the method by which malware enters or infects a computer.
-
What is a virus?
-
A virus is malware that hides in executable files, like .EXE or .DLL files, and runs when the infected file is executed.
-
What is a boot sector virus?
-
A boot sector virus infects the boot sector or partition table of a disk drive, hijacking the boot process.
-
What is a Trojan?
-
A Trojan is malware disguised as legitimate software. It gets installed along with seemingly normal programs and often grants attackers the same permissions as the legitimate software.
-
How do worms spread?
-
Worms spread by replicating themselves between processes in system memory and can spread across a network without user action.
-
What makes fileless malware difficult to detect?
-
Fileless malware doesn’t rely on files stored on disk but uses the system's own scripting environments like PowerShell or JavaScript, making it harder to detect.
-
What is a backdoor (RAT)?
-
A backdoor, or RAT, allows attackers to remotely control an infected system, often used for stealing data or installing more malware.
-
What does spyware do?
-
Spyware secretly collects information from the user’s system, such as browsing habits, personal data, and can redirect traffic to fake sites.
-
What is a keylogger?
-
A keylogger is a type of spyware that records keystrokes to capture sensitive information like passwords and credit card numbers.
-
What is a rootkit?
-
A rootkit is malware that gains high-level (administrator or system) access to a computer and hides itself from detection tools, often modifying system files or logs.
-
What is ransomware?
-
Ransomware is a type of malware that encrypts files on a system and demands payment in exchange for the decryption key.
-
What does cryptominer malware do?
-
Cryptominer malware hijacks the system’s resources to mine cryptocurrency without the user’s consent, often slowing down the computer.
-
What performance symptoms might indicate malware infection?
-
Slow startup, frequent crashes, lockups, slow network access, or unusual network activity may indicate malware infection.
-
How can malware affect applications?
-
Malware can cause security-related applications like antivirus or firewalls to stop functioning and may cause frequent crashes in other applications.
-
What are common file system symptoms of malware infection?
-
Missing or renamed files, unauthorized executable files, altered file permissions, and access denied errors are common file system symptoms.
-
How does rogue antivirus malware trick users?
-
Rogue antivirus displays fake virus alerts or notifications that mimic legitimate system warnings, tricking users into installing fake security software.
-
What are common browser-related symptoms of malware infection?
-
Frequent pop-ups, changes to the homepage or search engine, unexpected browser crashes, and being redirected to unwanted websites are common browser symptoms.
-
What is the role of the HOSTS file in malware infections?
-
The HOSTS file can be altered by malware to redirect URLs to malicious websites, leading to fake search results or redirection.
-
What do certificate warnings in a browser indicate?
-
Certificate warnings indicate that the website’s certificate is invalid, untrusted, or expired, possibly signaling a malware attack or misconfigured site.
-
What is an on-path attack?
-
An on-path attack occurs when malware intercepts the communication between a user and a website, often by presenting a fake certificate to the browser.
-
What should be done when malware is suspected on a system?
-
Quarantine the system by disconnecting it from the network to prevent further spread of malware.
-
Why should System Restore be disabled when removing malware?
-
Disabling System Restore prevents malware from hiding in restore points and being restored during future system rollbacks.
-
Why is Safe Mode useful during malware removal?
-
Safe Mode prevents most malware from running at startup, allowing for more effective scanning and removal.
-
What tools can be used for manual malware removal?
-
Task Manager to stop processes, Command Prompt or Registry Editor (regedit) to remove malicious entries, and msconfig to enable Safe Mode are useful tools.
-
When is OS reinstallation necessary for malware removal?
-
Reinstallation may be necessary if malware has gained a persistent foothold or cannot be fully removed by antivirus software.
-
What is on-access scanning?
-
On-access scanning checks files for malware each time they are opened, providing real-time protection.
-
Why are scheduled scans important?
-
Scheduled scans run regular checks on the system to detect malware, even when the system appears to be functioning normally.
-
How can DNS settings affect malware prevention?
-
Malware can alter DNS settings to redirect users to malicious sites; checking and securing DNS configurations is important for preventing reinfection.
-
Why is user education important in malware prevention?
-
Educating users about phishing, safe browsing, and password management reduces the risk of malware infections caused by human error.