CSCU Malware and Antivirus 2 — Questions and Answers

Question 1: What distinguishes a worm from a virus in terms of propagation?

Worms only infect Mac computers while viruses target Windows
Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread (Correct answer)
Worms are less harmful than viruses
Worms can only spread through email while viruses spread through USB drives

Correct answer: Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread

Unlike viruses that attach to files and require user action to spread, worms are self-replicating malware that can propagate automatically across networks by exploiting vulnerabilities.

The fundamental distinction between worms and viruses lies in their propagation mechanism. A virus attaches itself to a legitimate file or program (the host) and requires user action—such as opening an infected file, running a program, or booting from infected media—to activate and spread. A worm, in contrast, is a standalone program that self-replicates and spreads across networks autonomously by exploiting software vulnerabilities, weak passwords, or open network services. Worms do not need a host file or user interaction. This self-propagating nature makes worms particularly dangerous, as they can spread rapidly across entire networks. Historical examples include the ILOVEYOU worm, SQL Slammer, and WannaCry (which combined ransomware with worm capabilities).

Question 2: What is a rootkit and why is it particularly dangerous?

A tool for managing root access on Linux systems
Malware that hides deep within the operating system to conceal its presence and the presence of other malware (Correct answer)
A legitimate system administration utility
A type of firewall configuration tool

Correct answer: Malware that hides deep within the operating system to conceal its presence and the presence of other malware

A rootkit embeds itself deep in the operating system—sometimes at the kernel level—to hide malicious activity from security software and users, making detection and removal extremely difficult.

A rootkit is a type of malware designed to gain privileged access to a computer while actively concealing its presence. Rootkits operate at various levels: user-mode rootkits modify system utilities and API calls; kernel-mode rootkits embed in the operating system kernel, intercepting system calls to hide files, processes, and network connections; bootkit variants infect the boot sector and load before the operating system. Because rootkits control what the OS reports to applications—including security software—they can make themselves, other malware, and malicious activity completely invisible to standard detection methods. Removal often requires booting from clean media and using specialized anti-rootkit tools, or in severe cases, complete system reinstallation.

Question 3: What is heuristic-based malware detection?

Detection based on matching known virus signatures
Detection that analyzes code behavior and structure to identify potentially malicious programs even without a known signature (Correct answer)
Detection that only works when connected to the internet
Detection based on the file size of programs

Correct answer: Detection that analyzes code behavior and structure to identify potentially malicious programs even without a known signature

Heuristic analysis examines the behavior patterns and code characteristics of programs to detect potentially malicious software, even if it hasn't been previously identified and cataloged.

Heuristic-based detection is a proactive malware detection method that analyzes the behavior, code structure, and characteristics of programs to identify potentially malicious software without relying on known signatures. Traditional signature-based detection can only identify malware that has been previously discovered and cataloged. Heuristic analysis can detect new, unknown (zero-day) malware by looking for suspicious behaviors such as attempts to modify system files, disable security software, establish unauthorized network connections, or encrypt large numbers of files rapidly. Methods include static heuristics (analyzing code without execution), dynamic heuristics (monitoring behavior in a sandbox), and machine learning models trained on malware characteristics. While heuristic detection may produce false positives, it is essential for catching novel threats.

Question 4: What is a fileless malware attack?

Malware that only infects files smaller than 1 KB
Malware that operates entirely in memory without writing persistent files to disk, evading traditional file-scanning antivirus (Correct answer)
Malware that deletes all files on the hard drive
Malware that spreads through email without attachments

Correct answer: Malware that operates entirely in memory without writing persistent files to disk, evading traditional file-scanning antivirus

Fileless malware resides in RAM and uses legitimate system tools like PowerShell or WMI, avoiding detection by file-based antivirus scanners that look for malicious files on disk.

Fileless malware operates entirely in the computer's volatile memory (RAM) without writing traditional malicious files to the hard drive. Instead, it leverages legitimate system tools and processes—such as PowerShell, Windows Management Instrumentation (WMI), macros, and scripting engines—to execute malicious actions. Because no malicious files exist on disk, traditional file-scanning antivirus solutions cannot detect fileless attacks. These attacks often begin through phishing emails, malicious websites, or exploit kits that inject code into running processes. Fileless malware typically does not survive a system reboot (unless it establishes persistence through registry modifications or scheduled tasks). Detection requires behavior-based monitoring, memory analysis, and endpoint detection and response (EDR) solutions that monitor process behavior in real time.

Question 5: Why is it important to keep antivirus signature databases up to date?

Updated signatures improve computer performance
New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats (Correct answer)
Signature updates reduce the size of the antivirus program
Updated signatures prevent software license expiration

Correct answer: New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats

Hundreds of thousands of new malware variants emerge daily, and signature updates contain the latest threat definitions needed to detect and block these newly identified threats.

Antivirus signature databases contain unique identifiers (signatures or definitions) for known malware. The cybersecurity landscape evolves rapidly, with hundreds of thousands of new malware variants appearing daily. Without regular signature updates, antivirus software cannot recognize or block these new threats, leaving the system vulnerable. Signature updates are typically released multiple times per day by antivirus vendors as their research teams identify and analyze new malware samples. While heuristic and behavior-based detection provide some protection against unknown threats, signature-based detection remains a critical layer for quickly and accurately identifying known malware with minimal false positives. Most modern antivirus solutions update automatically, but users should verify that automatic updates are enabled and functioning.

Question 6: What is a potentially unwanted program (PUP)?

Any program not made by Microsoft
Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users (Correct answer)
A program that is too large for the hard drive
An outdated version of a legitimate application

Correct answer: Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users

PUPs are programs that users may not have intentionally installed and that exhibit behaviors like displaying unwanted ads, modifying browser settings, or collecting user data without clear consent.

Potentially Unwanted Programs (PUPs)—also called Potentially Unwanted Applications (PUAs)—exist in a gray area between legitimate software and malware. They are often bundled with free software downloads and installed when users click through installation wizards without reading each step. PUP behaviors include displaying excessive advertisements (adware), changing browser homepages and default search engines (browser hijackers), installing toolbars, collecting browsing data for marketing purposes, and degrading system performance. While PUPs technically may have user 'consent' buried in lengthy license agreements, their installation is often deceptive. Most antivirus and anti-malware tools can detect and remove PUPs. Prevention involves careful attention during software installation (choosing custom install options) and downloading software only from official sources.

CSCU Malware and Antivirus 2

What distinguishes a worm from a virus in terms of propagation?

🃏 CSCU Flashcards — Study This Quiz as Flip Cards →

📚 Want to go deeper? Read the Full CSCU Study Guide →