Malware can be a significant security issue for any network. In this video, you’ll learn about trojan horses, rootkits, spyware, keyloggers, ransomware, and more.
Malware is a broad term that describes many different types of malicious software. Although there are many different types of malware, they are all still considered to be things that you do not want to run on your computer. Some of this malware is designed to gather information from your system, such as the keys that you type into your keyboard. Or maybe this malware is working together with other systems that are infected to create a large bot of systems.
Malware could just be showing you advertising on the screen, which ultimately makes the attacker some money. Or you might have viruses, worms, or other types of malicious software that are designed to attack your system and your documents. In this video, we’ll look at many different types of malware. But keep in mind that this malware may use multiple methods to gain access to your system.
One common way is to start with a vulnerability. This is a known or unknown issue with your software that would allow someone access to your system without the proper credentials. Once this vulnerability is found, the malware then begins to embed itself into your operating system and begin installing additional software, such as a remote-access backdoor. Once that backdoor software is in place, the attacker can now connect to your computer at any time and install new software, delete files, or modify information on your computer.
For this malware to get onto your system, there has to be something that starts this process. We have to run some type of malicious software in the memory of your computer. This might be a malicious link inside of an email message that connects you to a website, downloads the malicious software, and runs it. Or it might be a pop-up on a website that encourages you to click the link. In reality, it is downloading and installing malware.
Or it could be what we call a drive-by downloading where you’re simply visiting a website, and then it automatically downloads a file to your computer. And sometimes it’s not something that you actively do, but instead it’s part of a worm that finds its way onto your computer without any type of human intervention. Fortunately, worms are very rare.
So most of the time, we will need to protect ourselves by following the best practices. But it’s always a good idea to keep your operating system updated to avoid any vulnerabilities on your system. So make sure you run the Windows Updater to keep everything up to date inside of Windows. And make sure that you check all of the applications on your system so that they’re up to date as well.
One type of popular malware is a Trojan horse. This is named after the story behind the Greeks using a large wooden horse to gain access to the city of Troy. You are effectively inviting the software onto your computer and running it, thinking that it’s going to provide you with some type of service or function. But in reality, behind the scenes, it’s malicious software that is embedding itself into your operating system.
Very often, the antivirus and anti-malware software you run on your computer can identify a Trojan Horse and stop it before it becomes embedded onto your computer. Since you are installing this Trojan horse with your rights and your permissions, the Trojan horse now has access to all of the data and all of the resources that you do. This is why it’s always a best practice to only install software that you trust so that you can avoid any instances of a Trojan horse.
The malware developers realized early on that, if they want to get their software on your computer, they need to be as invisible as possible. And one of the best ways to get onto your system is to avoid the antivirus and anti-malware scanner completely. One very common way to do this in the past was through the use of a rootkit. The name “root” in rootkit describes the superuser account that you would find in Unix or Linux.
A rootkit embeds itself as part of the core operating system. And because it’s running as the OS itself, it’s able to hide itself from antivirus and anti-malware scanners. This also makes the rootkit invisible to the operating system itself. If it can hide itself from the scanners, it can easily hide itself from Process Explorer or Task Manager. This makes it very difficult to remove from your system because it’s difficult to first identify that it’s running on your computer at all.
Fortunately, we addressed the problem of rootkits when we created the UEFI BIOS. This is a very standard, basic input-output system that we’re using on almost all of our modern computers today. There’s a feature within the UEFI BIOS called Secure Boot. Secure Boot will examine the signature of your operating system. And if anything has changed with your core system files, it will not boot your OS. This has effectively stopped rootkits from being able to run on our modern operating systems.
There are a number of scanners that will look for changes with your operating system and try to identify cases where rootkits may have embedded themselves within your OS. Many antivirus and anti-malware scanners have also included a rootkit scanner as part of their basic antivirus engine. Every rootkit tends to be a little bit different. So if you have identified a rootkit on a system, you may want to get a remover that is specific to that type of rootkit. And ultimately, using a system with a UEFI BIOS that has Secure Boot enabled and combining that with a modern operating system effectively limits the scope of a rootkit on those systems.
Just like an actual virus, a computer virus needs a human being to be able to run an application to replicate that virus from one computer to another. This might be a program that you’ve downloaded from the internet, and, when you click on that program, you’ve now started the virus running on your computer. And that virus may be communicating across the network. Or you may be moving that virus from one system to another using some type of USB drive or other portable storage system.
Some viruses are very quiet when they run. It’s difficult to even know that a system may be infected with a type of virus. But some viruses use lots of resources on the computer, slow everything down, and make it very apparent that something else is happening with that computer. There are thousands and thousands of new viruses discovered every week. And it’s always important to keep your antivirus and anti-malware software updated with the latest set of virus definitions.
If you ever feel that your computer is watching you, it may be because there’s spyware on your system. Spyware is malware that is watching what you do and is either reacting to things that you’re clicking on, or it’s documenting all of the things that you’re doing on your system. So it might be a Trojan Horse that ultimately has the malware that begins spying on us on our own computer.
Some spyware embeds itself in your browser. It monitors your surfing habits, documents, all of the websites you go to and is able to report all of that information back to the attacker. Some spyware will watch everything you type into your keyboard. We refer to this type of malware as a key logger. The key logger is watching everything you type in onto your computer and storing that information.
So this might be the URLs you type in to get to a website. Or it may be the usernames and passwords that you use to log in to your bank account. These key loggers will commonly collect all of these keystrokes on your computer. And then, once or twice a day, it will send that keystroke information back to the attacker.
This obviously creates a number of security challenges because there’s no encryption between you and the keyboard. Every key press you make, every word that you type, and anything else that’s input into your computer is stored for analysis later. And these key loggers very often go beyond just logging your keystrokes. They might also log mouse movements. They might capture screenshots and take anything else that you’re doing and provide that information to the attacker.
Here’s what a keylogger looks like when it’s running. I have started up on my computer, a keylogger called the DarkComet Remote Access Trojan, or a RAT. It is now watching all of the keys that I type in on my computer. So I started up a copy of Notepad. I typed in the words username colon professormesser and password colon not arealpassword.
You’ll notice the keylogger has captured all of this information inside the keylogger application. I started up Notepad. I typed in the word username colon professormesser. I typed in password colon not. I did a space and then a backspace and then arealpassword. On the screen, of course, it looks like all one word. And then you can see I hit the Escape key. And all of this information was saved so that the attacker could examine it later.
Ransomware is one of the newer forms of malware. And it’s a type of malware that has become prevalent in recent years. Ransomware operates by encrypting all of your private documents, and then it holds those documents for ransom. Once you pay the attacker, they provide you with a decryption key, and you can gain access to your documents again. So anything that’s on your system that you might have saved is now encrypted and unavailable to you. If you don’t have backups, then you have no way to recover any of this important data.
Interestingly enough, with ransomware, the underlying operating system is usually not encrypted because the attacker needs that operating system to run. They’ll usually have a message pop up on your screen that tells you exactly what you need to do if you want to gain access to those files again. The attacker knows that they’re using very strong encryption methods to be able to protect your files, and there’s no way to regain access again unless you can somehow get your hands on that decryption key.
Many viruses are written just like any other application that would run in your operating system. So once your OS starts up, the virus begins as soon as the OS is available. But some attackers have found a way to embed their malware within the bootloader of the operating system. So before the OS can even start, the malware has already begun its process.
This is another case where Secure Boot can really help prevent this type of malware from executing. Secure Boot will check all of our boot loaders as we’re starting up our system. And if anything has changed with the signature of that bootloader, Secure Boot will not boot your system and will prevent that malware from running.
Many types of cryptocurrency require some type of work to be done to be able to process additional cryptocurrency. For that reason, many cryptominers will have multiple systems using the maximum CPU so that they can run through these very complex mathematical medical equations in the hopes of finding some additional cryptocurrency. The more computers you can have doing all of this cryptomining, the more money you could possibly make.
And malware writers know that they could write malware to embed onto other people’s computers, just so they can run through these mathematical equations in the hopes of making more cryptocurrency. Some of these malicious cryptominers will run as JavaScript on a web page. So you visit a website, and you’ll suddenly notice that your CPU has spiked. Or you might accidentally click a link in an email or download software as part of a Trojan horse. And now there is a malicious cryptominer that’s running as an executable on your system.
Many of these cryptominers will often use most of your CPU resources, so it’s usually very obvious that something is not quite right in your operating system. Fortunately, most antivirus and anti-malware software will look for this type of software and remove it from your system.
A somewhat disturbing type of malware is referred to as stalkerware. This is software that’s designed to watch where you’re going and what you’re doing, and it’s designed to report that information back to the attacker. This is software that you can download from the internet from many different companies, and usually it’s software that is installed by someone that you happen to know. You can think of this as the worst kind of spyware. It’s watching everything you do and everywhere you’re going.
This might collect screenshots from your computer, identify where you happen to be based on your GPS coordinates. It might be listening in to your microphone or recording information from your camera. This is also a very common technique that countries will use to surveil other countries and try to find out what may be happening over the border. But the software is not invisible, and if you’re using the right anti-malware or antivirus software, you can probably identify stalkerware running on your system and be able to remove it completely.
In a lot of the descriptions of malware so far, we’ve described the process of downloading a file into our computer, clicking on that file, and running that program. But there is a type of malware that does not store any files on your system. If you were to perform a file scan with your antivirus scanner, you would not be able to find any instances of a fileless virus. That’s because this virus is never installing itself as part of the operating system or saving itself into a particular directory.
It’s always going to run in the memory of your system. And once that virus is done, it simply disappears completely. Like most viruses, of course, this fileless virus starts with the user beginning the process. This might be the user clicking on something on a website or inside of an email message. That click begins to take advantage of a vulnerability associated with a piece of software.
In previous years, we would see this with Flash, but you could also find this with Java or simply with a Windows vulnerability. Once the fileless virus has found that vulnerability in Windows, it can now tell PowerShell to start up and begin running a particular script. Notice so far that we still have not stored any files to the file system, and everything we’ve done so far is running in the memory of your computer.
From there, the program inside of your RAM can do anything that a normal virus would do. It may be exfiltrating data from your system, encrypting and damaging files that you might have, deleting information from your storage drive, or anything else that a virus might want to do.
And before it finishes, it might add an auto-start to your registry so that the next time you start your system, it goes through the entire process again. This is another good reason why you might want to have anti-malware software that runs in real time with your operating system, so that it can stop a fileless virus from executing inside of your RAM.
Some viruses are not so much malicious as they are annoying. We refer to this type of virus as a Potentially Unwanted Program or a PUP. This type of virus is still identified by antivirus and anti-malware, so if you’re running the latest signatures, then you’ll be able to identify and eradicate any of these PUPs. Very often, this unwanted software is something that you’re installing along with something else. But once it gets on your system and begins running, it can now perform a number of different functions.
For example, it’s very common for this PUP-type software to be associated with adware or some type of process for making money by showing you ads on the screen. If you’ve ever seen someone’s browser that has a very large toolbar with a lot of icons on it, and you can’t seem to get rid of it, it’s probably a potentially unwanted program. I’ve also seen PUPs that disguise themselves as backup utilities, but what it really is doing is showing you advertising.
And if you’re doing some type of search inside of your browser and you hit Enter, but instead of going to Google, you end up at some other very unusual search engine page. Then you’re probably running a potentially unwanted program that has hijacked your browser and presenting you with a different set of results.
Here’s an actual scan that I ran on one of my computers that identified a large number of potentially unwanted programs. Some of these are named multiple times in this list, applications such as Conduit or Spigot. But you can see that one is called MyPCBackup, which pretends to be a backup program, but, in reality, doesn’t do backup very well and is very good at showing you advertising. To prevent these potentially unwanted programs from running on your computer, make sure that you always keep your antivirus and your anti-malware signatures up to date.