How to protect your PCs from viruses? Types of Malwares, Malware Detection and security
By: Ajmal Nasumudeen
Tags: Computer Virus, Windows, Cybersecurity, Antivirus

How to protect your PCs from viruses? Types of Malwares, Malware Detection and security Ajmal Nasumudeen Apr 6·7 min read

Computer Virus is designed to spread from computer to computer and has the ability to replicate itself. Before deep diving into prevention. We should have a brief understanding of what malwares are. Virus is a type of malware..

Malware

Malware is an executable or binary code that is malicious in nature. Simply we can say it’s nothing but just a software, pieces of malicious code that take advantage of system vulnerabilities and exploit them

Example activities

Access camera without user’s permission. Keyboard logging without user’s knowledge

Why Malware used by attackers?

Spying: Monitoring user activity using RAT,

Data Exfiltration: Stealing highly important information

Data Encryption & Destruction:

Ransomware like

- Ryuk, 2019 and 2020

- SamSam, 2018

- WannaCry, 2017

Virus is a type of malware, It’s not just one type there are many

Virus Worms Trojans Ransomware Adware

Virus

Vital Information Resource Under Seize abbr for Virus, Its a file that harms your computer. Computer viruses are created for a cause, they are created to hack some system files. The information stored by the user in memory which is vital such as User photos, contacts, IDs, passwords.

How Virus spreads/infects systems?

Viruses are spread through many ways. Some of the common ways of spreading are through downloads, email attachments, removable hardware’s and so on. Piracy software is also a source for viruses, Visiting infected websites another source. Most viruses are very dangerous in nature and are designed for establishing an access on target system from hacker which makes it more dangerous.

Worm

These type malware won’t do any harm to your system. Unlike virus these files create unnecessary files, replicate files, which make the user irritated that takes up unnecessary hard disk space usage

Trojan

Trojan horse

Trojan horse is a malware which misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.(source Wiki)

Simply we can say Trojan is a file that looks and functions as normal (image, pdf, song..etc). Whenever a user clicks (execute) this file, the program opens whether a video or a picture, at the same time a key logger or a backdoor executes in the background without any graphical interface. The user thinks it’s a video or an image or other binary files. A backdoor is a program that executes and the system which will allow hackers to gain full control over the target system. This technique bypasses normal authentication and evades most of the antivirus. Evasion depends on how the code is written, packaging, publishing and what the code is supposed to do.

Ransomware

Ransomware is a type of malware that threatens to publish the victim’s data or continuously block access to it unless a ransom is paid. Ransomware encrypt filesystem or entire system from kernel level. And ask for money to decrypt without destruction. Ransomware attacks are typically carried out using a Trojan looks like a legitimate file that the user is tricked into downloading or opening. These programs use high end encryption which is hard to crack in normal cases. In most cases ransom asks for bitcoin for releasing the user system. So it is very difficult to trace the attacker.

Adware

Adware or advertising supported software display pop-up unwanted advertisements on the screen. Most of the time, this software that looks normal, but continuously delivers ads to the screen, while user clicks the ads the adware developers get earned. It’s a money making technique for developers.

How to find out if your system is infected or not?

Check your system having any

Strange behavior like processing services without the user’s knowledge. High usage of system memory (RAM) Slow booting Blue screens of death that make the computer unusable. Unusual error messages, warnings, alert popups Unexpected Data-loss, file replication.

How do antivirus's detect viruses — malwares?

So, it’s a good idea to understand how antivirus works, so users can understand how to prevent them, Let’s start.

Antivirus required continuous internet connection to update their signature database. Signature database contains newly found information about all types of malwares. New kinds of Malwares are created every minute so that AV constantly updates their signature for more detection. If AV found anything suspicious, put those files in quarantine or block their operation. Old detection methods looks at sequences of bytes, or instructions, to detect malicious binaries. AV Vendors add heuristics rules to AV updates, heuristics is a thumb rules

sonar heuristics

Modern AV uses sandboxing for scanning file’s behavior. Sand boxing a virtualized system environment that mimics end-user operating environments. Sandbox are isolated from host operating system. Sandboxes are used to safely execute suspicious code without risking harm to the host device or network.

Also Modern AV uses ML to study malware behavior, thus it’s not just dependent on a signature database, but also on anomaly detection method. This technique is capable of detecting ZERO DAY(previously unseen) attacks. Compared to typical methods ML with anomaly detection methods are more secure. In reality 100% security is not guaranteed. No vendor can provide the fullest security.

Prevention, Detection & Security

An up-to-date antivirus solution helps protect yourself and remove malware from your computer

There is also a chance of malware evasion, Detect and evasion is a cat and mouse game.

So here some steps to take if you have any suspicions that your system got infected.

1) Check the file properties.

2) Does it look like what it seems to be?

3) Use an online sandbox service and scan the file.

Open Control Panel > Administrative Tools > Resource Monitor

> Network tab

You can see all the open ports and which IP its pointing to it

Check whether there is any suspicious IP in Remote Address, check the IP using reverse dns lookup. This Lookup tell you which organization this IP belongs to, If the IP not pointing to website or not from Legitimate Entity, block those IP .

Below mentioned is a infected system’s resource monitor example

infected windows resource monitor, the IP targeting to someone else not a legitimate Organization

Have any suspicious about a file or program scan using VirusTotal. Files up to 650 MB can be uploaded to the website. Check task manager for service which consume more resources in process-tab trace them back and assure the service is legitimate or not, Also check for duplication in process. Check and analyze background processes if there is anything that user not initiated end this process. If any application is a source of virus, uninstall the whole program. I recommend use any uninstaller software. I personally use IObit uninstaller, this method of uninstalling let you know the registry belongings of those application and remove it permanently. Default uninstaller not remove whole application they left some files (Leftovers)

In the most extreme cases or having no solutions yet known, do OS Re installation. Before re installation, it is advisable to properly backup your most important personal and professional data.

Good advice to protect yourself

● Keep your PC and software up to date.

● Use only licensed software/games.

If you are planning to use any pirated software’s/games avoid connecting to the internet forever. using cracked versions contain Trojan executable. Don’t go free no vendors will not give anything for free

● Regularly back up your data to avoid unexpected data loss.

● Choose a suitable antivirus solution.

For personal use I suggest paid Kaspersky, Norton, K7

● Avoid opening mail from untrusted domain, unknown sender.

Mail with hyperlinks, hyperlink may contain phishing attack, email attachment (especially zipped file),

Preventing malwares from Browser

● Use adware blocker eg:- uBlock orgin, ADP extensions

● Use HTTPS Everywhere extensions for encrypted connection.

● Scan URLs from untrusted domain, unknown sender

Whenever you receive a random message with a clickable link, do check the address of the link. It is made by scammers to look similar to a valid URL, but if you take a close look at it, you will find junk or unwanted characters in it. In any case, whatever the URL, you should avoid clicking on any link

Any suspicious about URL scan using online shared AV databases like VirusTotal https://www.virustotal.com/gui/