CompTIA Security+ (SY0-601): Malware
This section explains various types of computer viruses and malicious software, such as boot sector, macro, polymorphic, and metamorphic viruses, along with grayware and rootkits. It also covers techniques like DLL injection, driver manipulation, and the use of shims, which attackers employ to gain stealthy and persistent access to systems.
Types of Viruses
Boot sector
Stored in the first sector of a hard drive and are loaded into memory upon boot up
Macro
Virus embedded into a document and is executed when the document is opened by the user
Program
Program viruses infect an executable or application
Multipartite
Virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer
Encrypted
Stealth
Armored (Have a layer of protection to confuse an analyst)
Hoax
Polymorphic
Advanced version of an encrypted virus that changes itself every time it is executed by altering the decryption module to avoid detection
Metamorphic
Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus)
Key Terms
Types of Viruses
Boot sector
Stored in the first sector of a hard drive and are loaded into memory upon ...
Grayware
Software that isn’t benign nor malicious and tends to behave improperly without serious consequences
Rootkit
Software designed to gain administrative level control over a system without detection
...
Rootkits: DLL Injection
Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries tha...
Rootkits: Driver Manipulation
An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level
Shim
A piece of software code that is placed between two components to intercept calls and redirect them
Related Flashcard Decks
Study Tips
- Press F to enter focus mode for distraction-free studying
- Review cards regularly to improve retention
- Try to recall the answer before flipping the card
- Share this deck with friends to study together
| Term | Definition |
|---|---|
Types of Viruses | Boot sector Stored in the first sector of a hard drive and are loaded into memory upon boot up Macro Virus embedded into a document and is executed when the document is opened by the user Program Program viruses infect an executable or application Multipartite Virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer Encrypted Stealth Armored (Have a layer of protection to confuse an analyst) Hoax Polymorphic Advanced version of an encrypted virus that changes itself every time it is executed by altering the decryption module to avoid detection Metamorphic Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus) |
Grayware | Software that isn’t benign nor malicious and tends to behave improperly without serious consequences |
Rootkit | Software designed to gain administrative level control over a system without detection DLL injection is commonly used by rootkits to maintain their persistent control Rootkits are activated before booting the operating system and are difficult to detect |
Rootkits: DLL Injection | Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime Occurs by the use of a shim |
Rootkits: Driver Manipulation | An attack that relies on compromising the kernel-mode device drivers that operate at a privileged or system level Occurs by the use of a shim |
Shim | A piece of software code that is placed between two components to intercept calls and redirect them Malware authors can use shims to get around security features (like UAC) or to elevate privileges Windows compatibility mode is an example of a shim |
Fileless Virus | Malware only running in memory No artifacts left on the endpoint that can be detected with traditional file type-based tools |
Refactoring | The process of rewriting the internal processing of the code, without changing its external behavior. |