This chapter covers the classification of malware types critical to the CompTIA A+ Core 2 (220-1102) exam: viruses, worms, ransomware, and rootkits. Understanding these categories is essential for exam success, as malware identification and removal questions appear in approximately 15-20% of the Security domain (Objective 2.1). We will dissect each type's infection mechanism, propagation method, payload behavior, and removal strategy, providing the precise technical details you need to answer exam questions correctly.
Jump to a section
Imagine your home computer as a secure apartment building. A virus is like a guest who arrives hidden inside a gift box (the host file) and, once inside, starts redecorating your apartment without permission, often breaking things. A worm is a burglar who picks the lock on your front door (a network vulnerability) and then uses your phone to call all your neighbors, giving them the same lock-picking instructions so they get robbed too. Ransomware is a kidnapper who locks you in your own bathroom and demands you pay a ransom via a money order slipped under the door, threatening to destroy your valuables if you don't comply. A rootkit is a secret passage built by a previous tenant, hidden behind the walls, that allows a thief to enter and exit without ever using the front door or being seen by security cameras; even if you change the locks, the passage remains undetected. Each type of malware uses a different method to gain access, spread, and hide, but all require a host (your computer) and a payload (the malicious action). Understanding the specific mechanism of each is critical for detection and removal, just as knowing whether an intruder came through a window, a door, or a secret tunnel determines how you secure your home.
1. Viruses: The Parasitic Infectors
A virus is a type of malware that replicates by attaching its code to a legitimate program or file (the host). It requires human action to spread, such as opening an infected email attachment or running an infected program. The key characteristic: a virus cannot run independently; it depends on the host file to execute.
Infection Mechanism: - File Infector Virus: Appends or prepends its code to executable files (.exe, .com, .dll). When the user runs the legitimate program, the virus code executes first, then transfers control to the original program. Common technique: changing the entry point in the PE (Portable Executable) header to point to the virus code. - Macro Virus: Written in a macro language (e.g., VBA for Microsoft Office). Embedded in documents (.doc, .xls) and executes when the document is opened. Classic example: the Melissa virus (1999), which used Outlook to email itself to contacts. - Boot Sector Virus: Infects the Master Boot Record (MBR) or Volume Boot Record (VBR). Loads before the operating system, making it extremely persistent. Example: Stoned virus (1987).
Propagation: Viruses rely on user activity: sharing infected files via email, USB drives, or network shares. They do not autonomously scan for targets.
Payload: May corrupt or delete files, steal data, display messages, or simply replicate. Some viruses are polymorphic, changing their code signature each time they infect a new host to evade signature-based antivirus.
Detection & Removal: - Signature-based antivirus scans for known virus signatures (byte sequences). - Heuristic analysis detects suspicious behavior (e.g., modifying other executables). - Removal requires booting from a clean medium (e.g., rescue disk) and scanning the system offline because the virus may be active in memory.
2. Worms: Self-Propagating Network Threats
A worm is a standalone malware program that replicates itself to spread to other computers, typically over a network. Unlike a virus, a worm does not need a host file or user action to propagate. It exploits vulnerabilities in network services or operating systems.
Infection Mechanism: - Network Scanning: The worm scans IP addresses for open ports (e.g., TCP port 445 for SMB). - Exploitation: Sends a crafted packet to trigger a buffer overflow or other vulnerability. Example: Conficker (2008) exploited the MS08-067 vulnerability in Windows Server service. - Payload Delivery: Once a system is compromised, the worm downloads and executes its payload (often from a remote server). - Replication: The worm copies itself to the new host and begins scanning from there.
Propagation: Worms can spread rapidly because they automate the entire process. The Morris worm (1988) infected about 10% of the Internet at the time. Modern worms use multiple propagation vectors: email (as an attachment or link), instant messaging, peer-to-peer networks, and removable drives (e.g., Stuxnet spread via USB).
Payload: Worms often carry a secondary payload such as a backdoor, keylogger, or DDoS agent. Some worms are designed to deliver ransomware.
Detection & Removal: - Network-based intrusion detection systems (IDS) can detect worm scanning patterns. - Signature-based antivirus can detect known worm code. - Removal often involves disconnecting the infected system from the network to prevent further spread, then running an antivirus scan. Patching the exploited vulnerability is critical.
3. Ransomware: Data Hostage
Ransomware is malware that encrypts the victim's files or locks the system, then demands a ransom (usually in cryptocurrency) for the decryption key. It is a major threat because of its direct financial impact.
Infection Mechanism:
- Delivery: Typically via phishing emails (with malicious attachments or links), drive-by downloads from compromised websites, or exploit kits (e.g., Angler, Nuclear).
- Execution: Upon execution, ransomware often contacts a command-and-control (C2) server to receive an encryption key. Modern ransomware generates the key locally using cryptographic functions (e.g., RSA-2048 or AES-256) to avoid network detection.
- Encryption: The malware enumerates local drives, network shares, and removable media. It encrypts files with specific extensions (documents, images, databases). It may also delete Volume Shadow Copies (VSS) using vssadmin.exe to prevent recovery.
- Ransom Note: A text file or image is placed in each directory with instructions on how to pay the ransom (typically Bitcoin) and receive the decryption key.
Examples: - CryptoLocker (2013): Used a C2 server to generate keys. Estimated $3 million in ransoms. - WannaCry (2017): Spread using the EternalBlue exploit (MS17-010). Encrypted files and demanded $300 in Bitcoin. Infected over 200,000 computers in 150 countries. - Ryuk: Targeted large organizations with ransom demands up to millions of dollars.
Detection & Removal: - Prevention: User education, email filtering, application whitelisting, and regular patching. - Detection: Behavioral analysis (e.g., mass file rename events, VSS deletion). - Removal: Disconnect the system immediately. Do NOT pay the ransom. Restore from clean backups. Use decryption tools if available (e.g., No More Ransom project). Reimage the system if necessary.
4. Rootkits: Deep Cover Malware
A rootkit is a collection of tools that provides persistent, undetectable access to a system, often at the kernel level. The term comes from Unix: a "rootkit" is a kit for maintaining root (administrator) access. Rootkits hide their presence and the presence of other malware by intercepting system calls and filtering output.
Types of Rootkits: - User-Mode Rootkit: Runs in user space (ring 3). Intercepts API calls (e.g., by hooking the IAT in Windows). Example: HackerDefender. - Kernel-Mode Rootkit: Loads as a device driver or kernel module (ring 0). Has full access to the OS. Can modify kernel objects (DKOM – Direct Kernel Object Manipulation). Example: FU rootkit. - Bootkit: Replaces the Master Boot Record (MBR) or boot loader, loading before the OS. Example: TDL-4 (Alureon). - Firmware Rootkit: Hides in hardware firmware (e.g., BIOS, UEFI, hard drive firmware). Extremely difficult to detect. Example: LoJax (used by Sednit group).
Mechanism:
- Hooking: Rootkits hook system calls (e.g., NtQueryDirectoryFile in Windows) to hide files, processes, registry keys, and network connections.
- Direct Kernel Object Manipulation (DKOM): Modifies kernel data structures (e.g., the EPROCESS list) to remove a process from the scheduler's view.
- Filter Drivers: Load a driver that sits between the OS and hardware, intercepting I/O requests.
Detection & Removal: - Detection: - Signature-based: Antivirus can detect known rootkit drivers. - Behavioral: Anomalies in system call timing (e.g., longer than expected). - Cross-view: Compare the view from the OS (which may be filtered) with a low-level scan (e.g., reading the disk directly). Tools like GMER, RootkitRevealer. - Removal: - Booting from a clean medium: Use a rescue disk or bootable antivirus (e.g., Kaspersky Rescue Disk). - System restore: If the rootkit is deep (e.g., bootkit), reimage the system from known good media. - Firmware rootkit: May require reflashing the BIOS/UEFI or replacing hardware.
5. Key Differences and Exam Focus
| Feature | Virus | Worm | Ransomware | Rootkit | |---------|-------|------|------------|--------| | Requires host file | Yes | No | Usually | No | | Self-propagating | No | Yes | Sometimes (e.g., WannaCry) | No | | Primary goal | Replication/damage | Propagation | Extortion | Stealth/control | | Persistence | Low | Low | Low (but can be persistent) | Very high | | Detection difficulty | Moderate | Low | Low-Moderate | Very high |
Exam Tip: The exam often asks you to classify a scenario. Remember: if the malware needs a host file, it's a virus. If it spreads automatically over a network, it's a worm. If it encrypts files for ransom, it's ransomware. If it hides itself and other malware, it's a rootkit. Be aware that real-world malware often combines characteristics (e.g., a worm that delivers ransomware).
6. Common Commands and Tools
View running processes: tasklist (Windows), ps (Linux)
View network connections: netstat -ano (Windows), netstat -tulpn (Linux)
Check startup programs: msconfig (Windows), systemctl list-unit-files (Linux)
Scan for malware: mrt (Windows Malicious Software Removal Tool), clamscan (ClamAV)
Check for rootkits: chkrootkit (Linux), GMER (Windows)
Remove ransomware: Restore from backup; use vssadmin list shadows to check for Volume Shadow Copies.
Identify Malware Type by Behavior
Observe the malware's behavior to classify it. If it attaches to an executable and spreads only when that file is run, it's a virus. If it spreads automatically across the network without user intervention, it's a worm. If it encrypts files and demands a ransom, it's ransomware. If it hides processes and files from the OS, it's a rootkit. Document all symptoms: unusual network traffic, file changes, system slowdowns, pop-ups, etc. This step is critical for choosing the correct removal method.
Isolate the Infected System
Disconnect the system from the network immediately to prevent further spread, especially if it's a worm or ransomware. For a virus or rootkit, isolation is still important to prevent data exfiltration. Remove the network cable or disable the wireless adapter. If the malware is a worm, also disconnect any shared drives. Do not power off the system if you suspect a rootkit, as some rootkits may lose persistence data on shutdown.
Boot from a Clean Medium
To ensure the malware is not active during scanning, boot the system from a trusted external medium (e.g., a bootable USB with antivirus software, a recovery disc, or a live Linux distribution). This bypasses the infected OS and prevents rootkits from hiding their presence. For bootkits, booting from a clean medium is essential because the MBR may be infected. Use tools like Kaspersky Rescue Disk or Microsoft Defender Offline.
Scan and Remove Malware
Run a full system scan using up-to-date antivirus software. For viruses and worms, signature-based detection is usually effective. For ransomware, use a dedicated decryption tool if available (e.g., from No More Ransom project). For rootkits, use specialized rootkit removal tools (e.g., GMER, Malwarebytes Anti-Rootkit). If the rootkit is firmware-based, reflash the BIOS/UEFI. After removal, verify that no remnants remain by scanning again.
Restore from Backup and Patch
After malware removal, restore any corrupted or encrypted files from a clean backup. For ransomware, do not pay the ransom; restore from backup. Apply all security patches to the OS and applications to close the vulnerabilities that allowed the infection. Change all passwords that may have been compromised. Implement preventive measures: enable email filtering, use application whitelisting, and educate users about phishing.
Enterprise Deployment Scenarios
Scenario 1: WannaCry Ransomware Outbreak in a Hospital
In May 2017, the WannaCry ransomware worm spread globally, crippling the UK's National Health Service (NHS). The worm exploited the EternalBlue vulnerability (MS17-010) in SMBv1. Many NHS systems were unpatched, running outdated Windows versions (e.g., Windows 7). The ransomware encrypted patient records and demanded $300 in Bitcoin per machine. The attack forced hospitals to cancel appointments and revert to paper records. The root cause: failure to apply the March 2017 security patch. Mitigation involved disconnecting infected machines, restoring from backups (where available), and patching all systems. This scenario underscores the importance of patch management and network segmentation.
Scenario 2: Rootkit in a Financial Institution
A bank's trading floor experiences unexplained data exfiltration. Security analysts find that antivirus reports show no malware, but network traffic reveals periodic connections to an unknown IP. Investigation using a bootable scanner (e.g., Kaspersky Rescue Disk) reveals a kernel-mode rootkit (e.g., similar to the "Rovnix" bootkit) hiding in the MBR. The rootkit intercepts disk reads to hide its files and modifies network stack calls to hide connections. Removal requires booting from a clean medium, wiping the MBR, and reinstalling the OS from trusted media. Post-incident, the bank implements UEFI Secure Boot to prevent bootkits and uses hardware security modules (HSMs) for sensitive data.
Scenario 3: Virus Infection via Email in a Law Firm
A law firm receives an email with a malicious macro-enabled Word document. An employee opens it, enabling macros, which triggers a file infector virus. The virus infects all .exe files on the local machine and any shared network drives. It does not spread automatically but relies on users running infected executables. The IT team notices that many applications crash or behave oddly. Using endpoint detection and response (EDR) tools, they identify the virus by its file modification patterns. They isolate the workstation, scan with updated antivirus, and restore infected files from backup. They then implement macro security policies (e.g., block macros from the internet) and conduct user awareness training.
Common Misconfigurations and Pitfalls: - Failing to patch: The number one cause of worm outbreaks. The exam emphasizes that patching is critical. - Over-reliance on antivirus alone: Rootkits and polymorphic viruses can evade signature detection. Use layered defenses. - Not verifying backups: Ransomware recovery depends on clean, tested backups. Many organizations discover their backups are also encrypted or corrupted. - Powering off a rootkit-infected system: Some rootkits (e.g., TDL-4) store data in the MBR; powering off may cause data loss. Always boot from a clean medium first.
Exam Focus for 220-1102
Objective Code: 2.1 (Given a scenario, apply the appropriate malware removal techniques). The exam expects you to classify malware based on symptoms and choose the correct removal method.
Common Wrong Answers and Why: 1. Confusing virus and worm: Candidates often say a virus spreads automatically. Remember: worms self-propagate; viruses need a host and user action. If the scenario says "spreads without user interaction," it's a worm. 2. Calling ransomware a virus: Ransomware is a distinct category. The exam may describe a scenario where files are encrypted and a ransom note appears. The correct answer is ransomware, not virus or worm. 3. Thinking a rootkit is just a hidden file: Rootkits operate at the kernel level. A hidden file alone does not indicate a rootkit; it could be a regular hidden file. Rootkits hide processes, network connections, and registry keys. 4. Selecting "reinstall OS" as first step for all malware: The exam emphasizes that you should first attempt to remove malware using antivirus tools. Reimaging is a last resort, but for bootkits or deep rootkits, it may be necessary.
Specific Numbers and Terms:
- WannaCry: Exploited MS17-010 (EternalBlue). Demanded $300 in Bitcoin.
- CryptoLocker: Used RSA-2048 encryption.
- Conficker: Exploited MS08-067.
- Polymorphic virus: Changes its signature each infection.
- Bootkit: Infects MBR or boot loader.
- DKOM: Direct Kernel Object Manipulation.
- VSS: Volume Shadow Copy; ransomware often deletes it via vssadmin.exe delete shadows /all /quiet.
Edge Cases: - Ransomware that spreads like a worm: WannaCry is both ransomware and a worm. The exam may ask: "What type of malware is WannaCry?" The correct answer is ransomware (primary purpose), but it also has worm characteristics. If the question asks for the primary classification, choose ransomware. - Rootkit that is not persistent: Some user-mode rootkits are memory-only and disappear on reboot. The exam may ask about persistence. - Macro virus vs. file infector: Both are viruses, but macro viruses infect documents, not executables.
How to Eliminate Wrong Answers: - If the malware requires user action to spread, eliminate worm. - If it encrypts files for ransom, eliminate virus and worm (unless it's a combo, but primary is ransomware). - If it hides itself and other malware, eliminate all but rootkit. - If it spreads via email attachment and infects other documents, it's a macro virus.
Exam Tip: Always read the scenario carefully. The exam often gives symptoms like "files are being renamed to .encrypted" or "network traffic to unknown IPs." Match the symptom to the malware type.
Viruses require a host file and user action to spread; worms self-propagate over networks.
Ransomware encrypts files or locks the system, demanding payment for decryption.
Rootkits hide malware and provide persistent, undetectable access, often at kernel level.
WannaCry is both ransomware and a worm; it exploited MS17-010 (EternalBlue).
Boot from a clean medium to detect and remove rootkits and bootkits.
Do not pay ransomware ransom; restore from clean backups.
Polymorphic viruses change their signature to evade signature-based detection.
Volume Shadow Copies (VSS) are often deleted by ransomware; use `vssadmin` to check.
User-mode rootkits hook API calls; kernel-mode rootkits modify kernel objects (DKOM).
Patching vulnerabilities (e.g., MS08-067, MS17-010) is critical to prevent worm outbreaks.
These come up on the exam all the time. Here's how to tell them apart.
Virus
Requires a host file to attach to
Spreads only when user executes infected file
Does not self-propagate over networks
Typically slower to spread
Examples: Melissa, ILOVEYOU
Worm
Standalone executable, no host needed
Spreads automatically over networks
Exploits vulnerabilities to self-propagate
Can spread rapidly (minutes to hours)
Examples: Conficker, WannaCry (also ransomware)
Mistake
All malware that spreads is a virus.
Correct
Only malware that requires a host file and user action to spread is a virus. Worms spread automatically without user intervention. Ransomware can also spread via worm-like mechanisms (e.g., WannaCry).
Mistake
Ransomware always encrypts files.
Correct
Some ransomware locks the screen (locker ransomware) without encrypting files. However, most modern ransomware (crypto-ransomware) encrypts files. The exam typically refers to crypto-ransomware.
Mistake
Antivirus software can always detect rootkits.
Correct
Rootkits are designed to hide from the OS, so antivirus running within the infected OS may not detect them. Booting from a clean medium is often required for detection.
Mistake
Paying the ransom guarantees file recovery.
Correct
There is no guarantee. Attackers may take the money and not provide the decryption key. Even if they do, the files may be corrupted. Restoring from backup is the preferred method.
Mistake
A worm is just a type of virus.
Correct
Worms are a distinct category. Unlike viruses, they do not need a host file and are self-propagating. Both are types of malware, but they are classified separately.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A virus requires a host file and user action to spread, while a worm is a standalone program that spreads automatically over networks by exploiting vulnerabilities. For example, a virus attaches to an .exe file and spreads when the file is shared; a worm scans for vulnerable systems and copies itself without user intervention.
Ransomware typically uses strong encryption algorithms like AES-256 to encrypt files. It may generate a key locally or contact a C2 server. After encryption, it deletes Volume Shadow Copies to prevent recovery. The victim is presented with a ransom note demanding payment (usually Bitcoin) for the decryption key.
A rootkit is malware that provides privileged access while hiding its presence. It hooks system calls (e.g., NtQueryDirectoryFile) to filter out its files/processes from being listed. Kernel-mode rootkits modify kernel data structures (DKOM). Detection often requires booting from a clean medium.
Yes. WannaCry is a prime example: it combines ransomware payload with worm-like propagation using the EternalBlue exploit. It scans for vulnerable SMB services and infects them automatically. So ransomware can be both a ransomware and a worm.
Boot from a trusted medium (e.g., rescue disk) and run a specialized rootkit removal tool (e.g., GMER, Malwarebytes Anti-Rootkit). If the rootkit is a bootkit, you may need to repair the MBR or reinstall the OS. Firmware rootkits may require reflashing the BIOS/UEFI.
Polymorphic viruses change their code signature each time they infect a new host, making detection by signature-based antivirus difficult. They use mutation engines that generate different decryption routines. Heuristic analysis is often needed to detect them.
No. Paying does not guarantee file recovery and encourages further attacks. Restore from clean backups if available. Some decryption tools are available from the No More Ransom project. Always report the incident to law enforcement.
You've just covered Malware Classification: Virus, Worm, Ransomware, Rootkit — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?