Viruses and malicious programs

Explain in your own words what a malicious program is and the difference between a virus, which needs to infect other files to spread, and a worm, which copies itself and travels across the network independently.

The diagram classifies the most common malicious software, as shown in the figure.

One of the types is covered by a question mark: it is a program that appears useful but, when installed, secretly carries out harmful actions. State which type is missing and describe with an example how it comes to be installed on a device.

Draw up a comparative table for a virus, a worm, and a Trojan with these three rows: needs to infect other files, spreads on its own over the network, tricks the user into installing it. Complete the nine cells and write a conclusion stating which type requires the most user cooperation.

You find a lost USB flash drive in the school playground with a label saying 'party photos'. Explain the risk of plugging it into your computer to see what it contains and what would be the correct thing to do with it.

When downloading a pirated game, the installer asks you to disable your antivirus 'so that it works properly'. Explain why this request is almost certainly a trap and why the program wants you to turn off your defences.

Explain two common ways a malicious program can enter a computer or mobile phone (for example, email attachments or apps from unofficial stores) and describe a specific precaution to block each of them.

A classmate claims: 'my phone can't have a virus because it's not a computer'. Explain why this statement is false and give an example of a real threat that affects mobile phones.

A teacher receives an email with the file 'invoice.doc' and, upon opening it, the program asks to 'enable macros to view content'. Explain what macros are, why they can be dangerous in a document received from an unknown sender, and what the teacher should do.

Explain what a security vulnerability is, how malicious programs exploit it to gain entry without needing to trick anyone, and why devices with old, unupdated systems are their main target.

A friend's computer has become a 'zombie': it is part of a network of infected devices attacking websites without them noticing. Explain how this could have happened, what signs they might observe on their device, and what they should do to clean it.

After installing a cheat for a game downloaded from a forum, all the photos on the mobile phone appear encrypted, and a ransom is demanded. Explain what type of attack has occurred, why game cheats and currency generators are such effective bait, and what prior measure would have prevented the disaster.

A secondary school's server suffers a ransomware attack: all student data and academic records are encrypted, and 10.000 € in cryptocurrencies is demanded to recover them. The school had a daily backup on an external hard drive that was permanently connected via USB to the server, which has also been completely encrypted.

1. a) Explain the technical cause why the school's backup system failed against this attack.
2. b) Justify two reasons why the school management must not pay the ransom under any circumstances.
3. c) Design a backup strategy based on the 3-2-1 rule that guarantees that, in the event of an identical attack in the future, the data can be restored without paying.

Comment on this statement: 'if my computer had a malicious program, I would notice right away'. Explain why many malicious programs try to remain unnoticed and name three subtle signs that could give them away.

A classmate claims: "I don't care if my computer gets infected: I don't use online banking, I have no money in my accounts, and nobody cares about my files, so no cybercriminal gains anything by attacking me."

Refute their stance by demonstrating three real and lucrative uses that attackers make of an infected computer belonging to a user with no apparent valuable data (using technical concepts such as zombie networks or botnets for denial-of-service attacks, hidden cryptocurrency mining, and identity spoofing to spread phishing). Justify why keeping an unprotected computer is a risk for the rest of the digital community.

While browsing a file download website, a student gets a pop-up window in their browser imitating the Windows Defender interface, featuring a warning siren and the message: "CRITICAL ALERT! Your computer has 37 trojan viruses that are destroying drive C:. Download this cleaner within 60 seconds to avoid losing your data".

1. a) Demonstrate, based on browser process isolation (sandbox) and operating system architecture, why it is technically impossible for a web page to know the actual state of the files on the hard drive.
2. b) Identify which deception category this message falls into (scareware) and predict what will happen to the system if the user clicks and opens the file offered to "disinfect" it.
3. c) Explain what two correct actions the user should take to close that warning without interacting with the malicious window's buttons.

Rank these application download sources from lowest to highest risk and justify your order: a 'free' software portal full of adverts, the official system store, the official developer website.

In the school library computers, continuous malware infections originating from students' USB flash drives are being detected. The management team proposes two extreme alternatives: A) "Block the USB ports with glue so no one can use them" or B) "Trust in individual responsibility and not apply any restrictions."

Design an intermediate and viable technical proposal that solves the problem without preventing students from using the computers to study. To do this, define three technical operating system configuration measures (account and privilege management, system freezing, or device scanning) and two organizational rules of use, justifying the exact risk that each one neutralizes.

In the Technology classroom, several computers have been infected because students download software for projects (video editors, 3D printer drivers) from untrusted links. Design a three-phase technical protocol ("Before downloading", "During installation", and "After the first run") that any student must mandatorily apply.

For each phase, describe an accurate technical check (such as verifying the source and digital signature or hash checksum, detecting bundled installers, or reviewing active system processes) and explain what type of malware or risk it prevents.