Viruses and Malicious Programs

Explain in your own words what a malicious program is and the difference between a virus, which needs to infect other files to spread, and a worm, which copies itself and travels across the network independently.

Match each situation with the most likely type of malicious software and justify your choice: (a) after installing a game downloaded from an unknown website, the computer continuously shows pop-up adverts; (b) a file named 'trip photos' asked to install a 'viewer' and, since then, saved passwords have disappeared; (c) an application secretly records everything typed and sends it off the device.

The diagram classifies the most common malicious software, as shown in the figure.

One of the types is covered by a question mark: it is a program that appears useful but, when installed, secretly carries out harmful actions. State which type is missing and describe with an example how it comes to be installed on a device.

Explain in your own words what spyware is, what kind of information it looks for on a device, and why it tries to remain unnoticed for as long as possible.

Draw up a comparative table for a virus, a worm, and a Trojan with these three rows: needs to infect other files, spreads on its own over the network, tricks the user into installing it. Complete the nine cells and write a conclusion stating which type requires the most user cooperation.

You find a lost USB flash drive in the school playground with a label saying 'party photos'. Explain the risk of plugging it into your computer to see what it contains and what would be the correct thing to do with it.

When downloading a pirated game, the installer asks you to disable your antivirus 'so that it works properly'. Explain why this request is almost certainly a trap and why the program wants you to turn off your defences.

Explain two common ways a malicious program can enter a computer or cell phone (for example, email attachments or apps from unofficial stores) and describe a specific precaution to block each of them.

A classmate claims: 'my phone can't have a virus because it's not a computer'. Explain why this statement is false and give an example of a real threat that affects cell phones.

A teacher receives an email with the file 'invoice.doc' and, upon opening it, the program asks to 'enable macros to view content'. Explain what macros are, why they can be dangerous in a document received from an unknown sender, and what the teacher should do.

Explain what a security vulnerability is, how malicious programs exploit it to gain entry without needing to trick anyone, and why devices with old, unupdated systems are their main target.

A friend's computer has become a 'zombie': it is part of a network of infected devices attacking websites without them noticing. Explain how this could have happened, what signs they might observe on their device, and what they should do to clean it.

After installing a cheat for a game downloaded from a forum, all the photos on the cell phone appear encrypted, and a ransom is demanded. Explain what type of attack has occurred, why game cheats and currency generators are such effective bait, and what prior measure would have prevented the disaster.

A municipality suffers an attack: all its documents appear encrypted and a note demands a payment to recover them. Explain what type of attack this is, why paying does not guarantee getting the files back, and what two prior measures would have greatly reduced the damage.

A classmate claims: "I don't care if my computer gets infected: I don't use online banking, I have no money in my accounts, and nobody cares about my files, so no cybercriminal gains anything by attacking me."

Refute their stance by demonstrating three real and lucrative uses that attackers make of an infected computer belonging to a user with no apparent valuable data (using technical concepts such as zombie networks or botnets for denial-of-service attacks, hidden cryptocurrency mining, and identity spoofing to spread phishing). Justify why keeping an unprotected computer is a risk for the rest of the digital community.

Comment on this statement: 'if my computer had a malicious program, I would notice right away'. Explain why many malicious programs try to remain unnoticed and name three subtle signs that could give them away.

A family laptop has been running very slowly since a free browser 'toolbar' was installed, and advert tabs open automatically. Explain what might have happened, what type of threat it appears to be, and what steps you would take to clean the device.

While installing a free audio editing program, a user clicked "Next" repeatedly without reviewing the intermediate panels. After restarting, the browser's home page has changed, pop-up ads appear, and the antivirus detects several programs classified as PUPs (Potentially Unwanted Programs).

1. a) Distinguish the concept of a PUP from that of a traditional virus or worm: why are many of these applications not formally considered illegal despite being harmful?
2. b) Explain how developers use "dark patterns" in the visual design of installers to induce users to authorize the installation of unwanted software.
3. c) Describe the technical procedure that should be followed to completely uninstall these programs and restore browsers without formatting the computer.

While browsing a file download website, a student gets a pop-up window in their browser imitating the Windows Defender interface, featuring a warning siren and the message: "CRITICAL ALERT! Your computer has 37 trojan viruses that are destroying drive C:. Download this cleaner within 60 seconds to avoid losing your data".

1. a) Demonstrate, based on browser process isolation (sandbox) and operating system architecture, why it is technically impossible for a web page to know the actual state of the files on the hard drive.
2. b) Identify which deception category this message falls into (scareware) and predict what will happen to the system if the user clicks and opens the file offered to "disinfect" it.
3. c) Explain what two correct actions the user should take to close that warning without interacting with the malicious window's buttons.

Rank these application download sources from lowest to highest risk and justify your order: a 'free' software portal full of adverts, the official system store, the official developer website.

In the school library computers, continuous malware infections originating from students' USB flash drives are being detected. The management team proposes two extreme alternatives: A) "Block the USB ports with glue so no one can use them" or B) "Trust in individual responsibility and not apply any restrictions."

Design an intermediate and viable technical proposal that solves the problem without preventing students from using the computers to study. To do this, define three technical operating system configuration measures (account and privilege management, system freezing, or device scanning) and two organizational rules of use, justifying the exact risk that each one neutralizes.

A free application promises to 'protect and speed up' a cell phone, but during installation asks for permission to read contacts, messages, and location. Analyze whether granting these permissions is reasonable, what hidden risk the application might pose, and what checks you would make before installing any security tool.

A company employee receives an email that pretends to be an urgent invoice from a supplier inside a compressed file. Upon decompressing it and opening the document (whose real name is "factura_abril.pdf.exe"), a trojan runs in the background. Hours later, cybercriminals transfer funds from the company's online banking.

1. a) Explain which two combined tricks (one of social engineering and another of file extension settings in the operating system) deceived the user at the first link of the chain.
2. b) Select two moments in the attack chain where it would have been most effective to stop the threat and determine which specific technological measure (for example, executable execution policies, outbound firewalls, or two-factor authentication 2FA) would have neutralized it in each case.

In the Technology classroom, several computers have been infected because students download software for projects (video editors, 3D printer drivers) from untrusted links. Design a three-phase technical protocol ("Before downloading", "During installation", and "After the first run") that any student must mandatorily apply.

For each phase, describe an accurate technical check (such as verifying the source and digital signature or hash checksum, detecting bundled installers, or reviewing active system processes) and explain what type of malware or risk it prevents.