3 Malware Prevention and Response

What malware does

Malware is software or code intended to harm a device, disrupt its operation, or gain unauthorized access to data. It can affect confidentiality, integrity, or availability: for example, by stealing passwords, changing files, or making them inaccessible.

Common malware types

Malware includes several types, and categories can overlap. One attack, for example, may use a Trojan horse to install spyware.

• A Virus attaches to a file or program and spreads when that host is run or shared.

• A Worm spreads between systems, often across a network, without needing a person to copy an infected file.

• A Trojan horse disguises itself as a legitimate program or file to trick someone into installing or running it.

• Ransomware locks or encrypts files and may demand payment; some attackers also threaten to publish stolen data.

• Spyware and keyloggers secretly collect information, such as browsing activity or keystrokes.

• A Rootkit hides malicious activity and may help an attacker maintain privileged access.

How malware reaches devices

Malware can arrive through deceptive messages, untrusted software, compromised websites, removable media, vulnerabilities, or exposed access. Common routes include:

• Opening an unexpected email attachment or clicking a deceptive link.

• Installing fake, pirated, or untrusted software or browser extensions.

• Visiting a compromised website or clicking a misleading download or advertisement.

• Connecting an infected USB drive or other removable media.

• Exploiting an unpatched operating system, application, or device.

• Misusing an exposed remote-access service or stolen account credentials.

A message that appears to come from a familiar person or company can still be deceptive. When in doubt, verify it through a separate, trusted contact method rather than using the message’s link or phone number.

Recognizing possible infection

Possible warning signs include unusual slowdowns, crashes, repeated errors, unexpected pop-ups or browser redirects, unfamiliar toolbars or applications, security tools that stop working, and messages sent from your accounts that you did not write. Ransomware may display a ransom note or make files inaccessible.

These signs do not prove that malware is present. Treat them as reasons to stop and investigate; security tools and qualified support can help confirm what happened.

Preventing infection

No single control prevents every infection. Layered protections reduce the chance of infection and limit damage if one control fails.

1. Update promptly. Keep the operating system, applications, browsers, and security software updated; enable automatic updates when practical.

2. Use endpoint protection. Keep reputable security software enabled and updated, and configure it to scan files and removable drives.

3. Apply Least privilege. Do everyday work with a standard account rather than an administrator account. Grant applications only the permissions they need.

4. Be cautious with links and downloads. Avoid unexpected attachments, unfamiliar download sites, and software promoted by suspicious pop-ups. Get software from trusted sources.

5. Protect accounts. Use unique passwords and Multifactor authentication (MFA), especially for email and administrator accounts.

6. Back up important data. Keep backups that malware cannot readily change or delete, and periodically check that files can be restored.

Responding to a suspected infection

If malware is suspected, take steps to limit exposure and avoid actions that could worsen the situation.

1. Stop sensitive activity. Do not enter passwords or use the device for banking or shopping.

2. Contain the device. Disconnect it from Wi-Fi or the wired network. Isolation can help prevent malware from spreading. If the device belongs to an organization, promptly notify its IT or security team and follow its incident procedures.

3. Avoid risky actions. Do not click a pop-up’s phone number, install software it recommends, or reconnect the device just to test it. If the incident may involve an organization or important evidence, get guidance before deleting files or resetting the device.

4. Scan and recover safely. Use trusted security software or a qualified support provider to assess and clean the device. A serious compromise may require rebuilding it from a known-good source. Restore files only from a backup believed to be clean.

5. Protect accounts from a clean device. Change passwords that may have been exposed and enable MFA. If work accounts or sensitive information may be involved, follow organizational reporting and recovery steps.

For suspected ransomware, isolate the affected device and contact the appropriate IT or security team immediately. Do not decide whether to pay based only on the ransom message; involve qualified responders and relevant authorities.