🎯

Aim / Objective

To understand types of malware (viruses, trojans, ransomware, rootkits); install, configure, and update antivirus software (Windows Defender / 3rd-party Antivirus); configure real-time protection, exclusions, and quarantine; execute Quick, Full, and Offline System Scans; and safely verify detection using the standardized EICAR test file.

🧰

Hardware & Software Requirements

Hardware Components

✓ PC running Windows 10/11 or Ubuntu Linux
✓ Internet connection for updating antivirus virus definition virus signature database
✓ Secondary flash drive for testing portable USB scan

Software, OS & Tools

✓ Windows Security / Microsoft Defender Antivirus (built-in)
✓ Third-Party Antivirus (e.g., Malwarebytes, Avast Free, or ClamAV for Linux)
✓ EICAR (European Institute for Computer Antivirus Research) standard test string

👨‍🏫

Teacher's Lab Delivery Guide

Essential briefing notes, pedagogy, and setup tips for lab instructors

Faculty Exclusive

⏱ 5-Minute Pre-Lab Lecture Briefing:

Clarify that modern malware is rarely written by rogue teenagers for fun; it is a multi-billion dollar cybercrime industry (ransomware, infostealers, cryptominers). Explain the 3 detection pillars: Signature-based (known MD5/SHA256 hashes), Heuristic analysis (looking for suspicious code patterns), and Behavioral / AI sandboxing (monitoring real-time actions like encrypting multiple files).

📝 Key Concepts to Write on Whiteboard:

Malware taxonomy: Virus (self-replicating inside host files), Worm (self-propagating over networks), Trojan (disguised as legitimate utility), Ransomware (encrypts files for ransom), Spyware/Keylogger, Rootkit (hides in kernel/bootloader)
Antivirus architecture: Real-Time On-Access Scanning vs Scheduled On-Demand Scanning
Virus Definitions (Signature database) updates
Quarantine vs Disinfect vs Delete
Microsoft Defender Offline Scan (reboots into Windows Recovery Environment to remove persistent rootkits without Windows running)
Safe testing with the standard non-malicious EICAR test string

⚙ Pre-Class Lab Setup:

Ensure students do NOT download real live malware samples! Distribute the safe standardized 68-character EICAR test string to demonstrate real-time neutralization.

⚠ Common Student Pitfalls & Fixes:

Students believe running multiple real-time antivirus products simultaneously provides double protection. Explain that two real-time scanners fight over file hooks, causing severe CPU lockups and false positives.

🛡 Lab Safety & ESD Precautions:

Demonstrate how to isolate infected machines from the local network by unplugging Ethernet cables or disabling Wi-Fi to stop lateral worm spread.

📜

Step-by-Step Practical Procedure

1

Open Windows Security & Verify Protection Modules

Press `Win + I` -> Privacy & Security -> Windows Security -> "Virus & threat protection". Confirm that "Real-time protection", "Cloud-delivered protection", and "Automatic sample submission" are toggled ON.

Command / Action:

Windows Security -> Virus & threat protection -> Manage settings

💡

Teacher Note / Pro-Tip: Cloud protection checks unknown file hashes against Microsoft's cloud threat intelligence in real time.

2

Update Antivirus Signatures / Security Intelligence

Under "Virus & threat protection updates", click "Check for updates". Verify that the Security Intelligence Version reflects today's date and latest definition build.

Command / Action:

PowerShell (Admin): Update-MpSignature

💡

Teacher Note / Pro-Tip: Antivirus software without updated definitions is ineffective against newly emerging zero-day threats.

3

Perform Quick Scan vs Full System Scan

Click "Scan options". Select "Full scan" (checks all files and running programs on the hard disk) and click "Scan now". Monitor the scan progress bar, files scanned counter, and elapsed time.

Command / Action:

PowerShell: Start-MpScan -ScanType FullScan

💡

Teacher Note / Pro-Tip: A Quick Scan only inspects memory, registry, and known common startup directories (takes 1-3 minutes).

4

Safely Test Antivirus Detection with EICAR Standard String

Open Notepad. Paste the standard 68-character EICAR test string. Save the file as `eicar.com`. Immediately observe Windows Defender trigger a threat notification and move the file into Quarantine without allowing execution.

Command / Action:

EICAR string: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

💡

Teacher Note / Pro-Tip: The EICAR file is a harmless ASCII string recognized by all certified antivirus products worldwide to test installation validity.

5

Inspect Threat Protection History & Quarantine Actions

In Windows Security, click "Protection history". Click on the detected EICAR alert to view the details (Threat Name: `Virus:DOS/EICAR_Test_File`, Affected items, Action: Quarantined). Demonstrate how to remove or restore items.

Command / Action:

Path: Windows Security -> Protection History -> Quarantined Threats

💡

Teacher Note / Pro-Tip: Quarantine isolates the file inside an encrypted vault where it cannot execute or spread.

⚡

Interactive Hands-On Lab Simulator

Practice and test concepts virtually before or after performing on physical lab equipment

Live Interactive

Loading simulator...

📊

Observations & Student Lab Record

Students are required to record the following measured parameters, hardware specifications, and output status into their physical lab journals:

Scan Type	Scan Scope / Locations Checked	Scan Duration	System Resource Impact	Best Use Case
Quick Scan	RAM, Kernel processes, Startup run keys, `%TEMP%`, `%APPDATA%`	1 - 3 Minutes	Low (10-20% CPU)	Daily routine check
Full System Scan	Every sector, folder, compressed archive (`.zip`/`.rar`), external drives	30 - 90 Minutes	High (50-80% CPU & Disk I/O)	Weekly deep audit / after suspected infection
Custom Scan	Specific user-selected folder, USB drive, or downloaded file	Seconds to Minutes	Low to Moderate	Scanning newly plugged USB flash drives
Microsoft Defender Offline	Scans before Windows OS kernel loads from Windows Recovery Environment (WinRE)	15 Minutes (System Reboots)	Dedicated (Exclusive PC control)	Removing evasive rootkits and kernel-level malware

💡

Conclusions & Learning Outcome

Antivirus operations, real-time protection, and scan workflows were demonstrated. Threat definitions were updated to the latest security intelligence version. A full system scan was initiated and evaluated. The validity of real-time interception and quarantine was safely verified using the international EICAR standard test file.

❓

Oral Exam & Viva Questions with Answers

Essential questions asked by external examiners and lab evaluators (Accordion UI)

Answer:

Signature-based detection compares a file's cryptographic hash or byte sequence against a known database of cataloged malware signatures (very fast, zero false positives, but cannot detect new zero-day viruses). Heuristic detection analyzes the file's code structure and instructions for suspicious behaviors (like self-modification or trying to hook keyboard interrupts) to identify previously unseen variants.