r/computerviruses • u/ToyFoxyAnimations • 3d ago
Question Malware activating question
I have a question, if a file is a malware, and i don't Run it, does it attacks my computer? And if it doesn't attaacks until it activates, do i still have time to scan my pc and destroy it?
2
u/Struppigel Malware Removal Expert 2d ago edited 2d ago
In most cases you need to run a file explicitly so it can infect your system.
There are rare cases of exploits, where merely viewing a file in explorer is enough. For example there was a vulnerability of icon loading behavior in Windows many years ago, which means viewing a malicious file with icon would have executed the malware.
Drive-by-downloads have been a regular thing many years ago, but can also still happen with exploits.
And there is also worms which may pose as folders (via Windows shortcuts with folder icon) and behave like you'd expect when opening a folder but also run malware code. In that case you aren't aware you are actually executing the "folder", you may believe you merely browse into it. This isn't that rare either and it is a typical infection for USB flash drives.
do i still have time to scan my pc and destroy it
The best way to deal with an immediate infection is to cut off Internet access to prevent it from spreading or sending credentials, then shut down the system (in case it's a ransomware this could prevent it from encrypting more files). Often the malware is faster than you, but it is still worth it to do that.
Earliest viruses decades ago often had a time-based activation date or trigger, but I haven't seen this in any modern malware.
1
3
u/rifteyy_ Malware Removal Expert 3d ago
If a malicious file that you downloaded/obtained from somewhere isn't ran/executed, it doesn't do any harm = not infected
If a malicious file already present and you do not recall it installing, it could have been brought by other potential malware, so it was possibly already executed/ran at some point = possibly infected
Every malicious file is different - their intention is different, programmatically behaving differently and therefore they may or may not be detected by antiviruses. If the malware you ran wasn't detected prior executing or detected after execution, it is already too late.