Malware Removal and Protection

Lesson 15 · Malware Removal and Protection · Download .docx

Objectives

Identify malware types and their defining characteristics
Apply the CompTIA malware removal process in the correct sequence
Explain heuristic vs. signature-based detection methods

Key terms

Virus: Malware attaching to a host file; activates when the infected file is executed.
Worm: Self-replicating malware spreading across networks without a host file.
Trojan: Malware disguised as legitimate software to trick users into installing it.
Rootkit: Modifies OS to hide itself and other malware — extremely difficult to detect.
Ransomware: Encrypts files and demands payment; combines Trojan delivery with extortion.
Spyware: Silently collects and transmits user data without consent.
RAT: Remote Access Trojan — gives attacker full remote control of victim's computer.
Adware: Displays unwanted advertisements; often bundled with free software.
Signature-based: Detects malware by comparing file hashes or patterns to known-malware database.
Heuristic: Detects malware by analyzing behavior patterns regardless of known signatures.
Sandboxing: Running suspicious code in isolated environment to observe behavior without risk.
System Restore: Must be disabled before malware removal to prevent re-infection from restore points.

The concept

MALWARE CATEGORIES

Each malware type has a defining characteristic. A virus must attach to a host file and activates when executed. A worm self-replicates across networks without user action. A Trojan masquerades as legitimate software. A rootkit modifies the OS to conceal itself and other malware — making it the hardest to detect. Ransomware encrypts files and demands payment. Spyware silently collects and exfiltrates data. A RAT (Remote Access Trojan) opens a backdoor for full attacker control. Adware displays unwanted ads. Many infections combine types: a Trojan may install a rootkit that hides a RAT.

MALWARE REMOVAL PROCESS (CompTIA A+ Sequence)

The CompTIA exam expects a specific removal sequence: 1) Identify the symptoms and type; 2) Quarantine — disconnect from the network to prevent spread; 3) Disable System Restore — restore points can preserve malware; 4) Remediate — run updated antimalware, remove detected threats; 5) Schedule scans — run additional full scans to confirm clean; 6) Educate the user — explain how the infection occurred; 7) Document the incident.

DETECTION METHODS

Signature-based detection compares file hashes and byte patterns against a database of known malware. It is highly accurate for known threats but cannot detect new malware without database updates. Heuristic detection analyzes the behavior of running code — if a program attempts to modify startup entries, inject into other processes, or rapidly encrypt files, it triggers an alert regardless of whether a signature exists. Sandboxing runs suspicious files in a fully isolated virtual environment to observe behavior safely before execution on the real system.

Worked examples

Example 1: A user reports their browser homepage changed without permission and pop-up ads appear constantly. Symptoms point to adware/browser hijacker. Removal process: disconnect from network; check installed programs in Settings → Apps for unknown software installed recently; run Malwarebytes (updated); remove detected items; reset browser settings; re-enable network; educate user about not accepting 'bundled software' during installations.

Example 2: A ransomware note appears demanding Bitcoin payment. Response: immediately disconnect from the network (prevent spread to shared drives); do NOT pay (no guarantee of decryption). Restore from last clean backup (verify backup is clean). If no backup, evaluate file recovery tools or check for available decryptors on nomoreransom.org. Rebuild from clean OS image if necessary.

Common mistakes

Running an antivirus scan before disconnecting from the network — the malware may still be receiving commands or spreading.
Forgetting to disable System Restore before removal — malware can survive in restore points and re-infect.
Assuming heuristic detection is always better than signature-based — both are complementary; heuristic has more false positives.
Confusing a Trojan (entry method) with a rootkit (concealment method) — both can be present simultaneously.
Paying ransomware — payment has no guaranteed outcome and funds criminal operations.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. A virus requires:

2. A rootkit is dangerous primarily because:

3. Step 1 of the malware removal process is:

4. Heuristic malware detection works by:

5. Before removing malware you should:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top