Malware Removal and Protection

Week of 2026-12-22 · Download .docx

Objectives

Identify malware types and their defining characteristics
Apply the CompTIA malware removal process in the correct sequence
Explain heuristic vs. signature-based detection methods

Key terms

Virus: Malware attaching to a host file; activates when the infected file is executed.
Worm: Self-replicating malware spreading across networks without a host file.
Trojan: Malware disguised as legitimate software to trick users into installing it.
Rootkit: Modifies OS to hide itself and other malware — extremely difficult to detect.
Ransomware: Encrypts files and demands payment; combines Trojan delivery with extortion.
Spyware: Silently collects and transmits user data without consent.
RAT: Remote Access Trojan — gives attacker full remote control of victim's computer.
Adware: Displays unwanted advertisements; often bundled with free software.
Signature-based: Detects malware by comparing file hashes or patterns to known-malware database.
Heuristic: Detects malware by analyzing behavior patterns regardless of known signatures.
Sandboxing: Running suspicious code in isolated environment to observe behavior without risk.
System Restore: Must be disabled before malware removal to prevent re-infection from restore points.

The concept

MALWARE CATEGORIES

Each malware type has a defining characteristic. A virus must attach to a host file and activates when executed. A worm self-replicates across networks without user action. A Trojan masquerades as legitimate software. A rootkit modifies the OS to conceal itself and other malware — making it the hardest to detect. Ransomware encrypts files and demands payment. Spyware silently collects and exfiltrates data. A RAT (Remote Access Trojan) opens a backdoor for full attacker control. Adware displays unwanted ads. Many infections combine types: a Trojan may install a rootkit that hides a RAT.

MALWARE REMOVAL PROCESS (CompTIA A+ Sequence)

The CompTIA exam expects a specific removal sequence: 1) Identify the symptoms and type; 2) Quarantine — disconnect from the network to prevent spread; 3) Disable System Restore — restore points can preserve malware; 4) Remediate — run updated antimalware, remove detected threats; 5) Schedule scans — run additional full scans to confirm clean; 6) Educate the user — explain how the infection occurred; 7) Document the incident.

DETECTION METHODS

Signature-based detection compares file hashes and byte patterns against a database of known malware. It is highly accurate for known threats but cannot detect new malware without database updates. Heuristic detection analyzes the behavior of running code — if a program attempts to modify startup entries, inject into other processes, or rapidly encrypt files, it triggers an alert regardless of whether a signature exists. Sandboxing runs suspicious files in a fully isolated virtual environment to observe behavior safely before execution on the real system.

Worked examples

Example 1: A user reports their browser homepage changed without permission and pop-up ads appear constantly. Symptoms point to adware/browser hijacker. Removal process: disconnect from network; check installed programs in Settings → Apps for unknown software installed recently; run Malwarebytes (updated); remove detected items; reset browser settings; re-enable network; educate user about not accepting 'bundled software' during installations.

Example 2: A ransomware note appears demanding Bitcoin payment. Response: immediately disconnect from the network (prevent spread to shared drives); do NOT pay (no guarantee of decryption). Restore from last clean backup (verify backup is clean). If no backup, evaluate file recovery tools or check for available decryptors on nomoreransom.org. Rebuild from clean OS image if necessary.

Common mistakes

Running an antivirus scan before disconnecting from the network — the malware may still be receiving commands or spreading.
Forgetting to disable System Restore before removal — malware can survive in restore points and re-infect.
Assuming heuristic detection is always better than signature-based — both are complementary; heuristic has more false positives.
Confusing a Trojan (entry method) with a rootkit (concealment method) — both can be present simultaneously.
Paying ransomware — payment has no guaranteed outcome and funds criminal operations.

Self-check

Try each question before reading the answer. Answers at the bottom of this page.

1. A virus requires:

A host file to attach to and spread when executed
No host — spreads across networks
Physical media only
User admin credentials

2. A rootkit is dangerous primarily because:

It modifies the OS to hide itself
It replicates rapidly
It encrypts files
It consumes all CPU

3. Step 1 of the malware removal process is:

Identify and quarantine — isolate from network
Delete all temp files
Run antivirus scan
Reinstall Windows

4. Heuristic malware detection works by:

Analyzing behavior patterns rather than known signatures
Comparing file hashes to a database
Monitoring network traffic only
Scanning specific file names

5. Before removing malware you should:

Disable System Restore to prevent restore-point re-infection
Enable System Restore
Run Windows Update
Delete the user profile

Self-check answers

1. A — Viruses attach to host files and activate when the infected file is executed.
2. A — Rootkits modify the OS kernel to conceal their presence from security tools.
3. A — Isolation prevents spread, C2 communication, and data exfiltration before cleanup.
4. A — Heuristic analysis detects threats by behavior — enabling detection of new, unknown malware.
5. A — Restore points can contain malware; disabling System Restore clears all restore points before cleanup.

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top