Domain 2 of 4 · Chapter 2 of 2

Malware Defense

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing CompTIA A+ Core 2 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Spot the infection: malware families and symptoms
  • The ten-step malware removal procedure
  • Remediation tools and the escalation ladder
  • Anti-malware, EDR, and staying up to date
  • Prevention: stop malware before the cleanup
  • How the exam frames malware questions

Malware families by how they spread and what they do

Malware typeHow it spreads or hidesSignature symptom or goalRemoval note
VirusAttaches to a host file; runs when that file runsCorrupted or odd files, spreads on shared filesAntivirus cleans it once definitions catch it
WormSelf-propagates over the network, no host or user actionTraffic spikes and fast spread across machinesIsolate first, then patch the exploited service
TrojanHides inside software the user wants and installsOdd behavior after installing 'free' softwareRemove the carrier app and scan for its payload
RansomwarePhishing or exploit delivery, then encrypts filesLocked or renamed files and a ransom noteRestore from clean backup; reimage the host
SpywareBundled or drive-by download, runs quietlyAds, tracking, browser changes, slowdownsA full anti-malware scan removes most
KeyloggerA Trojan or rootkit component (or hardware)Silent capture of keystrokes and credentialsScan to remove, then reset the exposed passwords
RootkitInstalls at or below the OS to hide itselfAV blinded, hidden processes, nothing obviousOffline or bootable scan; often a reimage
Boot sectorInfects the boot record, loads before the OSWill not boot, or reinfects after a cleanRecovery environment repair; often a reimage
CryptominerA Trojan or a malicious site scriptHigh CPU or GPU, hot and slow, high power drawRemove the miner; check browser extensions
FilelessRuns in memory via PowerShell or WMI, no fileNo file on disk to scan, abuses trusted toolsBehavior-based tools; reboot clears in-memory only
PUPRides along with a wanted installer (bundling)Toolbars, adware, a changed search engineUninstall, then a PUP-aware scan; read installers

Decision tree

First, always: verify it is malware, then quarantine (off the network) before cleaningFiles encrypted, ransom note?Does Windows boot and run?Normal full scan clears it?Rootkit signs (AV blinded)?Reboot to Safe Mode and rescanRansomwareisolate, restore from backupCleaned: re-enableSystem Restore, newpoint, then educateRecovery environment;reimage if neededOffline scan outsideWindows; reimage ifit persistsYesNoNoYesYesNoYesNo
Cheat sheet

Cheat sheet

  • A virus needs a host and a user; a worm spreads itself
  • A Trojan is malware disguised as software the user wants
  • Ransomware is answered by clean backups, not payment
  • A rootkit hides at or below the OS, so scan from outside Windows
  • A boot-sector infection loads before the OS and survives an OS reinstall
  • Fileless malware lives in memory via trusted tools, so file scans miss it
  • A cryptominer's tell is high CPU or GPU on an otherwise idle machine
  • A PUP rides along in a wanted installer's default options
  • Memorize the malware-removal order; it is the most-tested fact here
  • Quarantine (disconnect) an infected machine before you clean it
  • Disable System Restore before cleaning, re-enable it after
  • Update anti-malware definitions before you scan, inside the remediate step
  • Use Safe Mode when malware reloads on every normal boot
  • Microsoft Defender Offline scans from outside Windows to beat rootkits
  • MSRT is a monthly targeted sweep, not real-time antivirus
  • Windows Security is the app; Microsoft Defender Antivirus is the engine
  • Signatures catch known malware; behavior detection catches the new
  • Real-time protection blocks on access; a scan sweeps what is already there
  • EDR watches behavior across the fleet; antivirus checks files on one device
  • Malware inherits the privileges of the account that ran it
  • Prevent malware with prompt patching, trusted sources, and email caution
  • Tested, offline backups are what turn a ransomware hit into a restore
  • Default-deny plus approved-app rules is application allow-listing
  • A cleared or empty Security log is an attacker covering their tracks
  • Quarantining a file moves it to isolation so it cannot run
  • A Quick scan checks memory, the registry, and startup folders, not the whole drive
  • A process misspelling a system name or running outside System32 is malware
  • Protection history is where Defender logs actions and holds quarantined files
  • Protection history keeps entries only about two weeks
  • Malware that relaunches at logon hides in the registry Run keys
  • A no-publisher startup entry running from a Temp or AppData folder is malware

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. CompTIA A+ Core 2 (220-1202) Certification Exam Objectives (V15, Document Version 3.0)
  2. Microsoft Defender Antivirus in Windows overview
  3. Microsoft Defender Offline scan in Windows
  4. Windows Recovery Environment (Windows RE) technical reference
  5. Remove specific prevalent malware with Windows Malicious Software Removal Tool (KB890830)
  6. Microsoft Defender Antivirus security intelligence and product updates
  7. Overview of endpoint detection and response (EDR) capabilities