CompTIA A+ 1102 Malware

Malware

malicious software

Trojan Horse

- software that pretends to be something else

- anti-virus may catch it, but the better trojan horses are built to avoid and to disable anti-virus software

Rootkits

- modifies core system files

- embeds itself deep inside the OS, often in the kernel

- can be invisible to the OS and to anti-virus software

Finding and Removing Rootkits

- look for the unusual

- use a remover specific to the rootkit

- Secure Boot using a UEFI BIOS

Virus

- malware that can replicate itself

- requires the user to execute a program

Boot Sector Virus

- virus that is part of the boot sector

- runs every time that you start your computer

- preventable with UEFI Secure Boot

Spyware

- malware that spies on you

- may trick you into installing it

- may work in conjunction with a keylogger

Keylogger

saves your input and logs other data, such as your clipboard data

Ransomware

encrypts your data, but will decrypt it if you pay the attackers a ransom

Cryptominers

- require extensive CPU processing ability

- malware that forces cryptomining to occur on your computer

Windows Recovery Environment

- basic command line that can be used without having to fully start Windows

- provides complete control, but requires an extensive knowledge base to properly and safely use

Starting the Windows Recovery Environment

- hold shift while clicking the restart button

- or, boot from installation media

- or, restart into advanced startup

- recovery > troubleshoot > advanced options > command prompt

Software Firewall

- monitors the local computer

- prevents malware communication

- for example, Microsoft Defender Firewall

- built into Windows

What is the only way to guarantee malware removal?

OS reinstallation

Malware Removal Process (steps)

1. verify malware symptoms

2. quarantine infected

3. disable system restore

4. remediate : update anti-virus

5. remediate : scan and remove

6. schedule scans and run updates

7. enable system protection

8. educate the end user

2. Quarantine Infected (Malware Removal Process)

- disconnect from the network

- isolate all removable media

- control the spread

4. Remediate : Update Anti-Virus (Malware Removal Process)

- the malware may prevent the update process

- copy updated signatures onto your computer

5. Remediate : Scan and Remove (Malware Removal Process)

use tools or run in Safe Mode or in WinPE