2.3: Detect, Remove, and Prevent Malware

Malware

Malicious software that damages, disrupts, or steals data. Spreads via email attachments, malicious links, infected downloads, removable media, and drive-by downloads.

Prevented with updates, antivirus, and safe practices.

Types include viruses, worms, trojans, spyware, ransomware, rootkits, and keyloggers.

Trojan horse

Malicious software that disguises itself as legitimate software or file to trick users into installing it; often used to create backdoors, steal data, or download additional malware.

Rootkit

Malicious software designed to hide its presence and maintain privileged access to a system; can manipulate system processes and files to avoid detection.

Virus

Malicious software that attaches itself to files or programs and spreads when those files are shared or executed; can delete files, corrupt data, or slow system performance.

Boot sector virus

Malware that infects the boot sector of a storage device (HDD, SSD, or removable media), executing when the system starts; can prevent the OS from loading or spread to other drives. Blocked by UEFI Secure Boot.

Spyware

Malicious software that secretly monitors user activity, such as keystrokes, browsing habits, or personal data for ads, identity theft, or fraud.

Keylogger

Malicious software or hardware that records keystrokes to capture passwords, credit card numbers, or other sensitive information; bypasses encryption

Ransomware

Malicious software that encrypts files or locks a system and demands payment (ransom) for their release

Cryptominer

Malware that uses a victim’s computer resources (CPU/GPU) to mine cryptocurrency without consent

Windows Recovery Environment

A Windows troubleshooting and repair environment that can repair startup issues, restore system images, reset the PC, access command prompt, or perform system restore; typically accessed via bootable media or automatically when Windows fails to start.

Anti-virus/anti-malware tools

Software that detects, prevents, and removes malicious software (malware) such as viruses, worms, trojans, ransomware, spyware, and adware; uses signature-based, heuristic, and behavior-based detection methods.

Common examples include Windows Defender, Malwarebytes, Norton, and McAfee.

Software firewall

A program that monitors and controls incoming and outgoing network traffic on a device based on security rules; can block unauthorized access, filter traffic, and protect against malware and network attacks.

Examples include Windows Firewall and third-party firewalls like ZoneAlarm.

Anti-phishing training

Education programs that teach users to recognize and avoid phishing attacks, such as suspicious emails, links, or attachments; aims to reduce the risk of credential theft, malware infections, and social engineering attacks.

OS reinstallation

Wiping and reinstalling the operating system to fully remove malware; involves backing up data, formatting drives, and restoring only clean files. The only guaranteed way