7.07 Detect, remove, and prevent malware using the appropriate tools and methods

Introduction 

Think of your computer as a well-organized house. Just like how you lock your doors, check your windows, and make sure only trusted people come inside, your computer needs similar protection from unwanted guests like malware. In this lesson, you'll learn how to identify, remove, and prevent these digital intruders. By applying these skills, you’ll be able to not only keep your system secure but also help others protect their devices from threats. It’s all about knowing how to keep everything safe, just like you would for your home! 

What is Malware? 

Malicious Software—malware are harmful programs that cause damage to a computer or network. There are different types of malware, each with specific ways of spreading and affecting systems. These ways are called vectors. A vector is the method malware uses to enter or infect a computer, and sometimes it can spread across a network. 

Types of Malware Vectors 

Here are some common types of malware based on how they infect and spread: 

1. Viruses 

  • How They Work: Viruses hide in executable files, like programs or scripts that run on a computer. 

  • File Extensions: They can be found in files with extensions such as .EXE, .MSI, .DLL, .COM, .SCR, and .JAR. 

  • Execution: Once the program is run, the virus code also runs and can do whatever the infected program is allowed to do. 

  • Modern Viruses: While older viruses would spread quickly, newer ones focus on secretly controlling the infected system. 

2. Boot Sector Viruses 

  • How They Work: These viruses infect the boot sector or partition table of a disk drive. 

  • Infection: When the disk is used on a computer, the virus hijacks the boot process to load itself into memory. 

  • Effect: They take over during the computer's startup process, which can be very difficult to fix. 

4. Worms 

  • How They Work: Worms spread by copying themselves between processes in system memory instead of attaching to files. 

  • Network Spread: They can also exploit vulnerabilities in network software, allowing them to spread between computers on a network without user action. 

3. Trojans 

  • How They Work: Trojans are disguised as legitimate software. The malware is hidden inside an installer that looks like a normal program. 

  • Infection: When the user installs the program, the malware installs as well and gains the same permissions as the program. 

  • Persistence: Trojans often make sure they run every time the computer starts, which helps them stay active on the system. 

5. Fileless Malware 

  • How They Work: Fileless malware doesn’t rely on files stored on a hard drive. Instead, it uses the computer’s scripting features, like PowerShell in Windows or JavaScript in PDFs. 

  • Hard to Detect: Since it doesn’t involve traditional executable files, it can be harder to spot because it looks like normal scripting activity. 

Malware Payloads 

Malware payloads refer to the actions a piece of malware performs once it is installed on a system. These actions go beyond simply spreading the malware and help to achieve the attacker’s goals. 

1. Backdoors 

  • What It Is: A backdoor, or remote access Trojan (RAT), allows attackers to secretly control the infected system. 

  • What It Does: 

    • Lets the attacker access files, upload or steal data, and install more malware. 

    • Can give the attacker access to the rest of the network or make the computer part of a botnet for activities like launching Distributed Denial of Service (DDoS) attacks or spamming. 

  • How It Works: 

    • The malware opens a connection to a command and control (C2 or C&C) host, often hidden in normal traffic like HTTPS or DNS to avoid detection

2. Spyware and Keyloggers 

  • Spyware: 

    • What It Is: Malware that secretly collects data from the system. 

    • What It Does: 

      • Can track your browsing, change search settings, open websites, and even use your microphone or webcam without your knowledge. 

      • Redirects you to fake websites by modifying DNS settings. 

  • Keylogger: 

    • What It Is: A type of spyware that records keystrokes. 

    • What It Does: Attempts to steal sensitive information like passwords or credit card numbers by recording everything typed on the keyboard. 

    • Forms: Keyloggers can be software or hardware devices connected between the keyboard and computer. 

3. Rootkits 

  • What It Is: A rootkit is malware that hides deep within the system, often at the administrator or system level, making it very hard to detect or remove. 

  • What It Does: 

    • Runs with high privileges, allowing it to take full control of the system. 

    • Conceals itself from typical monitoring tools (like Task Manager or netstat) and may erase traces of its activities from system logs. 

  • How It Works: 

    • Installed with high-level access, sometimes exploiting vulnerabilities to bypass user authorization. 

    • Often disguises itself by using names similar to legitimate files (e.g., "run32dll" vs. "run32d11"). 

Rootkit Capabilities 

  • Windows Protections: Windows uses mechanisms like code signing to protect system files from rootkits, limiting what they can do. 

  • Potential Risks: 

  • Rootkits can manipulate critical system files, prevent detection by security tools, and remove evidence of their presence. 

This breakdown helps identify how different types of malware function once installed and highlights the threats posed by backdoors, spyware, keyloggers, and rootkits

Ransomware and Cryptominers 

Ransomware 

  • What It Is: A type of malware designed to extort money from victims by limiting access to their computer or files. 

Basic Ransomware: 

  • Displays fake warning messages claiming the computer has been locked by authorities, often for false reasons like illegal activities. 

  • Usually blocks access by installing a fake shell program but is relatively simple to remove. 

Crypto-Ransomware: 

  • What It Does: Encrypts files on local, removable, and network drives, making them inaccessible without the decryption key. 

    • Example: Cryptolocker, which scans the system for files to encrypt and then demands payment before a countdown timer expires, after which the decryption key is destroyed. 

  • Mitigation: The only reliable solution is having up-to-date backups, as decrypting the files without the key is extremely difficult. 

Payment Methods: Ransomware attackers often demand payments through: 

  • Cryptocurrency (e.g., Bitcoin): Difficult to trace. 

  • Wire transfers or premium-rate phone lines: Designed to hide the attacker’s identity and avoid detection by law enforcement. 

Cryptominers (Cryptojacking) 

  • What It Is: A type of malware that hijacks a computer’s resources to perform cryptocurrency mining without the user’s consent.  Mining new cryptocurrency involves complex blockchain calculations, which require vast computational power. 

  • Effect on the System: 

  • The malware exploits the system’s CPU or GPU to mine digital coins. 

  • It can significantly slow down the computer and waste electricity. 

Botnets and Cryptojacking: Cryptominers often operate across botnets, which are networks of infected computers working together to mine cryptocurrency for the attacker, amplifying the mining power. 

This understanding of ransomware and cryptominers helps in identifying and addressing these serious threats, which can have devastating impacts on both individual users and organizations. 

Troubleshooting Desktop Symptoms 

When diagnosing desktop issues, especially security-related ones, it is crucial to look for signs of malware infection. Malware can cause various problems, and noticing unusual behavior may help you identify and resolve the issue. Below are common symptoms and how to troubleshoot them. 

Performance Symptoms 

If your computer is running slowly or acting strangely, malware might be the cause. Here are some symptoms of a malware infection: 

  • Failure to boot or frequent lockups. 

  • Slow performance, either during startup or while using the computer. 

  • Network issues, such as inability to access the internet or slow network performance. 

Since performance problems can be caused by other factors, you should: 

  • Run an antivirus scan immediately. 

  • If no malware is detected but the issue persists, quarantine the system or closely monitor it for further issues. 

Application Crashes and Service Problems 

Malware often targets security-related applications and can cause them to stop functioning. Signs of this include: 

  • Antivirus, firewall, or Windows Update no longer working properly. 

  • Failed updates for OS or virus definitions. 

  • Frequent crashes of Windows tools like Task Manager or third-party applications. 

Browser plug-ins (such as Adobe Reader or Flash) are also frequent targets. If reputable software begins to crash regularly, suspect a malware infection. Quarantine the system for further investigation. 

File System Errors and Anomalies 

Malware may alter or hide files on your system, creating the following symptoms: 

  • Missing or renamed files. 

  • Suspicious new executable files with names similar to legitimate system files (e.g., scvhost.exe or ta5kmgr.exe). 

  • Changed file attributes, such as modified date stamps or file sizes. 

  • Access Denied errors due to altered file permissions. 

If you observe these types of file system anomalies, it is less likely to be caused by anything other than malware. Quarantine the system immediately. 

Desktop Alerts and Notifications 

Malware can mimic legitimate Windows notifications to trick users into installing it. Here are signs to watch for: 

  • Fake virus alerts that look like Windows notifications. 

  • Misuse of the push notification system by websites to send fraudulent security alerts. 

  • Rogue antivirus scams, where a website or pop-up mimics legitimate security software and prompts you to install a fake tool. 

Modern malware uses tactics such as cold-calling and posing as tech support to ask you to enable remote desktop access. Always be cautious when seeing unfamiliar alerts or receiving unsolicited support calls. 

Troubleshooting Browser Symptoms 

Browsers are frequent targets for malware, and signs of infection can vary from simple annoyances like pop-ups to serious issues like redirection to malicious sites. Below are common symptoms, causes, and troubleshooting steps for browser-related malware issues. 

Pop-ups and Browser Performance Issues 

Symptoms: 

  • Frequent, random pop-up ads. 

  • Installation of unwanted toolbars. 

  • Homepage or search engine changing without consent. 

  • Browser crashes and slow performance. 

  • Unexpected search results that differ from other computers. 

Troubleshooting Steps: 

  • Run an antivirus scan to detect spyware or adware. 

  • Remove unwanted browser extensions or toolbars. 

  • Reset browser settings to default to remove any malicious modifications. 

Redirection 

What is Redirection? Redirection occurs when you try to visit one webpage but are sent to a different one. This can be used by adware to generate traffic for certain sites or by spyware to capture sensitive information, like login credentials. 

Symptoms: 

  • Being redirected to different websites, especially ones that imitate legitimate ones. 

  • Seeing different search results compared to other devices on the same network. 

Troubleshooting Steps: 

  • Check the HOSTS file for malicious entries. HOSTS is a file that can be altered by malware to redirect URLs to different IP addresses. 

  • Verify the DNS server settings on the computer to ensure they haven’t been hijacked by malware. 

  • Compare search results with those from a known clean device. If the results differ significantly, this may indicate a problem. 

Certificate Warnings 

What are Certificate Warnings? When visiting a secure website, the browser checks the site’s certificate to ensure it is valid and from a trusted source. If the certificate is invalid or untrusted, the browser will display a warning. 

Common Causes of Certificate Warnings: 

  • The certificate is self-signed or issued by an untrusted authority. 

  • The Fully Qualified Domain Name (FQDN) does not match the certificate's subject. 

  • The certificate is expired or revoked. 

Symptoms: 

  • Padlock icon missing or replaced by an alert icon in the browser’s address bar. 

  • Strikethrough formatting on the URL. 

  • Warning messages that block access to the website. 

Troubleshooting Steps: 

  • Review the certificate details in the browser to check for issues like an expired or mismatched certificate. 

  • If the certificate is untrusted, it could be a sign of a malware attack or a misconfigured site. 

  • Do not override the warning unless you are sure the site is safe. 

Man-in-the-Middle Attacks (On-Path Attacks) 

What is a Man-in-the-Middle Attack? In a man-in-the-middle or on-path attack, malware or a malicious access point intercepts the communication between the user and the website. The attacker may present a spoofed certificate to trick the user into thinking the connection is secure. 

How it Works: 

  1. The user requests a connection to a secure website. 

  2. Malware or a malicious access point presents a fake certificate to the browser. 

  3. If the browser accepts the certificate or the user overrides a warning, the attacker intercepts and can modify all the data exchanged. 

Symptoms: 

  • Untrusted certificate warnings. 

  • Suspicious network activity. 

  • Unusually high traffic through certain ports or unexpected DNS queries. 

Troubleshooting Steps: 

  • Check the certificate details to ensure it is legitimate. 

  • Verify that the root certificate store has not been compromised by malware. 

  • Use network monitoring tools to detect unusual activity or proxy settings that may indicate an on-path attack. 

By understanding and identifying these browser-related symptoms, you can take the necessary steps to resolve issues and protect your system from further infections. 

Best Practices for Malware Removal 

The CompTIA recommended process for malware removal consists of seven steps. By following these steps carefully, you can ensure that malware is detected, removed, and that future infections are prevented. Let’s break down each step in detail: 

1. Investigate and Verify Malware Symptoms 

  • Look for performance issues, unexpected behavior, crashes, or network slowdowns. 

  • Check antivirus alerts or user-reported issues. 

  • Use antivirus vendor databases (e.g., Microsoft's Security Intelligence) to match symptoms with known malware. 

3. Disable System Restore in Windows 

  • Turning off System Restore prevents the malware from hiding in restore points. 

  • If not disabled, malware could be restored during future system rollbacks. 

5. Schedule Scans and Run Updates 

  • Once the malware is removed, schedule regular system scans. 

  • Update system software and antivirus regularly to prevent reinfection. 

  • Ensure that all security patches are applied. 

7. Educate the End User 

  • Inform users about safe browsing habits, phishing threats, and malware vectors. 

  • Advise them on the importance of updating software and running antivirus scans. 

  • Provide tips for recognizing potential threats, like pop-ups or unexpected attachments. 

2. Quarantine Infected Systems 

  • Isolate the computer from the network to prevent further spreading of malware. 

  • Avoid connecting external devices to the infected system. 

  • Disable network shares and remove any unauthorized users. 

4. Remediate Infected Systems 

  • Update your antivirus software to the latest version to ensure it can detect new threats. 

  • Use safe mode or a preinstallation environment (like Windows Recovery or a bootable antivirus disk) for scanning and removal. Some malware can hide from scans in normal operation. 

  • Perform a full system scan to identify and remove all infections. 

6. Enable System Restore and Create a Restore Point 

  • After confirming that the system is clean, re-enable System Restore. 

  • Create a restore point for future reference, in case any new issues arise. 

Infected Systems Quarantine 

When malware symptoms are detected on a system, quarantining it and disabling System Restore are critical next steps in the malware removal process. Here's how to handle these steps effectively. 

Quarantine Infected Systems 

1. Limit User Access: 

Prevent administrators or users with elevated privileges from signing into the infected system. This reduces the chance that malware could escalate privileges or further compromise the system

2. Disconnect from the Network: 

Immediately disconnect the computer from the network to stop malware, especially worms or backdoor malware, from spreading to other systems. Network links can be cut by: 

  • Disabling the network interface card (NIC). 

  • Disconnecting Wi-Fi or physically unplugging the Ethernet cable. 

3.Move to Secure Environment: 

Move the system to a sandbox or a secure network segment where it can be remediated without affecting the main production network. You may still need access to certain tools, but this ensures that the infected machine doesn't communicate with other systems. 

4. Investigate Removable Media: 

Scan any removable media (e.g., USB sticks, external drives) that might have been attached to the system. Malware could have spread through these devices, so it's essential to identify and clean any external storage. 

5. Preemptive Quarantine: 

Even if the infection is not fully verified, consider quarantining the system if there is strong suspicion of advanced malware to prevent potential damage. 

Disable System Restore 

1. Turn Off System Restore: 

After isolating the system, disable System Restore and other automated backup services like File History. Malware could be hiding in restore points, so turning off these features prevents reinfection during recovery. 

2. Handle Infected Backups: 

If you're planning to recover files from a backup, be aware that the backup might also be infected. Either delete old restore points or use antivirus software to scan and clean them. Ensure that you're restoring from a clean, malware-free backup. 

By quarantining the infected system and disabling any automated recovery services, you minimize the risk of spreading malware and ensure that the cleanup process is thorough. 

Malware Removal Tools and Methods 

When dealing with malware on an infected system, several tools and methods can help clean and restore the computer. The primary tool is antivirus software, though advanced infections may require additional techniques. 

Using Antivirus Software 

1. Update Antivirus: 

a. Before running a scan, ensure that the antivirus software is fully updated. New malware definitions are frequently released, so it's important to have the latest version. 

b. If the malware has disabled updates, it may be necessary to disconnect the infected system and update the antivirus from another machine. 

2. Scan for Malware: 

Use antivirus software to scan the system. The scan will attempt to: 

  1. Clean the infected file (remove the virus while preserving the file). 

  2. Quarantine the file (block access to it while it remains on the system). 

  3. Delete the file (remove both the virus and the infected file completely). 

  4. In some cases, a file may be flagged as a false positive, and the user can choose to ignore the threat if it is known to be safe. 

Recovery Mode 

For more advanced malware infections, antivirus software alone may not be sufficient. In these cases, manual tools and processes are required: 

1. Safe Mode/Recovery Environment: 

a. Boot the computer in Safe Mode to prevent malware from launching at startup. 

b. You can use the msconfig tool to enable Safe Mode, or you can boot the computer using recovery media and run commands in the Windows Preinstallation Environment (WinPE), which provides a clean command-line interface. 

2. Manual Malware Removal: 

a. Use Task Manager to terminate any suspicious or unrecognized processes. 

b. Open a command prompt or Registry Editor (regedit) to manually remove entries added by malware, such as startup items or altered registry keys. 

3. External Disk Scan: 

If the system is heavily infected, remove the hard drive and scan it from another machine, ensuring that proper precautions are taken to avoid cross-infection. 

OS Reinstallation 

In some cases, especially with deeply embedded or persistent malware, antivirus software may be unable to recover the system entirely: 

1. Reformat and Reinstall: 

The most thorough way to remove persistent malware is to reformat the disk and perform a complete system restore. This will involve: 

  1. Reinstalling the operating system (OS) and software. 

  2. Restoring data files from a known clean backup. 

2. System Image Backup: 

For faster recovery, a system image (a snapshot of the OS and installed software) can be used to restore the system to a pre-infected state, followed by restoring data files. 

This process may be time-consuming, but it ensures the infected system is fully restored without any lingering malware. 

Malware Infection Prevention 

Once a system has been successfully cleaned of malware, it’s important to take the following steps to prevent reinfection and ensure continued system security. 

Configure On-access Scanning:

On-access scanning ensures that files are scanned for malware each time they are opened. This is essential for protection but may slightly reduce performance. Most security software has on-access scanning enabled by default. 

Configure Scheduled Scans 

  • Scheduled scans run at specified times to check the entire system for malware. These scans can slow down the computer, so it’s best to schedule them for when the computer is not being actively used. 

  • Make sure that both malware definitions and the antivirus engine are set to update regularly to protect against the latest threats. 

Re-enable System Restore and Services 

Once malware removal is complete, re-enable important services that may have been disabled: 

1. System Restore and Backups: 

  1. Re-enable System Restore and other backup systems, like File History. 

  2. Create a fresh restore point or system image and ensure that backups are clean and malware-free. 

2. Verify DNS Settings: 

DNS spoofing can direct users to malicious websites. Check and secure the DNS configuration to prevent this from happening again. 

3. Re-enable Software Firewalls: 

Malware may have altered the software firewall to allow unauthorized connections. Review the firewall settings for suspicious changes and consider resetting the firewall to its default policy. 

4. Final Antivirus Scan: 

Before returning the system to normal use, run another antivirus scan to ensure the system is free of any lingering malware. 

Educate the End User 

User education is one of the most important steps in preventing future infections. Uninformed users are often the weakest link in security: 

1. Password and Account Management: 

Teach users to use strong passwords and follow best practices for account management. 

2. Recognizing Social Engineering and Phishing: 

Train users to identify phishing emails, fake websites, and other types of social engineering attacks. Warning signs include: 

  1. Unexpected messages. 

  2. Mismatched sender addresses. 

  3. Suspicious links and attachments. 

  4. High-pressure tactics, like exaggerated urgency or threats. 

3. Safe Software Use: 

Users should know how to securely use browsers, email clients, and social media, and understand the risks of interacting with spam or unfamiliar links. 

4. Continuing Education: 

Cybersecurity threats evolve, so it’s crucial that users receive ongoing training to stay updated on new risks and best practices. 

By combining system configuration with user education, you can greatly reduce the risk of reinfection and ensure a safer computing environment. 

Summary 

Great job on making it through this lesson! You've gained important skills for detecting, removing, and preventing malware—critical tools in today’s digital landscape. Understanding the various types of malware, how they spread, and how to troubleshoot infected systems will help you confidently protect not only your own systems but also assist others in staying secure. Remember, with regular updates, proper configuration, and user education, you can stay ahead of threats and maintain a strong line of defense against malware. Keep learning, and you're on your way to becoming an expert!