Lesson 2: Malware Types, Defensive Tools, and Removal

One symptom does not identify malware.

A computer that is slow could be overloaded, overheating, low on storage, updating, failing, or infected.

A browser redirect could come from a malicious extension, a changed search setting, a proxy configuration, adware, or a broader compromise.

So the first rule is familiar:

Do not promote a symptom into a diagnosis before the evidence earns it.

Malware categories describe behavior and position in the system

Trojan

Malicious software disguised as, bundled with, or presented as something the user expects.

The important clue is deceptive delivery, not one universal symptom.

Rootkit

Malware designed to hide or maintain control at privileged system layers.

Because trust in the running system may be reduced, remediation can require stronger recovery or reimage decisions.

Virus

Malicious code that attaches to or modifies other files or software and can replicate through execution.

Spyware

Software that secretly collects information or user activity.

Ransomware

Malware that encrypts, locks, or otherwise denies access to data or systems to extort payment.

The defensive priority is containment, recovery, and incident escalation, not experimenting with the affected files.

Keylogger

Captures keystrokes or input to collect information such as credentials.

That can turn one compromised endpoint into an account-security problem too.

Boot-sector malware

Targets early boot or storage structures, moving the malicious boundary below ordinary user applications.

Cryptominer

Abuses system compute resources for cryptocurrency mining.

High CPU or GPU use may be consistent with mining, but high resource use alone is not proof.

Stalkerware

Covert monitoring or surveillance software used against a person.

This category creates significant privacy and personal-safety concerns. Preserve evidence and follow the approved escalation path rather than confronting or experimenting with the suspected software.

Fileless malware

Abuses legitimate memory, process, scripting, or operating-system mechanisms without depending primarily on a traditional malicious file stored on disk.

That is one reason "antivirus found no suspicious EXE" cannot prove the endpoint is clean.

Adware and potentially unwanted programs

Adware aggressively serves advertising or changes browser behavior.

A potentially unwanted program may have been technically installed with user consent while still producing unwanted or risky behavior.

Not every unwanted application is identical to ransomware. Scope matters.

Visual reference

See the system before you troubleshoot it

reference sheetSecurity Controls and Evidence

Defensive tools answer different questions

Antivirus and anti-malware

Detect or remediate malicious or unwanted software according to their engines, signatures, behavior models, and current configuration.

Keep them updated before relying on the result.

Software firewall

Restricts network communication according to configured rules.

It can reduce network exposure or communication but does not clean an infected file by itself.

Email security gateway

Filters mail before or during delivery according to organizational policy and detection capability.

It cannot retroactively repair a compromised browser profile after the user installed an unsafe extension.

User education and antiphishing controls

Reduce the chance that suspicious communication becomes a successful action.

Training is a control. It is not permission to blame the user when an incident occurs.

EDR

Endpoint Detection and Response collects and analyzes endpoint security evidence and supports response actions according to the product and organization.

MDR

Managed Detection and Response adds an external or managed service component to monitoring and response.

XDR

Extended Detection and Response combines security data or controls across multiple sources such as endpoints, identity, email, or network systems depending on the platform.

The acronyms describe scope and operating model, not magic levels of security.

Recovery environments change what is running during remediation

Safe Mode, recovery environments, or preinstallation environments can reduce the normal startup state and make some repair or scan operations possible when normal Windows behavior interferes.

Use them because the approved workflow requires a cleaner or reduced environment, not because "Safe Mode fixes viruses."

The A+ SOHO malware-removal process is a controlled sequence

1. Investigate and verify symptoms

Record what was observed, when it started, recent changes, scope, and known-good evidence.

Do not begin by deleting files because their names look strange.

2. Quarantine the affected system

When appropriate, isolate the endpoint to reduce spread or unwanted communication while preserving data and evidence.

Quarantine is not the same as powering off every suspected system automatically. Follow the scenario and incident procedure.

3. Handle System Restore where the approved Windows Home procedure requires it

The classic A+ SOHO workflow includes disabling System Restore where required so infected restore state is not retained.

This is a certification remediation sequence, not a universal enterprise incident-response rule.

4. Remediate the infected system

Use approved removal, configuration, account, or recovery actions appropriate to the evidence.

5. Update anti-malware software

A stale detection engine weakens the value of the scan.

6. Scan and remove

Use the approved scan/removal process. Safe Mode or a recovery environment may be appropriate when normal startup interferes.

7. Reimage or reinstall if necessary

If trustworthy remediation cannot be established, reimage or reinstall from a known-good source after the required data and recovery decisions.

A reinstall is not failure. Sometimes it is the cleanest way to restore trust.

8. Schedule scans and run updates

Restore the endpoint's normal update and protection posture.

9. Re-enable System Restore and create a clean restore point where applicable

Restore the recovery feature after the approved cleanup process.

10. Educate the user and document

Record symptoms, actions, verification, remaining risk, and safer future behavior.

Do not turn the documentation into a lecture about who clicked what.

System process animation

Defensive malware-response sequence

Treat indicators as evidence to verify, then contain, remediate, recover, harden, and document.

RestartPreviousPlay sequenceNext

1. 1VerifyConfirm the observable symptom and scope.
2. 2ContainLimit impact with approved controls.
3. 3RemediateUse approved tools to remove the cause.
4. 4RecoverRestore function from trusted state.
5. 5HardenClose the weakness.
6. 6Verify + documentRetest and record remaining risk.

Technician question: Which stage prevents an unsupported compromise claim?

Worked case: redirects after one browser extension

Evidence:

redirects began after unapproved extension install
redirects occur only in one browser profile
other applications: normal
endpoint protection: enabled/current
system-wide indicators: none supplied

The narrowest current scope is the browser profile.

A controlled response can begin with browser evidence and approved extension removal, then updated security scanning and verification.

Do not call the entire operating system compromised without broader evidence.

Worked case: possible ransomware

Evidence:

user files: suddenly inaccessible
ransom note: present
shared network resources: potentially reachable

The first priorities are containment and escalation.

Do not reconnect network shares to test whether they are affected.

Do not delete the note because it looks malicious.

Do not improvise a cleanup that destroys recovery evidence.

The incident has crossed from ordinary support into a security-response boundary.

Build the malware decision record

For supplied symptom sets, document:

observed symptom
plausible malware category
non-malicious alternative
affected scope currently supported by evidence
defensive tool or method
A+ removal step reached
what would justify escalation or reimage
recovery dependency
verification
remaining uncertainty

Include Trojan, rootkit, virus, spyware, ransomware, keylogger, boot-sector malware, cryptominer, stalkerware, fileless malware, adware, and PUP scenarios.

Before you move on

Malware remediation is not:

Run a scanner and hope.

It is:

verify
→ contain
→ remediate
→ restore protections
→ recover
→ verify
→ educate and document

Next we harden the two surfaces a small-office technician touches constantly: the router or wireless edge and the browser.