220-1202 tests your ability to manage operating systems and security. Before you can manage a computer's health, you must understand the biggest threat to it: malware. This chapter gives you the plain-English knowledge to spot different types of malicious software, understand how they get in, and know the exact steps to kick them out and lock the door after.
Jump to a section
A simple way to picture Malware Threats and Removal
Have you ever planned a small get-together at your house, only to have someone you don't know turn up uninvited, and suddenly they're eating your food, using your Wi-Fi, and trying to convince your other guests to give them their phone numbers? That uninvited guest isn't just rude; they are a threat. In IT, that uninvited guest is malware (malicious software).
The house is your computer or a whole company network. The invited guests are legitimate programs you choose to run, like your web browser or word processor. The food and Wi-Fi are your system's resources: processing power, memory, and internet bandwidth. The uninvited guest (the malware) doesn't just want to hang out; they want to steal your valuables (personal data, bank details), trash the place (corrupt files, crash the system), or turn your house into a base for their other criminal activities (like using your computer to attack other computers).
Your job, when you learn to detect, prevent, and remove malware, is like being a good security guard at your own party. You check IDs (antivirus scans, firewalls) at the door. You have a bouncer (remove malware) to physically escort troublemakers out. You fix the lock on the back door (patch vulnerabilities) so the same crasher can't slip back in. You also have a security camera (system monitoring) to see if any crashers are already inside.
Malware is short for 'malicious software'. It is any program or file that is intentionally designed to cause harm to a computer, server, client, or computer network. Think of it as software with bad intentions. As an IT professional, you will spend a significant amount of time fighting it.
To understand how to fight it, you first need to know the different types. The CompTIA A+ Core 2 exam focuses on several specific categories.
Virus: A virus is a piece of code that can copy itself and spread by attaching to other programs or files. It needs a human action to spread, like opening an infected email attachment or running an infected program. Think of it like a biological virus that needs a host cell to replicate.
Worm: A worm is similar to a virus but with a key difference: it can spread automatically across a network without any human action. It exploits security holes in operating systems or software to jump from computer to computer. The infamous 'ILOVEYOU' worm spread through email, but it didn't just sit in an attachment; it used the user's address book to send itself to everyone the user knew.
Trojan Horse: Named after the ancient Greek story, a Trojan horse appears to be a legitimate, useful program (like a game, a PDF converter, or a free antivirus tool) but secretly contains malicious code. When you run the program, it activates the malware inside. It does not replicate itself like a virus or worm; it relies on tricking you into installing it.
Ransomware: This is one of the most dangerous types today. Ransomware encrypts (scrambles so it's unreadable) your files or locks you out of your entire system. The attacker then demands a ransom, usually in cryptocurrency like Bitcoin, to decrypt (unscramble) the files and give you back access. It often spreads through phishing emails or by exploiting vulnerabilities.
Spyware: This software secretly monitors your activities. It can log your keystrokes (keylogging), capture your passwords, track your browsing history, and steal personal information, like credit card numbers. It is designed to hide in the background and send data back to the attacker.
Adware: While often less malicious than spyware, adware is still unwanted. It automatically displays or downloads unwanted advertisements on your computer. It might change your browser's homepage to an ad-filled page or pop up constant ads, slowing down your system. It is a common way for free software makers to make money, but it can also redirect you to phishing sites.
Rootkit: A rootkit is a particularly nasty piece of malware because it is designed to hide its own existence and the existence of other malware from the operating system and antivirus software. It buries itself deep in the system, often at the kernel (the core of the operating system) level, making it incredibly difficult to detect and remove. Sometimes the only way to be sure you've removed a rootkit is to completely wipe the hard drive and reinstall the operating system.
So, how does malware get onto a system? The main methods are:
Phishing: This is the most common delivery method. The attacker sends a deceptive email, text message, or website that looks legitimate (like from your bank, a delivery company, or a social media site). It tricks you into clicking a malicious link or downloading an infected attachment.
Drive-by Download: This happens when you visit a compromised website. The website itself, without you clicking anything, automatically downloads and installs malware onto your computer by exploiting a vulnerability in your web browser or its plugins (like Adobe Flash or Java).
Removable Media: An infected USB drive, external hard drive, or even a memory card in a camera can spread malware. The 'Autorun' feature of older Windows versions would automatically launch the malware when the device was plugged in.
Prevention is the first line of defence. This includes keeping your operating system and software updated with the latest security patches, using a reputable antivirus and antimalware program, enabling a firewall (which blocks unauthorised network traffic), and, most importantly, educating users about the dangers of phishing emails and suspicious downloads.
When detection and removal are needed, the standard procedure follows a specific order. You must first identify the symptoms of an infection: the system is slow, it shows unusual error messages, programs start by themselves, or there are new toolbars you didn't install. Then, you quarantine the infected system by disconnecting it from the network to prevent the malware from spreading. Next, you run a scan using an up-to-date antivirus or antimalware tool. If the malware is identified, you attempt to remove or 'disinfect' the files. For stubborn infections, you may need to boot the system into Safe Mode (a diagnostic mode with minimal drivers and programs) to run the removal tool because the malware might be preventing it from running in normal mode. In severe cases, especially with rootkits or ransomware, the only viable removal method is to wipe the drive and reinstall the operating system from a known-good backup.
Step 1: Identify and Quarantine
Recognise the signs of an infection (slow performance, pop-ups, unknown processes). Immediately disconnect the computer from the network (unplug Ethernet and disable Wi-Fi). This prevents the malware from communicating with its command-and-control server or spreading to other computers.
Step 2: Boot into Safe Mode
Restart the computer and tap the F8 key (or use Shift + Restart in Windows 10/11) to enter the Advanced Boot Options menu. Select 'Safe Mode with Networking'. In Safe Mode, Windows loads only the essential drivers and services, which often prevents malware from loading and interfering with removal tools.
Step 3: Update Antivirus Definitions
Before running a scan, ensure your antivirus or antimalware software is updated with the latest virus definitions (a database of known malware signatures). An outdated definition database will not detect new threats. Use a clean computer to download updates if the infected one cannot connect to the internet.
Step 4: Run a Full System Scan
Perform a full, thorough system scan using your antimalware tool. Do not use a 'quick scan'. Allow the software to quarantine or delete any infections it finds. Note the names and locations of any files that cannot be removed.
Step 5: Research and Recovery
After the scan, use a separate computer to research any remaining malware or suspicious file names. Determine if system files need to be restored from a clean backup. If the scan successfully removed the malware, run a second scan to confirm the system is clean.
Step 6: Reimage the System (if necessary)
For severe infections like rootkits, ransomware that encrypted critical files, or when the system is unstable after removal, the only reliable solution is to wipe the hard drive and reinstall the operating system from a known-good image. Restore user data from a backup taken before the infection.
Imagine you are the junior IT technician at a mid-sized accounting firm. You get a frantic phone call from a user in the finance department. She reports that her computer screen has a large red banner that says all her files, including important client spreadsheets, have been encrypted, and a timer is counting down before the ransom amount doubles. This is a ransomware attack.
Your immediate reaction should not be to panic. Your first step is to isolate the affected computer. You physically unplug its network cable and disable its Wi-Fi card. This is the 'quarantine' phase. You must assume that the ransomware is also a worm and could be spreading to other computers on the network. If you are using a managed network, the lead administrator might remotely disconnect the switch port that computer is connected to.
Next, you assess the scope. You check if the network has network-attached storage (NAS) drives or shared folders. If the user had mapped drives, those files might also be encrypted. You check file version history and shadow copies (a Windows feature that takes automatic backups of files). In many cases, ransomware also deletes shadow copies, so you need to verify if they are intact.
The next step is to determine the point of entry. You check your email security logs. You ask the user, slowly and calmly, 'Did you click on any unusual links or open any unusual attachments in the past hour?' The user remembers receiving an email that looked like it was from the CEO asking her to 'review an urgent invoice.' She clicked the link. This is the 'delivery mechanism' — a phishing email.
Now, you must escalate the incident. You inform your security manager or the incident response team. Your official policy is to never pay the ransom. Paying does not guarantee you will get your files back, it funds criminal activity, and it makes your firm a target for future attacks.
The removal process begins with the infected machine. You boot it into Safe Mode with Networking. From a clean, known-good computer, you download the latest version of a specialised antimalware removal tool (like the Microsoft Malicious Software Removal Tool or a reputable third-party tool). You run the tool on the infected machine. It might detect and remove the ransomware payload. However, if the files are encrypted (with a strong encryption algorithm, which is almost always the case), removing the malware will not decrypt the files.
The final step is recovery. You check your backups. If you have a robust backup strategy (the '3-2-1 rule' — three copies of data, on two different media, with one offsite), you can restore the encrypted files from your backup system. You then perform a complete system scan on the restored machine to ensure no remnants of the malware remain. After the crisis is contained, you work with the IT security team to review and tighten the email filtering rules, conduct a company-wide awareness training on phishing, and patch the vulnerability that the initial phishing link exploited (if any).
The 220-1202 exam expects you to not just know what malware is, but to apply that knowledge in a given scenario. The questions are 'Given a scenario' type, meaning you get a description of symptoms and user actions, and you must identify the type of malware, the infection vector (how it got in), and the correct removal procedure.
Exam topics they love to test:
Types and Symptoms: You must be able to distinguish a virus from a worm based on the description of how it spreads. For example: 'A user reports that their computer is slow and other computers on the network are showing the same files appearing without explanation.' That points to a worm, not a virus, because it spread without human action. A Trojan is suspected when the user downloaded a 'free' program that looked legitimate.
Infection Vectors: Scenario: 'A user receives an email from what looks like a shipping company about a package delivery, and they click a link.' The vector is a phishing email. Scenario: 'A user's computer is infected right after visiting a news website.' The vector is a drive-by download.
Removal Process: A common multi-choice question will give you a list of steps like 'Run antivirus, update definitions, disconnect from network, boot into Safe Mode, reinstall OS.' You must put them in the correct order: 1. Disconnect from network (quarantine), 2. Boot into Safe Mode, 3. Update antivirus definitions, 4. Run antivirus scan, 5. Research malware and variant, 6. Create a system restore point (if possible), 7. Disable System Restore (to prevent restoring infected files), 8. Schedule scans.
Rootkit Specifics: They love to ask about rootkits. A typical question might say: 'After several antivirus scans, a user's computer is still acting strangely. The user suspects a rootkit. Which of the following is the most thorough way to remove it?' The answer is to wipe the drive and reinstall the operating system.
Safety and Best Practises: The exam will test your knowledge of 'end-user education' as a prevention method. Questions about ransomware will always favour the answer 'Backup files regularly' over 'Pay the ransom'.
Traps they set:
They will describe a worm and ask 'What type of malware is this?' and one of the wrong answers will be 'Trojan' because it is a common term.
They will ask about a user complaining about ads pop-ups and changed browser homepage, and a wrong answer will be 'Spyware'. The correct answer is 'Adware' because the primary symptom is unwanted adverts, not data theft.
They will ask about the first step in removal. Many beginners choose 'Run antivirus scan' first, but the correct first step is always 'Isolate the system' (disconnect from network).
They will ask about 'System Restore' and a beginner might think it is a removal tool. It is a recovery tool, but it can also restore infected files.
Key definitions to memorise for the exam:
Ransomware: Encrypts data and demands payment.
Boot Sector Virus: Infects the boot record (the first sector of a hard drive), loaded before the OS.
Phishing: An attempt to acquire sensitive information by masquerading as a trustworthy entity.
Social Engineering: Manipulating people into performing actions or divulging confidential information, often the precursor to malware delivery.
Antivirus vs. Anti-malware: Antivirus traditionally focuses on viruses; anti-malware is a broader category covering all forms of malicious software. Modern solutions are hybrid.
Malware (malicious software) is any program designed to harm a computer system; its types include viruses, worms, Trojans, ransomware, spyware, adware, and rootkits.
A virus requires a host file and a human action to spread, while a worm can spread independently across a network without user interaction.
A Trojan horse disguises itself as a legitimate program to trick you into installing it, and it does not replicate itself.
Ransomware encrypts your data and demands payment for its release; the best prevention is a robust, regularly tested backup strategy.
The first step in any malware removal process is to isolate (quarantine) the infected system from the network to prevent the malware from spreading.
Boot into Safe Mode before running antimalware scans, as it loads only the essential Windows drivers, making it harder for malware to interfere with the removal tool.
If a rootkit infection is suspected, the most thorough removal method is to wipe the drive and reinstall the operating system, as rootkits are designed to hide from detection software.
End-user education is the most effective prevention method against malware delivered via phishing emails.
These come up on the exam all the time. Here's how to tell them apart.
Virus
Requires a host file to attach itself to.
Needs a user action (e.g., opening a file) to spread.
Often attaches to executable files (.exe) or macro-enabled documents.
Worm
Is a standalone program that does not need a host file.
Spreads automatically across networks by exploiting vulnerabilities.
Can replicate itself without any user interaction.
Spyware
Secretly monitors user activity and steals personal data.
Often runs hidden in the background without the user's knowledge.
Poses a significant privacy and security risk to the user.
Adware
Displays unwanted advertisements to the user.
May change browser settings, inject ads, or create pop-ups.
Primarily a nuisance and a drain on system resources, less of a data theft risk.
Phishing
A generic, mass email sent to many people.
Uses a broad appeal (e.g., 'Your account has been compromised').
Easier to detect due to generic greetings and language.
Spear Phishing
A highly targeted email directed at a specific individual or organisation.
Uses personal information (name, job title) to appear legitimate.
Much harder to detect because it is customised for the target.
Disinfect/Remove
Attempts to remove the malware while keeping the OS and files intact.
May leave behind remnants of infection or registry corruption.
Suitable for less severe infections like common Trojans.
Reimage/Format
Wipes the entire hard drive and reinstalls the operating system.
Guarantees a clean, known-good state of the system.
The only reliable method for rootkits and heavily damaged systems.
Mistake
If I have an antivirus program installed, I am completely safe from all malware.
Correct
Antivirus software is a critical defence, but it is not perfect. It relies on signature-based detection (matching known malware patterns) and heuristic analysis (behaviour-based). New, unknown malware (zero-day threats) can slip through. Also, sophisticated malware like rootkits can hide from antivirus software.
People trust the 'shield' icon of antivirus software as an absolute guarantee. The marketing for many antivirus products oversimplifies their capability, leading to a false sense of total security.
Mistake
Malware is primarily a problem for Windows computers; Macs and Linux are immune.
Correct
While Windows is the most targeted operating system due to its vast market share, macOS and Linux can be and are infected with malware. Viruses, worms, and Trojans exist for all platforms. The misconception arose because historically there was less malware for Mac, but that gap has closed significantly.
Users of less common operating systems often feel a sense of elitism and security. They ignore basic security practises because they believe they are invisible to attackers, which is a dangerous and false assumption.
Mistake
Antivirus software can always clean or remove an infected file without causing any damage.
Correct
Removal is not always successful. For a virus attached to a system file, 'removal' might mean deleting the file, which could cause the operating system to become unstable. For ransomware, the decryption key is usually not available. In many cases, the safest and most reliable method is to delete the file and restore it from a clean backup.
People see antivirus as a 'medicine' that cures without side effects. In reality, the 'cure' (deleting the infected file) can damage the 'patient' (the operating system).
Mistake
A slow computer always means it is infected with malware.
Correct
A slow computer is a symptom, not a diagnosis. Many legitimate factors cause slow performance: a hard drive that is nearly full, too many startup programs, a fragmented hard drive (especially on older HDDs), insufficient RAM, or a failing hardware component. Malware should be a consideration, but not the automatic conclusion.
People associate malfunctions with 'viruses' because it is a scary, simple explanation they have heard about. They skip the more common, less dramatic troubleshooting steps first.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A virus requires a host program and a user action (like opening a file) to spread. A worm can spread automatically across a network by exploiting vulnerabilities, without needing a host file or user action.
Yes. While they are less targeted than Windows systems, macOS can be infected with malware. Macs are not immune, and users must follow the same security best practises, including using antivirus software.
No. Law enforcement and security experts strongly advise against paying the ransom. There is no guarantee you will get your files back, and it funds further criminal activity. Restoring from a clean backup is the recommended course of action.
A rootkit is a type of malware that hides its presence and the presence of other malware by modifying the core operating system (the kernel). Because it operates at a low level, it can intercept and alter the output of security tools, making them believe the system is clean.
Immediately disconnect the computer from the network. Unplug the Ethernet cable and turn off Wi-Fi. This prevents the malware from spreading to other devices on the network or communicating with its command server.
Not always. Free antivirus programs often offer basic, signature-based protection. Paid versions typically include advanced features like real-time behaviour monitoring, ransomware rollback, a firewall, and protection against zero-day threats. For professional use, a paid, centrally managed solution is usually required.
You've finished Malware Threats and Removal. Continue through the 220-1202 study guide to build a complete picture of the exam.
Done with this chapter?