CompTIA A+ Core 2
Malware removal on Windows for A+ Core 2: isolate, clean, rebuild
Isolate the infected PC from the network first, then remove the malware with up-to-date anti-malware software, using a Microsoft Defender Offline scan for malware that hides while Windows runs. If a rootkit or attacker tools replaced system files, or you cannot tell what was changed, rebuild the PC instead of cleaning it. Afterwards, keep Defender's settings protected with tamper protection.
Isolate first, but do not wait
NIST SP 800-83 says containment has two parts: stopping the malware spreading and preventing further damage to the host. For a single infected PC, that usually means disconnecting it from the network, either by changing network devices to deny it access or by unplugging the cable.
If the malware downloads files from a known external address and antivirus does not yet detect it, a firewall rule that blocks that address helps contain it until signatures arrive.
Disconnecting does not make the PC safe. NIST gives the example of malware that contacts another host on a schedule and overwrites the drive when that connection is lost. Start removal as soon as possible.
Scanning with Microsoft Defender
Security intelligence (definitions) holds information about the latest threats and is used on every scan. Windows downloads it through Windows Update. On a PC that has been offline, check manually under Virus & threat protection > Protection updates > Check for updates before scanning.
Quick scan is for when there is no time for a full scan. Full scan checks every file and program. Custom scan checks only the files and folders you choose, such as one USB drive.
Microsoft Defender Antivirus (offline scan) restarts the PC and scans with the latest definitions without loading Windows, so persistent malware has a harder time hiding or defending itself. Use it when a quick scan finds nothing but you still suspect an infection. Results appear under Protection history.
Clean or rebuild
Rebuilding means reinstalling and securing the operating system and applications, or restoring known good images, then restoring data from known good backups.
NIST says to rebuild rather than disinfect when any of these is true: an attacker had administrator-level access; administrator access was open to anyone through a backdoor or similar; system files were replaced by a Trojan, backdoor, rootkit or attacker tools; the PC is unstable after cleaning; or there is doubt about the extent of the infection.
Worked example: anti-malware removed a rootkit that had replaced system files, and a new scan is clean. You still cannot tell what else changed, so reinstall the OS and restore data from backup.
Backups can hold malware too. Restoring an infected backup can bring the infection back.
Keeping protection on afterwards
Tamper protection stops malicious apps changing important Defender settings such as real-time protection and cloud-delivered protection. An administrator can still change them in the Windows Security app, but other apps cannot.
Exclusions stop real-time scanning of the files, folders, file types or processes listed, and Microsoft warns they can leave the device vulnerable. A file type exclusion for .exe would leave every program unscanned in real time, so check the list after an infection.
Where the exam catches people
- Believing a clean quick scan means the PC is clean: persistent malware can hide while Windows runs, which is what the Defender Offline scan is for.
- Believing a disconnected PC is safe to leave for later: some malware destroys data when it loses its connection, so start removal promptly.
- Believing a clean rescan after rootkit removal ends the job: replaced system files or an unknown extent of compromise call for a rebuild.
- Believing antivirus alone can contain brand-new malware: until signatures exist, block its sources with other tools such as firewall rules.
- Believing tamper protection stops administrators from changing Defender settings: administrators can still change them in Windows Security; other apps cannot.