Malware Types & Threat Mitigation

Malware Taxonomy

The 220-1202 exam rewards knowing how each malware spreads and what makes it distinct, because scenario questions describe symptoms rather than naming the threat.

Symptom-to-type mapping the exam loves: fans spinning and CPU pinned at 100% on an idle machine = cryptominer; files renamed with a strange extension plus a ransom note = ransomware; the machine emails contacts on its own and spreads with no clicks = worm.

---

Social Engineering

People are the cheapest exploit. Match the attack to its channel:

Exam tip: "CEO emails accounting at 4:55 pm demanding an urgent wire transfer" is whaling/business email compromise, not generic phishing, because it targets a high-value role.

---

Detection Tools and the Ten-Step Removal Procedure

Objective 2.6 of the V15 Core 2 objectives lists the SOHO malware removal procedure as ten numbered steps:

1. Investigate and verify malware symptoms.
2. Quarantine the infected system — disconnect it from the network.
3. Disable System Restore in Windows Home so malware cannot hide in restore points.
4. Remediate the infected system.
5. Update anti-malware software — definitions and engine.
6. Scan and removal techniques — for example Safe Mode or a preinstallation environment (bootable media).
7. Reimage/reinstall the operating system from a clean image or trusted media.
8. Schedule scans and run updates.
9. Enable System Restore and create a fresh restore point in Windows Home.
10. Educate the end user about how the infection happened.

Older materials written for the retired V14 exam (220-1102) show a seven-step list with the update and the scan as sub-steps of remediate; study the ten V15 steps above.

Ransomware Special Case

• Disconnect from the network first to stop encryption of mapped shares.
• Do NOT pay — payment is unreliable and funds criminals; report to the FBI IC3 in the US.
• Restore from offline/immutable backups; check nomoreransom.org for free decryptors.

Rootkit / Boot-Sector Special Case

Standard scanners run inside the compromised OS and may be blinded. Use a bootable rescue/offline scanner or WinRE; if integrity cannot be verified, wipe and reinstall the OS from trusted media. After any reinstall, restore data from backup and reapply patches before reconnecting.

---

Anti-Malware Best Practices and Browser Hardening

Prevention beats remediation, and the exam expects you to recommend layered defenses rather than a single product. The pillars are: keep definitions and the engine auto-updating, leave real-time protection enabled, run scheduled full scans, patch the OS and applications promptly, and back up to offline or immutable storage so ransomware cannot reach it.

Browsers are a primary infection channel, so know these threats and their fixes:

Two end-user habits prevent most browser infections: only install software from trusted, official sources, and never disable security warnings to make a download work. On managed fleets, technicians push these as policy — forced auto-update, an allow-list of extensions, and SmartScreen/reputation filtering turned on.

Spam and rogue antivirus trap: a pop-up screaming "Your PC is infected — call this number" is itself the attack (scareware/rogue antivirus). The correct response is to close it without clicking, never call the number, and scan with the legitimate, already-installed antimalware tool.

Document the incident in the ticketing system, note the root cause, and feed it back into user training — the seventh removal step exists because the same user clicking the same kind of link is the most common cause of reinfection.