Malware Removal

Which of the following tools could you use to help you perform a Malware removal?

1) Boot into Safe Mode. 2) Delete Temporary Files (Disk Cleanup Utility) 3) Antivirus Programs/Scanners 4) MalwareBytes 5) OS Reinstall

What are some signs that a computer is infected with Malware?

1) Computer may run noticeably slower than usual. 2) Pesky ad pop-ups, and re-directs. 3) Changes to Default Homepage. 4) Strange toolbars located in a web browser. 5) Error Messages. 6) Unable to open any EXE or Microsoft Installer (MSI) files. 7) Unable to change wallpaper or desktop settings. 8) All entries under Start > Programs are empty and/or the C: Drive is blank. Malware with MacBooks: Apple products aren't as susceptible to malware. Common attacks though are often disguised as Apple certified programs. Problems aren't as detrimental on iOS compared to Windows. Malware aren't given Admin access and programs cannot load 1) Update the latest Security Updates/Software Updates through the App Store. 2) Check the Disk/Hard Drive itself using Apple's Internet Recovery Partition: Restart Mac > Hold Down CMD-R during Reboot > Disk Utility > Continue > First Aid > Run 3) Flushing the Cache: Resetting the NVRAM/PRAM and SMC. To Reset the NVRAM (on older Macs - PRAM): - Reboot the Mac and hold down CMD-Option-P-R for at least 20 seconds. - After resetting your NVRAM, you will be prompted to reconfigure system settings such as sound and time zones. 4) An SMC reset is a bit more complicated, and is only recommended after other troubleshooting options are exhausted. - Shutdown the Mac and plug it into a charger. - Restart the computer by pressing the Power Button along with Shift-Control-Option. - Release these keys, then just press the Power Button to properly start your computer. 5) Create a Partition on Mac/Erasing the Drive: Open Finder > Applications > Utilities Folder > Disk Utility > Select Hard Drive (Macintosh HD) > Click on Partition Tab > Click Plus (+) button > Change the size of the partition by dragging resize controls > Name New Partition > Apply. Disk Utility will check the disk and make changes. After that is completed, quit Disk Utility to return to Internet Recovery Menu. Click Reinstall MacOS > Continue > Agree to Licensing Agreements > Choose New Mac Hard Drive as the disk to install MacOS onto > Install Mac will download a fresh copy of your operating system from the App Store and install it. The Mac will restart automatically into the new partition once the software has downloaded, then the installation of the operating system will continue. *After finishing up the new hard drive, you can move files from the old hard drive onto the new one. (Avoid copying over programs/applications from the old hard drive; reinstall them from the App Store instead.)

Why is the registry important when cleaning Malware?

A registry key can be thought of like a file folder, just like any other, but these exist only in the Windows Registry. The Windows Registry is an internal database the computer uses to store configuration information. The Windows Registry is a single place for information as what hardware is attached, what system options are selected, how computer memory is set up, and what programs are present when the operating system is started. Windows malware often modify the Windows Registry database (i.e. registry key) in order to make sure it can launch itself after a reboot, to better hide, or to integrate with existing processes. So, it makes sense to monitor registry areas that are often manipulated by malware.

Name Three Types of Malware (ex: Adware):

Adware, Spyware, Bots, Ransomware, Trojans, Backdoor, Worms, Viruses, Rootkits

Malware can only infect the hard drive.

False.

Is reinstalling the operating system enough to remove any Malware?

Generally, reinstalling the OS is enough. However, malware authors are often clever and adapt to new ideas, specifically by attacking a computer's Firmware. Complex malware can persist through OS reinstalls staying in bios, firmware, or with a virus infecting data files on removable storage or on back-ups.

How could you uninstall an AntiVirus program that refuses to be removed?

Having more than one antivirus program running on a computer often causes problems, errors, slower performance, and failure of antivirus protection. Two Types of Anti-Viruses: 1) Real-Time Antivirus 2) On-Demand Scanners 1) Find the antivirus program through the Windows Start Menu, and uninstall it from there. 2) Add or Remove Programs Utility in Windows. 3) Uninstalling from Windows Safe Mode. 4) In some situations, a legitimate antivirus program cannot uninstall because the software used to uninstall it is corrupt, bad, or missing. In these situations, you must download an uninstaller program directly from the antivirus scanner company to remove all files associated with the antivirus. 5) Rogue antivirus programs. There is a possibility that the antivirus program trying to be uninstalled is actually a spyware or malware. Run a spyware removal program such as Malwarebytes to clean the computer.

Most computers can be cleaned simply by running MalwareBytes once.

If MalwareBytes disappears after it begins scanning and won't reopen, then the infection could be more serious and stopping the scanner from running. Perform MalwareByte's "Quick Scan" first. If results come up empty, run a full scan. If you can't seem to remove the malware or if Windows isn't working properly, go ahead and reinstall Windows OS.

Why is Safe Mode helpful when doing a Malware cleaning?

If a PC has a malware infection, boot the PC into Microsoft's Safe Mode. In this mode, only the minimum required programs and services are loaded. If any malware is set to load automatically when Windows starts, entering in this mode may prevent it from doing so. This is important because it can make removing infected files easier since they're not actively running. For Windows 10: 1) Click the start button in Windows 10 2) Select the power button as if you were going to reboot, but don't click anything. 3) Hold down the shift key and click reboot. 4) When the full-screen menu appears, select Troubleshooting > Advanced Options > Startup Settings. 5) On the next window, click restart and wait for the next screen to appear. 6) Next is a menu with numbered start options; select number 4, which is Safe Mode.

Why should you check start-up items when removing Malware?

Malicious softwares are often embedded in start-up functions. Examining the behavior of start-up items can reveal infected files.

When is it better to go with an OS reinstall instead of trying to clean the Malware?

Most of the time.

PUM stands for: _______________

Potentially Unwanted Modifications PUMs are detected when specific modifications are made to the Windows Registry. Malware may modify the Windows Registry to obscure its location and make recovery difficult. To ensure you have authorized these modifications, your MalwareBytes software alerts you whenever a PUM is detected.

PUP stands for: _______________

Potentially Unwanted Program Detected by MalwareBytes software. PUPs usually come in the form of toolbars, bundle-ware, bloatware, or similar programs that exhibit unwelcome behavior. PUPs can diminish user's experience, but are not classified as malware.

What are a few common ways computers get infected?

Spam Emails Infected Removable Drives Bundled with Program Installations Hacked or Compromised Websites

If a computer is infected with a _____ then you should almost always reinstall the operating system.

malware