Endpoint Security Concepts · Topic 6 of 6
Malware Scanning, Scan Logs and Remediation
Learn the steps of malware removal: signs of infection, scanning, reading scan logs, isolating the device and fixing the cause of the infection.
- 4 min
- Isolate an infected device from the network early.
- Update the security software before scanning.
- A full scan is thorough but slow, and a quick scan is fast but limited.
What it is
Malware removal is the process of finding malicious software on a device and putting the device back into a safe state.
It is more than running a scan. You must contain the infection, remove it, find out how it got in, and check that it is really gone.
This page follows the steps in order and explains what to look for in a scan log.
How it works
A calm, ordered approach prevents the infection from spreading and from coming back.
Signs of infection
- the device is suddenly slow, or the fan runs hard when it should be idle
- pop ups, new toolbars or a changed browser home page
- programs that crash, or security tools that are turned off
- unknown programs or processes
- files that are missing, renamed or encrypted
- unexpected network traffic
These signs can also have other causes, so confirm with a scan and the logs.
Step by step remediation
- Identify the symptoms and confirm that there is a problem.
- Isolate the device by disconnecting it from the network, so malware cannot spread or send out data.
- Scan the system with up to date security software.
- Review the scan log to see what was found and where.
- Remove or quarantine the malware, and repair or restore any damaged files.
- Find the cause and close the gap, for example by patching or changing a weak password.
- Verify with a new scan and by checking that the device behaves normally.
- Document what happened and what was done, and tell users what they should learn from it.
Quarantine moves a file to a safe place where it cannot run, so that it can still be examined later.
Scanning
Security software offers different scan types.
| Scan type | Use |
|---|---|
| Quick scan | Checks the places malware most often hides, and runs fast |
| Full scan | Checks every file, and takes much longer |
| Offline or boot time scan | Runs before the full operating system loads, to find malware that hides while the system is running |
| Scheduled scan | Runs on a regular timetable without user action |
Make sure the security software and its signature database are up to date before scanning. Old definitions miss new malware. Signature based tools find known malware, while behaviour based detection looks for suspicious actions and can catch new threats.
Some malware, such as a rootkit, can hide from tools running inside the infected system. In that case, an offline scan from separate trusted media may be needed.
Reviewing scan logs
A scan log lists what the scan checked and what it found. A typical entry shows:
- the name or type of the threat
- the file or location where it was found
- the action taken, such as quarantined, removed or skipped
- the date and time
Read the log carefully. A threat that is listed as skipped or failed to remove still needs attention.
Check whether the same threat appears on other devices, because that suggests the infection is spreading. Also note where the file came from, as this can show how the malware arrived.
When to rebuild
Sometimes cleaning is not enough. If the malware gained administrator rights, if a rootkit is present, or if you cannot be sure the system is clean, the safest answer is to wipe the device and rebuild it. Restore the user data from a backup that was made before the infection, and scan it before use.
After any serious infection, change passwords used on the device, because a keylogger or spyware may have stolen them.
What to remember for the exam
Seven facts cover most questions on this topic.
- Isolate an infected device from the network early.
- Update the security software before scanning.
- A full scan is thorough but slow, and a quick scan is fast but limited.
- An offline scan can find malware that hides while the system runs.
- Review the scan log for what was found, where, and what action was taken.
- Remediation includes finding and fixing how the malware got in.
- Rebuild the device when you cannot trust that it is clean.
Disconnect first, then scan. Spreading is the biggest risk in the first minutes.
Common mistakes
These four errors are common.
Scanning with old definitions. Out of date signatures miss new malware.
Removing malware but not the cause. The same weakness lets the infection return.
Ignoring skipped items in the log. A skipped threat may still be active.
Restoring backups without checking them. A backup made after the infection can bring the malware back.
Leaving an infected computer on the network can let malware spread to other devices within minutes.
Check yourself
Work through these three questions.
Why isolate an infected device before cleaning it?
Disconnecting it from the network stops the malware from spreading or sending out data.
Why review the scan log after a scan?
It shows what was found, where it was, and what action was taken, so you can spot items that were skipped or that failed to be removed.
When is it best to rebuild a device instead of cleaning it?
When the malware had administrator rights, a rootkit is present, or you cannot be sure the system is clean.
Topic 6 of 6 in Endpoint Security Concepts
Test yourself on Endpoint Security Concepts
The full Cisco CCST 100-160 Cybersecurity question bank has 864 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.