Security · Topic 6 of 13
Malware Types and Protection
Identify viruses, worms, trojans, ransomware, spyware, rootkits and other malware, and choose the tools and habits that detect, remove and prevent them.
- 4 min
- A virus needs a host file. A worm spreads by itself. A trojan hides inside something that looks useful.
- Ransomware encrypts data for payment. Backups are the best defence.
- A keylogger records keystrokes, and spyware gathers information secretly.
What it is
Malware is any software built to harm a system or steal data. It often arrives through email attachments, bad downloads, infected Universal Serial Bus (USB) drives or website exploits. The exam asks you to identify the type from its behaviour and then choose the right tool or practice.
How it works
Malware types
| Type | Behaviour |
|---|---|
| Virus | Attaches to a file or program and spreads when the host is run or shared |
| Worm | Spreads on its own across a network without needing a host file |
| Trojan | Looks like useful software but carries a hidden harmful function |
| Ransomware | Encrypts files or locks the system, then demands payment |
| Spyware | Secretly gathers information about the user |
| Keylogger | Records what is typed, often to steal passwords |
| Rootkit | Hides deep in the operating system (OS), often at a level that evades normal scans |
| Boot sector virus | Infects the startup code of a drive, so it loads before the OS |
| Cryptominer | Uses the computer's processor to mine cryptocurrency for someone else |
| Stalkerware | Spyware that secretly monitors a person on their phone or personal computer (PC) |
| Botnet member (bot) | A compromised device that a remote attacker controls with many others |
| Potentially unwanted program (PUP) | Bundled software the user did not intend to install |
A trojan does not replicate on its own, a worm does, and a virus needs a host file.
These three differences are the usual way the exam separates them.
Ransomware is best handled with prevention and backups. Paying does not guarantee the files come back. Stalkerware and spyware are often found as unfamiliar apps with broad permissions.
Fileless malware
Fileless malware runs in memory and abuses legitimate tools such as PowerShell or Windows Management Instrumentation (WMI), so it leaves no file on disk. Signature based scans miss it. Behaviour based detection such as EDR helps, and a restart clears the memory copy, although persistence settings may need to be removed too.
Tools for detection and removal
| Tool or method | Use |
|---|---|
| Antivirus and antimalware software | Scans for known malware and suspicious behaviour, quarantines or removes it |
| Endpoint detection and response (EDR) | Monitors behaviour across many endpoints and helps respond to threats |
| Software firewall | Blocks unwanted network traffic to and from the computer |
| Recovery mode or safe mode | Starts Windows with minimal drivers so malware is less active during cleanup |
| Windows Recovery Environment | Offline tools to scan, repair or restore a system that will not start normally |
| OS reinstallation | Wipes and rebuilds a system when cleaning cannot be trusted |
Rootkits are the case for offline or boot time scans, because they hide from tools that run inside the infected OS. If a system cannot be trusted after a deep infection, reinstalling the OS from known good media is the dependable answer.
Larger services build on EDR. MDR (managed detection and response) is an outsourced service whose analysts monitor and respond to threats around the clock. XDR (extended detection and response) correlates data from endpoints, email, network and cloud tools in one place.
Prevention
- Keep software updated. Patching removes the flaws that malware uses.
- Run antimalware with current definitions. Turn on real time protection.
- Use least privilege. A standard user account limits what malware can change.
- Filter email and web traffic. Block known bad attachments and sites.
- Educate users. Anti phishing training and guidance on common threats reduce risky clicks.
- Keep tested backups. Backups make ransomware recoverable.
- Control removable media. Disable AutoRun and scan USB drives.
Detection by symptom
Malware symptoms include slow performance, pop ups, redirected browsers, unexpected network activity, disabled security tools and locked or renamed files. The chapter on software troubleshooting covers these symptoms in more detail.
When a scenario says malware keeps returning or hides from the scanner, think rootkit and choose an offline scan or reinstall. When it says files are encrypted and a payment is requested, think ransomware and recovery from backup.
What to remember for the exam
- A virus needs a host file. A worm spreads by itself. A trojan hides inside something that looks useful.
- Ransomware encrypts data for payment. Backups are the best defence.
- A keylogger records keystrokes, and spyware gathers information secretly.
- A rootkit hides deep in the OS and may need an offline scan or a reinstall.
- A cryptominer causes high processor use and heat.
- Antivirus, a software firewall and updates are core prevention.
- User education reduces phishing success.
- Recovery mode or safe mode helps during cleanup.
- Reinstalling the OS is the last resort for a deep infection.
Common mistakes
Mixing up worms and viruses. Worms spread on their own over networks. Viruses need a host file to be run.
Trusting the scan result after a rootkit. Scans inside the infected OS may miss it, so use an offline scan.
Paying a ransom. There is no guarantee of recovery, so restore from backup.
Relying on antivirus alone. It does not replace updates, least privilege and training.
Check yourself
Which malware spreads across a network without a host file?
A worm.
Which malware hides itself from normal scans at a deep OS level?
A rootkit.
What is the best defence that makes ransomware recoverable?
Regular, tested backups kept separate from the computer.
Topic 6 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.