Antivirus, Windows Defender & Malware Removal

Table of Contents

1. Introduction to Malware
   • What is Malware?
   • Objectives of Malware
   • Brief History of Malware
   • Malware Categories at a Glance
   • How Malware Spreads
2. Viruses
   • What is a Virus?
   • Common Types of Viruses
   • Famous Viruses
   • How a Virus Works
3. Worms
   • What is a Worm?
   • How Worms Spread
   • Famous Worm Attacks
4. Trojan Horses
   • What is a Trojan?
   • Common Trojan Types
   • Famous Trojans
   • Virus vs Worm vs Trojan
5. Spyware
   • What is Spyware?
   • What Spyware Can Collect
   • Common Spyware Types
   • Signs of Spyware Infection
   • Real-World Spyware Examples
6. Adware
   • What is Adware?
   • Legitimate vs Malicious Adware
   • How Malicious Adware Works
7. Keyloggers
   • What is a Keylogger?
   • Types of Keyloggers
   • Spyware vs Adware vs Keylogger
8. Rootkits
   • What is a Rootkit?
   • Types of Rootkits (by Depth)
   • Famous Rootkit Examples
9. Botnets
   • What is a Botnet?
   • Botnet Architectures
   • What Botnets Are Used For
   • Famous Botnets
10. Ransomware
    • What is Ransomware?
    • Evolution of Ransomware
    • Types of Ransomware
    • Double & Triple Extortion
11. Malware Infection Process
    • The 6 Stages of Infection
12. Prevention
    • The Defense-in-Depth Model
    • The 3-2-1 Backup Rule
    • Essential Prevention Checklist
    • Which Prevention Blocks Which Infection Stage

Part 1: Antivirus & How It Works

Antivirus detects, prevents, and removes malware using signatures, heuristics, and behavior monitoring.

What is Antivirus?

AV is the first layer of security that detects both known and unknown malware.

Antivirus (AV) is software designed to detect, prevent, and remove malware. Modern AV has evolved into EDR (Endpoint Detection and Response) — behavior-based protection, not just signature matching.

Detection Methods

AV detects malware in 6 ways — signature, heuristic, behavior, cloud, sandbox, and ML.

Signature-Based Detection (Traditional)

Compares file hash against a known malware database — old method, fails on new malware.

File being scanned
        │
        ▼
Compute hash (MD5/SHA256)
        │
        ▼
Compare against Signature Database
   ┌──────────────────┐
   │ Is hash in AV     │
   │ database?         │
   └──────┬───────┬───┘
          │       │
         YES      NO
          │       │
          ▼       ▼
    🛑 BLOCKED   ✅ CLEAN / Send to heuristic

Limitation: Only catches KNOWN malware — new/modified malware evades signature detection.

Heuristic Detection (Modern)

Scores file behavior and code patterns — catches unknown malware too.

File/Program being analyzed
        │
        ▼
Analyze code structure + behavior + patterns
        │
        ▼
Score based on suspicious indicators:
  ┌─────────────────────────────────────┐
  │ • Tries to modify system files ──── +3  │
  │ • Uses encryption APIs ──────────── +2  │
  │ • Accesses registry startup keys ── +2  │
  │ • Creates network connections ───── +1  │
  │ • Self-modifying code ───────────── +4  │
  │ • Digitally signed? ─────────────── -3  │
  └─────────────────────────────────────┘
        │
        ▼
   If score > threshold → 🛑 BLOCKED (even if hash unknown)

Common AV Terminology

Basic AV terms — OTS, RTP, Quarantine, False Positive/Negative, Heuristics.

Antivirus Comparison

Top AV comparison — Defender (free), Bitdefender (best protection), Malwarebytes (removal), CrowdStrike (enterprise).

Note: Detection rates vary by year/test lab (AV-Test, AV-Comparatives). Always check latest results.

Part 2: Windows Defender (Microsoft Defender)

Built-in AV in Windows 10/11 — free, 98-99% detection rate, enterprise-grade protection.

What is Windows Defender?

Microsoft's built-in AV providing real-time protection, cloud-delivered intelligence, and tamper protection.

Windows Defender (now called Microsoft Defender Antivirus) is the built-in antivirus solution in Windows 10 and Windows 11. It provides enterprise-grade protection for free — no third-party AV needed for most users.

✅ Fact: Windows Defender consistently scores 98-99% in independent AV tests. It's one of the BEST free antivirus solutions available.

Key Features

8 key features — Real-time Protection, Cloud-Delivered, Controlled Folder Access, Tamper Protection, and more.

Windows Defender Dashboard

The main Windows Security interface — Virus protection, Firewall, App control, Device security.

Windows Security
┌─────────────────────────────────────────────────┐
│  🛡️ Virus & threat protection                   │
│     ┌──────────────────────────────────────┐    │
│     │ Current threats: No actions needed.   │    │
│     │ Last scan: Today, 3:00 AM             │    │
│     │ 7 quick scans, 2 full scans this week │    │
│     │ ✅ Real-time protection: ON            │    │
│     │ ✅ Cloud-delivered protection: ON      │    │
│     │ ✅ Tamper Protection: ON               │    │
│     └──────────────────────────────────────┘    │
│                                                  │
│  🔥 Firewall & network protection                │
│  💻 App & browser control                        │
│  🔐 Device security                              │
│  📊 Device performance & health                  │
│  👨‍👩‍👧‍👦 Family options                           │
└─────────────────────────────────────────────────┘

Important Windows Defender Settings

7 settings that should be ON — Real-time, Cloud, Tamper Protection, and Controlled Folder Access.

How to Run Scans in Windows Defender

4 scan types — Quick (daily), Full (monthly), Offline (rootkits), Custom (specific folders).

Quick Scan (Default — Scans common infection areas)

Settings → Privacy & Security → Windows Security → Virus & threat protection
                                          → Quick Scan

Full Scan (Scans all files + running programs)

Scans the entire system — use monthly or after an infection.

Same path → Scan options → Full Scan

Microsoft Defender Offline Scan (Boot-level scan)

Scans before Windows boots — for rootkits and deep malware.

Same path → Scan options → Microsoft Defender Offline Scan → Scan Now │ ▼ Windows reboots, scans from boot (catches rootkits)

### Custom Scan (Specific folders)

>Scan only specific folders or drives — for targeted checks.

Same path → Scan options → Custom Scan → Choose folders

### Command-Line Defender Scan (Run as Admin)

>Run Defender scans from the command prompt using MpCmdRun.exe commands.

```cmd
# Quick Scan
MpCmdRun.exe -Scan -ScanType 1

# Full Scan
MpCmdRun.exe -Scan -ScanType 2

# Custom Scan (folder)
MpCmdRun.exe -Scan -ScanType 3 -File "C:\Path\To\Scan"

# Boot Sector Scan
MpCmdRun.exe -Scan -ScanType 1 -BootSectorScan

When to Use Third-Party AV Alongside Defender

When Defender alone is enough and when to use Malwarebytes or enterprise AV.

⚠️ Note: Most third-party AV will DISABLE Windows Defender automatically when installed. Only one real-time AV should run at a time.

Part 3: Malware Removal

Complete malware removal process — from disconnect to system restore and verification.

The 7-Step Removal Process

7 steps to follow in sequence — Disconnect → Safe Mode → Scan → Tools → Manual → Verify → Restore.

If you suspect malware infection, follow these steps IN ORDER:

STEP 1: DISCONNECT FROM NETWORK
STEP 2: ENTER SAFE MODE
STEP 3: RUN ANTIVIRUS SCAN
STEP 4: USE ANTI-MALWARE TOOLS
STEP 5: MANUAL CLEANUP
STEP 6: VERIFY REMOVAL
STEP 7: RESTORE & RECOVER

Step 1: Disconnect from Network

First and most important step — cut the network to prevent data leakage.

Why: Prevents data exfiltration, stops worm/botnet communication, blocks remote control.

• Pull Ethernet cable
• Disable WiFi (Airplane Mode)
• Disable Bluetooth

Step 2: Enter Safe Mode

Only essential drivers load in Safe Mode — malware doesn't load, making cleanup easier.

Safe Mode loads only essential drivers/services — many malware types don't load in Safe Mode.

How to enter Safe Mode (Windows 10/11):

Settings → Recovery → Advanced Startup → Restart Now
                              → Troubleshoot → Advanced Options
                              → Startup Settings → Restart
                              → Press 4 or F4 for Safe Mode

Alternative method:

1. Hold Shift key → Click Restart
2. Or: msconfig → Boot → Safe Boot → Minimal

Step 3: Run Antivirus Scan

Run Defender Full Scan and Malwarebytes in Safe Mode for maximum detection.

In Safe Mode, run:

1. Windows Defender Full Scan (or Microsoft Defender Offline)
2. Malwarebytes (free version — excellent for removal)

Step 4: Use Anti-Malware Tools

Advanced tools for specific malware types — AdwCleaner (adware), RogueKiller (rootkits), GMER (deep scan).

Step 5: Manual Cleanup

If AV fails, manual cleanup — check processes, startup, browser, network, and hosts file.

If AV fails to remove everything, manual cleanup may be needed:

Check Running Processes (Task Manager):

Ctrl + Shift + Esc → Details tab
Look for: Suspicious names, high CPU/memory usage, 
          no digital signature, unknown publishers

Check Startup Programs:

Task Manager → Startup tab
or: msconfig → Startup
or: Autoruns (Sysinternals) — most comprehensive

Check Browser Extensions:

Chrome:  chrome://extensions
Edge:    edge://extensions
Firefox: about:addons
Remove anything you didn't install

Check Network Connections:

netstat -ano
# Look for suspicious connections to unknown IPs
# Note PID for suspicious connections
tasklist | findstr [PID]

Check Hosts File:

Location: C:\Windows\System32\drivers\etc\hosts
Should contain only comments (#) and 127.0.0.1 localhost
Malware often redirects legitimate sites to malicious IPs here

Common Malware Locations to Check:

%TEMP%                          — C:\Users\[User]\AppData\Local\Temp
%APPDATA%                       — C:\Users\[User]\AppData\Roaming
%LOCALAPPDATA%                  — C:\Users\[User]\AppData\Local
%PROGRAMFILES%                  — C:\Program Files
%WINDIR%\System32\Tasks         — Scheduled tasks
%WINDIR%\Temp                   — System temp

Step 6: Verify Removal

Confirm whether the malware is gone — check AV scan, behavior, network traffic, browser settings.

Step 7: Restore & Recover

Restore from backup or use nuclear option (clean reinstall) — formatting is the only fix for rootkits.

If data was damaged:

• Restore from clean backup (3-2-1 rule!)
• File History → Restore previous versions
• Use ShadowExplorer to recover from Volume Shadow Copies

If everything fails (last resort):

⚠️  NUCLEAR OPTIONS:

1. System Restore
   If you have a restore point before the infection

2. Windows Reset (Keep Files)
   Settings → Update & Security → Recovery → Reset this PC
   ⚠️ Some malware survives this!

3. Clean Reinstall (Format & Reinstall Windows)
   ✅ 100% removes ALL malware
   ❌ You lose everything (backup first!)
   This is the ONLY guaranteed removal for rootkits

Malware Removal Decision Tree

Decision tree — which removal approach to use for working PC vs BSOD scenarios.

Is the computer working?
        │
    ┌───┴───┐
    YES      NO (BSOD, won't boot)
    │        │
    ▼        ▼
Run Defender   Try Windows Recovery Environment (WinRE)
Full Scan     → Safe Mode
    │         → System Restore
    ▼         → Reset this PC
Found malware? → Clean install
    │
  YES│  NO
    │  │
    ▼  ▼
In Safe Mode:  Still suspicious?
Run Malwarebytes → Yes → Try second opinion AV (HitmanPro)
+ AdwCleaner     → No → Likely clean
    │                   (monitor for a few days)
    ▼
Run Defender Full Scan again (verify removal)
    │
    ▼
If malware persists → Manual Cleanup (Autoruns, Process Explorer)
    │
    ▼
If still not removed → Clean Windows Reinstall

Common Mistakes in Malware Removal

8 common mistakes — paying ransom, running one scan, not changing passwords, not finding root cause.

Post-Removal Checklist

What to do after removal — change passwords, enable MFA, check financial accounts.

After removing malware:

✅ Change ALL passwords (use a password manager)
✅ Enable MFA on all accounts
✅ Update ALL software (patch exploited vulnerabilities)
✅ Review financial accounts for fraud
✅ Monitor credit reports (if identity theft risk)
✅ Review what data was compromised
✅ Update backup strategy (improve it)
✅ Learn from the incident — how did it happen?