Malware and Ransomware Prevention
This domain tests malware categories and delivery routes, the everyday controls that stop execution, and the first actions when ransomware is suspected. Scenario items usually describe a file, a pop-up or a suddenly slow machine and ask what to do first.
Know the categories
A virus needs a host and user action. A worm self-propagates across networks. A trojan disguises itself as useful software. Spyware and keyloggers capture data and input. A rootkit hides at a privileged level. Ransomware encrypts data and demands payment, often after stealing it, which is double extortion. Infostealers harvest browser credentials and session cookies. Fileless or living-off-the-land attacks use built-in signed tools such as PowerShell.
Delivery routes
Phishing attachments and links, macro-enabled Office documents, cracked software and key generators, fake update prompts, infected USB media, and exposed remote desktop with weak credentials or unpatched internet-facing services.
Prevention that actually blocks execution
Patch promptly, remove local administrator rights, use application allowlisting, disable macros from internet sources, filter email and web traffic, deploy endpoint detection and response, and keep 3-2-1 backups with at least one offline or immutable copy.
Ransomware response
Isolate the host from the network, do not power it off or start deleting, note the time, preserve the screen and any message, and report immediately. Do not pay; payment funds crime and does not guarantee recovery. Restore from a verified clean backup and rebuild rather than trust a cleaned machine.
Worked example
A user opens an invoice named invoice.docm, enables content when prompted, and Word spawns PowerShell that contacts an external IP. Reasoning: an unexpected macro-enabled document plus a script interpreter making outbound connections is a classic execution chain. Correct response: disconnect the network cable or disable Wi-Fi, leave the machine running, record what happened and when, and call the incident line so the team can check for lateral movement and confirm backup integrity.
Marks that are easy to lose
- Believing one platform is immune to malware.
- Thinking paying is the fastest recovery.
- Disabling antivirus to install unlicensed software.
- Assuming backups are usable without a restore test.