Ethical › Module 7 › Lesson 3
Detection and Recovery Habits
Updates, backups, isolate, reinstall from trusted media.
Visual · malware_detection_recovery
Defender order on a device YOU own: stay patched, keep restorables, isolate a dirty session, reinstall from media you trust — not a sample detonation.
Opening
Detection is a habit on your own silicon. Recovery is isolate, then restore — not a second unknown antivirus APK.
Lessons 1–2 named families and the yeses that let them run. This lesson is what you do before and after on hardware you own. Detection, as Cyberlium uses the word, is not a cinematic sandbox where you detonate a specimen. It is noticing unexpected installs, blocked unknown sources, scanner alerts you did not invite, and the boring status pages: OS patch date, backup last success, Play Protect or system security state. Recovery is Topic 6’s Android IR shape lifted to any device: stop feeding the dirty session, revoke from a clean device, then rebuild from trusted media. You will not hack the operator back. You will not pay ransomware as a lab. You will not restore the same trojan from an “everything” backup. This lesson is ORIGINAL Cyberlium teaching mapped to the CEH v13 malware-threats domain — not official EC-Council training, not a certification, not exam dumps. Next is a checklist lab on YOUR phone and YOUR computer. Here you write the order, lock malware-detection-notes.txt, and treat live samples as still forbidden.
1. Detection is inventory plus alerts — not detonating a file to “see”
A defender notices what should already be true. Updates installed (Module 5: a CVE is a named bug you patch, not a PoC you run). Apps you recognize in the list. Unknown-source installers off except a source you can name. Backups that actually completed. Built-in security (OS firewall, SmartScreen / Play Protect class filters) turned on. Unexpected Device admin, Accessibility, or a new browser extension you did not add is a detection on a device you own — Topic 6 already walked those Android screens. You do not confirm by downloading the same family from a malware site. You do not confirm by scanning a café /24 for “more infected hosts.” Unauthorized scanning is still Module 3’s ethics failure even when the story is malware.
Antivirus and similar filters are useful and incomplete. They miss first-seen files (Topic 6 said the same of Play Protect). A clean scan is not a certificate that last week’s sideload was fine. A red alert is not permission to keep the file “for class.” Quarantine or delete on YOUR machine, write the product name and date in notes, and stop. Do not upload specimens to random Telegram “analysts.” Do not clone exploit repos because a popup named a CVE. Lesson 1’s family word is enough to pick the next control: isolate and restore, not reverse the binary.
Command guide
Detection is inventory plus alerts — WHAT/WHY (no detonate)
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' detection: inventory of what I run + alerts I actually look at refuse: detonating samples to see behavior EOF
2. Updates and backups are the controls that make families expensive
Patches close the wormable holes history keeps naming. A downloaded update that never rebooted is a file on disk, not a closed door. Three planes still matter on phones (OS / Play system / apps) and the PC cousins (OS, browser, office, mail client). Official Settings tiles and vendor pages you typed only — never an email that says tap here to patch. That email is Lesson 2’s foothold wearing this lesson’s vocabulary. Module 5’s risk treatment still holds: patch with an owner and a version check, not a Metasploit screenshot titled remediation.
Backups are how ransomware’s intent fails. Topic 6 split photos (files) from APKs and full app+data blobs that can walk the trojan home. The same split applies to a PC: documents and photos vs installer folders and system images taken while infected. 3-2-1 still applies: more than one copy, more than one medium, one copy the encryptor cannot reach (offline, versioned cloud, a disk you unplug). An untested restore is a wish. Restore a harmless file you own as a drill while healthy. After infection, restore data, reinstall programs from official channels — do not restore the surprise installer from Downloads.
3. Isolate, then reinstall from trusted media — Topic 6 IR without hack-back
If you suspect the device you own is dirty, stop using banking and mail on it. Disconnect if money is leaving or the machine is screaming unexplained traffic — containment, not a forever-offline lifestyle. From a CLEAN device you own (or are lent with consent), revoke sessions, rotate unique passwords, confirm MFA (Topic 4 / 5). On the dirty device: uninstall unexpected programs, disable mystery admin/accessibility, run the built-in scanner. If it persists, copy photos and documents as files, then reinstall the OS from media you trust: OEM recovery, vendor ISO you fetched from a page you typed (hash if the vendor publishes one), or factory reset on a phone you own. Trusted media is not a USB a stranger handed you and not a “windows-loader” from a forum.
Reinstall is a last honest step, not a shame sentence. Shame delays IR; attackers budget for delay. After rebuild: apps from official stores and vendor sites you initiate, unknown sources off, backups re-established, watch account alerts a few days. Work devices: tell IT facts (what you installed, when), not a confession essay. You recover hardware and accounts you control. You do not remotely wipe a roommate. You do not DDoS a domain you found in a log. You do not pay a ransom as Cyberlium homework. Payment is a legal and practical decision outside this course; it is never a lab checkbox.
4. What recovery is not: pay, hack back, restore the malware, second unknown AV
A blog that says “best ransomware decryptor” plus a download is often another trojan. A second unknown antivirus APK is Topic 6’s stacked dropper. Restoring a full disk image from the night of the infection is how Device admin comes home. Hack-back is still unauthorized access even if you are angry. Those four failures feel like action. The real action is already listed: isolate, revoke from clean hardware, rebuild from trusted media, restore files not programs. Write that order while you are calm so Lesson 4’s audit is a checklist, not invention under panic.
Empty notes fail. Notes that include other people’s hostnames, specimen hashes you fetched, or a ransom chat log you kept as a trophy fail ethics even if the OS is clean. chmod 600. Next lesson will tick updates, backups, and unknown-source settings on devices you actually own — still no samples.
5. Wrong vs right: detonating samples vs patch, backup, isolate, trusted reinstall
Worked failure — same scare, opposite next hour. Right never needs a live binary when the order is already a habit.
Wrong
Download a sample to “see detection.” Pay a ransom as a lab. Restore full app backup from the infected night. Sideload a second AV APK. Scan the café for victims. Hack-back the C2. Skip patches because updates “slow the box.” This path is not official CEH training and does not give you that circus.
Right
Keep OS/apps updated. Keep restorables the encryptor cannot reach. If dirty: isolate, revoke from a clean device, reinstall from trusted media, restore files not surprise installers. Write $HOME/cyberlium-lab/malware-detection-notes.txt, chmod 600. Next: Lab — Personal Malware Hygiene Audit.
6. Hands-on: write the order, then lock malware-detection-notes.txt
On a computer you own, fill the detection/recovery order in your words. Optional: copy YOUR current OS update status and last backup date — facts about your device, not a scan of anyone else. Do not fetch a specimen to generate an alert. chmod 600. The helper only prints the order and refuses extra arguments.
Command guide
Isolate then reinstall — WHAT/WHY (no hack-back)
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' ir_order: isolate -> preserve if needed -> reinstall from trusted media refuse: hack-back, DDoS the C2, detonate to confirm EOF
Mission: malware-detection-notes.txt in cyberlium-lab (mode 600)
1) Write detect / update / backup / isolate / trusted-reinstall in your own words. Optional: YOUR patch date and last backup success. 2) Fill $HOME/cyberlium-lab/malware-detection-notes.txt and chmod 600. 3) No samples, no ransom-as-lab, no hack-back, no café scans, no second unknown AV APK.
Stuck? Ask Cyberlium AI Mentor
If “I must run a sample to learn detection” still feels true, ask for a hint — not a binary. Try: "Hint only: why updates, backups, isolate, and reinstall from trusted media are the recovery lesson, why live samples and paying ransom are out, and where do locked notes live?" You still fill malware-detection-notes.txt. No café scan. No hack-back.
You now treat detection as habits on your own devices and recovery as isolate-then-rebuild from media you trust — carrying Topic 6 IR without a specimen. Notes are locked. This is original Cyberlium material covering the same domain as CEH v13 Module 7, not official training and not an exam dump. Next — Lab — Personal Malware Hygiene Audit — ticks updates, backups, and unknown-source installs on hardware you own. Still no samples.
Knowledge Check
APPLY: A popup says your PC is infected and a classmate wants a malware sample “to see if the scanner catches it.” What is detection/recovery here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: After ransomware, the ethical lab is to restore the full app backup from the infected night and sideload a forum decryptor.
True or False
Knowledge Check
APPLY: Which notes pairing matches this lesson’s ethics and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice