Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

An IT support technician is assisting a financial analyst whose Windows 11 laptop displays multiple unexpected pop-up notifications claiming the system is compromised, alongside severe performance degradation. The technician has confirmed the symptoms, disconnected all physical network cables, and disabled the Wi-Fi card to quarantine the infected host from the enterprise network. According to standard CompTIA malware removal procedures, which action should the technician perform NEXT?

  1. Disable System Protection and delete existing restore points on the infected system.Answer
  2. B
    Connect an external storage drive to perform an immediate full system backup before scanning.
  3. C
    Run an anti-malware definition update and execute a full background scan.
  4. D
    Conduct end-user training on identifying phishing vectors and suspicious browser pop-ups.

Answer

Disable System Protection and delete existing restore points on the infected system.
According to the official CompTIA 7-step malware removal process (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), the immediate next step after isolating the system is to disable System Restore/System Protection. This prevents Windows from saving copies of malware into restore points during remediation.

Step-by-Step Solution

1
Identify current progress in the 7-step malware removal workflow.
The technician completed Step 1 (Identify malware symptoms) and Step 2 (Isolate the infected system).
The scenario states symptoms were confirmed and all network adapters (Ethernet and Wi-Fi) were disconnected.
2
Determine the next sequential step in the process.
Step 3 of the CompTIA malware removal process is to Disable System Restore (in Windows).
If System Restore remains enabled during remediation, infected files or registry keys could be backed up into shadow copies or restored accidentally.
3
Select the option that matches Step 3.
Disabling System Protection/System Restore is the correct immediate next step.
This halts automatic creation of system restore points containing malicious files before running cleanup scans.

Key Concept

CompTIA 7-Step Malware Removal Process
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic