Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

A desktop support technician is servicing a Windows workstation at a hotel reception desk that exhibits severe browser redirects, persistent pop-up advertising, and unauthorized outbound network traffic. The technician has confirmed the malware infection and physically disconnected the system's Ethernet cable to isolate it from the network. Which of the following actions should the technician perform NEXT according to standard malware removal procedures?

  1. Disable System Restore in Windows.Answer
  2. B
    Boot the system into Safe Mode and run a complete anti-malware scan.
  3. C
    Reconnect the network cable to update anti-malware definition files.
  4. D
    Enable System Restore and create a clean restore point.

Answer

Disable System Restore in Windows as the immediate next step following isolation.
According to the official CompTIA 7-step malware removal process, once malware symptoms are identified (Step 1) and the system is isolated from the network (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. Disabling System Restore deletes existing restore points, ensuring that infected files stored in shadow copies cannot reinfect the workstation.

Step-by-Step Solution

1
Identify malware symptoms
Confirmed malware symptoms (browser redirects, pop-ups, unauthorized traffic).
Establishes that the system is infected (Step 1).
2
Isolate the infected system
System disconnected from Ethernet network.
Prevents potential lateral movement of malware across the LAN (Step 2).
3
Disable System Restore
System restore points are turned off and existing restore points are purged.
Prevents malicious files and registry keys from being backed up into system restore points or restored automatically (Step 3).

Key Concept

CompTIA 7-Step Malware Remediation Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic