Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

A systems administrator at an automated distribution facility notices that a Windows-based picking console is periodically dropping local service responses, running unprompted background tasks, and generating unauthorized outbound connections. The administrator confirms a malware infection and immediately quarantines the console by disconnecting its Ethernet cable and turning off all wireless radios. According to CompTIA's standard 7-step malware removal procedures, which of the following actions should the administrator perform NEXT?

  1. Disable System Restore in Windows.Answer
  2. B
    Boot the computer into Safe Mode and run a full anti-malware scan using pre-downloaded signature updates.
  3. C
    Temporarily re-enable the network interface to download updated malware signature files from an internal repository server.
  4. D
    Create an immediate restore point to save the current configuration in case remediation damages system files.

Answer

The administrator should disable System Restore in Windows before attempting remediation.
CompTIA's official 7-step malware remediation process specifies the following sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware software / scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, 7. Educate the end user. Because the technician has already identified the symptoms and isolated the system, the mandatory next step is disabling System Restore.

Step-by-Step Solution

1
Analyze the current state within the 7-step malware removal process.
Step 1 (Identify symptoms) and Step 2 (Isolate the infected system) have already been completed.
The scenario explicitly notes confirmed symptoms and the active physical/wireless network isolation of the machine.
2
Determine the required 3rd step in CompTIA's standard malware removal methodology.
Step 3 dictates disabling System Restore (in Windows).
Disabling System Restore purges pre-existing restore points where malware components might reside and prevents clean snapshots from being polluted.
3
Evaluate subsequent steps (Step 4 Remediate, Step 5 Schedule scans, Step 6 Enable System Restore, Step 7 Educate user).
Remediation scanning and signature updates take place in Step 4, after System Restore is disabled.
Following the strict sequence prevents re-infection during or after cleanup.

Key Concept

CompTIA 7-Step Malware Remediation Best Practices
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic