Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

An IT technician is troubleshooting a Windows workstation at a remote branch office that has been infected with browser-hijacking spyware and persistent adware. The technician has already identified the malware symptoms, disconnected the workstation from the local network, and turned off Windows System Protection (disabled System Restore). According to the CompTIA standard 7-step malware removal procedures, which of the following actions should the technician perform NEXT?

  1. Update the anti-malware signature files and perform a full remediation scan using targeted removal tools.Answer
  2. B
    Schedule recurring daily background scans and configure automatic operating system updates.
  3. C
    Re-enable System Protection and generate a new clean system restore point.
  4. D
    Replace the network interface card and storage drive assuming hardware failure is causing the performance degradation.

Answer

Update the anti-malware signature files and perform a full remediation scan using targeted removal tools.
CompTIA follows a strict 7-step malware removal process: (1) Identify malware symptoms, (2) Isolate infected systems, (3) Disable System Restore, (4) Remediate infected systems, (5) Schedule scans and run updates, (6) Enable System Restore and create a restore point, and (7) Educate the end user. Since the technician has already completed steps 1 through 3, the immediate next action required is Step 4: Remediating the infected system by updating anti-malware signatures and scanning/removing the threat.

Step-by-Step Solution

1
Analyze current progress in the 7-step malware removal process.
Completed steps are: Step 1 (Identify), Step 2 (Isolate system), and Step 3 (Disable System Restore).
CompTIA enforces a mandatory sequential ordering for malware remediation.
2
Identify the immediate subsequent step following Step 3.
Step 4 is 'Remediate infected systems', which includes updating anti-malware software and executing full system scans in a safe/isolated environment.
System restore must remain disabled while active scanning and removal tools clean the operating system.
3
Evaluate the choices to find the matching action.
Updating anti-malware definitions and running remediation scans directly corresponds to Step 4.
Steps 5 (Schedule scans), 6 (Enable System Restore), and 7 (End-user education) occur later in the process.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic