A desktop support technician at a regional meteorology research institute discovers that a Windows workstation used for weather radar monitoring has been infected with a rootkit trojan. The technician needs to execute the standard CompTIA seven-step malware remediation process. Place the following remediation steps in the correct chronological order from first to last.
- 1Isolate the infected workstation by disconnecting its Ethernet cable and turning off Wi-Fi.
- 2Disable Windows System Restore to clear existing restore points containing infected files.
- 3Update anti-malware signatures and perform a full system scan in Safe Mode to remove the rootkit.
- 4Re-enable System Restore and create a clean baseline restore point.
- 5Train the meteorology staff member on identifying suspicious email attachments and phishing attempts.
Answer
The correct sequence follows the CompTIA 7-step malware remediation process: 1. Isolate the infected workstation (Quarantine), 2. Disable Windows System Restore, 3. Update anti-malware signatures and perform a full scan (Remediate), 4. Re-enable System Restore and create a clean restore point, 5. Train the user on security best practices (Educate user).
The correct order strictly follows the standard CompTIA malware removal procedure: Step 2 (Quarantine/Isolate), Step 3 (Disable System Restore), Step 4 (Remediate by updating definitions and scanning), Step 6 (Enable System Restore and create a restore point), and Step 7 (Educate the end user).
Step-by-Step Solution
Key Concept
CompTIA 7-Step Malware Remediation Best Practices