Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

A tier-1 desktop technician is dispatched to handle an enterprise Windows 11 workstation that has been infected with rogue software generating persistent security alerts and attempting unauthorized network transmissions. Place the following remediation steps in the exact sequence required by the standard CompTIA 7-step malware removal procedure.

  1. 1Unplug the physical Ethernet cable and disable all wireless network adapters on the workstation.
  2. 2Disable System Protection (System Restore) to purge existing restore points containing infected shadow copies.
  3. 3Boot the system into Safe Mode, update anti-malware signatures, and run a complete remediation scan.
  4. 4Configure automated recurring anti-malware scans and verify automatic OS update settings.
  5. 5Re-enable System Protection and manually generate a clean system restore checkpoint.

Answer

The proper sequence for remediating the infected system according to the CompTIA 7-step malware removal process is: 1. Unplug physical network connections (Isolate system) -> 2. Disable System Protection (Disable System Restore) -> 3. Boot into Safe Mode and run anti-malware scans (Remediate system) -> 4. Configure automated recurring scans and updates (Schedule scans/updates) -> 5. Re-enable System Protection and create a fresh baseline restore point (Enable System Restore).
The CompTIA standard 7-step malware removal process follows a strict linear sequence: 1. Identify malware symptoms, 2. Isolate infected systems, 3. Disable System Restore (in Windows), 4. Remediate infected systems (update anti-malware software; scan and use removal techniques), 5. Schedule scans and run updates, 6. Enable System Restore and create a restore point, and 7. Educate end users. Disconnecting network interfaces isolates the host (Step 2), followed by disabling System Restore to clear infected shadow copies (Step 3). System remediation via Safe Mode anti-malware scans follows (Step 4), after which automated update/scan routines are scheduled (Step 5). Finally, System Restore is safely re-enabled to establish a clean baseline point (Step 6).

Step-by-Step Solution

1
Isolate the infected machine from the network.
Network communication is halted, containing malware propagation.
Isolation must occur immediately after identifying symptoms to protect adjacent network infrastructure.
2
Disable System Restore / System Protection.
All existing restore points containing latent malicious files are removed.
If System Restore remains enabled, infected system files stored within restore points can cause reinfection after cleanup.
3
Remediate the infected system using anti-malware tools.
Malware files, registry keys, and processes are detected and removed.
Remediation requires updating definitions and running thorough scans, often in Safe Mode to prevent active process tampering.
4
Schedule automatic scans and verify software updates.
System defensiveness is reinforced against prospective threat variants.
Establishing automated scan schedules ensures ongoing proactive monitoring and patch compliance.
5
Enable System Restore and create a clean restore point.
A reliable, uncorrupted recovery baseline is established.
System Restore must only be re-enabled after complete verification of malware removal to ensure the newly created restore point is uninfected.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic