Examkin

Question

Difficulty: HardMalware Symptoms and Standard Removal Procedures

An IT technician is remediating a severe malware infection on a Windows 11 workstation used in a healthcare clinic's billing department. The technician has confirmed the presence of rogue security software, disconnected all network interfaces, and disabled System Restore. When attempting to launch the local anti-malware utility to scan the system, the malicious process immediately forces the security application to close. Which of the following is the NEXT best step the technician should take to remediate the machine?

  1. Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scanAnswer
  2. B
    Reconnect the network interface cable to allow cloud-based anti-malware signatures to update automatically
  3. C
    Enable System Restore and roll back the system to an automatically generated baseline checkpoint
  4. D
    Execute the sfc /scannow command from an elevated command prompt to purge active malware processes

Answer

Boot the workstation into Safe Mode or a pre-installation environment to update definitions and run the scan
When active malware interferes with security tools in standard Windows operational mode, booting into Safe Mode or an isolated pre-installation environment (such as WinPE) prevents third-party malware services and startup hooks from running. This allows the technician to update anti-malware definitions (via USB/offline package) and execute remediation scans successfully as part of Step 4 in the CompTIA removal process.

Step-by-Step Solution

1
Assess current progress within the CompTIA 7-step malware removal framework
Step 1 (Identify), Step 2 (Isolate), and Step 3 (Disable System Restore) are complete. The technician is performing Step 4 (Remediate infected systems).
Remediation requires updating anti-malware signatures and running scans to remove malicious files.
2
Analyze the barrier preventing standard anti-malware execution
The malware uses active self-defense mechanisms in standard boot mode to kill security software processes.
Rogue software relies on active background services and startup registry entries running in standard user mode.
3
Implement a minimal boot environment to bypass malware persistence
Safe Mode or a WinPE boot environment loads only essential operating system drivers.
Disabling non-essential startup items prevents the malware process from starting, enabling security software to execute scans and clean infected files.

Key Concept

CompTIA 7-Step Malware Remediation Procedure - Step 4 (Remediate Infected Systems)
Estimated Time:2m 0s
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic