Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

An IT technician at a pharmaceutical testing laboratory is responding to a Windows workstation that exhibits heavy background network activity, unauthorized pop-up windows, and degraded performance. The technician confirms the presence of malware. Which TWO of the following actions should the technician take NEXT prior to initiating anti-malware remediation tools?

  1. Disconnect the workstation's Ethernet cable and disable Wi-Fi adapters.Answer
  2. Disable Windows System Restore (System Protection) on the infected workstation.Answer
  3. C
    Create a new manual system restore point to preserve the OS baseline.
  4. D
    Schedule daily automated antimalware scans and system update tasks.

Answer

The technician must isolate the infected system by disconnecting network interfaces and disable Windows System Restore prior to executing malware remediation.
According to CompTIA's standard 7-step malware removal procedure (1. Identify, 2. Isolate, 3. Disable System Restore, 4. Remediate, 5. Schedule scans/updates, 6. Enable System Restore, 7. Educate end user), immediately after identifying the malware symptoms, the technician must isolate the infected system (unplug network interfaces) and disable Windows System Restore before scanning or attempting removal.

Step-by-Step Solution

1
Identify malware symptoms
Malware presence confirmed based on network activity, pop-ups, and performance degradation.
Completes Step 1 of CompTIA's 7-step malware removal process.
2
Isolate the infected system
The computer is disconnected from Ethernet and Wi-Fi networks.
Prevents lateral malware movement across the local subnet (Step 2).
3
Disable System Restore
System protection is turned off and previous restore points are cleared.
Prevents the OS from creating backups containing malicious executable files (Step 3).

Key Concept

CompTIA 7-Step Malware Removal Procedure: Step 2 (Isolate) and Step 3 (Disable System Restore) must occur before Step 4 (Remediate).
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic