Examkin

Question

Difficulty: MediumWeb Browser Security and Pop-Up/Redirect Troubleshooting

A desktop support technician is remediating an enterprise workstation experiencing severe browser hijacking, unexpected ad pop-ups, and forced website redirects. Place the following remediation steps in the correct order to resolve the browser compromise and verify system integrity.

  1. 1Disconnect the workstation from the network to isolate the system from potential command-and-control servers.
  2. 2Terminate running browser processes using Task Manager.
  3. 3Remove malicious browser extensions and restore browser default configurations.
  4. 4Check network proxy configurations and inspect the Windows hosts file for unauthorized entries.
  5. 5Execute a full anti-malware scan and reconnect the system to verify clean browser operation.

Answer

The correct order of remediation is: First, isolate the workstation from the network. Second, terminate active browser processes via Task Manager. Third, remove rogue browser extensions and reset browser defaults. Fourth, check system proxy settings and the hosts file for unauthorized redirect rules. Fifth, run a full anti-malware scan and reconnect the network to verify system functionality.
The correct remediation sequence follows standard incident containment and malware removal procedures: first isolating the machine to stop malicious data transfer, stopping active processes to release file locks, clearing localized browser extensions and settings, auditing OS-level redirect mechanisms (hosts file and proxy settings), and finally scanning for secondary payloads while verifying clean connectivity.

Step-by-Step Solution

1
Isolate the compromised system from the network.
Network communication between the host and malicious external servers is halted.
CompTIA best practices dictate containing the incident prior to active remediation.
2
Close malicious or frozen browser tasks using Task Manager.
Browser memory is freed and open lock handles on profile files are released.
Terminating processes stops ongoing pop-ups and allows profile resetting without file access conflicts.
3
Remove rogue extensions and perform a browser reset.
Adware addons, hijacked homepages, and altered search engines are removed.
Unwanted extensions are the primary vector for persistent browser redirects and ad injections.
4
Inspect Windows hosts file (C:\Windows\System32\drivers\etc\hosts) and system proxy settings.
System-wide redirect configurations and loopback/proxy hijack entries are identified and purged.
Hijackers frequently alter proxy settings or append malicious static IP mappings into the hosts file to maintain redirects across browsers.
5
Perform anti-malware scanning and functional verification.
Secondary payload components are removed and browser behavior is confirmed clean under active network conditions.
Final scanning ensures no rootkit or trojan dropper remains, while live testing confirms full resolution.

Key Concept

Browser Security and Hijack Remediation Workflow
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic