Examkin

Question

Difficulty: MediumMalware Symptoms and Standard Removal Procedures

An IT technician at a regional logistics center is responding to a Windows workstation displaying unauthorized pop-ups and rogue security software alerts. Arrange the following malware remediation actions in the correct sequence according to standard CompTIA 7-step procedures, starting from the earliest step to the final step.

  1. 1Disconnect the computer from the local network and disable wireless connections.
  2. 2Disable Windows System Restore to clear existing restore points.
  3. 3Update anti-malware signatures and perform a comprehensive system scan in Safe Mode.
  4. 4Re-enable Windows System Restore and generate a clean system restore point.
  5. 5Conduct a brief security awareness session with the primary operator on identifying malicious email attachments.

Answer

The proper sequence follows CompTIA's standard 7-step malware remediation process: 1) Disconnect network connections to isolate the system, 2) Disable System Restore, 3) Update anti-malware signatures and scan/remediate, 4) Re-enable System Restore and create a new restore point, and 5) Educate the end user.
The standard CompTIA workflow dictates isolating the host first to contain the infection, disabling System Restore to purge infected backup states, updating definitions and remediating the system, restoring System Restore with a clean baseline, and concluding with end-user education.

Step-by-Step Solution

1
Identify the immediate containment action required after detecting malware.
Disconnecting network interfaces isolates the machine (Step 2).
Isolating the system prevents rogue software from communicating with command-and-control servers or spreading across the LAN.
2
Prepare the system for clean remediation by preventing infected restore image retention.
Disabling System Restore purges existing system snapshots (Step 3).
If System Restore remains enabled, infected files might be saved or re-initialized during recovery attempts.
3
Apply anti-malware engine updates and eliminate the threat.
Updating definitions and running an in-depth scan removes the malware (Step 4).
Up-to-date signatures are required to detect and clean modern malware variants effectively.
4
Restore system protection infrastructure.
Re-enabling System Restore and creating a fresh restore point secures a known-good baseline (Step 6).
Once the machine is fully remediated, establishing a fresh restore point protects future working states.
5
Provide preventative guidance.
Educating the end user completes the process (Step 7).
Training users on threat vectors prevents re-infection from similar attacks.

Key Concept

CompTIA 7-Step Malware Removal Procedure
Estimated Time:1m 30s
Rate this question

Topics

Malware Symptoms and Standard Removal Procedures

More questions from this topic