Examkin

Question

Difficulty: MediumWeb Browser Security and Pop-Up/Redirect Troubleshooting

A tier-2 desktop support technician is investigating a Windows 11 workstation where users report persistent pop-up advertisement redirects. While auditing the browser environment, the technician removes a rogue browser add-on, but finds that a local HTTP proxy setting pointing to address 127.0.0.1:8080127.0.0.1:8080 automatically reinstates itself in the system network settings every time the computer restarts. Which of the following actions should the technician perform NEXT to permanently resolve the redirect issue?

  1. Inspect Task Scheduler and background system services for unauthorized persistence scripts or executable files re-applying the proxy settings.Answer
  2. B
    Clear the web browser's local storage, cache, and SSL state cache via the Internet Options applet.
  3. C
    Run netsh winsock reset from an elevated command prompt to repair corrupted local system file signatures.
  4. D
    Configure User Account Control (UAC) to the highest level to block unauthorized web page redirects.

Answer

Inspect Task Scheduler and background system services for unauthorized persistence scripts or executable files re-applying the proxy settings.
Inspecting Task Scheduler and background services directly targets the persistent loader causing the setting to revert. Adware and browser hijackers frequently write scheduled tasks or background services to monitor and re-apply proxy registry entries whenever the user logs in or reboots.

Step-by-Step Solution

1
Analyze the symptom of automatic setting re-initialization upon system restart.
Identified that an external system mechanism outside the browser application is maintaining persistence.
When browser configuration changes revert across system reboots, an operating system startup item, scheduled task, or background service is actively modifying registry keys.
2
Check persistent operating system launch locations including Task Scheduler, Services, and Startup keys.
Locate and disable the unauthorized task or background process responsible for enforcing 127.0.0.1:8080127.0.0.1:8080 proxy redirection.
Removing the underlying startup loader prevents the malicious proxy configuration from re-engaging.
3
Reset the proxy configuration back to default settings and verify remediation.
Browser network settings remain clean after subsequent reboots.
Ensures complete removal of both the hijack payload and its persistence mechanism.

Key Concept

Browser Hijacker Persistence Remediation
Estimated Time:1m 15s
Rate this question

Topics

Web Browser Security and Pop-Up/Redirect Troubleshooting

More questions from this topic