Examkin

Soru

Zorluk: OrtaMalware Symptoms and Standard Removal Procedures

A desktop support technician is servicing a Windows workstation at a hotel reception desk that exhibits severe browser redirects, persistent pop-up advertising, and unauthorized outbound network traffic. The technician has confirmed the malware infection and physically disconnected the system's Ethernet cable to isolate it from the network. Which of the following actions should the technician perform NEXT according to standard malware removal procedures?

  1. Disable System Restore in Windows.Cevap
  2. B
    Boot the system into Safe Mode and run a complete anti-malware scan.
  3. C
    Reconnect the network cable to update anti-malware definition files.
  4. D
    Enable System Restore and create a clean restore point.

Cevap

Disable System Restore in Windows as the immediate next step following isolation.
According to the official CompTIA 7-step malware removal process, once malware symptoms are identified (Step 1) and the system is isolated from the network (Step 2), the technician must disable System Restore (Step 3) before attempting remediation. Disabling System Restore deletes existing restore points, ensuring that infected files stored in shadow copies cannot reinfect the workstation.

Adım Adım Çözüm

1
Identify malware symptoms
Confirmed malware symptoms (browser redirects, pop-ups, unauthorized traffic).
Establishes that the system is infected (Step 1).
2
Isolate the infected system
System disconnected from Ethernet network.
Prevents potential lateral movement of malware across the LAN (Step 2).
3
Disable System Restore
System restore points are turned off and existing restore points are purged.
Prevents malicious files and registry keys from being backed up into system restore points or restored automatically (Step 3).

Anahtar Kavram

CompTIA 7-Step Malware Remediation Procedure
Bu soruyu puanla

Konular

Malware Symptoms and Standard Removal Procedures

Bu konudan daha fazla soru