A technician is cleaning malware on a Windows workstation. Which of the following would MOST likely prevent a recurrence of the same malware?

Question

Options

• AEnable Shadow Copy.
• BDisable System Restore.
• CUpdate root certificates
• DModify file permissions

• A
  7% (3)
• B
  88% (36)
• C
  2% (1)
• D
  2% (1)

Explanation

The correct answer is B. Windows System Restore creates restore points that snapshot system state, including the registry and system files. When malware infects a system, it can embed itself within existing or newly created restore points. If System Restore is left enabled after cleaning, the malware can resurface if a user or process rolls back to an infected restore point. Disabling System Restore purges all existing restore points, eliminating those infection vectors. Enabling Shadow Copy (A) creates additional file-version snapshots that could similarly preserve malware copies. Updating root certificates (C) addresses trust chain issues but does not remove existing malware. Modifying file permissions (D) may restrict access but does not address the stored malware in restore points. Disabling (and then re-enabling after cleaning) System Restore is a recognized best practice in malware remediation.

No community discussion yet for this question.