A technician is remediating a virus on an infected workstation. All user files are set to system and hidden. Which of the following should a technician perform NEXT to remediate the system?

Question

Options

• ABack up user data and rebuild the user profile.
• BRestore user data and reset the user file attributes via a command line.
• CRun System Restore to a date before the infection
• DPerform a clean install of the OS and restore the user data
• EReset all file attributes on the user's profile via command line

• A
  9% (3)
• B
  6% (2)
• C
  3% (1)
• E
  82% (27)

Explanation

The correct answer is E. The virus has used the Windows 'attrib' command (or equivalent) to set user files as system (+S) and hidden (+H), making them invisible to normal browsing but leaving them intact on disk. The targeted remediation is to reverse these attributes using the command line: 'attrib -s -h /s /d' applied to the user profile directory restores all files to their normal state without data loss. Since the files are still present (just hidden), there is no need to restore from backup (B), rebuild the profile (A), run System Restore (C), or perform a clean OS install (D)-all of which are more disruptive and unnecessary. Option E is the minimal, precise fix that directly addresses the observed symptom, which is the principle of least invasive remediation in troubleshooting.

No community discussion yet for this question.