nerdexam
CompTIA

220-802 · Question #153

A client has a computer that is infected with several viruses and spyware. Which of the following should the technician perform FIRST before spyware removal?

The correct answer is B. Disable system restore. System Restore must be disabled before removing malware to prevent infected restore points from reinfecting the system after cleanup.

Hardware and network troubleshooting

Question

A client has a computer that is infected with several viruses and spyware. Which of the following should the technician perform FIRST before spyware removal?

Options

  • ARun Windows Update
  • BDisable system restore
  • CRun the chkdsk /r command
  • DDisable network cards

How the community answered

(14 responses)
  • A
    7% (1)
  • B
    86% (12)
  • C
    7% (1)

Why each option

System Restore must be disabled before removing malware to prevent infected restore points from reinfecting the system after cleanup.

ARun Windows Update

Running Windows Update before removal can be beneficial but is not the first priority - updates do not prevent existing malware from hiding in restore points.

BDisable system restoreCorrect

Windows System Restore periodically snapshots the system state, and these snapshots can contain copies of active malware and spyware. If System Restore is not disabled before remediation, the antivirus or anti-spyware tool may successfully remove the infection, but a subsequent system restore or the restore service itself can reintroduce the malware from a saved snapshot. Disabling System Restore clears all existing restore points and prevents this reinfection vector before scanning begins.

CRun the chkdsk /r command

chkdsk /r checks for disk errors and bad sectors; it does not address malware persistence mechanisms like System Restore snapshots.

DDisable network cards

Disabling network cards can prevent network-based reinfection but does not address the restore-point reinfection vector, which is the more immediate concern.

Concept tested: Disabling System Restore before malware removal

Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-antivirus/malware-removal

Topics

#system restore#malware removal#spyware#virus remediation

Community Discussion

No community discussion yet for this question.

Full 220-802 Practice