220-802 · Question #153
A client has a computer that is infected with several viruses and spyware. Which of the following should the technician perform FIRST before spyware removal?
The correct answer is B. Disable system restore. System Restore must be disabled before removing malware to prevent infected restore points from reinfecting the system after cleanup.
Question
A client has a computer that is infected with several viruses and spyware. Which of the following should the technician perform FIRST before spyware removal?
Options
- ARun Windows Update
- BDisable system restore
- CRun the chkdsk /r command
- DDisable network cards
How the community answered
(14 responses)- A7% (1)
- B86% (12)
- C7% (1)
Why each option
System Restore must be disabled before removing malware to prevent infected restore points from reinfecting the system after cleanup.
Running Windows Update before removal can be beneficial but is not the first priority - updates do not prevent existing malware from hiding in restore points.
Windows System Restore periodically snapshots the system state, and these snapshots can contain copies of active malware and spyware. If System Restore is not disabled before remediation, the antivirus or anti-spyware tool may successfully remove the infection, but a subsequent system restore or the restore service itself can reintroduce the malware from a saved snapshot. Disabling System Restore clears all existing restore points and prevents this reinfection vector before scanning begins.
chkdsk /r checks for disk errors and bad sectors; it does not address malware persistence mechanisms like System Restore snapshots.
Disabling network cards can prevent network-based reinfection but does not address the restore-point reinfection vector, which is the more immediate concern.
Concept tested: Disabling System Restore before malware removal
Source: https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-antivirus/malware-removal
Topics
Community Discussion
No community discussion yet for this question.