Which step in the best practice procedure for malware removal is specifically intended to prevent the malware from reinfecting the device via a backup of system files?
Disabling System Restore in Windows is a critical step in the malware removal process. This action prevents malware from infecting restore points, which could reinfect the system if a user later restores from a compromised point. Disabling this feature also deletes all existing restore points, eliminating them as a hiding place for malicious software.
The official CompTIA steps for malware removal are:
Investigate and verify malware symptoms
Quarantine infected system
Disable System Restore in Windows
Remediate infected systems
Update anti-malware software
Scan and removal techniques (e.g., safe mode, preinstallation environment)
Reimage/reinstall
Schedule scans and run updates
Enable System Restore and create a restore point in Windows
Educate the end user
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why is it important to disable System Restore during the malware removal process?
Open an interactive chat with Bash
What are the potential risks of not disabling System Restore when removing malware?
Open an interactive chat with Bash
What is a restore point and why is it created in Windows?