Question
A technician verifies that a malware incident occurred on some computers in a small office. Which of the following should the technician do next?
- A. Quarantine the infected systems. Correct
- B. Educate the end users.
- C. Disable System Restore.
- D. Update the anti-malware and scan the computers.
Explanation
CompTIA's malware removal procedure is: investigate and verify symptoms, quarantine infected systems, disable System Restore in Windows, remediate (update anti-malware and scan/remove), schedule scans and updates, enable System Restore and create a restore point, then educate the end user. Since the infection is already verified, the next step is to quarantine the infected systems so the malware cannot spread. Disabling System Restore, updating and scanning, and educating users all come later.
