Question

A technician has just finished removing several malware infections from a user's Windows workstation using an updated antivirus scanner in Safe Mode. All threats are reported as quarantined, and the technician has re-enabled System Restore and created a new restore point. Before returning the machine to the user, what is the MOST appropriate next action according to CompTIA's malware removal best-practice process?

Accepted Answer

Boot the system normally and run additional scans to verify the malware has not returned before educating the user

Answer

Immediately reimage the workstation from a known-good backup image

Answer

Disconnect the workstation from the network permanently to prevent reinfection

Answer

Roll back to the restore point created before remediation to confirm the system boots