A user reports their Windows PC is slow and shows pop-ups even when no browser is open. Following CompTIA best practices for malware removal, what should the technician do immediately after identifying and verifying the malware symptoms?
- A
Run a full antivirus scan and remove the threats
- B
Quarantine the infected system (disconnect from the network)
- C
Disable System Restore and create a fresh restore point
- D
Educate the end user about safe browsing
Correct answer: B — Explanation
In the CompTIA malware removal process, after identifying and verifying symptoms you quarantine the system — disconnect it from the network to stop the malware spreading or communicating. Disabling System Restore and remediating come next, scanning is part of remediation, and user education is the final step. Quarantining first contains the threat before any cleanup begins.