220-1101 Question 438
Single answerMalwareA user brings a Windows laptop to the help desk because a fake security warning keeps appearing in the browser, several pop-ups claim the PC is infected, and the default homepage has changed without permission. The user says the issue started after installing a free PDF converter from an unfamiliar website. Internet access is still working, but the system is noticeably slower. Which of the following is the BEST next step for a technician to take to address the malware issue while following standard malware-removal best practices?
- A
Boot the laptop into safe mode, run updated antimalware scans, and remove any detected threats
- B
Replace the browser with a different browser and restore the default homepage settings
- C
Run Disk Cleanup to remove temporary files and improve performance before investigating further
- D
Disable the Windows firewall so the antimalware tool can scan more thoroughly
Show answer and explanation
Correct answer: A
Explanation
The scenario describes common signs of scareware/adware infection: fake security warnings, persistent pop-ups, degraded performance, and unauthorized browser changes after installing software from an untrusted source. For A+ Core 1, the best response is to follow a structured malware-removal process rather than treating only visible symptoms. In practice, technicians often isolate the system if necessary, use safe mode when malware interferes with normal operation, update antimalware definitions, and run scans to detect and remove threats. After remediation, they should verify full functionality, restore settings if needed, ensure the OS and security software are updated, and educate the user about avoiding untrusted downloads and bundled installers. These steps reflect widely accepted support best practices and CompTIA's published malware-removal methodology.
- A. Correct.
This is the best answer because standard malware-removal procedure begins with containing and safely assessing the system, often by using safe mode to limit unnecessary startup items and malicious processes. Running updated antimalware tools is the appropriate corrective action for symptoms consistent with scareware or adware, such as fake infection alerts, browser hijacking, and excessive pop-ups. This aligns with common CompTIA malware-removal methodology: identify symptoms, quarantine if needed, disable System Restore when appropriate, remediate with updated tools, schedule scans and updates, and then enable protections and educate the user.
- B. Incorrect.
This is incorrect because changing browsers or restoring homepage settings only addresses a symptom, not the underlying infection. Malware associated with bundled freeware commonly installs browser hijackers, adware, or potentially unwanted programs that can persist across browsers or reinstall settings after reboot. A technician should first scan for and remove the malicious software rather than just switching applications.
- C. Incorrect.
This is incorrect because Disk Cleanup may free space and remove some temporary files, but it is not a malware-removal tool and does not address the root cause of fake security alerts or browser hijacking. A candidate might choose this because temporary files can affect performance, but malware symptoms require a security-focused remediation process first.
- D. Incorrect.
This is incorrect because disabling the firewall reduces security and is not part of standard malware-removal best practices. Antimalware tools do not require the firewall to be disabled in order to scan effectively. A technician should avoid weakening protections unless there is a specific, documented troubleshooting reason, and even then it should be temporary and controlled.