Free Small Office/Home Office (SOHO) Malware Removal practice questions

The proper malware removal sequence is to quarantine the infected system first, disable System Restore in Windows, and then remediate the infection. Quarantine must come first to stop the malware from spreading to other devices over shared Wi-Fi, folders, or printers. Disabling System Restore is done before cleaning because restore points can contain infected files that would reinfect the machine if a restore is later performed. Only after those two steps do you remediate using updated anti-malware tools. 'Remediate the infection, quarantine the system, then disable System Restore' is wrong because remediating before quarantine allows the threat to continue spreading, and cleaning before disabling System Restore risks reinfection from snapshots. 'Disable System Restore, remediate the infection, then quarantine the system' places quarantine last, which defeats its purpose of containment. 'Quarantine the system, remediate the infection, then disable System Restore' correctly starts with quarantine but cleans the system before disabling System Restore, meaning infected restore points remain and can undo the cleanup. Following the exact order ensures the fix holds permanently and prevents the reinfection loop that wastes time in a small office where downtime affects shared work.

One odd symptom rarely proves anything, but here three categories line up: fake infection warnings appearing outside the browser, a hijacked homepage, and Windows Security being switched off repeatedly. Malware disables the built-in protection to defend itself, and combined with browser hijacking that pattern is strong enough to move to verification and then quarantine. Fake 'your PC is infected' pop-ups are the signature of scareware and adware, not ransomware, which announces itself with encrypted files and a ransom note, so wiping the drive on that evidence alone skips the whole procedure. A failing drive causes slowness, errors, and crashes; it cannot change a homepage or turn off Windows Security. A Windows update does not reset the homepage to an unfamiliar search page or keep disabling Windows Security after the user turns it back on.

Active ransomware is a containment emergency, and the first move is to isolate the machine: pull the Ethernet cable and turn off Wi-Fi so the malware cannot reach shared folders, the NAS, cloud sync, or its command-and-control server. In a small office with no incident-response team it is then acceptable to stop the machine (power off or hibernate) to halt encryption of the remaining files and continue from recovery media; in a managed environment the security team may instead want it left running to preserve memory evidence, which is why network isolation, not power, is the universal first step. Letting the encryption finish guarantees maximum data loss. Reconnecting to the internet reopens the channel the malware uses to spread and fetch payloads, and a working decryption tool rarely exists. Creating a restore point captures the infection in a snapshot; the procedure disables System Restore during removal for exactly that reason.

To disable System Restore, you search for System Protection, select the main drive (usually C:), and click Configure, then choose 'Disable system protection' and apply the change. This turns off restore point creation and lets your cleanup work stick without infected snapshots reintroducing malware. 'Open Task Manager, select the Startup tab, then disable services' is used to stop malware persistence items from launching at boot, not to control System Restore. 'Open Device Manager, expand the drive, then update the driver' manages hardware drivers and has nothing to do with restore points. 'Search for Disk Cleanup, select the drive, then clear restore points' can delete old restore points as a maintenance task, but it does not disable the System Restore feature itself, so the system would continue creating new points. Before disabling, a technician should note the current setting and the maximum usage slider position so the original configuration can be restored later. After cleanup, System Restore is re-enabled and a fresh, clean restore point is created.

System Restore snapshots system files, the registry, drivers, and program files, and malware is captured inside those snapshots. Clean the live system, roll back to an old point later, and the infection returns; disabling System Protection before remediation also purges the existing points so that hiding place is gone. System Restore has no effect on anti-malware definition updates, which come from Windows Security. Scanners do not scan restore points one by one, and speed is not the reason for the step. System Restore does not manage services in real time; it only replaces system state when a restore is run. The entire justification is removing the reinfection path stored in restore points, which is why this is step 3, before any cleaning.

Safe Mode loads a minimal Windows environment with most drivers and startup items disabled, which strips the malware of its hooks. This often stops the pop-ups and allows security tools to launch and complete scans that were blocked in normal mode. You reach Safe Mode by holding Shift while clicking Restart, then choosing Troubleshoot, Advanced options, Startup Settings, Restart, and pressing 4 or 5. 'Immediately reinstall Windows from bootable USB media' is premature; reimaging is a last resort reserved for when cleanup fails, and you should attempt Safe Mode remediation first. 'Reconnect the network to update definitions during the scan' is risky because keeping the device offline blocks command-and-control traffic and reinfection; you connect only briefly for updates, not during a scan. 'Create a new restore point before running the scan again' is counterproductive because System Restore should be disabled during malware removal, and creating a point now could capture infected files. Safe Mode is the correct escalation when normal mode remediation is being actively blocked by the infection.

Scanners focus on files and often miss configuration changes that malware leaves behind. Persistent browser redirects that survive a clean scan point to altered proxy settings, changed DNS servers, or malicious entries in the hosts file. A technician should turn off manual proxies, confirm DNS is set to automatic or a trusted server, and open the hosts file (C:\Windows\System32\drivers\etc\hosts) as admin to remove odd entries below the last comment. Removing lingering browser extensions and resetting the browser to defaults also helps. 'Increase the amount of RAM installed in the system' addresses performance, not redirection, and has no effect on where the browser sends traffic. 'Defragment the primary drive to reorganize files' is a disk maintenance task unrelated to browser behavior. 'Enable System Restore and create a new restore point' is incorrect during active remediation and would only capture the still-compromised configuration. The correct approach recognizes that manual configuration checks—proxy, DNS, hosts file, extensions, startup entries, and scheduled tasks—are needed to seal the persistence gaps that file-based scanners leave behind.

When backing up from an infected machine, you copy personal files only—such as documents and photos—while skipping programs, since executables and macros commonly carry infections. You use a clean external drive that has been scanned first, avoid copying unknown EXE files or macro-laden documents, and rescan the backup before restoring to confirm it is clean. 'Copy the entire drive image including installed programs' is wrong because program files and system components are exactly where malware hides, so imaging the whole drive would preserve the infection. 'Compress all files into an archive and skip scanning' is dangerous because archiving does nothing to remove threats, and skipping the scan means you may restore malware onto the freshly rebuilt system. 'Restore the data first, then reinstall Windows over it' reverses the correct sequence; data must always be restored last, after Windows is reinstalled, fully patched, and security tools are installed. The guiding principle is to save only user data, verify it is clean with a scan, and restore it as the final step of a clean rebuild.

The secure rebuild order is to reinstall Windows from clean USB media, fully update Windows and install drivers from trusted vendor sites, install security software such as Windows Security and a secondary scanner, patch applications like browsers and PDF readers, and finally restore the previously scanned data into user folders only. Restoring data last ensures it lands on a fully patched, protected system. 'Restore data, reinstall Windows, install security software, update Windows, then patch apps' is wrong because restoring data before reinstalling Windows makes no sense and would place files on the compromised system. 'Install security software, restore data, reinstall Windows, patch apps, then update drivers' is incorrect because you cannot install security software before Windows is reinstalled, and restoring data before the reinstall is unsafe. 'Update Windows, restore data, reinstall Windows, install security software, then patch apps' places the reinstall after updating and restoring, which is illogical. The correct sequence builds a trusted, fully patched foundation before any user data is reintroduced, minimizing the risk of reinfecting the fresh installation.

Strange logins, unexpected MFA prompts, and unknown admin accounts are severe-level indicators of possible credential theft. At this point the mindset shifts from 'remove malware' to 'protect accounts,' because the attacker may already have access. The correct response is to isolate the device and reset passwords from a separate, clean device, then review accounts and recovery options. 'Mild severity; clean the browser and remove unwanted apps' drastically underestimates the threat; browser cleanup does nothing to stop an attacker who already holds credentials. 'Moderate severity; remove startup items and rescan the drive' treats it as a persistence problem rather than a credential compromise, missing the urgency of protecting accounts. 'Critical severity; preserve evidence and pay the ransom quickly' is wrong on two counts: these symptoms indicate credential theft rather than active ransomware, and you should never pay a ransom because it funds crime without guaranteeing recovery. Correct triage matches the response to the risk—here, credential theft demands immediate isolation and password resets from a trusted device before anything else.