CompTIA A+ Core 2 (220-1202)Software TroubleshootingHard
During malware remediation on a Windows workstation, a technician disables System Restore before running removal tools. Which of the following BEST explains the reason for this step?
- AIt frees additional disk space for the antivirus update files
- BIt prevents the malware from being saved in an existing restore point and later reintroduced
- CIt speeds up the scanning process by reducing background services
- DIt is required before Windows Update can be run
Show answer & explanationAnswer & explanation
Correct answer: B. It prevents the malware from being saved in an existing restore point and later reintroduced
System Restore points can contain a snapshot of the infected system state. Disabling System Restore before remediation ensures that if a user later restores the system, the malware is not reintroduced from a saved restore point.
Why the other options are wrong
- A. Disk space freed is a minor side effect, not the primary reason for this step.
- C. System Restore has minimal impact on scan speed; that is not the reasoning behind this step.
- D. Windows Update does not require System Restore to be disabled.
Disable System Restore Before Remediation
A malware removal best practice where System Restore is turned off before cleaning a system to prevent existing restore points from reintroducing the infection later.
- Restore points may capture the system while already infected.
- Disabling prevents rollback to an infected state.
- System Restore is re-enabled with a fresh restore point after cleanup.
Memory trick: 'Pause the Time Machine so the Virus Can't Come Back'