A+ Malware Removal Steps: The Order and the Reason for Each

The ten steps, with the reason for each

Objective 2.6 of the 220-1202 objectives, version 3.0, is a "given a scenario" objective about basic malware removal on a small office or home office (SOHO) PC. Unlike most A+ objectives, it is written as a numbered sequence, which makes it natural material for ordering questions. Here is the sequence in plain words, with the reason for each position.

1. Investigate and verify the symptoms. Pop-ups, a slow PC, or failed updates can have other causes. Confirm that malware is the likely explanation before you take the machine away from its user. Otherwise you treat the wrong problem.
2. Quarantine the infected system. Disconnect it from the network, both wired and wireless, and stop using shared drives or USB media with it. This keeps the infection from spreading or sending more data out while you work.
3. Disable System Restore (in Windows Home). Restore points are snapshots of system files and settings. A point created while the PC was infected can bring the malware back later. Turning the feature off before cleanup keeps the infected state from being saved or restored. The next section explains this step.
4. Remediate the infected system. This is the cleanup phase. Steps 5 and 6 are how you do it.
5. Update the anti-malware software. Get current definitions before the scan. An out-of-date scanner can miss what infected the PC. Do this without putting the infected machine back on the shared network, for example with offline definitions or scan media prepared on a clean machine.
6. Scan and remove, using safe mode or a preinstallation environment. Microsoft describes safe mode as starting Windows in a basic state, with a limited set of files and drivers, so less of the malware may load. A preinstallation environment, such as bootable scan media, goes further and scans from outside the installed Windows. Microsoft Defender Offline works this way: it runs in the Windows Recovery Environment before Windows loads, where Microsoft says it is harder for malware to hide or defend itself.
7. Reimage or reinstall if needed. If removal fails, or you cannot trust the system afterward, restore a known-good image or reinstall the OS. Some infections, such as rootkits and boot-sector viruses, are strong candidates for this step.
8. Schedule scans and run updates. Set recurring scans and install OS and application updates. This closes the hole the malware may have used and catches a return.
9. Enable System Restore and create a restore point (in Windows Home). Now that the PC is clean, turn System Restore back on and make a fresh, clean restore point. Future recovery starts from a known-good state.
10. Educate the end user. Explain what happened, in plain terms, and how to avoid it next time: suspicious attachments, fake update prompts, unofficial download sites. This is last because it uses what you learned in steps 1 to 9.

The objective names Windows Home in steps 3 and 9. Treat that as the typical SOHO case where System Restore is in use. Learn the steps in this order, and learn them as a story, not as ten flashcards.

Many prep pages still teach this procedure from the retired 220-1102 exam, under a different objective number and sometimes with a different step count. For 220-1202, the ten steps in objective 2.6 are the list to learn.

Why System Restore goes off at step 3 and back on at step 9

Microsoft says System Restore reverts system files, registry settings, and installed programs to the state saved in a restore point, without affecting personal files. Restore points can be created automatically during significant system events. That is useful for recovery and risky during an infection.

• Before cleanup. A restore point taken after the infection may include the malware's changes. If you clean the PC and someone later rolls back to that point, the infection returns. Turning System Restore off for the cleanup prevents that, and it stops new restore points from capturing the infected state while you work.
• After cleanup. The PC is now clean, so a new restore point captures a clean state. Microsoft notes that System Protection, which creates restore points, is not enabled by default, so step 9 may also be the moment the feature gets turned on for the first time.

Two traps follow from this. Re-enabling System Restore before the scan just saves the infection again. And forgetting step 9 leaves the user with no restore points at all.

Where candidates get the order wrong

An ordering drill

These steps are shuffled. Number them before you check the answer.

• A. Turn System Restore back on and create a restore point.
• B. Update the anti-malware definitions.
• C. Disconnect the PC from Wi-Fi and unplug its network cable.
• D. Confirm that the browser redirects and fake antivirus alerts point to malware.
• E. Show the user how the fake update prompt tricked them.
• F. Turn off System Restore.
• G. Boot into safe mode and run the scan.
• H. Set a weekly scan and install pending Windows updates.

Answer: D, C, F, B, G, H, A, E. Steps 4 and 7 have no letter here. Remediation is the B and G block, and this PC did not need a reimage.

Malware types and the symptoms that point to them

Objective 2.4 lists the malware types, and objective 3.4 lists PC security symptoms. The pairings below are typical, not guaranteed. Many symptoms fit more than one type.

Certificate warnings in the browser deserve a second look. They can come from malware that tampers with web traffic, or from an on-path attack on the network rather than the PC.

The tools the objectives pair with these threats include antivirus and anti-malware software, endpoint detection and response (EDR), managed and extended detection and response (MDR and XDR), email security gateways, software firewalls, the recovery console, OS reinstallation, and user education such as anti-phishing training. In a SOHO scenario, the ten steps above usually decide which tool comes next. The rest of the Core 2 Security domain is mapped in the A+ Core 2 security guide.

Practicing for an ordering question

Ordering items reward knowing why, not just what. Cover the list at the top of this page and rebuild it from the reasons: confirm, contain, protect the restore state, prepare current tools, clean, rebuild if needed, harden, restore protection, teach. The A+ PBQ guide explains how CompTIA's performance-based items work. Then put the malware steps in order on original A+ Core 2 scenarios in Passy →, or try the free A+ practice questions.