Joe, a technician, receives notification that a share for production data files on the network is encrypted.
Joe suspects a crypto virus is active.
He checks the rights of the network share to see which departments have access.
He then searches the user directories of those departmental users who are looking for encrypted files.
He narrows his search to a single user's computer.
Once the suspected source of the virus is discovered and removed from the network, which of the following should Joe do NEXT?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The correct answer to this question is B. Scan and remove the malware from the infected system.
Explanation:
In this scenario, Joe suspects a crypto virus is active on the network and has found a single user's computer with encrypted files. The next step for Joe would be to remove the malware from the infected system, as this will help prevent the spread of the virus to other systems on the network. To do this, Joe should perform the following steps:
Disconnect the infected computer from the network: This will help prevent the virus from spreading to other systems on the network.
Scan the infected system with antivirus software: Joe should use a reputable antivirus software to scan the infected system thoroughly. This will help identify and remove any malware present on the system.
Remove any suspicious files: Joe should remove any suspicious files that were identified by the antivirus software during the scan.
Update the antivirus software: Joe should ensure that the antivirus software is up-to-date with the latest virus definitions to provide the best protection against future threats.
Reconnect the system to the network: Once the system has been scanned and cleaned of any malware, Joe can reconnect it to the network.
Monitor the system: Joe should monitor the system for any signs of recurring malware infections.
While educating the end user on safe browsing and email habits is important to prevent future infections, it is not the next step that Joe should take in this scenario. Creating a system restore point and rebooting the system is not a recommended solution as it will not remove the malware and could potentially make the situation worse. Scheduling antivirus scans and performing Windows updates is a good practice but not the next step that Joe should take in this scenario.