Plant your own persistence, then remove it in the prescribed order

short · 45 min · Objective 2.2

Task

Create the artefacts a real infection leaves -- a startup entry, a scheduled task, a service and a browser extension, all written by you -- and then work through the removal procedure in order, recording what each step found. The artefacts are yours, so nothing hostile exists; the procedure is identical, which is what is being practised.

Steps

  1. Create four persistence artefacts of your own on the guest -- a startup entry, a scheduled task, a service and a browser extension -- each doing something visible and harmless such as writing a line to a file. Record them in lab/removal/planted.csv with header artefact,location,what_it_does.
  2. Record the machine's state before removal in lab/removal/identify.csv with header item,value covering running processes of interest, startup entries, scheduled tasks, services and extensions.
  3. Work through the removal procedure in order, recording each step in lab/removal/steps.csv with header step,what_you_did,what_it_found,why_this_order.
  4. Confirm every planted artefact is gone by searching for each specifically, and record the result in lab/removal/confirm.csv with header artefact,found,removed_at_step.
  5. Write lab/removal/restore.md recording what you did about system protection: when you disabled it, why, and the fresh restore point you created at the end.

Verify

awk -F, 'NR>1 && NF>=3 {n++} END {print n" artefact(s) planted"}' lab/removal/planted.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" procedure step(s)"}' lab/removal/steps.csv
awk -F, 'NR>1 && $2 ~ /no/ {n++} END {print n" artefact(s) confirmed gone"}' lab/removal/confirm.csv
awk -F, 'NR>1 && NF>=3 {n++} END {print n" artefact(s) checked"}' lab/removal/confirm.csv
grep -Eic 'disable|restore point|protection' lab/removal/restore.md
grep -Eic 'quarantine|disconnect|network' lab/removal/steps.csv

Four artefacts planted, six or more procedure steps, every artefact confirmed gone, and the restore note covering both disabling and re-enabling protection. The steps must include disconnecting the network before cleaning.

Notes

The step people skip is the last one: turning system protection back on and creating a fresh restore point. A machine left with protection disabled has had a recovery feature silently removed, and nobody notices until it is needed.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.