Remove malware with the best-practice procedure
On a canned isolated Windows 11 workstation, carry out the command-based stages of an authorized malware-removal runbook: disable System Restore, update Defender security intelligence, start a full scan, inspect and remove the active sample detection, verify its historical record is Removed, re-enable System Restore, and create a post-cleanup baseline. The SOP also covers investigation, quarantine, scheduled scans and updates, documentation, escalation, and user education. This simulation does not inspect or change the learner's machine. Practice, not exam questions. Not a score predictor. Nothing here is taken from any exam.
The steps on this page are free to read. The hands-on lab for this procedure is included with Academy.
Steps
- 1
Run Disable-ComputerRestore "C:\". Normal success has no output and returns control to the prompt.
- 2
Run Update-MpSignature through the approved update path. Normal success has no output and does not independently prove definition currency.
- 3
Run Start-MpScan -ScanType FullScan. Normal success has no persistent output; use approved Defender status or event records to confirm completion on a real workstation.
- 4
Run Get-MpThreatDetection and read ActionSuccess, Resources, ThreatID, and ThreatStatusID. In the first canned record, ActionSuccess is False and ThreatStatusID is 1 (Detected).
- 5
Run Remove-MpThreat. It removes all active Defender threats, which is the single listed threat in this canned fixture, and normal success has no output.
- 6
Run Get-MpThreatDetection again. The historical record remains but now shows ActionSuccess True, a RemediationTime, and ThreatStatusID 4 (Removed).
- 7
Run Enable-ComputerRestore "C:\" after the approved remediation validation is complete. Normal success has no output.
- 8
Run Checkpoint-Computer -Description "post-cleanup baseline" -RestorePointType MODIFY_SETTINGS. This fixture has no restore point in the previous 24 hours; normal success has no output.
What you should see
The restore, update, scan, removal, and checkpoint cmdlets return silently. Before removal, the detection record shows ActionSuccess False and ThreatStatusID 1. Only after Remove-MpThreat is in the prior command log does the re-run show the retained record with ActionSuccess True, RemediationTime populated, and ThreatStatusID 4.