mediumMultiple ChoiceObjective-mapped
Malware Persistence Mechanisms: Why Virus Keeps Reappearing After Removal
A user reports that their Windows 10 PC is infected with a virus that keeps reappearing after removal. The technician boots into Safe Mode, runs a full antivirus scan, and removes the threat. However, after rebooting normally, the virus returns. What is the most likely reason?
Quick Answer
The answer is that the virus has a persistence mechanism, such as a scheduled task or registry run key. This is correct because even after removal during a Safe Mode scan, the virus’s persistence mechanism—often a scheduled task created via schtasks.exe or a Run key in HKCU\Software\Microsoft\Windows\CurrentVersion\Run—survives the cleanup. When the system reboots normally, these triggers re-execute the malware, causing the virus to keep reappearing after removal. On the CompTIA A+ Core 2 220-1202 exam, this scenario tests your understanding of how malware maintains footholds and why Safe Mode alone isn’t enough; a common trap is assuming the antivirus failed rather than recognizing the persistence layer. A helpful memory tip is “Run and Task” for the two main persistence vectors: Registry Run keys and scheduled tasks.
⚠ Common exam trap
CompTIA often tests the distinction between detection failure (outdated definitions or polymorphism) and re-infection due to persistence mechanisms, so the trap here is assuming the antivirus failed to detect the virus rather than recognizing that the virus is being re-introduced after removal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The virus has a persistence mechanism, such as a scheduled task or registry run key.
The virus likely uses a persistence mechanism such as a scheduled task (via schtasks.exe) or a registry Run key (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run) to re-infect the system after boot. Safe Mode may bypass some of these mechanisms, but a normal boot re-triggers them, allowing the virus to reinstall itself even after the initial removal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The antivirus definitions are outdated.
Why it's wrong here
Outdated definitions could miss the virus, but the technician already removed it in Safe Mode, so the issue is likely persistence, not detection.
- ✓
The virus has a persistence mechanism, such as a scheduled task or registry run key.
Why this is correct
Persistence mechanisms allow malware to reinstall itself after removal. The technician must identify and delete these triggers in Task Scheduler, registry, or startup folders.
- ✗
The user is re-downloading the virus from the same source.
Why it's wrong here
While possible, the scenario states the virus 'keeps reappearing after removal' without user action, pointing to a persistence mechanism rather than user behavior.
- ✗
The virus is a polymorphic variant that changes its signature.
Why it's wrong here
Polymorphic malware changes code to avoid signature detection, but the technician successfully removed it in Safe Mode, so the issue is not evasion but re-infection.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
Safe Mode
Safe Mode is a diagnostic startup mode in operating systems that loads only essential drivers and services, allowing users to troubleshoot and fix problems caused by non-critical software or hardware.
Key term
Registry
The Windows Registry is a central hierarchical database that stores configuration settings and options for the operating system, hardware, software, and user preferences.
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 220-1202
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A user reports that their Windows 10 PC is infected with a virus that changes the desktop background to a ransom note. After removing the virus with antivirus software, the desktop background remains unchanged. What should you do to restore the original background?
medium- A.Reinstall the graphics driver.
- B.Run System File Checker (sfc /scannow).
- ✓ C.Check Group Policy settings for desktop wallpaper enforcement and reset them.
- D.Perform a system restore to a point before the infection.
Why C: The virus likely modified the Group Policy setting that enforces a specific desktop wallpaper. Even after the virus is removed, the Group Policy setting persists and overrides any user attempts to change the background. Resetting the Group Policy wallpaper enforcement restores the user's ability to change the background normally.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.