How to Troubleshoot Common PC Security Issues for CompTIA A+ Core 2 (220-1102)

Introduction: Why this objective matters

For CompTIA A+ Core 2, PC security troubleshooting is really more about making the right call in the right order than it is about memorizing a bunch of malware names. In real support work, security issues don’t usually walk up and introduce themselves clearly. Usually, they show up as a slow PC, weird browser redirects, fake antivirus alerts, repeated MFA prompts, locked accounts, certificate warnings, or just that classic “something feels off” report from the user.

What CompTIA’s really testing is practical judgment: spot the symptom, protect the environment first, and only then start fixing the endpoint. That order matters. On the exam and on the job, the best answer is often the safest next step, not the most aggressive fix.

A practical workflow for PC security troubleshooting

1. Identify symptoms
2. Verify scope and impact
3. Isolate or quarantine if needed
4. Determine the likely cause
5. Remediate with approved tools
6. Restore protections and secure settings
7. Validate security and functionality
8. Document and escalate when appropriate

This sequence is high value for the exam. If ransomware is suspected, isolate first. If the user entered credentials into a phishing page, use the approved password-reset process and escalate it right away. If antivirus is suddenly disabled and nobody can explain why, I’d suspect tampering, malware, or maybe security software being managed by policy. If a trusted site throws a certificate warning, don’t just click through it and hope for the best.

Recognize compromise symptoms without overdiagnosing

A slow computer isn’t automatically infected, even though it’s easy to jump to that conclusion. Performance problems can come from all kinds of ordinary things too, like Windows updates, low disk space, startup bloat, too many browser tabs, background scans, disk errors, heat issues, or even failing hardware. What matters is symptom grouping.

• Slow performance
• CPU, disk, memory, or network usage that’s unusually high
• Pop-ups that show up out of nowhere, especially fake antivirus warnings
• Browser redirects or changed search engine
• Unknown extensions or toolbars
• Disabled antivirus or firewall
• Unknown local accounts or admin rights changes
• Repeated MFA prompts the user did not initiate
• Strange file extensions or inaccessible files
• Unusual outbound traffic

One symptom means investigate. Multiple related symptoms increase confidence. Slow performance plus unknown startup items might be normal software bloat. Slow performance plus disabled protection plus outbound traffic is more concerning.

Malware troubleshooting: support-safe response

You don’t need advanced malware analysis for A+, but you absolutely do need a clean, safe process. The usual suspects include ransomware, trojans, spyware, rootkits, adware, and keyloggers. The support question is usually not “what exact strain is this?” but “what is the safest next action?”

Containment first: what isolation means in practice

If active compromise is suspected, isolate the endpoint before cleanup. In practice that means:

• Disconnect Ethernet
• Turn off Wi-Fi
• Disconnect VPN
• Remove access to shared drives if policy allows

Do not power off the system unless organizational procedure tells you to. Some environments want the machine left on to preserve volatile evidence. Others may direct immediate shutdown for specific threats. Follow incident-response policy.

How I’d handle malware cleanup on Windows 10 and 11

1. First, make sure the symptom is real. Then, if it looks like active compromise, isolate the system.
2. Open Windows Security and verify current protection status
3. Check which protection provider is active
4. Update signatures or definitions if the endpoint can safely do so under policy
5. Run an approved scan: quick, full, or offline as appropriate
6. Review Protection history
7. Quarantine first, then remove per tool guidance and policy
8. Review startup items, scheduled tasks conceptually, services, installed apps, and browser extensions
9. Restore baseline protections
10. Rescan and validate normal behavior

Important precision: Windows Security is the management interface. Microsoft Defender Antivirus is one protection engine or provider. If a third-party antivirus or EDR product is installed, Defender AV may be passive or disabled by design. That is not automatically malicious.

Older malware-removal guidance sometimes mentioned disabling System Restore to avoid reinfection from restore points. That is more of a legacy exam-era concept than a common modern enterprise practice. Do not disable recovery features casually. Follow policy and approved incident procedures.

If malware gets in the way of normal cleanup, Safe Mode or an offline scan may be the better move. On modern Windows, Defender Offline or another approved enterprise tool can be really useful when the infection is stopping normal scans from working.

Sometimes cleanup just isn’t enough. If you still can’t trust the machine after remediation, if you suspect something rootkit-level, if it keeps getting reinfected, or if your policy says to rebuild from a known-good image, that’s when reimaging needs to be part of the conversation.

Ransomware indicators: immediate actions

If files suddenly start using strange extensions, won’t open the way they should, or a ransom note appears, I’d treat that as ransomware until you’ve proven it’s something else.

• Cut the machine off from both wired and wireless networking right away.
• Disconnect VPN and shared storage access if possible
• Do not delete encrypted files
• Do not start wiping or reimaging on your own
• Do not pay the ransom
• Do not reboot or power off unless policy directs it
• Preserve useful evidence such as ransom-note text, sample filenames, time first noticed, and affected shares
• Escalate immediately

Ransomware is rarely just a single-PC nuisance. Shared drives, mapped drives, cloud sync folders, and lateral movement are all concerns. A support technician’s job is containment, evidence preservation, and rapid escalation.

Differentiate browser issue vs malware vs network issue

This distinction is extremely testable. A good first question is whether the issue is limited to one browser, happening in every browser on that one PC, or showing up across multiple devices on the same network.

• One browser only: suspect extension, browser notifications, search or homepage hijack, bad browser profile, or browser sync contamination
• All browsers on one PC: suspect proxy settings, DNS settings, HOSTS file tampering, local malware, or security software interference
• Multiple devices on same network: suspect router DNS hijack, captive portal behavior, rogue hotspot, or upstream network issue

For redirects, check:

• Browser extensions
• Homepage and default search engine
• Notification permissions
• Proxy settings
• DNS server settings
• HOSTS file

ipconfig /flushdns only clears the local DNS resolver cache. That can help if the problem is just stale or poisoned cached data, but it won’t fix bad DNS server settings, a bad proxy, browser hijacking, HOSTS file changes, or anything being caused higher up on the router or network side.

Browser hijacker and adware troubleshooting

Many “malware” complaints are actually browser-specific problems. Some fake antivirus messages are just web pages, not installed software. That matters because the fix may be browser cleanup rather than full system remediation.

In Edge or Chrome, a practical sequence is:

1. Open extensions and remove anything unknown or unapproved
2. Check homepage, startup pages, and default search engine
3. Review notification permissions and remove abusive sites
4. Clear site data and cache
5. Reset browser settings if needed
6. Review downloads and installed apps for related potentially unwanted programs
7. Scan the endpoint with approved antimalware

If scam pages trap the browser in full-screen loops, ending the browser task in Task Manager may be the most practical support action. Notification abuse deserves special mention: it is often just a permissions problem, not proof of a full malware infection.

Phishing, suspicious attachments, and credential compromise

Not every phishing incident is equally serious, so you’ve got to look at what actually happened. Separate these cases carefully:

• Clicked link only: determine whether anything was downloaded or submitted
• Downloaded file: contain and scan; determine whether it was executed
• Executed file: higher concern for endpoint compromise; isolate and remediate
• Entered credentials: treat as account compromise
• Approved MFA prompt unexpectedly: treat as urgent account compromise activity

If credentials were entered, password reset alone may not be enough. In managed environments, the response may also include revoking active sessions or tokens, checking recent sign-ins, reviewing MFA enrollment changes, and inspecting mailbox forwarding or inbox rules if an email account may be compromised. Also consider password reuse risk on other systems.

There is also an important distinction between local device compromise and cloud identity compromise. A user who enters Microsoft 365 or Entra ID credentials into a fake page may expose cloud access even if the local PC shows no malware symptoms.

Troubleshooting suspicious account behavior

Account lockouts and login failures are not always attacks. Common causes include stale saved credentials in mail clients, mapped drives, scheduled tasks, services, password managers, and mobile devices repeatedly trying an old password.

When reviewing local Windows accounts, use support-safe tools:

• whoami — confirms the current user context
• hostname — confirms which system you are on
• net user — useful for reviewing local accounts in local context; use approved directory tools for domain or cloud account investigation
• net localgroup administrators — shows local Administrators group membership
• ipconfig /all — helps review adapter and DNS settings
• nslookup — helps validate name resolution

If you find an unknown admin account and you think compromise might be involved, don’t rush to delete it. First, write down exactly what you found, capture the details, check whether it might be a legitimate support or management account, and then escalate according to policy. If you delete it too quickly, you can lose useful evidence and make the investigation a lot harder.

Also remember edition limitations: Local Users and Groups (lusrmgr.msc) is not available on Windows Home editions.

Certificate warnings and secure next steps

Certificate warnings matter, but not every warning means an attacker is actively intercepting traffic. Common causes include:

• Incorrect system date or time
• Expired certificate
• Hostname mismatch
• Captive portal on public Wi-Fi
• Enterprise SSL or TLS inspection appliance
• Missing trusted root certificate in a managed environment

The safe response is still the same: do not click through blindly. Verify the exact address being accessed, check the system date and time, try another browser or device, and if you can, test it on another trusted network too. If the issue only happens on public Wi-Fi, I’d start thinking about a captive portal or maybe even a rogue hotspot. If it appears on a managed corporate network, SSL inspection or missing enterprise trust configuration may be part of the explanation.

Windows security features and what to inspect

In Windows 10 and 11, it’s important to know where to check and what the status is actually telling you.

• Windows Security > Virus & threat protection: current provider, scan options, threat status
• Protection history: what was detected, quarantined, allowed, or blocked
• Firewall & network protection: whether the active profile is protected
• Settings > Apps > Installed apps: recently installed suspicious software
• Task Manager > Processes / Startup: unusual resource use and suspicious startup entries

Firewall and Defender settings may be centrally managed by Group Policy, Intune, or third-party EDR. If a device shows “managed by your organization,” local changes may not persist and may not be appropriate. That is normal in enterprise environments.

Managed environment vs standalone PC

Troubleshooting does shift a bit when the device is domain-joined or managed in the cloud. On a standalone PC, you usually’ve got a little more freedom to inspect and fix things locally. In an enterprise, security controls may be enforced centrally, remote isolation may be available through EDR, and local administrators may be restricted.

Support boundaries matter. If policy-managed settings are disabled, do not assume you should override them locally. Document what you see, check for active security tooling, and escalate when the issue involves identity platforms, email systems, EDR alerts, or suspected broader compromise.

Network and Wi-Fi risks

Security symptoms are not always endpoint-local. Picture this: someone connects to airport Wi-Fi, gets a certificate warning on a site they trust, and then suddenly gets pushed to a login page. That could be a captive portal, a rogue hotspot, or some kind of interception problem in the middle. The safest move is to stop, disconnect, and test it again on a trusted network before typing in any credentials.

If one PC has redirects, suspect local settings. If every device on the same Wi-Fi has redirects, suspect the network or router. Testing another device or another network is a fast way to narrow scope.

When to preserve evidence and escalate

Escalate quickly if you see ransomware signs, unexplained certificate warnings on sites the user should trust, MFA prompts the user didn’t start, unknown admin accounts that look suspicious, or anything that makes you think more than one system could be involved.

Good escalation notes should include:

• Who reported the issue and when
• Symptoms observed
• Whether the device was isolated
• Tools used and scan results
• Accounts involved
• Any suspicious files, addresses, extensions, or messages

Post-remediation validation checklist

• No active detections remain or the case is properly escalated
• Antivirus or EDR status is healthy and definitions are current
• Firewall is enabled or confirmed as centrally managed
• Browser settings, extensions, and notifications are back to normal
• No suspicious startup items, services, or unknown local admins remain unreviewed
• OS and applications are patched
• User can access required apps normally
• Documentation is complete

If files were affected, verify backup and recovery options through approved channels. A system that appears functional is not automatically trustworthy until protections, accounts, and behavior are validated.

Best next step exam summary

CompTIA trap answers to avoid

• Wiping or deleting files before containment
• Clicking through certificate warnings
• Assuming every slow PC has malware
• Resetting passwords before verifying identity
• Treating notification spam as proof of deep infection without checking browser permissions
• Using random third-party cleanup tools instead of approved tools

Final review

For this objective, think in sequence: identify, scope, isolate, remediate, restore, validate, document. Remember the high-yield distinctions: one browser versus all browsers, clicked link versus entered credentials, disabled Defender versus approved third-party AV, account lockout versus compromise, and certificate warning versus normal browsing error.

If you can look at a scenario and say, “Here is the likely cause, here is the safest next step, and here is when I escalate,” you are thinking exactly the way CompTIA wants.