A system has been patched many times and has recently become infected with a dangerous virus. If antivirus software indicates that disinfecting a file may damage it, what is the correct action?

A.
Disinfect the file and contact the vendor.

B.
Back up the data and disinfect the file.

C.
Replace the file with the file saved the day before.

D.
Restore an uninfected version of the patched file from backup media.

Explanation:
D: Some files cannot be properly sanitized by the antivirus software without destroying them or affecting their functionality. So, the administrator must replace such a file with a known uninfected file. Plus, the administrator needs to make sure he has the patched version of the file, or else he could be introducing other problems. Answer C is not the best answer because the administrator may not know the file was clean yesterday, so just restoring yesterdays file may put him right back in the same boat.