SOHO Malware Removal

What are CompTIA’s malware removal steps, in order?

There are ten, and objective 2.6 numbers them. This is CompTIA’s exact wording:

1. Investigate and verify malware symptoms.
2. Quarantine infected system.
3. Disable System Restore in Windows Home.
4. Remediate infected systems.
5. Update anti-malware software.
6. Scan and removal techniques (e.g., safe mode, preinstallation environment)
7. Reimage/reinstall.
8. Schedule scans and run updates.
9. Enable System Restore and create a restore point in Windows Home.
10. Educate the end user.

Objective 2.6 numbers ten separate steps. Steps 5 through 7 describe how you usually carry out step 4: update the anti-malware, scan and remove, and reimage or reinstall if the infection can’t be removed reliably. The sections below explain what each step involves on a Windows PC. For what each kind of malware does, see malware types explained.

1. Investigate and verify malware symptoms

Confirm that you’re dealing with malware before you start removing things. Typical signs include pop-ups and tabs that won’t close, a homepage or search engine that keeps changing, unwanted extensions that come back, browsing redirected to unfamiliar pages, and virus alerts (Chrome Help). Ransomware usually announces itself with a message demanding payment (Microsoft Support). In Windows Security, Current threats shows what has been found and when the last scan ran, and Protection history lists what Microsoft Defender Antivirus has already done; it keeps events for two weeks and needs admin rights to show threat details (Microsoft Support, Protection history).

2. Quarantine infected system

Isolate the PC so the infection can’t reach other devices: keep it off the network and don’t share its removable drives. Microsoft warns that ransomware on a networked computer may spread to other computers or storage devices on that network (Microsoft Support). In managed business environments, Microsoft Defender for Endpoint and Defender for Business can “isolate” a device remotely, disconnecting it from the network while keeping its connection to the Defender service (Microsoft Learn). Don’t confuse this with the Quarantine action in Windows Security, which applies to a detected file, not to the whole PC (Microsoft Support).

3. Disable System Restore in Windows Home

Turn off System Protection before you clean the PC. Restore points are snapshots of system files, installed applications, the registry and system settings (Microsoft Support: System Protection), so restore points taken while the PC was infected capture that infected state. That’s the reasoning behind turning protection off before cleaning (step 3) and creating a new restore point once the PC is clean (step 9). System Protection settings are in System Properties > System Protection > Configure; open it by searching Start for “Create a restore point” or running systempropertiesprotection.exe (Microsoft Support).

4. Remediate infected systems

Remediating means removing the infection and undoing what it changed. When Defender reports “Threat found – action needed,” choose Quarantine if you aren’t sure the item is safe; a quarantined threat isn’t removed yet but shouldn’t pose a risk, and Remove deletes it (Microsoft Support). Some remediations need a reboot (Microsoft Learn). Uninstall unwanted programs, including anything a tech-support scammer had you install, and change passwords if a scammer had access (Microsoft Support). For ransomware, fully clean the PC before trying to recover files, and know that paying gives no guarantee of getting access back (Microsoft Support).

5. Update anti-malware software

Update the definitions before scanning, so the scan can detect the newest threats. Security intelligence (definitions) files hold information about the latest threats; Windows downloads them through Windows Update, and you can check manually in Windows Security > Virus & threat protection > Protection updates > Check for updates (Microsoft Support). A full scan uses the definitions installed when the scan starts (Microsoft Learn).

6. Scan and removal techniques (e.g., safe mode, preinstallation environment)

Scan with up-to-date tools, and if malware resists removal while Windows is running, scan from an environment where it isn’t active.

To open WinRE, hold Shift while selecting Power > Restart, or go to Settings > System > Recovery and select Restart now next to Advanced startup (Windows 10: Update & Security > Recovery); Windows also enters it on its own after repeated failed starts (Microsoft Support). More recovery tools are in Windows troubleshooting.

7. Reimage/reinstall

If the infection can’t be removed reliably, start over with a clean copy of Windows. Reset this PC reinstalls Windows: “Keep my files” removes apps and settings, and “Remove everything” also removes personal files; back up first (Microsoft Support). Microsoft lists reinstalling from installation media as the option for a device you suspect is infected with malware, and it removes everything (Microsoft Support). A clean install removes personal files, apps, manufacturer customizations and settings changes (Microsoft Support). A system image backup can also be restored from WinRE (Microsoft Support).

8. Schedule scans and run updates

Set up recurring scans and bring Windows and apps up to date so the PC stays protected. Defender scans on its own, and you can add a schedule in Task Scheduler under Task Scheduler Library > Microsoft > Windows > Windows Defender > Windows Defender Scheduled Scan > Triggers (Microsoft Support). Microsoft recommends scheduled quick scans and generally doesn’t recommend scheduling full scans (Microsoft Learn). Install updates from Settings > Windows Update (Microsoft Support), and turn on automatic updates for non-Microsoft software too, especially browsers (Microsoft Support).

9. Enable System Restore and create a restore point in Windows Home

Once the PC is clean, turn System Protection back on and create a restore point. Microsoft notes System Protection isn’t enabled by default. In System Properties, select Configure > Turn on system protection and set the disk space limit, then select Create and give the restore point a description (Microsoft Support). System Restore later rolls back system files, registry settings and installed programs without affecting personal files (Microsoft Support).

10. Educate the end user

Explain how the infection most likely got in and how to avoid a repeat. Common ways in include unsafe email attachments, downloads from unsafe websites and infected USB drives (Microsoft Support). Points worth covering:

• Don’t open attachments or links in unsolicited email (Microsoft Learn), and don’t select Enable Content on an unexpected Office file, because that runs its macros (Microsoft Support).
• Download software only from official sources; keygens often install malware, and pirated content may contain it (Microsoft Support, Microsoft Support).
• Microsoft’s real error messages never include phone numbers, and Microsoft won’t call unless you asked it to (Microsoft Support).
• If a pop-up says the browser needs updating, close it and check for updates from the browser’s own settings (Microsoft Support).

What PC security symptoms does objective 3.4 list, and what do they point to?

Objective 3.4 lists six common symptoms and four browser-related ones. Several have harmless explanations, so check the likely causes before assuming malware.

Browser settings that prevent many of these problems, such as pop-up blocking and extension control, are covered in workstation and browser hardening.

Practice scenarios

These are original practice scenarios written for this page, not real exam questions.

1. A home user’s browser homepage keeps changing and a toolbar reappears after removal. Which step comes first? Investigate and verify: confirm the symptoms point to malware (step 1) before quarantining and cleaning.

2. You’ve confirmed an infection on a Windows 11 Home laptop on a small office network. What next? Quarantine it by taking it off the network (step 2), then disable System Restore (step 3) before remediation.

3. A rootkit survives a full scan in normal Windows. Which technique fits? Scan outside the running OS: Microsoft Defender Offline, which runs from the Windows Recovery Environment, or a preinstallation environment (step 6). If it still persists, reimage/reinstall (step 7).

Related A+ Articles