SOHO Malware Removal(OBJ.2.6)

In a small office or home office, one infected laptop can reach every shared folder, the NAS, the printer, and the router within minutes. Removing malware there is a fixed set of steps in a fixed order, so the infection is contained, removed, and does not come back. The exam tests the procedure as a sequence: what comes first, what comes next, what comes last, with real steps in the wrong slot as the distractors. Learn the list first; the detail below makes the order stick.

The SOHO malware removal procedure, in order

1. Investigate and verify malware symptoms. Confirm you are dealing with malware, not a failing drive or a misconfiguration.
2. Quarantine the infected system. Cut it off from the network and from shared resources so it cannot spread or phone home.
3. Disable System Restore in Windows. Stop restore points from preserving and later reloading the infection.
4. Remediate the infected system. Update the anti-malware software first, then scan and remove using Safe Mode or a preinstallation environment as needed.
5. Update anti-malware software. Fresh definitions and engine before the scan, never after.
6. Scan and use removal techniques. Full scan in normal mode, then Safe Mode, then a preinstallation environment for threats that hide from a running Windows.
7. Reimage or reinstall. When cleanup cannot restore trust, rebuild from known-good media.
8. Schedule scans and run updates. Patch Windows and applications and set recurring scans so the machine stays clean.
9. Enable System Restore and create a restore point. Only now, so the first new snapshot is of a clean, patched system.
10. Educate the end user. Close the loop on the behaviour that let the malware in.

Steps 4, 5, and 6 are the remediation block: remediate means update, then scan and remove. Step 7 is the escape hatch when that block fails. Steps 8 through 10 are recovery and prevention, in an order that matters just as much.

Step 1: Investigate and verify malware symptoms

What: Gather enough evidence to be sure malware is the cause before you disconnect anything or run a scanner.

Why: Low disk space, a failing drive, a stuck update, and a bad browser extension all imitate infections. Quarantining a machine and wiping its restore points for a dying drive wastes the user's time and can lose data. One odd symptom rarely proves anything; two or three categories at once usually do.

How: Collect what the user sees (pop-ups outside the browser, a changed homepage, redirects, unknown extensions), system strain that does not match the workload (high CPU or disk at idle, fans roaring), and security interference (Windows Security switched off, updates blocked). Sign-in alerts from new locations, unexpected MFA prompts, or ransom notes raise the urgency. Verify with built-in tools: Task Manager processes and Startup apps, Protection history in Windows Security, Settings > Apps sorted by install date, every browser's extensions, and Task Scheduler for jobs that run at logon. Write down what you find.

Step 2: Quarantine the infected system

What: Isolate the machine from every network path and every shared resource.

Why: SOHO networks are flat. A compromised laptop can write to the NAS, spread through mapped drives, and upload stolen files. Quarantine stops the spread and cuts the command-and-control channel malware relies on.

How: Turn off Wi-Fi, unplug the Ethernet cable, and disable Bluetooth. Pause cloud sync (OneDrive, Google Drive, Dropbox) so infected or encrypted files do not overwrite good copies in the cloud. From a clean device, change the router admin and Wi-Fi passwords, check the router for unknown admin users or DNS changes, and pause shared folders and NAS access until scans finish. If ransomware is visibly encrypting files, disconnect the network first, then stop the machine (power off or hibernate) so no more files are lost, and continue from recovery media; a security team in a managed environment may prefer it left running to preserve memory evidence, but a SOHO with nobody to collect that evidence should stop the loss. Tell the user what not to do: no signing in to accounts from this machine, no USB drives, no "scan now" pop-ups, no paying a ransom, no do-it-yourself reinstall before their data is backed up.

Step 3: Disable System Restore in Windows

What: Turn off System Protection on the system drive before you clean anything.

Why: Restore points are snapshots of system files, the registry, and program files, and malware is captured inside them. Clean the live system, run System Restore later, and the infection comes back. Disabling protection also purges the existing points, removing that hiding place entirely.

How: Search the Start menu for Create a restore point; it opens System Properties on the System Protection tab. Select the C: drive, click Configure, choose Disable system protection, then Apply and OK. Note the previous state and the Max Usage slider (5% is typical) so you can restore the same settings in step 9.