SOHO Malware Removal Procedure

What it is

CompTIA defines a fixed order of steps for removing malware on a small office or home office (SOHO) computer. The order matters because early steps protect other devices and prevent the malware from hiding in restore data. The exam usually asks which step comes next or which step a described action belongs to.

How it works

The ten steps

Step 1: investigate and verify

Confirm that the symptoms are really malware. Ask what the user saw, when it started and what they did, and look for pop ups, redirects, slow performance, disabled security tools or unknown programs. Some faults look like malware but are not, so verifying avoids unnecessary work.

Step 2: quarantine

Isolate the infected computer so the malware cannot spread or send data out. Disconnect the network cable, turn off Wi-Fi and remove shared drives or Universal Serial Bus (USB) storage. Keep the machine away from other devices, and treat removable media that was attached as possibly infected.

Step 3: disable System Restore

System Restore saves copies of system files, and malware can hide inside those restore points. Antimalware tools usually cannot clean the protected restore data. Turning the feature off, which deletes the old restore points, prevents a cleaned system from being reinfected by a restore.

Step 4: remediate

Remediation is the work of cleaning the infected system. Steps 5 and 6 are the two parts of it: first bring the tools up to date, then use the right removal technique.

Step 5: update the antimalware software

Update the antimalware software first, so it knows the newest threats. An out of date scanner misses newer variants.

Step 6: scan and removal techniques

Use the technique that fits the case.

• Safe mode. Starts with minimal drivers and services, so most malware is not running.
• Preinstallation environment. Boot from external media into a clean environment and scan the offline operating system (OS).
• Run a full scan. Quarantine or delete what is found, and re scan until clean.

Step 7: reimage or reinstall

If the malware cannot be removed, back up the user's data and reimage or reinstall the OS. This is the last resort when cleaning fails.

Step 8: schedule scans and run updates

Set up regular scans and keep the OS, applications and definitions updated. This closes the hole that let the malware in and catches any leftovers.

Step 9: enable System Restore

After the system is clean, turn System Restore on again and create a fresh restore point. This gives a known good state to return to if a later problem occurs.

Step 10: educate the end user

Explain how the infection happened and how to avoid it. Cover safe browsing, careful handling of attachments and links, avoiding untrusted downloads and reporting odd behaviour quickly. Training is the step that reduces repeat incidents.

A short example

A user reports pop ups and a slow browser. You confirm the symptoms, unplug the network cable, and turn off System Restore. You then update the antimalware tool, boot into safe mode, and run a full scan that finds and removes a hidden program.

After a restart you schedule weekly scans, apply pending updates, turn System Restore back on and create a restore point. Finally, you explain to the user that the program came with a free download.