Legacy Haven University

The CompTIA A+ Core 2 exam scores you on order, not improvisation. Objective 2.6 asks you to implement a fixed SOHO malware removal procedure so you isolate an infected PC, stop the payload from hiding in restore points, clean or rebuild the system, and close the hole the user opened. Older study guides still call this the 7-step process. The current 220-1202 objectives split that same workflow into ten numbered actions. Memorize the ten. Map them back to the seven so a drag-and-drop question cannot scramble you.

This article walks the official sequence, shows what each action does under the hood, and flags the exam traps that cost points. Pair it with a full Core 2 study plan at https://legacyhaven.university/how-to-pass-comptia-a-core-2-220-1202/ so you can drill the order until it is automatic.

Why CompTIA Locks the Order

Malware is not a single file. A trojan drops a payload, a rootkit hides that payload below the OS, a boot-sector virus rewrites the first sectors the firmware reads, and fileless malware lives in memory and scheduled tasks. If you scan before you isolate, the host phones home and infects mapped drives. If you leave System Restore on, a later “fix” reloads the same infection from a snapshot. If you re-enable restore before you patch, the first new snapshot is dirty. CompTIA writes the list so you never do those things out of sequence.

The classic 7-step memory aid still works as a scaffold:

1. Investigate and verify
2. Quarantine
3. Disable System Restore
4. Remediate (update definitions, then scan and remove)
5. Schedule scans and updates
6. Enable System Restore and create a clean point
7. Educate the end user

220-1202 expands step 4 into discrete actions and inserts reimage/reinstall as an official escape hatch. Here is the exam list, word for word.

The Official 220-1202 SOHO Malware Removal List

Objective 2.6 — Given a scenario, implement procedures for basic small office/home office (SOHO) malware removal.

1. Investigate and verify malware symptoms.
2. Quarantine infected system.
3. Disable System Restore in Windows Home.
4. Remediate infected systems.
5. Update anti-malware software.
6. Scan and removal techniques (e.g., safe mode, preinstallation environment).
7. Reimage/reinstall.
8. Schedule scans and run updates.
9. Enable System Restore and create a restore point in Windows Home.
10. Educate the end user.

Treat steps 4–6 as one remediation block. Treat step 7 as the rebuild path when that block fails. Treat steps 8–10 as lock-down and prevention. On a performance-based question, drop these items in this order. Do not invent extra steps such as “backup first” or “notify the user first.” Those actions may be good practice; they are not on CompTIA’s scored list.

Step 1 — Investigate and Verify Malware Symptoms

Confirm infection before you pull cables. A dying HDD, a bloated browser profile, and a failed Windows Update all mimic malware.

Look for clusters of symptoms, not a single slowdown:

• Security tools disabled or missing from Settings
• Browser home page, search engine, or proxy changed without consent
• Unexpected pop-ups, ransom notes, or “your PC is infected” scareware
• New startup programs in Task Manager, msconfig, or Autoruns
• High CPU or disk with no user workload
• Outbound connections to unknown IPs in Resource Monitor
• Windows Security or a third-party scanner naming a threat
• Certificates, hosts file, or DNS settings rewritten

Differentiate malware types so you pick the right removal path later. A virus infects files and needs a file scan. A trojan looks like a useful installer and often drops extra tools. Spyware and keyloggers steal input. Ransomware encrypts user data and mapped shares. A rootkit or boot-sector virus hides from a running OS. Fileless malware stores itself in WMI, PowerShell, or registry run keys. Cryptominers burn CPU and GPU. Stalkerware watches a device owner. Adware and potentially unwanted programs (PUPs) are lower severity but still fail a clean bill of health.

Use Task Manager, Event Viewer, Windows Security history, and a second-opinion scanner from known-good media. If symptoms stay ambiguous, treat the box as infected and move to quarantine. You can always prove a false positive after the network is cut.

Step 2 — Quarantine the Infected System

Unplug Ethernet. Disable Wi-Fi and Bluetooth. Do not use a USB drive to “save files real quick.” Do not map or touch network shares. Do not back the system up to a NAS. The goal is simple: stop lateral movement and stop command-and-control traffic.

In a SOHO, quarantine also means physical isolation. Take the laptop off the guest SSID. If the device is a desktop on a switch with no unused ports, disable the switch port or the NIC in Device Manager after you disconnect the cable. Document the MAC and hostname so you can hunt other hosts later.

Do not create a restore point or a backup image at this stage. Those copies can include the payload. Recover user documents only after you have a clean scanner path or after you mount the disk read-only from another trusted machine.

Ransomware changes the priority inside this step. Disconnect first, even before you finish a full symptom review, because encryption of mapped drives happens in minutes.

Step 3 — Disable System Restore in Windows Home

Windows Volume Shadow Copy Service stores restore points and previous versions. Malware writers copy themselves into those snapshots. If you leave protection on, a later System Restore can resurrect the infection.

On Windows Home (and Pro with System Protection enabled):

1. Open System Properties → System Protection.
2. Select the system drive.
3. Click Configure → Disable system protection.
4. Delete existing restore points when Windows offers the option.

You turn protection back on in step 9, after the box is clean and patched. Disabling it now is not optional on the exam, even if the scenario never mentions restore points.

Steps 4–6 — Remediate, Update Definitions, Then Scan

CompTIA lists three lines because students used to scan with stale signatures. The engine and definition files must be current before the first real scan.

Update first. If the live OS still talks to the vendor, run the product updater. If malware blocks the updater, copy a portable scanner or an offline definition pack from a known-clean PC on USB, then run it locally. Windows Security, Malwarebytes, and vendor rescue ISOs all follow this pattern: fresh engine, then fresh signatures, then scan.

Scan on the lightest OS you can boot.

• Normal mode works when the payload is sloppy and Windows Security still runs.
• Safe Mode (and Safe Mode with Networking only if you must reach an update server) loads a minimal driver set. Many user-mode trojans never start.
• Windows Preinstallation Environment (WinPE) or a vendor rescue ISO boots from USB and scans the offline volume. Use this for rootkits, boot-sector viruses, and anything that kills Safe Mode.

WinPE is the Windows Recovery environment you reach from a Windows install USB or from Settings → Recovery → Advanced startup. From WinRE you open a command prompt, run chkdsk, repair the BCD with bootrec, or launch an offline scanner against C:. The recovery console listed in objective 2.4 lives in this same family of tools.

Remediation is more than clicking Quarantine. Remove the dropped files, the persistence keys (Run, RunOnce, scheduled tasks, WMI subscriptions, services, browser extensions), and any policy the malware wrote to disable Defender. Re-enable Windows Security if the payload turned it off.

After the first clean scan, reboot and scan again. A single clean pass is not evidence. Two consecutive clean scans, one of them offline, is the standard you want before you trust the box.

Step 7 — Reimage or Reinstall

When scans cannot restore trust, you stop cleaning and rebuild. CompTIA put this on the official list because helpdesk work in 2026 favors a known-good image over a three-hour autopsy.

Use reimage/reinstall when you face:

• Rootkits or boot-sector infection that survives offline scans
• Ransomware that encrypted the OS volume
• Fileless persistence you cannot fully enumerate
• A SOHO PC with no business-critical local apps and a current cloud backup of documents

Copy user data from a second, trusted boot environment. Do not copy executables, scripts, or Outlook OST files until a scanner clears them. Wipe the disk or deploy the shop image. Install the OS from vendor media if no image exists. Join the device back to the workgroup or Microsoft account only after patches land.

OS reinstallation is also listed under objective 2.4 tools and methods. On the exam, reimage is not a failure. It is the correct next action when remediation cannot prove cleanliness.

Step 8 — Schedule Scans and Run Updates

A clean disk that never patches will not stay clean.

• Turn real-time protection back on in Windows Security.
• Set a weekly full scan and a daily quick scan.
• Enable automatic definition updates.
• Run Windows Update to completion, including optional driver and firmware packages the OEM flags as security-related.
• Patch the browser, office suite, PDF reader, and any runtime the user actually launches.
• Confirm the firewall profile is on for private and public networks.

This step is prevention, not decoration. CompTIA places it after cleanup and before you snapshot the system. If you create a restore point first, you snapshot an unpatched OS.

Step 9 — Enable System Restore and Create a Restore Point

Turn System Protection back on for the system drive. Set disk usage to a modest cap so snapshots cannot eat the volume. Create one manual restore point and name it after the cleanup (for example, Post-malware-clean-2026-09-25).

That snapshot is only useful if steps 4–8 succeeded. A restore point taken on a dirty box is a landmine. That is why CompTIA splits disable and enable into two distant steps.

Step 10 — Educate the End User

The infection started with a person. Close that loop or you will ticket the same PC next week.

Cover the actual vector you found:

• Do not enable macros in unexpected Office attachments
• Do not run cracked software or “driver boosters”
• Verify sender addresses and hover links before you click
• Use the company password manager and MFA
• Report ransom notes and scareware pop-ups instead of calling the number on the screen

Keep the talk short. Show the user the phishing email or the fake invoice if you still have it. CompTIA also lists antiphishing training under objective 2.4. On a scenario question, “educate the user” is the last item, never the first.

How the 7-Step Branding Maps to the 10-Step Exam List

If a practice test still uses seven boxes, collapse 4–6 into “remediate” and keep 7 as an option inside that box. If the live exam uses ten tiles, use the official wording.

Tools the 220-1202 Objectives Expect You to Name

Objective 2.4 sits next to 2.6. Name the right tool for the threat:

• Antivirus / anti-malware — signature and heuristic scanners on the live OS
• EDR / MDR / XDR — enterprise telemetry; SOHO exams still mention them as detection methods
• Email security gateway — stops the attachment before it lands
• Software firewall — limits the payload’s outbound channel
• Recovery console / WinPE / WinRE — offline repair and offline scan
• OS reinstallation — the clean-slate method in step 7
• User education / antiphishing training — step 10

You do not need to configure Splunk on this exam. You do need to know when a desktop scanner is not enough and when a bootable rescue disk or a full rebuild is the next move.

Exam Traps and SOHO Edge Cases

Order questions. The most common miss is enabling System Restore too early or updating signatures after the scan. Update, then scan. Clean, then snapshot.

Quarantine vs. backup. Students want to copy Documents first. CompTIA wants the NIC disconnected first. Recover files from a trusted environment later.

Windows Home wording. The objectives say “Disable System Restore in Windows Home” and “Enable System Restore and create a restore point in Windows Home.” On Pro and Enterprise the same System Protection tab exists. Use the Home wording on the exam.

Safe Mode vs. WinPE. Safe Mode still loads Windows, just with fewer drivers. WinPE does not load the installed OS. Rootkits lose if the OS they hook never starts.

Ransomware. Disconnect immediately. Do not pay. Restore from offline backups after you rebuild. A ransom note is a verify-and-quarantine event, not a negotiation event.

False positives. Step 1 exists so you do not wipe a PC because Chrome is slow. Verify with more than one signal.

Mobile and macOS. 2.6 is a SOHO Windows-centric procedure. Mobile malware and malicious profiles live under other security objectives. Do not drag iOS MDM steps into this list unless the question does it first.

A Worked SOHO Scenario

A bookkeeper reports that Excel opens a second window advertising a “license repair” tool and that Windows Security is missing from Settings. Task Manager shows an unknown svchost child holding a network socket.

You verify the extra process and the missing Security app (step 1). You unplug Ethernet and disable Wi-Fi (step 2). You disable System Protection and delete restore points (step 3). Windows Security will not start, so you boot a Malwarebytes rescue USB, update definitions on that environment from a second NIC you attach only for the update, then detach it (steps 4–5). You run a full offline scan, remove the trojan and two persistence tasks, and confirm a second clean pass (step 6). The machine boots, but the hosts file and a rogue scheduled task return after reboot. You image the Documents folder from WinPE, verify those files on another PC, and deploy a clean Windows 11 image (step 7). You run Windows Update, enable Defender real-time protection, and set a weekly full scan (step 8). You turn System Protection on and create Post-clean-2026-09-25 (step 9). You sit with the bookkeeper, show the fake Excel add-in prompt, and walk through how to reject unexpected macro and installer dialogs (step 10).

That story is the exam. Every extra hero move you add — “I also reset the BIOS password,” “I also cloned the drive first” — is a tile you will want to place when CompTIA did not give you that tile.

Study Drill for Test Day

Write the ten lines from memory. Then write the seven-line scaffold. Then explain out loud why restore points go off before remediation and back on after patching. If you can do that without notes, objective 2.6 is no longer a surprise.

Use the same drill on malware types from 2.4 so a scenario that says “the PC mines Monero at idle” sends you toward a cryptominer cleanup, and a scenario that says “the bootloader hash changed” sends you toward WinPE or reimage.

When you are ready to lock the rest of Core 2 — Windows tools, scripting pitfalls, operational procedures — follow the structured path in https://legacyhaven.university/how-to-pass-comptia-a-core-2-220-1202/. The malware list is one scored procedure. The rest of the exam rewards the same habit: named steps, in the published order, with the right tool at each step.