A system (100, 600) for operating system remediation, the system comprising: at least one processor (102, 604); a system cache (202, 612) configured to store file restore data; and at least one memory (104, 614) comprising computer program code, the at least one memory (104, 614) and the computer program code configured to, with the at least one processor (102, 604), cause the at least one processor (102, 604) to: intercept an input/output (I/O) request to write to a file (212, 214); determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file (212, 214) to the system cache (202, 612) prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache (202, 612) in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file (202, 612) using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file (202, 612) with the restore copy of the file (202, 612) that represents a previous version of the file. at least one processor (102, 604); a system cache (202, 612) configured to store file restore data; and at least one memory (104, 614) comprising computer program code, the at least one memory (104, 614) and the computer program code configured to, with the at least one processor (102, 604), cause the at least one processor (102, 604) to: intercept an input/output (I/O) request to write to a file (212, 214); determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file (212, 214) to the system cache (202, 612) prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache (202, 612) in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file (202, 612) using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file (202, 612) with the restore copy of the file (202, 612) that represents a previous version of the file. intercept an input/output (I/O) request to write to a file (212, 214); determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file (212, 214) to the system cache (202, 612) prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache (202, 612) in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file (202, 612) using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file (202, 612) with the restore copy of the file (202, 612) that represents a previous version of the file.