A system for operating system remediation, the system comprising: at least one processor ; a system cache configured to store file restore data; and at least one memory comprising computer program code, the at least one memory and the computer program code configured to, with the at least one processor , cause the at least one processor to: intercept an input/output (I/O) request to write to a file ; determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file to the system cache prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file with the restore copy of the file that represents a previous version of the file. at least one processor ; a system cache configured to store file restore data; and at least one memory comprising computer program code, the at least one memory and the computer program code configured to, with the at least one processor , cause the at least one processor to: intercept an input/output (I/O) request to write to a file ; determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file to the system cache prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file with the restore copy of the file that represents a previous version of the file. intercept an input/output (I/O) request to write to a file ; determine that the I/O request relates to a modification to a binary file within a defined list of system binary files; add to or remove from the defined list of system binary files at least one restore file type of a file based at least on a duration of time since a last quarantine for a file type corresponding to the at least one restore file type of the file; store, as the file restore data, (i) a restore copy of the file to the system cache prior to performing write operations of the I/O request and (ii) identification information for a process or entity making the corresponding I/O request in the system cache in response to the I/O request being related to the modification of the binary file that is within the defined list; and revert to the restore copy of the file using the file restore data and based at least on a later determination that the process or entity making the corresponding I/O request was malware by replacing a current version of the file with the restore copy of the file that represents a previous version of the file. <EOS>