Abstract: A system and accompanying method of identifying and removing malware on a computer system is disclosed. The system comprises a source file containing reference attributes and properties of components of a local computer system in a state unaffected by malware, and exact copies of the system control files. The components of the local computer system may comprise executable and script files such as operating system files, application programs, system controls, registry files and all other executable and script files and their related relevant files. Current status of executables are checked against the reference attributes. All executables on local computer system failing certain match criteria are removed from the local system, or alternatively, replaced with reference copies from source file.