Remove malware and recover a PC or Mac

A sample reception PC comes with three symptoms at once: the browser opens on a search page the user never set, the start-up list has a program nobody recognises, and the clock loses a few minutes a day. One of the three has an ordinary explanation and the others do not, so you cannot close the ticket with a quick scan and a reboot. The order of the next hour is the lesson: confirm what you see, isolate the device from the network, find what keeps bringing the infection back, clean a browser down to its home page and extensions, and recognise the moment to stop cleaning and reimage. The step that costs least and is skipped most is the note written as you go, which keeps the security team’s evidence instead of wiping it.

Confirm each symptom before the removal starts

CompTIA’s A+ Core 2 objective 3.4 lists the signs an infected PC often shows: desktop alerts and unwanted notifications, false alerts about antivirus protection, files that are missing, renamed or cannot be opened, failed operating-system updates and a network the PC cannot reach, and in the browser random pop-ups, certificate warnings, redirection and slow pages. Most of these can also be caused by something ordinary, so the first step of a removal is to tell the two apart on the ticket in front of you.

The reception PC in the opening shows three signs. Walk them through this table before touching anything:

Three symptoms in a row that have no ordinary explanation count as a working theory of infection, and the removal starts. One symptom with an ordinary cause is fixed in that ordinary way first; the ticket then says that the user’s other complaints went with it, or did not. The troubleshooting method lesson’s rule still applies: ask what changed, test one thing at a time, and keep a reversible step before a destructive one.

The order of removal keeps the fix short and the evidence intact

Objective 2.6 of the same CompTIA document gives the steps a technician follows for a known or suspected infection, and this track teaches them in the order below, in its own words, with one branch no other list draws clearly: the step where cleaning stops and reimage takes over. Isolate the device before scanning, because malware with network access can call home, download new parts and spread to other devices on the same subnet; a scan after isolation sees what is already there and nothing new.

The small decisions along the way are the ones that get skipped and go wrong:

• Isolate the right way. Unplug the network cable, turn off Wi-Fi in Settings (not with the hardware switch, which many users have never used), and keep the PC powered on. A shutdown destroys evidence in memory the security team may want.
• Turn off System RestoreSystem Restore: A Windows tool that rolls back system files and settings to an earlier restore point without touching personal files. It reaches back further than the 3 days of point-in-time restore. More in “Fix boot problems: WinRE, Safe Mode, Recovery” on Windows Home. The feature keeps snapshots of system files, called restore pointsA saved copy of system files and settings that Windows System Restore can go back to; infected files inside one are restored with it, so System Restore is turned off during a cleanup., and an infected system file inside a restore point will come back if someone later rolls back to it. Turning the feature off deletes the stored restore points. Turn it back on at the end and create a fresh restore point.
• Scan with updated signatures. Microsoft Defender’s security intelligence is checked, and updated, in Windows Security’s Protection updates page; the windows security settings lesson shows how to read it. A scan with intelligence that is nine days old misses this week’s threats.
• Use the right scan. The windows-security-settings lesson teaches when a quick scan, a full scan, a custom scan or Microsoft Defender OfflineMicrosoft Defender Offline scan: A Microsoft Defender scan that restarts the PC and runs from a trusted environment outside the normal Windows kernel, to find malware that hides from a running Windows. It takes about 15 minutes. More in “Windows Security: Defender, firewall, BitLocker” is the right one; this lesson reuses those rules and adds one: when a quick scan removes a threat and the same threat comes back a day later, the next scan is the offline one. Reboot into safe modesafe mode: A start that loads only a limited set of files and drivers, to show whether default settings and basic drivers cause a problem. Windows and macOS both have one, reached differently. More in “Fix boot problems: WinRE, Safe Mode, Recovery” for a scan whose findings a running Windows keeps protecting from removal.
• Reimage when in doubt. The next section lists the signs that make this the only safe choice. The branch to reimage is a step, not a failure of the technician’s effort.
• Educate the user. Close the ticket with a short note that names what the user saw, what to watch for next time and what to do if they see it. Threats users face is the lesson they can read.

Persistence is what brings an infection back

Malware stays through a reboot by registering itself with the operating system in a way the user does not see: persistenceThe ways malware arranges to run again after a reboot, a sign-in or a scan: start-up entries, scheduled tasks, services, a changed hosts file or proxy, login items, background items and configuration profiles.. Finding every place a device starts programs from is the difference between removal and reinfection the next morning. The places are short and the same on every Windows PC, and reading them against a known-good listingA list of the start-up items, scheduled tasks, services and settings a healthy device of this fleet carries; new entries that are not on it are the ones a technician reads first. turns the question into pass or fail:

• Start-up items: programs set to run when the user signs in. Task Manager’s Startup apps tab is one view; the more complete one is Microsoft’s own Sysinternals AutorunsA Microsoft Sysinternals tool that lists every place Windows starts a program from: Run keys, Startup folders, scheduled tasks, services, drivers, Explorer add-ons, codecs and more., which lists every registered start-up place.
• Scheduled tasksA Windows feature, managed in Task Scheduler, that runs a program when a time, an event or a sign-in matches a trigger; a common persistence trick is to add a task that runs a program every hour.: Task Scheduler, read as the signed-in administrator. A task created by malware often runs every hour from a path under the user’s AppData\Local\Temp folder.
• Services: services.msc. A service that starts automatically, runs under a system account and points at a random-looking name in a Users folder is a stop point.
• The hosts filehosts file: A plain text file on a device whose entries win over every DNS lookup for the names they list. On Linux and macOS it is /etc/hosts; on Windows it is under System32\drivers\etc\hosts. More in “DNS for support: resolve, flush and fix names”: C:\Windows\System32\drivers\etc\hosts. Changes here redirect well-known names (banking sites, antivirus update servers) to another address, which no browser setting then shows.
• The proxy serverproxy server: A server that sits between a device and the internet, forwarding requests and often caching or inspecting traffic. Browsers consult the system settings or a PAC file to find it. More in “VPNs, proxies, file shares and remote work”: Internet Options or Settings > Network & internet > Proxy. A proxy that was blank the day before means every page the user opens now travels through a server they do not own.

On macOS the places are a little different: login itemslogin item: An app, document, folder or server connection that opens when a user logs in, listed under Open at Login in System Settings, General, Login Items & Extensions. More in “macOS apps, Gatekeeper and software updates” and background itemsbackground item: Part of an app allowed to do work while the app is not open, such as checking for updates or syncing, listed under App Background Activity in Login Items & Extensions. More in “macOS apps, Gatekeeper and software updates” listed in System Settings > General > Login Items & Extensions, and configuration profilesconfiguration profile: A bundle of settings that a device management server sends to a device, such as Wi-Fi, VPN, mail accounts, certificates and restrictions. More in “MDM, BYOD and lost or stolen devices” listed in System Settings > General > Device Management. Apple’s “Protecting against malware in macOS” page describes XProtectApple's built-in anti-malware component in macOS: it checks apps for known malicious content when they are first run or changed, and Apple updates its signatures without a system update. as the layer that compares launched apps with a signature list Apple maintains, and GatekeeperGatekeeper: The macOS check that runs when downloaded software first opens: it must come from an identified developer, be notarised by Apple and be unaltered, and the user confirms the first open. More in “macOS apps, Gatekeeper and software updates” as the layer that checks their signatures and notarisation. The profiles list is where to look when a browser setting cannot be changed back: an organisation’s management server, or a rogue profile a user accepted, holds that setting.

The program below reads an invented start-up listing of a sample reception PC (its start-up entries, scheduled tasks, hosts-file lines and proxy setting; names and addresses are reserved for documentation) and compares each entry with a known-good baseline. Each finding is printed with the reason, so a technician pastes the six lines straight into the ticket. The second listing is the cleaned PC; it prints no finding.

"""Compare a device's start-up listing with a known-good baseline.

The listings in this file are invented for the lesson. The names and
addresses come from the reserved documentation ranges of RFC 2606
(example domains) and RFC 5737 (documentation IPv4 ranges), not from
any real malware or real website.
"""

TEMP_FOLDER_HINTS = (
    r"\AppData\Local\Temp",
    r"\Windows\Temp",
    r"\AppData\Roaming\Temp",
    "/tmp/",
    "/var/folders/",
)

WELL_KNOWN_NAMES = {
    "www.bank.example.com",
    "update.microsoft.com",
    "download.windowsupdate.com",
    "www.example.com",
}


def path_of(entry):
    """Return the path or trigger string of an entry, or an empty string."""
    return entry.get("path") or entry.get("trigger") or ""


def suspicious_entries(listing, baseline):
    """Return the suspicious entries of one listing against the baseline.

    Order of findings:
      1. an entry missing from the baseline (start-up and scheduled tasks),
      2. a program in a user-writable temporary folder,
      3. a hosts line that redirects a well-known name elsewhere,
      4. a proxy where the baseline has none.
    """
    out = []
    seen = ("startup", "scheduled_tasks")

    for group in seen:
        baseline_names = {entry["name"] for entry in baseline.get(group, [])}
        for entry in listing.get(group, []):
            if entry["name"] not in baseline_names:
                out.append(f"Unknown {group} entry: {entry['name']}")

    for group in seen:
        for entry in listing.get(group, []):
            where = path_of(entry)
            if any(hint in where for hint in TEMP_FOLDER_HINTS):
                out.append(f"Program in a user-writable temp folder: {entry['name']}")

    for line in listing.get("hosts", []):
        if line["name"] in WELL_KNOWN_NAMES:
            out.append(f"Hosts line redirecting {line['name']} to {line['ip']}")

    proxy = listing.get("proxy") or {}
    base_proxy = baseline.get("proxy") or {}
    if proxy.get("enabled") and not base_proxy.get("enabled"):
        out.append(f"Proxy where baseline has none: server {proxy.get('server', '')}")

    return out


BASELINE = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
    ],
    "hosts": [],
    "proxy": {"enabled": False, "server": ""},
}

WEAK = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
        {"name": "UpdateHelper", "path": r"C:\Users\reception\AppData\Local\Temp\uh.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
        {"name": "SyncCheck", "trigger": r"every 1 hour, runs C:\Users\reception\AppData\Local\Temp\sync.exe"},
    ],
    "hosts": [
        {"name": "www.bank.example.com", "ip": "192.0.2.44"},
    ],
    "proxy": {"enabled": True, "server": "192.0.2.44:8080"},
}

CLEANED = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
    ],
    "hosts": [],
    "proxy": {"enabled": False, "server": ""},
}


for label, listing in (("WEAK", WEAK), ("CLEANED", CLEANED)):
    found = suspicious_entries(listing, BASELINE)
    verdict = "fails the baseline" if found else "matches the baseline"
    print(f"{label} listing: {len(found)} finding(s), {verdict}")
    for note in found:
        print(f"  - {note}")
    print()

WEAK listing: 6 finding(s), fails the baseline
  - Unknown startup entry: UpdateHelper
  - Unknown scheduled_tasks entry: SyncCheck
  - Program in a user-writable temp folder: UpdateHelper
  - Program in a user-writable temp folder: SyncCheck
  - Hosts line redirecting www.bank.example.com to 192.0.2.44
  - Proxy where baseline has none: server 192.0.2.44:8080

CLEANED listing: 0 finding(s), matches the baseline

The weak listing fails the baseline on six lines: two entries that are not on the baseline (a start-up program and a scheduled task), two more because both run from a user-writable temp folder under AppData\Local\Temp, a hosts line that redirects a well-known bank name to an address in the documentation range of RFC 5737, and a proxy where there was none. The cleaned listing meets every line of the baseline and prints no finding, which is the state the ticket closes on.

A browser clean-up reverses what a hijack can change

A browser hijackerMalware or an unwanted browser extension that changes a browser's home page, search engine, new-tab page or added search providers so a user is sent to pages they did not choose. and a user who accepted every site’s notification request leave almost the same traces. Fix both with the same steps, in order, so the browser ends on the home page and search engine the organisation wants:

Each step maps to one place a browser setting can be changed. Google’s “Reset Chrome settings to default” page lists what a reset puts back: the default search engine, the home page and start-up tabs, the new-tab page, pinned tabs, content settings such as site permissions, cookies and site data, and extensions and themes. Saved bookmarks and passwords stay. Microsoft Edge has a reset of its own at edge://settings/reset, and Microsoft’s Edge troubleshooting page says what it does: bookmarks, history and saved passwords are kept, while pinned tabs, the start-up page, the search engine and extensions go back to their defaults. A reset is the fifth step, not the first; opening it on a browser whose extensions are still untouched throws out the user’s settings and leaves the extension to switch itself back on.

A site notificationA one-off permission that lets a site send a browser notification to a user's desktop; a site that was granted it keeps sending until it is removed from the site permissions list. is the easy case to miss. A user who clicked “Allow” on a notification request a year ago sees the site’s banners on their desktop every morning, with no browser window open. The per-site lists are Privacy, search, and services > Site permissions > All sites in Edge, Privacy and security > Site Settings > Notifications in Chrome, and Settings > Websites > Notifications in Safari. Remove the sites the user does not want, or set their Notifications to Block. The symptom often ends there, with no infection to clean.

Stop and reimage when trust is gone

Some findings end the removal before the scans finish, because cleaning cannot prove the device is trustworthy again. The reimagereimage: Writing a prepared system image over a PC's disk so that it returns to the organisation's standard build. Local data is replaced, so what must be kept is backed up before. More in “Reset, reimage or repair: choose and do it” decision is a step of the procedure, not an escalation of effort: it is cheaper than two more days of scans that each find nothing new. CISA’s #StopRansomware Guide asks responders to take a system image and a memory capture of a sample of affected devices for the investigation, and then to rebuild systems from pre-configured standard images, the most important services first.

Four findings mean the removal stops and reimage is the next step:

• A rootkitMalware that runs with kernel-level privileges, often as a signed driver, and hides its files, processes and network use from the running operating system; scans inside Windows cannot see or remove it. or a boot-sector virusA changed boot sector or UEFI firmware component that runs before Windows starts, and so loads before any anti-malware driver; found and removed only with offline tools or firmware recovery.: a kernel-mode component or firmware-level change that scans running inside Windows cannot see or remove.
• A ransomware incident where files are encrypted, including a wiper: the device may work, but every file it holds is suspect, and the images belong to the security team’s investigation.
• Reinfection after a clean removal: the same detection returns within a day on the same device after a full scan removed it, without a clear source outside the PC.
• Any sign that credentials, administrator accounts or persistence places have been touched: an administrator account the user does not know, a service running under one, scheduled tasks or start-up entries that come back after they are removed.

Weigh the three courses with the table below. The ticket’s own answers to its three questions pick the course.

In an organisation, isolate through the security tooling and hand over

A small office may run only Microsoft Defender; a larger one usually runs an endpoint detection and responseEndpoint detection and response: a security product that records what each managed device does, raises alerts a security operations centre reviews, and lets analysts isolate or investigate a device from a console. tool, often as part of a wider extended detection and responseExtended detection and response: a security product that joins the signals of endpoints, identity, email and cloud services into one view, so an analyst sees a chain of related alerts rather than one at a time. platform, or outsources the alerts to a managed detection and responseManaged detection and response: a service that watches an organisation's security alerts and acts on them, so a small team does not have to run its own security operations centre. provider that reads them for the organisation. On those devices the help desk’s job changes: the fastest contain step is the console’s own, not a cable the user pulls.

Microsoft’s “Take response actions on a device” page describes a device isolationA console action in an endpoint detection and response tool, such as Microsoft Defender for Endpoint, that cuts a device off from the network except for a limited set of security traffic, so an analyst can look at it without the device communicating further. action in Microsoft Defender for Endpoint that cuts the device off from the network while it stays connected to the Defender service, and that can keep Outlook and Microsoft Teams working so the analyst can still reach the user. Other platforms have the same action under different names. The order on a managed device is:

What goes in the hand-over is the evidence of the lesson so far: the symptoms the user reported with the time of day, the six findings the baseline check printed, the browser settings the user noticed changing, and the file names a scan reported. “An indicator of compromiseA fact that points at an infection or an incident, written so another technician can test for it on another device: a file name and path, a hash, a scheduled task name, a domain name, an IP address. on this ticket” is better than “a few odd things on this PC”.

Phones follow their own short procedure

A phone that behaves oddly after a sideloaded app or an accepted “mobile management” profile answers to a shorter list. Read the right page in Settings before anything is removed:

On Android, Google’s page on finding problem apps with safe mode gives the order. Restart the phone in safe mode (the buttons differ between makers, so the maker’s support site has the steps), use it for a while and see whether the problem goes away. If it does, an app is the likely cause: restart normally, then remove recently downloaded apps one at a time, the unknown one first, restarting after each, until the problem stops. A phone whose problem stays in safe mode does not have an app problem, and that is a case for the organisation’s mobile device management or a factory reset.

On an iPhone or iPad, Apple’s “Install or remove configuration profiles on iPhone” page says where installed profiles are listed: Settings > General > VPN & Device Management. The same page warns what removal costs, which is the sentence to read to the user first: deleting a profile also deletes the settings, apps and data that came with it. A profile managed by an organisation stays until the organisation removes it (that is its point), so the help desk checks whether the device is enrolled in a work mobile device managementmobile device management: Software that enrols phones, tablets and computers, sends them settings and apps, checks them against a security policy and can lock or wipe them remotely. Microsoft Intune is one example. More in “MDM, BYOD and lost or stolen devices” service before anything is pulled off. The MDM, BYOD and lost devices lesson covers that path.

Practise: list the suspicious entries in a start-up listing

The exercise turns the baseline check into a function a help desk ticket system could call every morning. It receives one device’s start-up listing and the fleet’s baseline, and returns the suspicious entries in a fixed order, so a shared counter PC checked at two shift handovers gets a ticket that reads the same both times. Try the sample tests against this lesson’s weak and cleaned listings first, plus a few variants: an entry whose path is a user-writable temporary folder, a hosts line that redirects a well-known name to another address, a proxy where the baseline has none, and a proxy the baseline itself sets, which is not a finding.

# The hints a path or a trigger is checked against, and the names a hosts line
# must not be allowed to redirect. Both lists are given to you; the function is yours.
TEMP_FOLDER_HINTS = (
    r"\AppData\Local\Temp",
    r"\Windows\Temp",
    r"\AppData\Roaming\Temp",
    "/tmp/",
    "/var/folders/",
)

WELL_KNOWN_NAMES = {
    "www.bank.example.com",
    "update.microsoft.com",
    "download.windowsupdate.com",
    "www.example.com",
}


def suspicious_entries(listing, baseline):
    """Return the suspicious entries of one listing against the baseline, in a fixed order."""
    return []

from suspicious_entries import suspicious_entries


BASELINE = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
    ],
    "hosts": [],
    "proxy": {"enabled": False, "server": ""},
}

CLEANED = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
    ],
    "hosts": [],
    "proxy": {"enabled": False, "server": ""},
}

WEAK = {
    "startup": [
        {"name": "OneDrive", "path": r"%LocalAppData%\Microsoft\OneDrive\OneDrive.exe"},
        {"name": "Teams", "path": r"%ProgramFiles%\Microsoft\Teams\current\Teams.exe"},
        {"name": "UpdateHelper", "path": r"C:\Users\reception\AppData\Local\Temp\uh.exe"},
    ],
    "scheduled_tasks": [
        {"name": "MicrosoftEdgeUpdateTaskMachineCore", "trigger": "every 1 hour"},
        {"name": "SyncCheck", "trigger": r"every 1 hour, runs C:\Users\reception\AppData\Local\Temp\sync.exe"},
    ],
    "hosts": [
        {"name": "www.bank.example.com", "ip": "192.0.2.44"},
    ],
    "proxy": {"enabled": True, "server": "192.0.2.44:8080"},
}


def test_cleaned_listing_has_no_finding():
    assert suspicious_entries(CLEANED, BASELINE) == []


def test_weak_listing_lists_every_rule_in_order():
    assert suspicious_entries(WEAK, BASELINE) == [
        "Unknown startup entry: UpdateHelper",
        "Unknown scheduled_tasks entry: SyncCheck",
        "Program in a user-writable temp folder: UpdateHelper",
        "Program in a user-writable temp folder: SyncCheck",
        "Hosts line redirecting www.bank.example.com to 192.0.2.44",
        "Proxy where baseline has none: server 192.0.2.44:8080",
    ]


def test_unknown_entry_from_a_safe_path_is_still_flagged():
    listing = dict(CLEANED)
    listing["startup"] = CLEANED["startup"] + [
        {"name": "VendorHelper", "path": r"%ProgramFiles%\Vendor\VendorHelper.exe"},
    ]
    assert suspicious_entries(listing, BASELINE) == ["Unknown startup entry: VendorHelper"]


def test_temp_folder_catches_a_task_whose_trigger_names_the_folder():
    listing = dict(CLEANED)
    listing["scheduled_tasks"] = CLEANED["scheduled_tasks"] + [
        {"name": "SyncCheck", "trigger": r"every 1 hour, runs C:\Users\x\AppData\Local\Temp\s.exe"},
    ]
    assert suspicious_entries(listing, BASELINE) == [
        "Unknown scheduled_tasks entry: SyncCheck",
        "Program in a user-writable temp folder: SyncCheck",
    ]


def test_hosts_line_for_a_well_known_name_is_a_finding():
    listing = dict(CLEANED, hosts=[{"name": "update.microsoft.com", "ip": "198.51.100.7"}])
    assert suspicious_entries(listing, BASELINE) == [
        "Hosts line redirecting update.microsoft.com to 198.51.100.7",
    ]


def test_hosts_line_for_an_unknown_name_is_not_a_finding():
    listing = dict(CLEANED, hosts=[{"name": "internal.corp.example", "ip": "10.0.0.5"}])
    assert suspicious_entries(listing, BASELINE) == []


def test_proxy_disabled_matches_the_baseline():
    listing = dict(CLEANED, proxy={"enabled": False, "server": "203.0.113.1:8080"})
    assert suspicious_entries(listing, BASELINE) == []


def test_proxy_enabled_is_a_finding_when_the_baseline_has_none():
    listing = dict(CLEANED, proxy={"enabled": True, "server": "203.0.113.1:8080"})
    assert suspicious_entries(listing, BASELINE) == [
        "Proxy where baseline has none: server 203.0.113.1:8080",
    ]


def test_missing_proxy_key_counts_as_off():
    listing = {k: v for k, v in CLEANED.items() if k != "proxy"}
    assert suspicious_entries(listing, BASELINE) == []


def test_proxy_the_baseline_also_sets_is_not_a_finding():
    office_proxy = {"enabled": True, "server": "proxy.example.com:8080"}
    baseline = dict(BASELINE, proxy=office_proxy)
    listing = dict(CLEANED, proxy=dict(office_proxy))
    assert suspicious_entries(listing, baseline) == []

Interview questions

Warm-up (fresher): A user says their PC “feels infected”. Why do you isolate the device from the network before you run any scan?

Isolation sets a boundary around the problem. Many kinds of malware have active network parts: they call home for new instructions, download more parts, or scan the subnet for other devices they can reach. A scan on a connected device sees what is on it now, which can be less than before the scan ran and more a minute later. Pulling the cable, or turning off Wi-Fi in Settings, stops that movement without destroying the evidence a shutdown would. Memory, running processes and open files stay, which the security team may want to look at. Isolation is also protection for other devices on the same subnet: a tool that scans for shared folders stops reaching them. So the sequence is observe, isolate, scan, decide.

Two harder tickets sit in the queue. One is a shared counter PC whose morning scan reports the same detection it reported yesterday, after two full scans and an offline run have each already removed it. The other is a Mac that came back from a reimage, whose only backup was written while it was still infected, and whose user wants their apps, settings and files on it today. Decide your own first move on each before you open the row.

Key takeaways

• Confirm each symptom against an ordinary cause first, so a slow PC with a full disk is not treated as an infection and three unexplained signs together are not treated as “probably fine”.
• The order is observe, isolate, scan with updated signatures, find and remove persistence, clean the browser, and reimage when trust is gone; writing down times and actions as they happen is a step, not an afterthought.
• Persistence survives a reboot by registering with the system; a known-good baseline turns the check into pass or fail across start-up items, scheduled tasks, services, the hosts file, the proxy, login and background items and configuration profiles.
• A browser clean-up goes extensions, site notifications, home page and search engine, proxy settings, and only then a reset, so the user’s work is kept and the hijacker’s work is not.
• A rootkit, a boot-sector change, ransomware, reinfection after a clean removal and anything that touched credentials end the cleaning and start the reimage; a managed device is isolated through the security console and handed to the security operations centre with the evidence already written down.