IT Support Knowledge Base

← All runbooksSecurity

Malware Cleanup Basics

First-response steps when a computer may be infected: pop-ups, unknown programs, browser hijacks or antivirus alerts.

Windows 10 / 11 using Microsoft Defender (Windows Security)about 3 min read

Symptoms

  • Pop-ups or ads appearing when no browser is open; browser home page or search engine changed.
  • Unknown programs, toolbars or extensions the user didn't install.
  • Antivirus alerts, or antivirus switched off and can't be turned on.
  • PC suddenly very slow, fan constantly loud, or high network use.
  • Files renamed or locked, or a message demanding payment (ransomware: see below).
  • The user entered a password on a suspicious site or opened a suspicious attachment.

Before you start

  • This is a security matter. Follow your organisation's incident-reporting policy. When in doubt, report it.
  • Ransomware or a ransom note, or signs that many files were encrypted: disconnect the device from the network (unplug the cable / turn off Wi-Fi), do not pay, do not try to clean it yourself, and escalate immediately.
  • Ask: what was the user doing when it began? Did they click a link, open an attachment, install something, or enter a password?

Steps

  1. Isolate the device. Disconnect from the network (unplug Ethernet, turn off Wi-Fi) so any malware can't spread or send data. Don't sign in to anything important from this device.
  2. Record what you see (screenshots, names of strange programs, the time it started). This helps the next person.
  3. Run a full Windows Security scan: Windows Security > Virus & threat protection > Scan options > Full scan > Scan now. Quarantine/remove what it finds.
  4. Run an offline scan for stubborn malware: the same Scan options screen > Microsoft Defender Antivirus (offline scan). The PC restarts and scans before Windows fully loads.
  5. Check what is installed and starting up:
    • Settings > Apps > Installed apps: sort by install date, uninstall unknown software recently installed (confirm with the user).
    • Task Manager > Startup apps: disable unknown entries.
    • Browser: remove unknown extensions; reset the browser's settings if the home page is hijacked.
  6. Update Windows and the antivirus definitions (Windows Update; Windows Security > Virus & threat protection updates). Reconnect to the network only to download updates if your policy allows.
  7. Consider a second-opinion scanner: a reputable on-demand scanner approved by your organisation can catch things the first missed.
  8. Change passwords from a different, clean device if the user entered passwords on a suspicious site or the PC was infected: email first, then banking and work accounts. Turn on multi-factor authentication where possible. See Password Reset and Account Lockout.
  9. Decide whether to rebuild. If malware keeps returning, the antivirus can't be re-enabled, or you can't be sure it's gone, the safest option is to back up personal files (scan them), then reinstall Windows (with approval).
  10. Close the loop: explain to the user what likely happened and how to avoid it (don't open unexpected attachments; check links; don't install cracked software; report phishing).

Escalate when

  • Ransomware, or any sign of data being stolen.
  • The user entered work credentials or approved an unexpected MFA prompt.
  • More than one device shows the same symptoms.
  • The device holds sensitive or regulated data (customer, health, payment).
  • Antivirus can't be started, or the malware comes back after cleaning.
  • Your policy requires a security team to handle every suspected incident.

Ticket note template

Issue: Suspected malware on <device> (user: <name>)
Symptoms / first noticed: 
Likely cause (user action): link / attachment / install / unknown
Device isolated from network at: <time>
Scans: Windows Security full scan [clean / found: <names>] | Offline scan [clean / found] | second scanner [name, result]
Removed: <programs / extensions> | Updates installed [Y/N]
Credentials possibly exposed: Y/N -> passwords changed from clean device [Y/N], MFA [Y/N]
Result: Clean (no detections after rescan) / Not resolved
Rebuild recommended: Y/N | Reported to security: Y/N <who>
Next step / escalated to:

View as Markdown

How to use this

  1. Search first. Type what the user is describing, like printer offline or locked out. The search reads the whole text of every runbook, not only the titles.
  2. Narrow it down if you want to. The topic links under the search box (Windows, Network, Accounts and so on) trim the list. Click one again, or pick All, to go back.
  3. Open a runbook and read down the page. Symptoms tell you if you are in the right place. Before you start lists the quick questions. Then work through Steps in order, simplest first.
  4. Know when to stop. The shaded Escalate when box lists the signs that it is time to hand the ticket on. If any one of them matches, stop and escalate.
  5. Copy the ticket note. The last section has a note template. Press Copy, paste it into your ticketing system, and fill in the blanks.
Words you will see
Runbook
A written set of steps for one kind of problem, so you do not have to work it out from scratch each time.
First-line support
The first person a user talks to. Fixes the common problems and passes the rest on.
Escalate
Hand a ticket to someone with more access or experience, with notes so they do not have to start over.
Scope
How many people or devices are affected. One laptop and the whole office are very different problems.
Ticket note
A short written record of what was reported, what you tried and what happened.

Why I built this

I'm a computer science student in Toronto and I'm looking for junior IT support and help desk roles. When I started practising troubleshooting, I noticed I knew a lot of individual fixes but not a calm order to try them in, or when to stop and hand a problem on.

So I wrote these twelve runbooks to put that in order for myself, and I built this site so they are easy to search and read. They come from public vendor documentation and common help desk practice. They are not copied from a workplace and they are not real tickets.

They are still a work in progress. If a step looks wrong or something is missing, I would like to know.