--- title: Malware Cleanup Basics category: Security summary: First-response steps when a computer may be infected: pop-ups, unknown programs, browser hijacks or antivirus alerts. applies_to: Windows 10 / 11 using Microsoft Defender (Windows Security) related: 05-password-reset-account-lockout, 11-backups, 02-slow-pc --- ## Symptoms - Pop-ups or ads appearing when no browser is open; browser home page or search engine changed. - Unknown programs, toolbars or extensions the user didn't install. - Antivirus alerts, or antivirus switched off and can't be turned on. - PC suddenly very slow, fan constantly loud, or high network use. - Files renamed or locked, or a message demanding payment (**ransomware**: see below). - The user entered a password on a suspicious site or opened a suspicious attachment. ## Before you start - **This is a security matter.** Follow your organisation's incident-reporting policy. When in doubt, report it. - **Ransomware or a ransom note, or signs that many files were encrypted:** disconnect the device from the network (unplug the cable / turn off Wi-Fi), **do not pay**, do not try to clean it yourself, and **escalate immediately**. - Ask: what was the user doing when it began? Did they click a link, open an attachment, install something, or enter a password? ## Steps 1. **Isolate the device.** Disconnect from the network (unplug Ethernet, turn off Wi-Fi) so any malware can't spread or send data. Don't sign in to anything important from this device. 2. **Record what you see** (screenshots, names of strange programs, the time it started). This helps the next person. 3. **Run a full Windows Security scan:** Windows Security > Virus & threat protection > *Scan options* > **Full scan** > Scan now. Quarantine/remove what it finds. 4. **Run an offline scan** for stubborn malware: the same *Scan options* screen > **Microsoft Defender Antivirus (offline scan)**. The PC restarts and scans before Windows fully loads. 5. **Check what is installed and starting up:** - Settings > Apps > Installed apps: sort by install date, uninstall unknown software recently installed (confirm with the user). - Task Manager > *Startup apps*: disable unknown entries. - Browser: remove unknown extensions; reset the browser's settings if the home page is hijacked. 6. **Update Windows and the antivirus definitions** (Windows Update; Windows Security > *Virus & threat protection updates*). Reconnect to the network only to download updates if your policy allows. 7. **Consider a second-opinion scanner:** a reputable on-demand scanner approved by your organisation can catch things the first missed. 8. **Change passwords from a *different, clean* device** if the user entered passwords on a suspicious site or the PC was infected: email first, then banking and work accounts. Turn on multi-factor authentication where possible. See *Password Reset and Account Lockout*. 9. **Decide whether to rebuild.** If malware keeps returning, the antivirus can't be re-enabled, or you can't be sure it's gone, the safest option is to **back up personal files (scan them), then reinstall Windows** (with approval). 10. **Close the loop:** explain to the user what likely happened and how to avoid it (don't open unexpected attachments; check links; don't install cracked software; report phishing). ## Escalate when - Ransomware, or any sign of data being stolen. - The user entered **work credentials** or approved an unexpected MFA prompt. - More than one device shows the same symptoms. - The device holds sensitive or regulated data (customer, health, payment). - Antivirus can't be started, or the malware comes back after cleaning. - Your policy requires a security team to handle every suspected incident. ## Ticket note template ``` Issue: Suspected malware on (user: ) Symptoms / first noticed: Likely cause (user action): link / attachment / install / unknown Device isolated from network at: