> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Malware Removal: Detection, Cleanup, and Hardening
> Identify malware symptoms, isolate infected systems, run targeted removal scans, and apply post-cleanup hardening steps to prevent reinfection.
Malware infections can range from mildly disruptive adware to devastating ransomware that encrypts your entire file system. Catching the warning signs early, acting quickly to isolate the affected machine, and following a structured removal process dramatically improves your chances of a full recovery without data loss.
## Recognizing Infection Symptoms
Before running any tools, confirm that you are actually dealing with malware rather than a hardware or software misconfiguration. Common indicators include:
Open **Task Manager** (`Ctrl + Shift + Esc`) and check the **CPU** and **Disk** columns. If an unknown process is consistently consuming 80–100 % of resources, it may be a cryptominer or worm.
```powershell theme={null}
# List top 10 CPU-consuming processes in PowerShell
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, Id
```
Persistent advertisement pop-ups outside of a browser window, a changed default homepage, or a new search engine you did not install all point to adware or a browser hijacker.
Open your browser's extension manager and look for items you do not recognise. In Chrome: **Menu → More Tools → Extensions**. In Edge: **Menu → Extensions**.
A full-screen message demanding payment in cryptocurrency, along with files that have been renamed with an unfamiliar extension (e.g., `.locked`, `.encrypt`, `.ryuk`), is a clear ransomware indicator. **Stop all activity immediately and move to isolation.**
Malware frequently attempts to disable security software. If Windows Security shows a red status or your antivirus product cannot be opened, treat the machine as compromised.
***
## Step-by-Step Removal Process
Disconnect the computer from all networks to prevent the malware from spreading, phoning home, or exfiltrating data.
* Unplug the **Ethernet cable**.
* Turn off **Wi-Fi** (physical toggle or `Fn + F2` on most laptops).
* Disable **Bluetooth** if it is enabled.
Do **not** shut down the machine if you suspect ransomware — some variants delete shadow copies on shutdown. Keep it powered on but fully isolated until you are ready to run scans.
If the device is managed by your organisation, notify the IT Security team immediately so they can begin an incident record before you proceed.
Running removal tools in Safe Mode prevents many malware strains from loading alongside Windows.
1. Press `Windows + R`, type `msconfig`, and press **Enter**.
2. Go to the **Boot** tab, check **Safe boot**, and select **Network**.
3. Click **OK** and restart.
You need networking enabled in Safe Mode so you can download updated scanner definitions in the next steps.
Windows Defender Offline runs before Windows fully loads, allowing it to catch rootkits and boot-sector malware that can hide from a standard scan.
**Option A — From Windows Security (GUI):**
1. Open **Windows Security** → **Virus & threat protection**.
2. Under **Current threats**, click **Scan options**.
3. Select **Microsoft Defender Offline scan** and click **Scan now**.
4. The machine will restart and scan automatically (allow 15–30 minutes).
**Option B — From PowerShell (elevated):**
```powershell theme={null}
# Trigger a Defender Offline scan at next reboot
Start-MpWDOScan
```
Review the results under **Protection history** after Windows restarts.
No single scanner detects everything. Malwarebytes is widely used as a complementary tool because it uses a different detection engine and excels at adware and PUP (Potentially Unwanted Program) removal.
1. Download the free version from `https://www.malwarebytes.com` on a **clean machine** and transfer it via a freshly formatted USB drive.
2. Install and immediately click **Update Database** before scanning.
3. Select **Threat Scan** and click **Scan Now**.
4. When the scan completes, click **Quarantine** to isolate all detected items.
5. Restart when prompted.
The free tier of Malwarebytes is sufficient for on-demand scanning. You do not need to activate a trial or purchase a licence to complete a manual cleanup.
Many malware strains survive reboots by registering themselves as startup entries. Remove any you cannot identify.
**Using MSConfig (basic):**
```text theme={null}
Win + R → msconfig → Startup tab → Open Task Manager
```
Disable any entry with an unknown publisher or suspicious file path.
**Using Sysinternals Autoruns (advanced — recommended):**
1. Download Autoruns from `https://learn.microsoft.com/sysinternals/downloads/autoruns`.
2. Run as Administrator.
3. Go to **Options → Scan Options** and enable **Check VirusTotal.com**.
4. Look for entries highlighted in **red** (file not found) or **yellow** (unsigned).
5. Right-click any suspicious entry and select **Delete**.
```powershell theme={null}
# Check all run keys via registry (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
```
Deleting the wrong startup entry can prevent legitimate software or system components from loading. If unsure, **disable** rather than delete, then test the system.
Sophisticated malware often uses the Windows Task Scheduler to re-download itself after removal.
```powershell theme={null}
# List all non-Microsoft scheduled tasks
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } |
Select-Object TaskName, TaskPath, State
```
Open **Task Scheduler** (`taskschd.msc`) and review flagged tasks. Delete any with random-looking names or pointing to `%TEMP%`, `%APPDATA%`, or unknown executables.
Even after system-level cleanup, malicious browser extensions or cached redirect scripts can persist.
1. Open your browser's extension page and **remove** any unknown extensions.
2. Reset the browser to defaults: **Settings → Reset settings → Restore settings to their original defaults**.
3. Clear all browsing data including cached images, cookies, and site data for **All time**.
4. Confirm your homepage and default search engine are set to your preferred values.
Cleaning the infection is only half the job. Close the doors that allowed it in.
| Hardening Action | How To |
| ------------------------------- | ------------------------------------------------------------------ |
| **Apply all Windows Updates** | Settings → Windows Update → Check for updates |
| **Enable real-time protection** | Windows Security → Virus & threat protection → turn on |
| **Review user accounts** | `lusrmgr.msc` — disable unknown local accounts |
| **Enable SmartScreen** | Windows Security → App & browser control → On |
| **Audit installed software** | Settings → Apps — uninstall anything unrecognised |
| **Change all passwords** | From a **clean device**, reset email, banking, and SSO credentials |
Enable **Controlled Folder Access** in Windows Security → Virus & threat protection settings to protect Documents, Desktop, and Pictures from unauthorised writes by future ransomware.
***
## Escalation
Escalate immediately if any of the following apply. Do not attempt further self-remediation.
* You see a ransomware notice and files have been encrypted.
* The infection has spread to network shares or other machines.
* Malware persists after two full scan cycles.
* A domain administrator account appears to have been compromised.
* Any patient, financial, or personally identifiable data may have been exfiltrated.
Submit an incident ticket including: the machine hostname, your username, the time you first noticed symptoms, which tools you ran, and screenshots of any detections. Your IT Security team will take over the investigation and determine whether a full reimaging is required.