Skip to content

Malware or Virus Infection

Symptom

The user reports unexpected pop-ups, a hijacked browser homepage, unusually slow performance, or an antivirus alert flagging a threat.

Possible Causes

  • A malicious email attachment or link was opened.
  • Software was downloaded from an untrusted source.
  • A drive-by download from a compromised or malicious website.
  • An infected USB drive or external device.
  • Outdated antivirus definitions or a disabled antivirus service.

Step-by-step Resolution

  1. Disconnect the device from the network (Wi-Fi and Ethernet) to prevent the infection from spreading or communicating outward.
  2. Confirm antivirus or endpoint protection is running and its definitions are up to date.
  3. Run a full antivirus scan and let it complete before taking further action.
  4. Review the scan results and quarantine or remove anything flagged.
  5. Check installed programs and browser extensions for anything unfamiliar, and remove them.
  6. Reset the browser's homepage and search settings if they were changed.
  7. Change the user's passwords for any accounts they accessed on the device, once it's confirmed clean.
  8. Reconnect the device to the network and run a second scan to confirm the infection is gone.
  9. Confirm normal behavior with the user before closing the ticket.

When to Escalate

  • The antivirus tool cannot remove or fully quarantine the threat.
  • The infection appears to be ransomware, or any files are encrypted or held for ransom.
  • There's evidence of data exfiltration, or the device accessed sensitive systems while infected.
  • The infection is present on multiple devices, suggesting a network-wide compromise.
  • You suspect the user's credentials were compromised as a result.

Still stuck? Submit a ticket and reference this article. The agent will already know what steps you've tried.