Suspected Infection: A Calm Triage Sequence
A strange pop-up, a browser that opens unwanted pages, or a sudden slowdown can mean a serious compromise, a nuisance extension, or nothing at all. The instinct is either to delete things until the symptom disappears or to ignore it. Both lose information. A short, ordered sequence keeps the machine usable, keeps your data recoverable, and gives you a defensible point at which to decide between cleaning and rebuilding.
Table of contents
- Read the early signals carefully
- Contain before you clean
- Identify the scope
- Clean or rebuild: the honest decision
- Restore in the right order
- Afterwards, and the part that prevents a repeat
- FAQ
- Bottom line
Read the early signals carefully
Start by writing down what you noticed and when: which application, which message, whether it appears only in the browser or across the system, and what changed just before it started. A recent install, a browser extension, or a downloaded attachment is a much more likely explanation than a sophisticated compromise, and the note is useful if you later need to trace it.
Some signals are misleading. A browser notification that claims your machine is infected is usually a site permission that was granted, not a diagnosis. A slowdown can be an update, a full disk, or a failing drive. Conversely, a machine that appears normal can still be running something unwanted. Treat the observation as a trigger to check, not as a conclusion.
Contain before you clean
- Disconnect the machine from the network if you have a concrete reason to believe something is actively communicating or spreading. This limits damage while you think.
- Do not sign in to additional accounts from that machine until you understand what happened, particularly email and financial accounts.
- Do not start deleting files at random. Removing a visible component can make the rest harder to identify and can destroy the note you just wrote.
- From a different, trusted device, change the password on your primary email and any account with payment details, and revoke active sessions where the service offers it.
- Check whether a backup exists and when it last ran before any removal attempt, not afterwards.
Identify the scope
Work from the least invasive checks outward. Look at installed applications and browser extensions, especially anything added near the time the symptom began. Check startup items and scheduled tasks if you are comfortable doing so; if not, say so and get help rather than guessing. Run a scan with the protection already installed, and consider a second opinion from a reputable on-demand scanner.
Record what each tool reported and what it removed. If a scan finds something and a repeat scan is clean, that is a reasonable outcome for a nuisance-class problem. If the same item returns after a reboot, or if several tools disagree, treat that as a sign that the scope is larger than a single removable component.
Clean or rebuild: the honest decision
Cleaning is proportionate for a clearly identified, self-contained problem: an unwanted extension, a bundled adware install, or a file downloaded and run once, where you can name what it was and confirm it is gone. Rebuilding is the honest answer when you cannot identify the entry point, when the same component returns, when the machine holds sensitive records, or when system files may have been altered.
Rebuilding is not an admission of failure; it is the only way to reach a known-good state. The practical barrier is usually data rather than the operating system, which is why the backup check belongs near the start. Before wiping, make a copy of only the documents you need, and keep it separate from the machine until the new system is running and protected.
Restore in the right order
- Reinstall or reset the system from a trusted source, then apply current updates before restoring anything.
- Enable built-in protection and confirm it is active and updating.
- Restore documents from the backup or copy, not installed programs, browser profiles, or executable files from the old machine.
- Reinstall applications from official sources, and recreate browser profiles rather than importing the old one wholesale.
- Change passwords again from the clean machine, starting with the primary email, then financial accounts, then anything else used on the affected device.
- Check recovery details and session lists on those accounts for changes you did not make.
Afterwards, and the part that prevents a repeat
Keep the note of what happened, including what the scans found and what you decided. It is useful if the symptom returns and useful for deciding whether a backup from that period is safe to keep. Watch the accounts that were accessible from the machine for a while, and keep an eye on statements rather than assuming the problem ended at the reboot.
Prevention is mostly unglamorous: current system and browser updates, applications from official sources, fewer extensions, a backup that actually runs, and an account structure where a compromise of one device does not unlock everything else. None of those is a substitute for judgement about an attachment, but together they turn a frightening event into a recoverable one.
FAQ
Should I turn the machine off immediately?
Disconnecting from the network is usually more useful than powering off, because it stops communication while preserving what is in memory and on screen for diagnosis. Power off if you are unsure how to disconnect safely, or if the machine is actively doing something destructive.
Is a clean scan enough to say the machine is safe?
It is a reasonable answer for a clearly identified, self-contained problem. It is not enough when the same item returns after reboot, when you cannot identify how it got in, or when system files may have been changed. In those cases a rebuild is the only way to reach a known-good state.
Can I restore my old browser profile after rebuilding?
It is better to recreate it. Profiles can carry extensions, settings, and cached data from the affected system. Restore bookmarks or passwords from a trusted source after the clean system is running, rather than importing the profile wholesale.
Do I need to change every password?
Prioritise the primary email, financial accounts, and anything used on the affected machine, and revoke active sessions from a trusted device. Unique passwords elsewhere are not exposed by an incident on a different service; a password manager's reused-password report helps confirm that.
Bottom line
A suspected infection is a triage problem, not a race to delete files. Write down what you saw, contain the machine, secure the accounts that unlock everything else from a different device, and confirm a backup exists before removing anything. Identify the scope with the least invasive checks first, then make an honest call: cleaning for a named, self-contained problem; rebuilding when you cannot explain the entry point or the problem returns. Restore documents rather than programs or profiles, change the high-value passwords again from the clean machine, and keep the note. The unglamorous work — updates, official sources, fewer extensions, a backup that runs — is what makes the next incident recoverable instead of catastrophic.
If you want to compare current plans in this category, the link below goes to our own product page.