Step 1: Isolate the infected device
Disconnect from Wi-Fi and Ethernet immediately to prevent lateral movement and data exfiltration. Do not log into banking or email from the compromised machine until cleanup is complete.
Step 2: Run a full system scan
Boot into Safe Mode with Networking disabled when possible, then run a Full System Scanner. Quarantine all detected threats before rebooting normally.
# Check suspicious startup entries (run as admin)
Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, LocationStep 3: Remove persistence mechanisms
- Review scheduled tasks and startup folders
- Check browser extensions for unknown add-ons
- Rotate passwords from a clean device after removal
- Update Windows and all applications to patch exploited vulnerabilities