Blog
Suspected Compromise: Client Checklist
If a computer is hot, slow, or acting strangely, stop using it for sensitive work and call us before changing anything.
First 15 minutes
Do these now, in order:
- Disconnect from Wi-Fi or unplug the network cable. Leave the computer powered on.
- Call (754) 300-9786 or email info@cybercon-solutions.com with what you noticed and when it started.
- Switch to a different, trusted device for email, banking, and work accounts.
- Write down anything unusual: pop-ups, files you didn’t create, recent downloads or links you clicked.
Please do not
- Do not delete files, uninstall apps, or run “cleaner” tools. This destroys evidence and can trigger the malware to restart.
- Do not change passwords from the affected computer. Do it from a clean device.
- Do not restart repeatedly or wipe the machine before we review it.
Warning signs
Any one of these is a reason to call (754) 300-9786. Several together are urgent.
| Sign | What it can mean |
|---|---|
| Fan running loudly while idle | Hidden software using the processor, such as a cryptominer |
| Computer hot to the touch or battery draining fast | Same, or heavy background activity |
| Sudden slowness with no new software | Unauthorized process or startup item |
| Unknown apps or browser extensions | Possible malware or adware |
| Login alerts from services you didn’t use | Stolen credentials |
| Security software turned off | Tampering |
What we check
Our first pass is read-only: we look, and we don’t change anything until you approve.
- Processor and heat usage, and any unfamiliar programs running from temporary or hidden folders.
- Startup items that relaunch software automatically after a restart.
- Outbound network connections, including known cryptomining services.
- Scheduled tasks, login items, and device profiles.
- A list of accounts and credentials that were available on the machine.
You then get a short written summary of what we found, how sure we are, and a proposed cleanup plan. Suspicious files are quarantined, not deleted, so evidence is preserved. This review shows what is on the machine now. It doesn’t prove how it got there or whether anything else was affected.
After cleanup
Removing the software is not the end. Assume anything stored on the computer may have been exposed until we confirm otherwise.
- Change email and Microsoft or Google passwords from a clean device
- Change passwords for banking, payroll, and cloud storage
- Rotate GitHub, SSH, and other access keys or tokens, if you use them
- Sign out all sessions and review recent sign-in activity
- Confirm multi-factor authentication is on for every account
- Check other computers on the same accounts or network
- Ask Cybercon whether a full reinstall is the safer choice
