Symptoms of compromise on a desktop, and what each one narrows down

Why this matters

The security domain taught the malware categories and the removal procedure. This lesson is the part in between: recognising, from what a user describes, that a machine has been compromised rather than simply misbehaving.

That recognition is where most of the delay happens in real incidents. A user reports that their searches go somewhere odd, a technician clears the cache, and three weeks later the same machine is the entry point for something serious. The exam asks these as symptom-to-cause questions, and the practical value is the same: knowing which complaints mean "run the removal procedure" rather than "clear the browser data".

The lesson

Redirected searches, injected adverts, and the extension behind both

This is the most common compromise a support technician meets, and it is almost always the same thing.

The symptoms:

• Searches go to a provider the user did not choose, or through a redirector.
• A new home page or new tab page.
• Advertisements appearing on sites that do not have them, or in places that do not look like advertising.
• Links redirecting to somewhere other than what they say.
• A toolbar the user does not recognise.

The cause, in the overwhelming majority of cases, is a browser extension installed either by a bundled installer or by the user clicking through a prompt. It is not usually a virus in the classic sense and it will not usually be found by a file scanner, because there is nothing malicious on disk — the extension is doing exactly what it asked permission to do.

Where to look, in order:

1. The browser's extension list, in every installed browser and every profile. A hijack often installs into all of them.
2. The browser's search provider and startup page settings.
3. The shortcut's target. A modified shortcut appends a URL to the browser's command line, so the hijack reappears the moment the browser is launched from that icon and looks like the removal failed.
4. Policy-installed extensions, which cannot be removed from the extension list. On Windows these live in the registry's browser policy keys; their signature is an extension with no remove button.
5. Proxy settings and the hosts file, which achieve the same redirection without touching the browser at all.

Clearing the cache does none of the above, which is why the complaint comes back.

Certificate warnings on sites that should have none, and what that implies

A certificate warning on a site that should have a valid certificate is a strong signal, and it is worth knowing what it can mean.

The benign causes, which are common and should be ruled out first:

• A wrong system clock. Certificates are valid between two dates, so a machine whose clock is badly wrong reports every site as invalid. If the whole internet is broken at once, check the clock.
• An interception appliance on a corporate network, which is legitimate, installed deliberately, and produces a certificate issued by the organisation's own authority. On a managed machine this is expected.
• A genuinely expired or misconfigured certificate on one site.

The concerning cause: a certificate issued by an authority that was installed on this machine without authorisation. That is how traffic is intercepted locally — something installs its own root certificate, and from then on it can present a valid-looking certificate for any site while reading everything.

What to check: the certificate's issuer, in the browser's own certificate view, and then the machine's trusted root certificate store for entries that should not be there. An issuer naming an unfamiliar company, or naming software the user installed, is the finding.

The discriminator: one site with a warning is usually that site's problem. Every site with a warning on one machine is the machine's problem, and it is either the clock or something in the certificate store. On an unmanaged machine, the second means compromise.

New accounts, changed settings, and security software that will not start

These three are the strongest indicators in this lesson, and any one of them justifies the full removal procedure.

New accounts, or changed rights. An account nobody created, an existing account added to Administrators, or a disabled account re-enabled. This is persistence: a way back in that survives removing whatever arrived first. Check the local accounts and the Administrators group on any machine you suspect.

Changed settings that nobody changed. Firewall rules added, remote desktop enabled, a service installed, a scheduled task created, sharing turned on, system restore turned off. Each of these is a deliberate act by something with administrative rights.

Security software that will not start, will not update, or has been disabled. This is the single strongest signal available. Endpoint protection does not fail by accident, and tamper protection exists specifically because disabling it is the first thing hostile software tries. A machine whose antivirus is off, and whose user did not turn it off, should be treated as compromised until shown otherwise.

Two more in the same family:

• Windows Update disabled or failing consistently, which keeps the machine vulnerable.
• A user unable to reach security vendors' websites, which is a classic block placed by the infection itself.

The common thread: all of these are administrative actions, so they tell you something ran with administrative rights — which is the fact that, from the detection lesson, moves the decision decisively towards rebuild.

Unexplained network traffic, and watching it without trusting the machine

Network evidence is valuable because it comes from somewhere the machine cannot edit.

What to look for:

• Connections to addresses or countries with no relationship to anything the user does.
• Traffic when nobody is using the machine — overnight, at lunch, with the screen locked.
• Large outbound transfers, which is exfiltration.
• Repeated connections at a regular interval, which is the signature of something checking in for instructions.
• Internal scanning — one machine connecting to many others on the same port, which is how a worm looks from the network.

Watching without trusting the machine:

• The router or firewall's logs, which is the best source, because the machine cannot alter them.
• A second device capturing traffic on the same segment.
• The organisation's DNS logs, which show the names the machine asked for even when the connections are encrypted — often the most informative single source available.
• On the machine itself, netstat -a -n -o maps connections to processes. Useful and, per the detection lesson, not authoritative on a machine that may be lying.

The correlation that is worth the most: a connection seen by the router that the machine does not report. That discrepancy is one of the few pieces of evidence that positively indicates something is hiding, and it is the difference between suspicion and a finding.

Capture what you see, with times. If this turns out to matter, that record is what the incident is reconstructed from.

Deciding between clean, rebuild, and escalate, with a reason you can state

Three outcomes, and each needs a reason you can state.

Clean when: the finding is a browser extension or adware, nothing ran with administrative rights, no credentials were entered, no security software was disabled, the machine holds nothing sensitive, and you can explain how it arrived. Run the removal procedure, close the route in, and educate the user.

Rebuild when: something ran with administrative rights, security software was disabled, accounts or system settings were changed, a rootkit is suspected, remote access software was installed, there are multiple unrelated findings, or you cannot establish how it got in. That last one is the clause people argue with and it is the most important: an unexplained infection is an unclosed route, and cleaning it leaves the route.

Escalate when: the machine handled regulated data, belongs to someone with elevated access, shows signs of a targeted rather than commodity attack, or where there is any legal, contractual or regulatory dimension. Also when money has moved, when another organisation's data is involved, or when you are asked to do something that would destroy evidence.

Escalation is not an admission of inability. It is the correct action, and the operational procedures domain sets out what travels with it: what you observed, when, what you did, and what you have preserved.

The sentence worth being able to say to whoever decides: "I can clean this in an hour and I cannot tell you how it got in, or I can rebuild it in three and you will know it is clean." That is the trade, stated honestly, and the decision belongs to the person who owns the risk.