Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.
Work through these checks
0 of 4 complete01Perform a full offline malware scan and clean the registry startup paths
- Perform a full offline malware scan and clean the registry startup paths
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
02Block outbound connections to known C2 server IP addresses
- Block outbound connections to known C2 server IP addresses
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
03Enforce strict email gateway attachments filters
- Enforce strict email gateway attachments filters
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
04Reset all compromised account credentials
- Reset all compromised account credentials
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
Possible causes
- Phishing emails with malicious OneNote files, PDFs, or ZIP archives
- Drive-by downloads on compromised web pages
- Lateral movement via SMB share exploits
Was this helpful?
Your progress is saved on this device.