4.1.4. Troubleshoot common personal computer (PC) security issues. (Obj. 3.4)

💡 First Principle: PC security issues often manifest as performance degradation, unwanted browser behavior, or altered system files.

Troubleshooting security issues on a PC requires a keen eye for behavior that deviates from the norm. Malware and other security compromises are designed to be stealthy, but they almost always leave traces that a trained technician can spot.

Common security-related symptoms include:

• Pop-ups and Adware: Similar to mobile, if you are seeing pop-up ads on your desktop when your browser is closed, you have an adware infection on the system itself.
• Browser Redirection / Hijacking: The user tries to go to google.com, but their browser takes them to a different, sketchy search engine. This is caused by a malicious browser extension or a PUP that has modified the browser's settings.
• System File / Security Tool Tampering: The user reports they can no longer open Task Manager, Registry Editor, or their anti-malware software. This is a huge red flag that malware is actively trying to prevent its own removal. You might also find that Windows Update is disabled and cannot be re-enabled.
• Ransomware Messages: The most obvious and terrifying symptom. The user's files have been renamed with a strange extension, and a text file or a new desktop wallpaper appears demanding a ransom payment.
• Hijacked Email: The user's contacts report receiving spam or phishing emails from their address. This could be simple email spoofing, or it could mean a keylogger has stolen their password and an attacker has full access to their account.
• Invalid Certificate Warnings: If a user suddenly starts seeing certificate warnings on major, trusted sites (like Google, Microsoft, their bank), it could be a sign of a man-in-the-middle attack on their local network, where traffic is being intercepted.

Technician's Diagnostic Path: Scenario: A user reports that every time they search for something on Google, they are redirected to a different search engine called "QuickSearchFinder." Their web browser's homepage has also been changed to this site.

1. Identify the Problem: The symptoms are a classic case of browser hijacking, a common function of adware and Potentially Unwanted Programs (PUPs).
2. Establish a Theory: The user has most likely installed a malicious browser extension or a PUP. This often happens when installing a "free" program, where the PUP is bundled in the installer and the user clicks "Next" without reading the fine print that gives consent to the extra software.
3. Test the Theory (Browser First):
   • The first place to look is inside the browser. Open the browser's Extensions/Add-ons manager.
   • Look for any suspicious extensions, especially anything with "Search" or "Toolbar" in the name.
   • Disable the suspicious extension and test the browser again. If the redirection stops, you've found the culprit.
4. Establish a Plan of Action and Implement:
   • Step 1 (Remove Extension): Go back to the extensions manager and Remove the malicious extension completely.
   • Step 2 (Reset Browser): Go into the browser settings and reset it to its default state. This will clear the hijacked homepage and search engine settings.
   • Step 3 (Scan for PUPs): The extension was likely just a symptom. Open Control Panel -> Programs and Features and look for any strange programs that were installed around the same time the problem started. Uninstall them. Then, run a full scan with a good anti-malware tool like Malwarebytes, which is specifically designed to find and remove PUPs and adware.
5. Verify Functionality: After the scan and removal, reboot the PC. Open the browser and confirm that the homepage is correct and searches on Google are no longer being redirected.
6. Educate the User: Explain that the problem was caused by a program that was bundled with something else they installed. Show them an example of an installer with a pre-checked box for extra software and advise them to always choose "Custom" or "Advanced" installation to avoid these PUPs in the future.

Reflection Question: If a user reports that they can no longer open Task Manager or their antivirus software, what is the immediate concern, and what type of malware might be responsible?