4.1.4. Troubleshoot common personal computer (PC) security issues. (Obj. 3.4)

💡 First Principle: PC security issues often manifest as performance degradation, unwanted browser behavior, or altered system files.

Troubleshooting security issues on a PC requires a keen eye for behavior that deviates from the norm. Malware and other security compromises are designed to be stealthy, but they almost always leave traces that a trained technician can spot.

Common security-related symptoms include:

• Pop-ups and Adware: Similar to mobile, if you are seeing pop-up ads on your desktop when your browser is closed, you have an adware infection on the system itself.
• Browser Redirection / Hijacking: The user tries to go to google.com, but their browser takes them to a different, sketchy search engine. This is caused by a malicious browser extension or a PUP that has modified the browser's settings. If redirection survives removing extensions and resetting the browser, look at the system level: entries added to the HOSTS file (C:\Windows\System32\drivers\etc\hosts) override DNS for chosen names, and a changed DNS server or proxy setting affects everything. Redirection that follows the network rather than the PC (it starts when the PC joins one particular network) points to DNS poisoning/hijacking of that network's DNS server or router.
• System File / Security Tool Tampering: The user reports they can no longer open Task Manager, Registry Editor, or their anti-malware software. This is a huge red flag that malware is actively trying to prevent its own removal. You might also find that Windows Update is disabled and cannot be re-enabled.
• Ransomware Messages: The most obvious and terrifying symptom. The user's files have been renamed with a strange extension, and a text file or a new desktop wallpaper appears demanding a ransom payment. Respond in order: isolate the PC from the network first (ransomware also encrypts any network shares it can reach), then recover by wiping or reimaging and restoring data from a clean backup taken before the infection. Removing the ransomware does not decrypt the files, paying gives no guarantee of a working key, and System Restore is not a recovery path because ransomware routinely deletes Volume Shadow Copies and restore points.
• Hijacked Email: The user's contacts report receiving spam or phishing emails from their address. This could be simple email spoofing, or it could mean a keylogger has stolen their password and an attacker has full access to their account.
• Invalid Certificate Warnings: If a user suddenly starts seeing certificate warnings on major, trusted sites (like Google, Microsoft, their bank), it could be a sign of a man-in-the-middle attack on their local network, where traffic is being intercepted. Rule out a wrong system date and time first, since that breaks certificate validation on every site; with the clock correct, suspect an on-path attack (CompTIA's current term for man-in-the-middle).
• Desktop Alerts and False Antivirus Alerts: Alarming 'your PC is infected' warnings from a program the user didn't install, styled differently from their real security software, are rogue antivirus/scareware pushing a paid 'fix'. If the alert gives a phone number to call, it is a tech support scam whose goal is remote access to the PC and payment. By contrast, a notification from the user's own installed security product saying a threat was blocked or quarantined means the tool did its job: confirm it is genuine and reassure the user.
• Antivirus or OS Update Failures: When anti-malware definitions are out of date and updates keep failing, a common cause is an expired subscription or license: the product keeps running but can no longer download definitions. Also check connectivity, and suspect malware if updates are blocked and can't be re-enabled. Missing OS updates matter in the other direction too: an unpatched system is a common way for malware to get in, by exploiting the vulnerabilities those patches fix.
• Unable to Access the Network: Work up the layers. No address, or a 169.254.x.x (APIPA) address, points to the cable, adapter or DHCP. Once the IP configuration is valid and the default gateway answers, those are ruled out, so look at software on the host: a firewall rule (Windows Defender Firewall or a third-party suite) blocking traffic, a malicious proxy setting, or tampered DNS settings.
• Malware That Keeps Coming Back: If a file or symptom returns after the scanner removed it and the PC rebooted, a persistence mechanism is recreating it: a scheduled task, a Run/RunOnce registry key, a startup-folder entry or a service. Check Task Scheduler and startup items (Task Manager's Startup tab or Sysinternals Autoruns), and scan from Safe Mode or a bootable rescue disk.

Technician's Diagnostic Path: Scenario: A user reports that every time they search for something on Google, they are redirected to a different search engine called "QuickSearchFinder." Their web browser's homepage has also been changed to this site.

1. Identify the Problem: The symptoms are a classic case of browser hijacking, a common function of adware and Potentially Unwanted Programs (PUPs).
2. Establish a Theory: The user has most likely installed a malicious browser extension or a PUP. This often happens when installing a "free" program, where the PUP is bundled in the installer and the user clicks "Next" without reading the fine print that gives consent to the extra software.
3. Test the Theory (Browser First):
   • The first place to look is inside the browser. Open the browser's Extensions/Add-ons manager.
   • Look for any suspicious extensions, especially anything with "Search" or "Toolbar" in the name.
   • Disable the suspicious extension and test the browser again. If the redirection stops, you've found the culprit.
4. Establish a Plan of Action and Implement:
   • Step 1 (Remove Extension): Go back to the extensions manager and Remove the malicious extension completely.
   • Step 2 (Reset Browser): Go into the browser settings and reset it to its default state. This will clear the hijacked homepage and search engine settings.
   • Step 3 (Scan for PUPs): The extension was likely just a symptom. Open Control Panel -> Programs and Features and look for any strange programs that were installed around the same time the problem started. Uninstall them. Then, run a full scan with a good anti-malware tool like Malwarebytes, which is specifically designed to find and remove PUPs and adware.
5. Verify Functionality: After the scan and removal, reboot the PC. Open the browser and confirm that the homepage is correct and searches on Google are no longer being redirected.
6. Educate the User: Explain that the problem was caused by a program that was bundled with something else they installed. Show them an example of an installer with a pre-checked box for extra software and advise them to always choose "Custom" or "Advanced" installation to avoid these PUPs in the future.

Reflection Question: If a user reports that they can no longer open Task Manager or their antivirus software, what is the immediate concern, and what type of malware might be responsible?