Removing What You Found¶
Finding is most of the work. Removal has an order that matters, because malware that's still running can put itself back.
Order¶
- Stop it running. Kill the process first.
- Remove the persistence. The task, service, run key, or startup entry.
- Delete the file.
- Scan. Let Defender confirm the machine is clean.
Doing 3 before 1 fails (the file is in use). Doing 3 before 2 leaves an entry that errors at boot, and a smarter piece of malware recreates the file from a second copy.
Commands¶
Stop a process:
taskkill /pid 5820 /f
taskkill /im nc.exe /f
Remove a scheduled task:
Unregister-ScheduledTask -TaskName "Updater" -Confirm:$false
Remove a service:
sc stop badservice
sc delete badservice
Remove a run key value:
reg delete HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /f
Delete a file, including hidden and read-only:
Remove-Item "C:\Users\bob\AppData\Roaming\svchost.exe" -Force
If the file won't delete because it's in use, something is still running it. Go back to step 1.
Uninstalling programs¶
Installed programs come out through Settings → Apps or winget uninstall. If the uninstaller is missing or broken, delete the program folder and then remove its startup entries and services by hand.
Scan¶
Update-MpSignature
Start-MpScan -ScanType FullScan
Defender catches known malware. Everything above catches what's been renamed, is too new for signatures, or was hidden behind an exclusion.
Keep notes¶
Write down what you removed and where it was. Forensics questions often ask about exactly this, and you can't answer after it's gone.
Example¶
The Updater task from the previous page runs an encoded PowerShell command that launches C:\ProgramData\cache\update.exe. Order: taskkill /im update.exe /f; Unregister-ScheduledTask -TaskName Updater; Remove-Item C:\ProgramData\cache -Recurse -Force; full scan. Then note the path and the task name for the forensics questions.