What Was Happening
Pop-ups in the browser. Performance had also been getting worse over a few months — not dramatically, but noticeably. The customer was a careful user and wanted to know not just whether the laptop was clean, but whether it was healthy more broadly: was the storage failing, was the cooling system overdue for service, were there security gaps that had let the infection in?
That’s a more useful conversation than “remove the virus”. The infection is a symptom; the conditions that allowed it are the underlying question.
Our Diagnosis
Malware side:
- Boot to Safe Mode with Networking. Confirmed which pop-ups were still active in Safe Mode (none — entirely browser-based) and which were not.
- Examined browser state. Extensions, startup pages, search engines, granted site permissions, cached service workers.
- Examined OS state. Scheduled tasks, registry run keys, startup folder, services, recent processes. Looking for anything that runs at login and isn’t legitimate.
- Ran two independent on-demand malware scanners. Different scanners catch different things.
Health side:
- SMART check on the internal SSD. Reallocated sectors, pending sectors, controller responsiveness, total writes vs the drive’s rated lifespan.
- RAM diagnostic. Quick MemTest pass to rule out memory errors as a cause of stability issues.
- Thermal stress test. Sustained CPU + GPU load for 15 minutes while monitoring temperatures. Looking for thermal throttling, fan noise patterns and any sign that the cooling system needed service.
- Windows update state. Checked for pending updates, especially security updates.
- Security configuration. Reviewed Windows Defender status, firewall configuration, account permissions, BitLocker (or equivalent disk encryption) status, browser security settings.
What we found
- Browser adware — an extension installed via a fake update prompt several weeks earlier, plus three sites with granted notification permission that were pushing scam alerts.
- A scheduled task that was reinstalling the extension if it was removed.
- Storage healthy. SMART clean, plenty of life left on the SSD.
- RAM clean.
- Thermal performance acceptable but trending warm. CPU under sustained load was running hotter than expected for this model. Diagnosis: fan dust accumulation and thermal paste past its prime.
- Several Windows security updates pending but failing to install — common when a system is borderline unstable.
- Windows Defender enabled but with some scanning exclusions that weren’t appropriate.
- Firewall fine, BitLocker not enabled.
How We Fixed It
Malware removal:
- Disabled the scheduled task first so the extension couldn’t reinstall itself.
- Removed the browser extension.
- Reset browser settings to defaults: search engine, startup pages, site permissions, cached service workers.
- Cleared the scheduled task properly.
- Checked and cleaned other persistence locations (registry, startup folder, services).
- Ran two follow-up scans on the cleaned system to confirm nothing remained.
Health work:
- Removed the cooling system, cleaned dust from the fan and heatsink, replaced thermal paste. Reassembled. Re-ran the thermal stress test — temperatures noticeably cooler under load.
- Resolved the failing Windows updates manually (each one had a specific reason for failing; identifying and addressing each individually was faster than the alternative of a full reset).
- Reviewed Defender’s scanning exclusions and reset them to the appropriate set for this user’s needs.
- Briefed the customer on enabling BitLocker — discussed pros and cons, customer chose to enable, set up correctly with recovery key saved to the customer’s Microsoft account (and noted separately for the customer’s records).
- Updated the browser to the current version and re-ran the security-settings checklist.
The Result
Clean machine, running cooler under load, current on Windows security updates, with a sensible security configuration in place. We sent the customer home with a written summary of what we’d found, what we’d changed and why — so they knew what to look for if any of the symptoms recurred.
Why This Happens
A laptop that ended up with an infection often has other contributing weaknesses worth catching:
- Outdated Windows. Missing security updates leave the OS more vulnerable.
- Outdated browser. Older browsers have weaker controls against the pop-up and notification abuses scammers rely on.
- Misconfigured Defender or third-party AV. Exclusions added “just to make this thing work” sometimes leave large gaps.
- Failing or borderline hardware. A laptop that’s frustrating to use because it’s slow or overheating is more likely to have impatience-driven security mistakes (“just install whatever this update prompt is asking for to make it stop”).
- No backup. Means a ransomware infection — which we didn’t find but is the worst-case scenario — would be catastrophic rather than annoying.
Doing the wider check while the laptop is on the bench is much cheaper than doing it in a separate visit, and catches the issues that contributed to vulnerability in the first place.
What you can do yourself
- Keep Windows up to date. Pending updates often contain security fixes for vulnerabilities being actively exploited.
- Keep browsers up to date. Same reason.
- Run a reputable anti-malware scan monthly even when nothing seems wrong.
- Review browser extensions every few months and remove anything you don’t recognise.
- Use the supplied Windows Defender rather than chasing third-party AV deals. Defender is good when configured properly.
- Enable disk encryption (BitLocker on Windows Pro, Device Encryption on Home editions, FileVault on Mac). Stops a lost laptop becoming a data breach.
Local Help in Putney SW15
Aggressive pop-ups, locked browser settings or ‘support call’ scareware all have different removal routes.
We clean the infection, fix the conditions that allowed it, and brief you on what changed.
Book a workshop visit on 020 7610 0500 or via the contact form.