Hunt the Persistence on the Infected PC

Scenario

The front-desk PC at a small accounting firm is confirmed infected. The user says it was fine until she opened an invoice attachment on Monday. Since then the fan runs flat out, the PC is slow, and Windows Update has stopped finding anything. Your analysis so far: • A process called updchk.exe is running from the user's AppData folder, using CPU all day. • Killing it once is not enough: it comes back after every sign-in or reboot, so something is relaunching it. • The same payload also sits in C:\ProgramData under a service that Windows lists as "Windows Service Helper". • Windows Update and Defender updates both time out, as if download.windowsupdate.com no longer pointed at Microsoft. • Windows Security shows a detection under Current threats. The PC stays on the network while you work. Remove the malware and every way it survives a reboot. When you finish: • The malicious process is no longer running. • Nothing starts it at sign-in: the registry autorun entry and the startup entry that comes from it are gone. • The malicious service is stopped and set to Disabled. (Stop and disable it; do not delete it, so the incident record keeps its configuration.) • The added redirect is removed from the hosts file, and everything else in the file is left as it was. Windows protects that file, so a normal window cannot save it: you need an administrator window. • Microsoft Defender has run a scan and the threat is quarantined. Leave Windows Explorer and the legitimate Windows services alone. Grading is on the final state.

These instructions stay visible beside the lab while you work.You can reread these instructions in the lab at any time.