devto 2026-06-27 원문 보기 ↗
A practical, no-BS walkthrough of detecting, containing, and eliminating malware — with real scenarios and the commands that actually work.
So it happened. Your machine is acting weird. Maybe Chrome is opening tabs you didn't ask for. Maybe your CPU is pegged at 95% doing... nothing. Maybe your antivirus just screamed at you. Whatever it is, that sinking feeling in your stomach is valid — but panic won't help. A methodical approach will.
This guide walks you through exactly what to do when your system is compromised, from initial triage to full recovery. I'll use real-world malware scenarios so you can match your situation to the right fix.
Before we dive into removal, let's confirm we're actually dealing with malware and not a failing hard drive or a runaway Chrome extension.
Common infection symptoms:
If two or more of these apply to you — keep reading. You've got a problem.
Scenario: You notice your system fan is running full blast at 2 AM while your computer is idle. You check Task Manager and see a process called svchost32.exe consuming 80% CPU.
🔴 Red flag: Legitimate Windows processes don't have numbers in their name like that.
svchost.exeis real;svchost32.exeis almost certainly a cryptominer or trojan.
What to do:
Before you start killing processes or running scans, document what you're seeing. Take screenshots. Note the process names, PIDs, and any network connections.
On Windows (PowerShell, run as Admin):
# List all running processes with their full file paths
Get-Process | Select-Object Name, Id, Path | Sort-Object Name | Format-Table -AutoSize
# Check network connections and which process owns them
netstat -b -n -o
# See scheduled tasks (a favorite malware persistence trick)
Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Select-Object TaskName, TaskPath
On macOS/Linux (Terminal):
# Full process list with CPU usage
ps aux --sort=-%cpu | head -20
# Active network connections
sudo lsof -i -n -P | grep ESTABLISHED
# Cron jobs (persistence mechanism)
crontab -l
cat /etc/cron* 2>/dev/null
Scenario: You ran the netstat command above and see your machine making outbound connections to an IP in a country you've never visited. The process is update_helper.exe — which you've never heard of.
This is classic C2 (Command & Control) communication — your machine is "phoning home" to a remote attacker who may be exfiltrating your data right now.
Act immediately:
# Disable a specific network adapter (replace "Ethernet" with your adapter name)
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
Disable-NetAdapter -Name "Wi-Fi" -Confirm:$false
Scenario: You have a ransomware infection (you'll know because your files now have extensions like .locked, .encrypted, or .ryuk and there's a README_DECRYPT.txt on your desktop).
⚠️ Critical warning: Do NOT back up encrypted files as your only copy. Do NOT pay the ransom until you've checked for free decryptors (more on this later).
What to back up NOW (before any cleanup):
.env files, API credentials — rotate these immediately afterWhat NOT to back up:
.exe, .bat, .ps1, .sh) from your system — they may be infectedUse an external drive or a clean cloud upload — not another partition on the same disk.
Most malware is clever enough to defend itself while the OS is running normally — it hides its processes and blocks antivirus updates. Safe Mode loads the bare minimum, making the malware easier to kill.
Boot into Safe Mode with Networking:
single to kernel boot parametersNow run these — in this order:
Download from a clean device if needed. Malwarebytes is excellent at catching PUPs (Potentially Unwanted Programs), adware, trojans, and rootkits that traditional AV misses.
# After install, run a Threat Scan — it targets the most common infection locations:
# - Running processes
# - Startup entries
# - Registry keys
# - File system hotspots (%AppData%, %Temp%, %ProgramData%)
This runs before Windows loads, catching bootkits and rootkits that hide at the OS level:
# Run this from PowerShell as Admin — it will schedule a pre-boot scan
Start-MpWDOScan
If your scanner keeps getting blocked or your AV won't open, use RKill from BleepingComputer to terminate known malicious processes before scanning:
# Run rkill.exe as Administrator
# It will generate a log of everything it killed — save this for later
Automated scanners miss things. Here's how developers should manually investigate.
Scenario: Your browser keeps opening a casino website every time Windows starts, even after you've reset your homepage.
# Windows: Check all autorun locations
# Sysinternals Autoruns is the gold standard — download it from Microsoft
autoruns.exe # Run as Admin, look for entries highlighted in red or yellow
# Via PowerShell:
Get-CimInstance -Class Win32_StartupCommand | Select-Object Name, Command, Location
# macOS — LaunchAgents are a common persistence location
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/
# Linux — systemd services
systemctl list-units --type=service --state=running
ls /etc/systemd/system/
Malware often hijacks your hosts file to redirect legitimate sites (like your bank) to phishing clones.
# Windows
notepad C:\Windows\System32\drivers\etc\hosts
# macOS/Linux
cat /etc/hosts
A clean hosts file should only have 127.0.0.1 localhost and ::1 localhost entries. Anything pointing to external IPs is suspicious.
Scenario: Your colleague clicked a "free PDF converter" Chrome extension and now everyone in the office is seeing ads injected into every website.
Chrome: chrome://extensions/
Firefox: about:addons
Edge: edge://extensions/
Remove anything you don't recognize or haven't intentionally installed. Even legitimate-looking extensions (e.g., "Grammar Checker Pro") can be malicious if they were silently installed.
Ransomware deserves its own section because the response is different.
Before paying anything:
If you have Volume Shadow Copies enabled (Windows):
# Check if shadow copies exist (ransomware often deletes these — check anyway)
vssadmin list shadows
# If they exist, you can restore individual files via:
# Right-click file → Properties → Previous Versions tab
Once you've identified the malware, it's time to remove it cleanly.
# Always back up the registry before editing
reg export HKLM\SOFTWARE backup_HKLM_SOFTWARE.reg
# Common malware persistence locations to inspect:
# HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
regedit # Navigate manually and delete suspicious entries
Malware often changes your DNS to a rogue server that intercepts your traffic.
# Windows — reset DNS to automatic (DHCP)
netsh interface ip set dns "Ethernet" dhcp
netsh interface ip set dns "Wi-Fi" dhcp
ipconfig /flushdns
# Or set to a trusted public DNS
netsh interface ip set dns "Wi-Fi" static 1.1.1.1 # Cloudflare
# macOS
networksetup -setdnsservers Wi-Fi 1.1.1.1 8.8.8.8
# Linux
echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf
Chrome: Settings → Reset and clean up → Restore settings to original defaults
Firefox: Help → More Troubleshooting Information → Refresh Firefox
Scenario: You found a keylogger on your machine. It's been running for 3 weeks.
Assume every password you typed is compromised. Assume every SSH session you opened is compromised. Act accordingly.
Immediate credential rotation checklist:
ssh-keygen -t ed25519 -C "post-incident-$(date +%Y%m%d)"
You've cleaned up. Now let's make sure it doesn't happen again.
# Run a final Malwarebytes scan
# Run Windows Defender Full Scan
# Recheck netstat for unexpected connections
netstat -b -n | findstr ESTABLISHED
# Verify no new scheduled tasks appeared
Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)}
# Windows: Enable Controlled Folder Access (blocks ransomware from encrypting your files)
Set-MpPreference -EnableControlledFolderAccess Enabled
# Enable audit logging
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
# Linux: Install and configure fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban
# Enable automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades
Universal hardening tips:
Sometimes the malware is too deeply embedded — rootkits that survive OS reinstalls by hiding in the bootloader or firmware, for instance. Here's when to wipe and start fresh:
chkrootkit or rkhunter on Linux can detect these)# If reinstalling Windows, use the "Remove everything" option with "Remove files and clean the drive"
# This does multiple overwrite passes — more thorough than a quick format
# On Linux, reinstall from a verified ISO (check the SHA256 hash)
sha256sum ubuntu-24.04-desktop-amd64.iso
# Compare against the hash published on ubuntu.com
DETECT
[ ] Identify symptoms
[ ] Document process names, PIDs, network connections
CONTAIN
[ ] Disconnect from network
[ ] Do NOT shut down (preserve forensics)
[ ] Photograph/screenshot everything
COLLECT
[ ] Back up clean data to external drive
[ ] Export browser bookmarks
[ ] Note all installed software
ANALYZE
[ ] Boot into Safe Mode
[ ] Run Malwarebytes + Windows Defender Offline
[ ] Check startup entries, hosts file, browser extensions
[ ] Identify malware strain (ID Ransomware for ransomware)
REMOVE
[ ] Delete malicious files/registry entries
[ ] Remove suspicious extensions and software
[ ] Reset DNS, reset browser settings
RECOVER
[ ] Rotate all credentials from a clean device
[ ] Revoke SSH keys, API keys, OAuth tokens
[ ] Notify team if shared services were affected
[ ] Report to authorities if data was exfiltrated
HARDEN
[ ] Enable full-disk encryption
[ ] Enable Controlled Folder Access / equivalent
[ ] Set up automatic OS updates
[ ] Deploy DNS-level filtering
[ ] Review and tighten user privileges
Getting hit with malware is frustrating, but it's survivable if you stay calm and methodical. The biggest mistakes people make are:
The developers who handle incidents best treat them like debugging sessions: gather data, form a hypothesis, test it, repeat. Your machine is just another system to troubleshoot — and you're good at troubleshooting.
Stay safe out there. 🔐
Have a specific malware scenario that isn't covered here? Drop it in the comments — I read everything.
Tags: #security #cybersecurity #tutorial #devops