A long-time customer called me after she ran into trouble getting Google Drive to work. While she was troubleshooting, ChatGPT spotted something suspicious in the PowerShell output and told her to disconnect the laptop. By the time I looked at it, she’d already switched off Wi-Fi.
I don’t see many genuine malware infections these days, so I was sceptical at first. Then I found a scheduled task dressed up as an Edge installer. It was set to run with system privileges, tried to add exclusions to Microsoft Defender, and was configured to download and run more code. I also found that the laptop was set up to route web traffic through a proxy running on the machine itself.
Defender’s real-time protection was down when I checked, and a scan from a separate Windows drive came back clean. On VirusTotal, 27 of 67 antivirus engines flagged one of the files, and 9 of 60 flagged the script. The detections pointed to an infostealer, a type of malware designed to collect information such as saved passwords. I couldn’t establish whether any information had been stolen or what caused Defender’s protection to stop.
Given what the malware was set up to do, I kept a full image of the original drive and did a clean Windows installation. I reinstalled her apps and restored her files. We also reviewed her Google and Microsoft accounts and signed out existing sessions.
I’d have liked to find out how the malware got onto the laptop, but I couldn’t pin down where it came from.
My advice is to slow down before installing anything. Look up the software and read a few independent reviews first. If you decide to install it, read each screen before clicking Next. Some installers bundle extra apps you didn’t ask for, and the option to skip them can be easy to miss. The same advice applies whether you’re using a laptop, a desktop PC or a phone.
