I think my computer might be compromised. Today, while I was checking my PC (I'm not an expert at this), I used a tool called SystemInformer to look into Lsass.exe. I found out I couldn't create a memory dump or access memory options, even in admin mode. This makes me worried that my computer is compromised. Right now, I've disconnected it from the internet and plan to reinstall Windows, but I have a few questions:
1. I have about 2TB of data on an external SSD that I'd like to keep. Is it safe to keep this, and how can I reduce the risk of it being infected?
2. For my other drives, how can I reset them completely without leaving any remnants of my old Windows? I have both internal and external drives—can this be done from my computer?
3. What's the best way to reinstall Windows without risking infection on my new version? If I download Windows onto a USB stick from another computer, will it be infected when I plug it into my compromised system?
I do have access to another secure computer with internet. Also, is the Windows 11 ISO suitable for this scenario? Let me know if you need any more information. Thanks to anyone who can help!
3 Answers
If you're worried about malware, first, consider running a full virus scan. Use Windows' built-in antivirus, and if it doesn’t find anything, try downloading Malwarebytes and run a scan with that too. Just because Lsass.exe options were inaccessible doesn't necessarily mean your system is compromised—it could be a permissions issue. But getting that scan done is crucial!
When reinstalling Windows, download the ISO onto a USB stick using that non-compromised computer. Make sure to use the official Microsoft website for the cleanest version of Windows 11. When you plug in the USB to the compromised PC, it should remain unaffected as long as you don’t run any suspicious files or programs from it. Just be vigilant about the installation process!
To keep your external SSD safe, consider scanning it with an antivirus after you've backed up the data. Before moving files back, make sure they're clean. For your other drives, you can use Disk Management in Windows to format them completely, which will remove all data. Just ensure that you're doing this on the right drives—double-check before proceeding!
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures