How do you clean a computer after a phishing click?

A network tool cannot clean a device; that is the job of your endpoint protection and, when in doubt, a reinstall. A practical order: disconnect the device from the network but keep it powered on, so IT can capture evidence if needed. Run a full scan with your endpoint detection and response (EDREDR: endpoint detection and response. Security software installed on each computer that watches what happens on that machine.) or antivirus tool, and check for new programs, browser extensions, scheduled tasks and startup items. If anything suspicious ran, or the device belongs to an administrator or someone in finance, the safer choice is to wipe it and reinstall from a known-good image, then restore files from backup, rather than trust a cleanup. Before reconnecting, change the user's passwords from another device. Once it is back, keep an eye on its network behaviour for a few weeks: NetSenX can show whether it starts regular outbound connections or unusual traffic again.

← All 29 questions on Phishing and e-mail aftermathAll topics