Viruses and Malware / Assistance needed to remove from a University computer

Objective

• To provide direction for removing viruses and malware from a University-owned computer when:
  • Your office computer has a virus
  • Your University computer seems to be compromised
  • A department computer has been hacked and you want the other computers in your department to be scanned for a virus or malware
  • A website message tells you that your University computer is infected with a virus or malware

Environment

• 10684: DHCP
• 1184990: Endpoint Detection and Response (EDR) - CrowdStrike Falcon
• Viruses & Malware
• University-owned Computer
  • Windows
  • macOS
• Security

Resolution

For Windows

CrowdStrike Falcon should be deployed to all university owned computer. Falcon provides next-generation virus protection. The Falcon sensor continuously monitors your university computer's applications, processes and services, detecting viruses, malware and PUP (potentially unwanted programs). Although you can use Falcon's user initiated scan capabilities, results of the scan will only be available to your local support representative and IT Services security admin in the Falcon console. Besides running the Falcon user initiated scan, you can also use Microsoft's Safety Scanner for an interactive scanning experience.

Using Microsoft's Safety Scanner

1. Download the Microsoft Safety Scanner. Note, you should download the Safety Scanner each time you want to run the tool to ensure you have the latest definition file
2. Double-click the file you downloaded and follow the prompts on the screen. You can choose to run a Quick Scan, Full Scan or Customized scan
3. Review the results once the scan is complete

Using Falcon's user-initiated scan

1. Right-click on your desktop 
2. Select Crowdstrike Falcon malware scan from the short-cut menu
3. Select Scan all drives or Scan System Drive to begin a scan. A notification pop-up will inform you that a scan has started
   • Note, computing resources available to other applications will diminish as the scan runs
4. You will receive another notification when the scan is complete
5. Right-click on your desktop and choose Crowdstrike Falcon malware scan -> See results of last scan to view your results

For macOS

1. Check that Mac's built-in anti-virus/anti-malware is enabled and being updated
   • Information and steps to confirm XProtect is enabled and being updated can be found here: How to Run XProtect on Mac
2. If you suspect that there is still a virus on your computer, contact IT Help by phone at 513-529-7900 or by live chat session at MiamiOH.edu/ITChat to report your issue
3. Provide the following information:
   • Your computer's location, including building name and room number
   • Your contact information