What to Do if You Suspect Malware

Stop using the device, disconnect it from networks, leave it powered on and contact the Help Desk immediately if you suspect malware or unauthorized access.

This guide is for Shenandoah University faculty, staff and students who suspect malware or unauthorized access.

How to disconnect the device

Unplug any network cable and turn off Wi-Fi:

• Mac: Click the Wi-Fi icon (🛜) in the upper-right menu bar and turn Wi-Fi off. If the Wi-Fi icon is not in the menu bar, click Control Center (the two-switch icon), click Wi-Fi and turn Wi-Fi off.
• Windows: Open Start > Settings > Network & Internet > Wi-Fi and turn Wi-Fi off. If Turn Wi-Fi back on appears, select Manually.

When you contact the Help Desk

Give your callback number, the device's location and whether it is disconnected.

After hours: Call the same number. You will be directed to the after-hours service to report the incident, and someone will call you back.

Do not delay reporting to gather details or try to fix the problem. Telling your supervisor does not replace contacting the Help Desk or after-hours service.

Keep the device disconnected until cleared

• Reconnect and resume use only after OIT explicitly clears the device. An alert disappearing or a scan finding no threats does not mean you can resume use.
• Keep the device secure and available for OIT inspection. Arrange a handoff or approved support session through the Help Desk.
• Use an alternate device only as OIT permits. Do not move suspect files to another device.
• Do not disable or change endpoint protection or other university device-management software. Tampering with it violates university policy.

OIT will determine whether the device needs cleanup, rebuilding or data restoration.

What to report

Report any of the following, even if you are unsure whether the device is infected:

• A malware or endpoint protection alert, unexpected remote control, unfamiliar applications or disabled security software.
• Unusual browser redirects, pop-ups or unexplained account activity.
• Opening a suspicious attachment, installing unexpected software or running a command supplied by a website.
• Entering your sign-in information on an unfamiliar page or approving an unexpected multifactor authentication (MFA) request.

Never share an MFA code or approve a request you did not initiate. Never copy and paste a command into Terminal (on macOS) or Command Prompt (on Windows).

Details to provide after reporting

Record what you know and share it with the Help Desk when possible or when asked. Leave unknown items blank.

• Your name and callback number.
• Device name or asset tag and location.
• Date and time you first noticed the issue.
• Symptoms and what you were doing immediately beforehand.
• Accounts or data that may be affected.
• Actions you took and the time you disconnected the device.
• Time you contacted the Help Desk or after-hours service and your ticket number.
• OIT's instructions and authorization to resume use.