The client said the computer was slow. On the surface, it looked like another routine office check: find what was slowing the workstation down and get it working smoothly again. Antivirus scans found nothing that explained the problem, but something about the computer's behavior did not look right to me.
After thirty years working with computers, including older systems, you learn to notice things that do not appear in an alert. That instinct led me to keep checking what was running in the background, beyond what the user could see on the screen.
I found remote control tools running in the background with signs of update activity. They included ScreenConnect installations the user did not recognize. It is legitimate support software, but its capabilities are significant: controlling a computer, transferring files and executing commands. In unauthorized hands, it can provide a way into the office's working environment.
I continued investigating processes and connections. One process had a name resembling a familiar browser component. In fact, it was in an unusual location, lacked a digital signature and maintained an active connection to an external address. Scheduled tasks were also found that were designed to restart suspicious components. These are automated operating system instructions that can bring software back even after it has been stopped.
The emerging picture indicated an intrusion and the possibility of unauthorized access and data extraction. A computer in that state could provide a route to email, documents and systems the employee is signed into. Risks also include installing additional components, affecting other computers and disrupting operations. There was no proof that data had actually been extracted or that anyone was connected at that moment, but those possibilities still required caution.
The order of operations now mattered. I wanted to stop the suspicious activity without making the situation worse and reduce the risk to the other office workstations. I was working remotely, so disabling every access tool at once could also cut off my own support connection. An immediate reinstall was not possible.
I stopped and disabled suspicious services, blocked the identified communications and removed mechanisms that restarted the software. Remaining components in the sign-in process were addressed later, and daily scans were configured on the office computers. Checks after those actions found no activity from the components that had been disabled.
I compiled the findings and actions into an incident report, alongside the outstanding work: account remediation, follow-up checks and planning a reinstall or replacement. A complaint about slowness had led to a deeper investigation, leaving the business owner with a clear view of the risk and the way forward.
Is a computer behaving differently from usual? Suntech can help investigate the signs and define a structured response.