Your computer or phone has slowed down, shows unusual ads, is flagged by antivirus, or does things you did not tell it to do. Malware can steal passwords saved in your browser, so treat any account used on that device as also at risk.
Signs
- Your antivirus shows a warning, or it has been switched off and cannot be turned on again.
- Pop-up ads keep appearing, your browser's home page has changed, or there are browser extensions you did not install.
- The device is slow and its fan spins loudly even though no heavy apps are open.
- Your email or social media account sends messages you did not write.
- New programs, icons, or apps appear that you did not install.
- On phones: the battery drains quickly, mobile data is used up, or an app asks for accessibility permissions.
Do this now
- Disconnect the device from the internet: unplug the network cable and turn off Wi-Fi or mobile data.
- Photograph or screenshot the antivirus message, including the detection name and the file location.
- Do not log in to any account from that device until it has been declared clean.
- If the device belongs to your agency, report it before cleaning it. The investigation may need the device in its current state.
- For personal Windows devices, run a full scan followed by a Microsoft Defender offline scan, then remove any browser extensions and new programs you do not recognize.
- From another clean device, change the passwords of your email, social media, and financial apps that were ever used on the infected device.
- If symptoms persist, back up your documents and photos (not programs or installers), then reinstall the operating system or perform a factory reset.
Don't
- Do not install cleaner or antivirus apps offered through pop-up ads. Such offers often contain malware too.
- Do not plug flash drives from that device into other computers before they have been scanned.
- Do not disable your antivirus to stop its warnings.
- Do not enter passwords or OTPs while the device is still infected.
Report
Report it through /lapor under the category Malware / Ransomware. Choose Sedang (Medium) for a single device without important data, and Tinggi (High) if more than one device is affected, or if the official device stores residents' personal data or is used to log in to government applications. If files are locked and a ransom is demanded, follow the ransomware page. Attach screenshots of the antivirus warning and describe when the symptoms started and which file or link was opened last.
The /lapor form only accepts images and PDFs, so do not attach malware samples there. An OPD that needs malware sample or log analysis can apply through a service request.
To prevent a recurrence
- Install apps only from the developer's official website or an official app store.
- Turn on automatic updates for the operating system, browser, and antivirus.
- Do not use pirated software, cracks, or activators.
- Scan flash drives before opening them.
- Do not save passwords for official accounts in the browser of a shared computer.