Lesson 4: PC Security Troubleshooting Lab

Security symptoms on a PC are messy because the same visible behavior can come from Windows, a browser, a network setting, a normal application, or malicious software.

That means the technician has two jobs at once:

1. recognize when security is plausible;
2. avoid using security as an excuse to skip evidence.

This lab uses supplied and fictional evidence only.

The security troubleshooting ladder

Use this sequence for every station:

symptom
  ↓
which process / application / Windows component produced it?
  ↓
what still works?
  ↓
security concern + ordinary alternative
  ↓
containment needed?
  ↓
smallest evidence source
  ↓
controlled correction
  ↓
verification + escalation

Station A: unable to access the network

Evidence:

physical link: up
IP configuration: valid
other devices: normal
local security software: network rules changed recently

A failed NIC is weak because the interface already has link and configuration.

A security or firewall rule becomes relevant because the timing matches the change.

But ordinary gateway, DNS, or service causes remain possible until the evidence narrows further.

The word security should not make you forget the network ladder.

Station B: desktop security alerts

Evidence:

alerts: repeated on desktop
source application: unfamiliar
Windows Security: does not show the same condition

First question:

Which process or application generated the alert?

A security-looking notification is still just a notification until you verify the source.

Possible explanations include:

• legitimate third-party security software;
• browser/site notification;
• potentially unwanted software;
• deceptive malicious alert.

Do not click the alert to discover what it does.

Inspect the source through trusted system state.

Station C: false antivirus protection alert

Evidence:

browser pop-up: antivirus expired, pay now
approved endpoint protection: healthy/current
alert source: browser page

What has the approved protection state proven?

It strongly weakens the claim made by the pop-up.

Do not purchase, call, install, or enter credentials through the warning.

Close or report the page and inspect browser notification, extension, and site-permission state.

Station D: altered system or personal files

Unexpected file changes can indicate:

• user or application action;
• synchronization;
• storage corruption;
• malware;
• script or automation;
• administrative change.

Preserve:

• filenames;
• timestamps;
• known-good copies;
• application or sync history;
• security alerts;
• recent installs.

Do not overwrite the affected files while investigating.

If the files may contain important evidence or recoverable user data, preservation comes before cleanup.

Station E: missing or renamed files

A user says:

My files are gone.

Separate the possibilities:

moved or renamed
sync change
Recycle Bin / recovery state
permission issue
storage failure
malicious alteration or encryption

A missing file is not one-to-one proof of ransomware.

Use file history, sync state, recovery tools, storage evidence, and security indicators.

Station F: inability to access files

This symptom needs even more precision.

Compare:

Permission denied

The file exists. Authorization fails.

File cannot be opened because it is corrupted

The path and permission may be fine. Integrity fails.

File appears encrypted or renamed unexpectedly

Security concern increases, especially with broader simultaneous changes.

Storage device is unavailable

The file layer may not even be reachable.

The error message changes the boundary.

Station G: unwanted operating-system notifications

Identify whether the notification came from:

• Windows;
• an installed application;
• a browser or site;
• a security product;
• potentially unwanted software.

Do not disable all notifications because one source is bad.

That would hide legitimate system and security evidence too.

Remove or correct the responsible source after identification.

Station H: Windows Update failures

A failed update can involve:

• insufficient storage;
• network or Microsoft service problems;
• damaged update state;
• policy;
• security-software conflict;
• unsupported system lifecycle;
• malware or unwanted modification.

Security is one hypothesis.

If the disk is nearly full and the update reports insufficient space, the evidence already gives you a cleaner explanation.

Station I: frequent browser pop-ups

Scope the browser:

• one site?
• one profile?
• every browser?
• notifications or new windows?
• extension installed recently?
• homepage/search behavior changed?

Possible boundaries include:

• site notification permission;
• extension/plugin;
• adware or PUP;
• deceptive website;
• broader malware.

The scope tells you how far to widen the investigation.

Station J: certificate warning

A certificate warning can result from:

• wrong device date/time;
• wrong destination hostname;
• expired or invalid certificate;
• untrusted certificate chain;
• proxy or inspection configuration;
• redirection or on-path concern.

Do not bypass the warning to see whether the site loads afterward.

That removes the trust boundary you are trying to investigate.

Verify the clock, destination, network/proxy path, and legitimate service state.

Station K: browser redirection

Redirects can come from:

• changed search or home settings;
• unwanted extension;
• proxy configuration;
• local DNS/hosts changes;
• adware/PUP;
• malicious software.

Worked case:

one browser profile: redirects
second clean profile: normal
other applications: normal
unknown extension: installed recently

The extension/profile boundary is much stronger than "Windows is infected everywhere."

Keep the correction proportional until the evidence widens.

Station L: degraded browser performance

Slow browsing can involve:

• too many extensions;
• high CPU/memory use;
• enormous or damaged profile/cache state;
• poor network performance;
• provider/service slowdown;
• security scanning;
• adware or malicious behavior.

Compare another browser or profile, local versus remote application performance, Task Manager resource state, and network evidence.

Slow browser does not equal infection.

Worked incident: several symptoms actually belong to one browser source

Evidence:

fake antivirus alerts: browser notifications
pop-ups: same browser profile
redirects: same profile
Windows Security: normal
other browser profile: normal

Strongest current scope: browser profile.

A controlled response can include:

• remove untrusted site notification permission;
• remove suspicious extension if present;
• restore approved search/startup settings;
• update browser;
• run approved endpoint scan;
• verify the affected profile and other system functions.

Do not format the PC because three browser symptoms share one local profile boundary.

Worked incident: files altered plus ransomware-style note

Evidence:

many personal files: renamed / inaccessible
ransom note: present
network shares: mounted
scope: more than browser

The incident scope is broader.

Containment and security escalation now outrank browser cleanup.

Same general category of "weird PC behavior," completely different response.

Build eight station records

Complete at least eight cases, including at least four browser/security symptoms.

For each document:

symptom
source / scope
security concern plausible
ordinary alternative
last proven-good boundary
first safe evidence source
containment required? why?
controlled correction
recovery / evidence concern
verification
escalation / documentation
remaining uncertainty

Make sure your eight cases cover the full Core 2 PC-security symptom set across the class record: network access failure, desktop alerts, false antivirus alerts, altered files, missing/renamed files, inaccessible files, unwanted OS notifications, update failures, browser pop-ups, certificate warnings, redirection, and degraded browser performance.

Before you move on

The technician skill is not seeing malware everywhere.

It is knowing when the evidence has crossed from ordinary troubleshooting into security response, and preserving enough state to make that decision defensible.

Next the labels disappear. You get one mixed queue and have to decide whether the problem is Windows, mobile, security, hardware, network, or policy.