| Detection | Type | Location | Action |
|---|---|---|---|
| Browser push-notification hijack | Adware | Chrome & Edge site permissions | Removed |
| Rogue scheduled task "UpdaterSvc32" | Persistence | Task Scheduler | Removed |
| Registry Run key dropper | Persistence | HKCU\…\Run | Removed |
| WMI event subscription | Persistence | root\subscription | Removed |
| Info-stealer staging folder | Stealer | %AppData%\Local\Temp\~st | Quarantined |
| Fake "PC optimizer" PUP | PUP | Program Files (x86) | Uninstalled |
| Malicious browser extension | Adware | Edge extensions | Removed |
| Suspicious startup shortcut | Persistence | shell:startup | Removed |
| Modified hosts file (ad redirects) | Hijack | drivers\etc\hosts | Restored |
| Proxy auto-config injection | Hijack | WinINET settings | Cleared |
| 2× bundled toolbars | PUP | Browser add-ons | Removed |
What an info-stealer would have targeted — and whether it was reachable before we cleaned the machine.
Because browser-stored credentials were reachable, we advise rotating email, banking and primary logins, and enabling 2FA.
Force-installed ad/tracker blocking and set secure DNS. Monthly remote check-up recommended.