ojava
Start free trial

All guides

Security logging switched off

What happened

Windows' security records were switched off or cleared, sometimes followed by data leaving the PC. Attackers erase their tracks this way.

How serious

Critical: act within the hour.

Steps: Windows PC

  1. Take the PC off the network now: unplug the cable and turn off Wi-Fi. Don't switch it off: what's in memory helps your IT provider.

  2. Turn security logging back on: your IT provider re-enables the Windows audit policy and the Windows Event Log service; until then treat the PC as suspect.

  3. Ask the person at that PC what they were doing at that time (installing something, a link in an email, a USB stick).

  4. Change the passwords used on that PC (Windows, Microsoft 365 or Google, banking) from ANOTHER, clean device.

How to check it’s fixed

Fixed when the deep scan finds nothing, protection is on again and Ojava shows the PC as healthy for 24 hours.

When to call your IT provider

Call your IT provider today, before using the PC again for work.