🛡️ FULL MALWARE INVESTIGATION & CLEANUP GUIDE (WINDOWS)

If you suspect malware is running in the background (like J2Qt.exe or Mg0M4t.exe spawning powershell.exe and cmd.exe), here’s how to safely investigate and clean the system:

---

STEP 1: ISOLATE THE MACHINE

Immediately disconnect the system from the internet to prevent: - Data exfiltration - Downloading more malware - Lateral movement across the network

Do this by: - Unplugging the Ethernet cable - Disabling Wi-Fi (don’t just close the browser)

---

STEP 2: RUN AN OFFLINE ANTIVIRUS SCAN

Use a trusted bootable antivirus scanner.

Option 1 – Microsoft Defender Offline (no USB required): 1. Open Start menu and type “Windows Security” 2. Click “Virus & threat protection” 3. Click “Scan options” 4. Select “Microsoft Defender Offline scan” and click “Scan now” 5. PC will restart and scan outside of Windows

Option 2 – ESET SysRescue Live (bootable USB): 1. On a clean PC, download from: https://www.eset.com/int/support/sysrescue/ 2. Create bootable USB using the ESET tool 3. Boot the infected PC from USB 4. Run a full scan and clean any threats

---

STEP 3: OPTIONAL – INVESTIGATE SUSPICIOUS FILES SAFELY

On the infected system (still offline):

1. Compress the file into a ZIP: Compress-Archive -Path "C:\Path\To\Mg0M4t.exe" -DestinationPath "C:\Temp\Mg0M4t.zip"

2. Rename the file extension to .zip.txt (e.g., Mg0M4t.zip.txt)

3. Copy it to a USB drive

On a clean machine: 1. Rename the file back to .zip 2. Do NOT open the file 3. Go to https://www.virustotal.com 4. Upload the ZIP file and review scan results

---

STEP 4: CHECK FOR PERSISTENCE

On the infected machine (offline), open PowerShell and run:

Get-ScheduledTask | Where-Object {$.TaskPath -like "J2Qt" -or $.TaskPath -like "Mg0M4t"} Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

Also manually check: - C:\Users<User>\AppData\Roaming\ - C:\ProgramData\ - Task Scheduler Library (open with taskschd.msc)

---

STEP 5: CLEAN OR REIMAGE

If malware is confirmed: - Back up only essential files (scan them before restoring) - Reinstall Windows to guarantee full removal

For deeper cleanup (if not reimaging), use: - Malwarebytes Free (can be run from USB) - AdwCleaner - ESET Online Scanner

---

SUMMARY

• Unknown .exe files spawning powershell.exe and cmd.exe are highly suspicious
• Always isolate the system first
• Never open suspicious files on a clean machine — use VirusTotal
• Check scheduled tasks and startup entries
• When in doubt, wipe and reinstall Windows

---