What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Isolate the infected server, preserve useful evidence, and determine how far the compromise reached before trying to remove malware. For a server with privileged access compromised, an uncertain infection scope, or suspected rootkit persistence, a clean rebuild is safer than relying on an in-place cleanup. Restore only from a source assessed as clean, rotate exposed secrets, and monitor for renewed activity before returning the server to normal service.
1. Coordinate the response and contain the infection
Follow your organization’s incident response plan if it has one. Identify the affected server, connected systems, and services that may be at risk. Containment should limit the attacker’s ability to spread or maintain access without needlessly destroying evidence or disrupting essential services.
The Cybersecurity and Infrastructure Security Agency (CISA) lists host, internal-network, and perimeter controls as possible containment measures. Depending on the incident, these can include disconnecting a public-facing system, restricting network access, changing firewall rules, or blocking and logging known malicious traffic. If multiple hosts or network segments may be affected, network-level isolation may be more practical than isolating one server at a time. Choose the scope with your incident responders, considering potential spread, business continuity, evidence needs, and available resources.
Avoid treating shutdown as the automatic first move. CISA warns that powering off a system can destroy volatile evidence; its ransomware guidance reserves shutdown for situations where disconnection or network isolation is not possible. In a cloud environment, consider taking a volume snapshot for later forensic review if your response process and platform support it.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
2. Preserve evidence and establish the scope
Before eradication or other destructive changes, preserve relevant evidence where feasible. Depending on the environment and the people available to collect it, this may include logs, system images, memory capture, cloud volume snapshots, and artifacts associated with the suspected compromise. Keep records of the response decisions and when they were made.
Build a timeline and scope from available evidence. Record the suspected entry point, affected services, observed indicators, relevant accounts, network connections, and other systems that may have communicated with the server. Review detection data and logs for earlier access or activity on connected hosts; the malware’s discovery date does not establish when the incident began. CISA, the FBI, and the NSA recommend collecting and reviewing relevant logs, data, and artifacts, and advise considering outside expertise when it can help establish scope and remove residual access.
There is no universal Linux command set for evidence collection in the cited government guidance. Collection methods depend on the distribution, hosting platform, incident, and forensic requirements. If the incident has significant business, legal, or operational impact, involve qualified incident-response or forensic specialists before taking steps that could alter evidence.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
3. Decide whether to rebuild or remediate in place
Base the recovery route on the level of access the attacker had, how confidently you can determine the scope, whether persistence may remain, and whether you have a trustworthy image or backup. CISA’s federal incident-response playbook directs responders to account for multiple attack paths and persistence mechanisms, remove incident artifacts, and reimage affected systems from clean backups or trusted gold sources. It specifically calls for rebuilding hardware when rootkits were involved.
When a clean rebuild is the safer choice
- Privileged access was compromised, or you cannot rule out that the attacker gained it.
- The scope or persistence mechanisms are uncertain.
- A rootkit is suspected or confirmed; CISA’s playbook calls for rebuilding the hardware in this case.
- You have a clean, trusted image or backup and can restore service from it.
Keep the original system and evidence available as appropriate for investigation. The cited playbook supports reimaging from a clean source but does not prescribe a Linux-specific rebuild procedure; that depends on your distribution and environment.
What targeted cleanup can and cannot establish
Removing known malicious files may be part of eradication, but it does not by itself establish that all access or persistence has been removed. CISA recommends scanning for malicious code and allowing adequate time to look for persistence, such as backdoors. A scan is one verification activity, not proof that a compromised host is trustworthy. If new signs of compromise appear, return to technical analysis and reassess the scope rather than treating the cleanup as complete.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
4. Rotate credentials and revoke access
Assume secrets available to the compromised server may have been exposed. As part of containment and recovery, change administrator passwords, rotate private keys and service or application secrets where compromise is suspected, and revoke privileged access that should no longer be trusted.
Scope this review beyond local logins: consider credentials or tokens the server could access for deployment, backup, cloud, and monitoring services. This is an operational application of CISA’s direction to rotate suspected compromised secrets; the playbook does not enumerate that particular list. Coordinate rotation so dependent services receive the new secrets and old credentials are no longer usable.
5. Restore from a clean source and validate service
Use backups or gold images that are known, or reasonably assessed, to be clean. CISA recommends offline, encrypted backups, regular restoration testing, and careful restoration to avoid reintroducing malware. A backup is useful for recovery only if its contents and access path are suitable for the incident; the presence of a backup alone does not establish that it is safe to restore.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
- Prepare a clean system or recovery environment before restoring the affected service.
- Restore critical services in priority order from a clean source, keeping the recovery environment isolated as appropriate.
- Validate the restored data and confirm that essential service functions work before restoring normal network connectivity.
- Reconnect only systems assessed as clean, and do so in a controlled manner.
Test restoration regularly so that recovery does not depend on discovering during an incident that a backup is unusable. An offline external drive can be one element of a backup arrangement, but a drive alone is not a safe backup plan: isolation, access controls, encryption, and restoration testing matter too.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.6. Monitor for re-entry and document the incident
Watch for renewed attacker activity and signs of persistence during eradication and recovery. CISA’s federal playbook describes the transition from containment to eradication this way: “Upon successful containment (i.e., no new signs of compromise), preserve evidence for reference and law enforcement investigation (if applicable), adjust detection tools, and move to eradication.” The guidance emphasizes that containment is based on the absence of new signs of compromise, not merely on having disconnected a host.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →If new activity appears, contain it and resume technical analysis to identify the infection vector and reassess affected systems. Document the timeline, findings, decisions, and lessons learned, then update response plans and controls based on what the incident revealed.
What the guidance does—and does not—establish
CISA’s Federal Government Cybersecurity Incident and Vulnerability Response Playbooks, its #StopRansomware Guide, and a joint CISA, FBI, and NSA advisory provide general incident-handling guidance that supports the sequence above. They do not provide a distribution-specific Linux command procedure, certify any particular scanning tool as sufficient, or guarantee that a system is malware-free. Adapt operational steps to the server’s platform and incident, and use qualified responders when the evidence, scope, or business impact warrants it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
