The antivirus said 'no malware detected'. It was sitting right there on the disk.

A real incident, and a lesson about green lights.

Every command output, version number and CVE ID below is from the actual investigation. Nothing was invented for the narrative.

It started with an unrelated question

I was tidying up scheduled tasks on my Synology NAS and opened Task Scheduler. Two entries I didn't remember creating:

PowerOff task 0 → 2026-07-26 09:00