Start with an updated Microsoft Defender Antivirus full scan. If malware keeps returning, run Microsoft Defender Offline; if the problem continues, back up important files and consider resetting or clean-installing Windows. Restore compromised accounts separately from a trusted, cleaned device: for a Microsoft account, scan the PC before changing its password, then check account settings the intruder may have changed.
1. Run a full scan with Windows Security
Microsoft recommends Microsoft Defender Antivirus, which is built into Windows. Before scanning, make sure Windows Security and its protection components are up to date. Open Windows Security, choose Virus & threat protection, and select Scan options. Choose Full scan, then select Scan now. A full scan checks files and running programs; it can take time.
If the scan errors or will not start, Microsoft suggests freeing disk space, installing Windows and protection-component updates, closing other applications, or restarting the PC and trying again. Follow Microsoft’s troubleshooting guidance for [Microsoft Defender Antivirus scanning and troubleshooting].
When the scan finishes, review its findings in Windows Security. A clean result is useful, but it does not prove that every threat has been removed or that accounts used on the PC are secure.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
2. If malware persists or returns, run Microsoft Defender Offline
A recurring detection can mean a hidden component is reinstalling the threat. Microsoft Defender Offline restarts the PC and scans outside the usual Windows session, making it harder for persistent malware to hide. Save open work first because the scan requires a restart.
- Open Windows Security and select Virus & threat protection.
- Choose Scan options, select Microsoft Defender Offline scan, and choose Scan now.
- After Windows restarts, return to Windows Security and review Protection history for the result.
For details, see Microsoft’s instructions for a [Microsoft Defender Offline scan].
Rank #2
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
3. Back up important files before a reset or reinstall
Resetting or reinstalling Windows can remove files, applications, and settings. Back up important files before escalating. Prefer a backup made before the infection and stored externally, rather than copying files from a system you still suspect is compromised. An external USB drive can provide separate storage, but it does not clean malware or make infected files safe.
Microsoft explains backup options in [Back up and restore with Windows].
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
4. Choose the least disruptive recovery option that addresses the problem
If infection concerns continue after scanning, Microsoft advises trying a virus scan first and then reinstalling Windows if the problem persists. The recovery choices differ in how much they change and what data they can remove:
| Option | What it does | Disruption and data impact |
|---|---|---|
| Full scan | Checks the PC while Windows is running. | Least disruptive starting point; does not reinstall Windows. |
| Microsoft Defender Offline | Restarts the PC and scans outside the normal Windows session. | Requires a restart; does not itself reinstall Windows. |
| Reset this PC | Reinstalls Windows and offers choices about keeping or removing personal files. | More disruptive; the outcome depends on the option selected. |
| Clean install from installation media | Reinstalls Windows from installation media. | Microsoft says this removes Windows, personal files, apps, and settings from the selected drive. |
Microsoft’s [Windows recovery options] explain the available paths. Back up first and choose the least disruptive option that addresses the problem. If you use a work- or school-managed PC, follow your organization’s IT recovery process rather than reinstalling it independently.
Rank #4
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION AND ANTI-PHISHING: Webroot protects your personal information against keyloggers, spyware, and other online threats and warns you of potential danger before you click
- ALWAYS UP TO DATE: Webroot scours 95% of the internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
- SUPPORTS ALL DEVICES: Compatible with PC, MAC, Chromebook, Mobile Smartphones and Tablets including Windows, macOS, Apple iOS and Android
- NEW SECURITY DESIGNED FOR CHROMEBOOKS: Chromebooks are susceptible to fake applications, bad browser extensions and malicious web content; close these security gaps with extra protection specifically designed to safeguard your Chromebook
These instructions cover Windows 10 and Windows 11 where Microsoft specifies them, but screens can vary by version and device. Windows 10 support ended on October 14, 2025; a PC still running Windows 10 is on an operating system that no longer receives standard support.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Recover a compromised Microsoft account
Account recovery is separate from cleaning the PC. Microsoft Support advises scanning the computer before changing a compromised Microsoft-account password: “Regardless of which antivirus app you install, run a full scan on your PC before you change your password.” Use a trusted device you believe is clean for the account-recovery steps.
Best Value
- AWARD-WINNING ANTIVIRUS - Real-time protection against malware, viruses, spyware, ransomware, and other online threats, up to 3x faster scans
- SAFE BROWSING – Guides you away from risky links, blocks phishing and risky sites, protects your devices from malware
- ADVANCED FIREWALL - Stops up to 10x more malicious websites, blocks unauthorized access, protects against hackers and cybercriminals
- EASY TO USE - user-friendly interface, easily manage security settings, hassle-free protection
- TRUSTED BY EXPERTS - McAfee is recognized by industry experts for its exceptional security solutions, giving you confidence in our ability to keep you protected
- Run a full scan on the PC before changing the password.
- Change or reset the Microsoft-account password.
- Review connected accounts, email forwarding, and automatic replies, and undo changes you do not recognize.
Follow Microsoft’s [guidance for recovering a hacked or compromised Microsoft account]. If you cannot sign in or no longer recognize the verification options, use the [Microsoft sign-in helper and account recovery process].
For email, banking, social, or work accounts, use that provider’s official recovery process. Microsoft’s instructions do not establish the recovery steps for other services.
6. Strengthen sign-in after you regain access
Once you can access your account, consider adding sign-in protections. Microsoft describes authenticator apps and physical security keys among its security and passwordless options. Choose an option that fits your needs and keep recovery information current; these tools can improve sign-in security but do not guarantee that an account cannot be compromised.
See Microsoft’s information about [Microsoft Authenticator and passwordless accounts] and [signing in with a security key].
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
