What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume both the computer and the accounts used on it are exposed. Stop entering passwords on the suspected device, isolate and clean it with updated trusted security software, and use a separate clean device for account recovery. Start with your primary email account, replace unique and reused passwords, revoke unfamiliar sessions and connected apps, inspect recovery and forwarding settings, and turn on two-step verification. If the malware symptoms continue, reset the computer or obtain help from its manufacturer; if you are locked out, use the service’s official recovery process.
What an information-stealing trojan can expose
An information-stealing trojan (often called an infostealer) is malware that disguises itself as legitimate software or arrives with another download, then searches for valuable data. Depending on the malware and the applications installed, that data can include passwords saved in a browser, credentials typed into websites, email content, autofill information, cryptocurrency-wallet data, and account-session information.
You do not need to identify the exact strain before taking protective action. Treat the computer as untrusted if you notice unexplained sign-ins, new browser extensions, disabled security tools, unfamiliar programs, changed browser behavior, or account settings you did not change. A normal-looking desktop does not prove that the system is clean, and one scan does not prove that every credential or session is safe.
First response: contain the suspected computer
Stop sensitive activity on the device
- Do not sign in to email, banking, shopping, work, social, or password-manager accounts on the suspected computer.
- Do not change passwords from that computer yet. Malware can capture the replacement password as you type it.
- Disconnect the computer from the internet if you need to prevent further communication while arranging a scan. If you need online security-definition updates, reconnect only for the scan process and avoid opening accounts.
- Do not copy unknown executables or browser-profile files to another computer. Preserve documents you need, but treat programs and extensions from the device as potentially unsafe.
Microsoft Support gives the sequence plainly: “Regardless of which antivirus app you install, run a full scan on your PC before you change your password.” Google Ads Help explains why: “Changing your password while malware is still present poses a risk of the malicious software capturing the new credentials.” The Google Ads guidance is written for advertising-account users, but the credential-capture risk applies to any account used on an infected system.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Record what happened
From a separate device, note the date you first saw suspicious activity, the accounts involved, unusual sign-in locations, and any messages about password or recovery changes. Do not delay containment while trying to determine the exact infection time. This record helps an account provider, bank, employer, or computer manufacturer understand the incident.
Clean the computer before using it for new logins
Windows: run a full Microsoft Defender scan
- Update Windows and the security software’s threat definitions while connected to a trusted network.
- Open Windows Security.
- Choose Virus & threat protection.
- Select Scan options.
- Choose Full scan, then select Scan now.
- Allow the scan to finish. Quarantine or remove detections using the actions Windows Security provides, and restart if it requests one.
- Run another full scan after remediation and install pending operating-system and browser updates.
A full scan checks more of the system than a quick scan, so it can take substantially longer. Keep the computer powered and do not use it for account access during the scan. If another trusted, up-to-date security product is already installed, use its full-system scan instead of running several products simultaneously; conflicting real-time scanners can create errors without improving the result.
Remove unsafe software and extensions
After the scan, uninstall applications you do not recognize or did not intentionally install. Review browser extensions one by one and remove anything unfamiliar, recently added, or no longer needed. Update the browser and operating system, then reset browser settings if the browser still redirects searches, opens unexpected tabs, changes the home page, or reinstalls extensions.
Free tools Windows power users keep installed
One-click scans. No signup required.
Resetting a browser can remove extensions and restore settings, but it does not substitute for a malware scan. Before resetting, export only data you trust, such as bookmarks, and make sure you know the account or sync credentials needed to restore them. Avoid restoring an entire browser profile from the suspected computer until you have checked it.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When a clean scan is not enough
Escalate if detections return, security software will not run or update, unknown programs reappear, the browser remains hijacked, or the computer continues behaving abnormally. Follow the computer maker’s recovery instructions and consider a full device reset. A reset can remove persistent malware, but it also erases applications and, depending on the option selected, personal files. Back up essential documents first using a method that does not copy executable files or other untrusted content. If you cannot establish that the reset completed correctly, use the manufacturer’s support service or a qualified technician.
Recover accounts from a separate, trusted device
Use a phone or another computer that is up to date and not showing signs of compromise. If you only have one computer, complete its cleanup or reset before changing credentials. Start with the email account that controls password resets, then work through accounts that contain money, identity information, work data, or access to other services.
Recommended order
- Primary email: It can receive password-reset links for many other accounts. Change it first once the replacement device is trusted.
- Financial and payment accounts: Contact the bank or payment provider promptly if you see unauthorized transactions or changed payment details. Use the number on a statement or the provider’s official website, not a number in a suspicious message.
- Work, school, cloud-storage, and password-manager accounts: These can expose many additional systems or files.
- Other accounts using the same email address, saved password, or reused password: Change them even if you have not seen an alert.
Replace passwords correctly
Give every important service a different, strong password. A password used on the suspected device, saved in its browser, or reused elsewhere should be considered exposed. Google advises changing the compromised account’s password and also changing that password on other services where it was reused, services connected to the account’s email address, and services whose credentials were saved in the browser.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchGenerate passwords with a password manager on the clean device rather than inventing small variations. If you use a password manager, change its master password after the computer is clean and review its active sessions and recovery methods. Do not paste a new password into the suspected computer to “test” it.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
If you cannot sign in
Use only the account provider’s official recovery page or sign-in helper. Follow its identity checks, review the recovery email and phone options it presents, and avoid third-party “recovery” services that request your password or remote access. If the attacker changed recovery details, continue through the provider’s recovery process and preserve confirmation emails and case numbers.
Revoke access an intruder may have retained
Changing a password does not necessarily remove every existing login. Account controls differ, and consumer guidance does not provide one universal way to revoke every stolen browser session or cookie. Open each provider’s official security page and inspect the following areas.
Security events and active devices
- Review recent sign-ins, security alerts, and unfamiliar locations or times.
- Remove devices, browsers, and sessions you do not recognize. When a service offers “sign out of all sessions,” use it after changing the password, then sign in again only on trusted devices.
- Check newly added sign-in methods, app passwords, backup codes, and passkeys. Delete unknown entries and generate new backup codes if any may have been viewed.
Recovery and communication settings
- Confirm the recovery email address and phone number are yours.
- Inspect email forwarding rules, filters, delegates, automatic replies, and mailbox access. An attacker can forward password-reset messages even after you change the password.
- Check connected applications and third-party integrations. Remove anything you do not recognize, including applications with permission to read mail, files, contacts, or calendars.
Payments and personal details
- Review payment methods, billing addresses, saved cards, orders, and transfer or payout destinations.
- Check profile details, usernames, phone numbers, and linked accounts for unauthorized changes.
- For work or organization accounts, notify the administrator so they can inspect audit logs, revoke tokens, and protect other users.
Google recommends reviewing suspicious activity and unfamiliar devices. Microsoft’s compromised-account guidance specifically calls out connected accounts, forwarding, and automatic replies. The labels and locations of these controls change, so use the provider’s current security and account-activity pages rather than relying on an old menu path.
Turn on stronger sign-in protection
Enable two-step verification
Turn on two-step verification (also called two-factor authentication or multi-factor authentication) for email first, then for financial, work, cloud, and social accounts. Prefer an authenticator app, passkey, or hardware security key when the service supports it; SMS can be useful when stronger methods are unavailable, but it is not equally resistant to every form of account takeover.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
After enabling two-step verification, create and store recovery codes in a safe place that is not the suspected computer. Check that your recovery phone and email still belong to you. Do not approve an unexpected sign-in prompt, and do not give a one-time code to anyone who calls or messages claiming to be support.
Optional: use a FIDO2/WebAuthn security key
A physical security key can protect accounts that support FIDO2 or WebAuthn. Before buying or enrolling one, verify:
| Factor | What to verify |
|---|---|
| Service support | The account must offer FIDO2, WebAuthn, passkey, or security-key enrollment. |
| Connector | Choose a connector compatible with the computers and phones you use, or use a model and adapter combination the service supports. |
| Backup | Enroll a second key or another approved sign-in method so a lost key does not lock you out. |
| Recovery | Store recovery codes and understand the provider’s lost-key process before relying on the key exclusively. |
Security keys strengthen sign-in but cannot repair an already compromised account. Change the password, revoke unknown sessions, and correct recovery settings first.
Decide whether the device is safe to use again
| Situation | Next action |
|---|---|
| Full scan removes a detection and the computer behaves normally after updates and a second scan | Keep monitoring, but continue treating credentials used before cleanup as exposed and replace them from a trusted device. |
| The scan finds malware that returns or cannot complete | Disconnect sensitive use, follow the manufacturer’s recovery guidance, and consider a full reset or professional help. |
| Security tools are disabled, blocked, or repeatedly uninstalled | Do not trust the computer for account access; use manufacturer support or reset it. |
| You cannot determine whether cleanup succeeded | Back up essential personal documents cautiously, reset the device, reinstall software from official sources, and apply updates before signing in. |
Keep monitoring account alerts after cleanup. An alert appearing later does not prove the computer is still infected; it may reflect a previously stolen password or session. Investigate it through the account’s official activity controls and repeat the credential and session checks when appropriate.
If money or identity information may be involved
Contact banks, card issuers, payment services, or cryptocurrency platforms immediately when you see unauthorized activity, changed payout details, or exposed financial credentials. Ask what transactions can be stopped and whether cards, tokens, or account numbers should be replaced. If you suspect identity misuse, contact the relevant local authorities and follow the identity-protection process available in your country.
For a work or school account, tell the administrator even if your personal accounts appear unaffected. An infostealer may have captured corporate passwords, browser sessions, or files, and administrators can revoke organization-wide access that an individual user cannot see.
Quick Recap
Common mistakes that prolong an infostealer incident
- Changing passwords first on the infected computer: The new credentials may be captured immediately. Clean or replace the device first.
- Stopping after a quick scan: Use a full scan and investigate continuing symptoms.
- Changing one password only: Reused credentials and passwords saved in the browser can expose several services.
- Ignoring email settings: Forwarding rules, delegates, and automatic replies can preserve unauthorized access.
- Assuming a password change ends every session: Review devices and active sessions through each provider.
- Restoring everything from an old browser profile: Reintroducing unknown extensions or executables can recreate the problem.
- Trusting unsolicited “support”: Use official recovery and support channels; never disclose passwords or verification codes to a caller.
A practical recovery checklist
- Stop sensitive logins on the suspected computer and isolate it.
- From a trusted network, update security software and run a full scan.
- Remove unsafe software and browser extensions; update the operating system and browser.
- Run a follow-up scan and reset the computer or contact the manufacturer if symptoms persist.
- From a clean device, secure the primary email account.
- Change every exposed, reused, or browser-saved password to a unique one.
- Review security events, active devices, recovery details, forwarding, automatic replies, connected apps, and payment settings.
- Sign out unknown sessions and remove unfamiliar devices or sign-in methods.
- Enable two-step verification and store recovery codes safely.
- Contact financial providers, employers, schools, or authorities when the incident involves their systems or your money or identity.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors
