Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If you pasted and ran a PowerShell command from a fake CAPTCHA, error message, verification page, or support prompt, treat the Windows computer as potentially compromised. Disconnect Wi-Fi, Ethernet, and Bluetooth; update Microsoft Defender; run a full scan; and use Microsoft Defender Offline if concern remains. From a different, clean device, change passwords used on the computer, revoke browser sessions, and enable or refresh multifactor authentication (MFA). A clean scan does not prove that credentials or session tokens were not stolen.
Act first: isolate the computer
ClickFix attacks depend on getting you to execute the command yourself, but voluntary execution does not make the command safe. The first priority is to prevent a payload from contacting its operator, downloading another stage, or sending data away.
Disconnect every network path
- Turn off Wi-Fi from the Windows taskbar or Settings.
- Unplug the Ethernet cable if one is connected.
- Turn off Bluetooth and disconnect nearby phones, headsets, or other paired devices.
- Do not sign in to websites, open cloud storage, or continue browsing on the affected computer while you decide what to do.
Microsoft Security Intelligence gives the same priority in its Behavior:Win32/SuspClickFix.A guidance: “Immediately isolate the infected device from all networks to cut off threat actor access and stop data theft.” Keep the computer isolated while scans and an initial assessment are under way.
Use another device for help and account changes
Use a phone or computer that was not exposed to the command to read instructions, contact your organization, and change passwords. If the computer belongs to an employer, school, or client, contact its security or IT team from that clean device before deleting files or resetting Windows. An organization may need to preserve evidence, revoke enterprise sessions, or collect logs.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Do not paste another “cleanup” command
Do not return to the page that displayed the prompt, and do not paste a second command offered as a fix. Campaigns can change their payloads, and a filename or registry path seen in one incident is not a universal indicator for every ClickFix infection.
What ClickFix is and why running the command is serious
It is a delivery technique, not one malware program
Microsoft uses ClickFix for a social-engineering technique. A page shows a fake error, CAPTCHA, browser notice, verification step, or urgent support message and instructs the visitor to copy a command into PowerShell or another Windows utility. The command may use PowerShell, mshta.exe, or another built-in component to download or launch a second stage.
Because ClickFix describes the delivery method rather than a single malware family, two incidents can leave different files, scheduled tasks, registry entries, and account risks. A command that appears to run for only a moment, displays no obvious window, or leaves no recognizable file can still have started a later stage.
The payload can target accounts as well as the PC
Microsoft’s July 16, 2026 reporting on ACR Stealer describes ClickFix intrusion chains that stole browser credentials, authentication tokens, and sensitive documents. That means a successful scan and removal do not automatically make every account safe. Browser sessions and stored credentials may have been copied before the malware was detected.
How common is the technique?
Microsoft’s Digital Defense Report 2025 said ClickFix accounted for 47% of attacks observed in Microsoft Defender Expert notifications during the preceding year. That percentage applies only to that specified Defender Experts notification population; it is not a rate for all cyberattacks, all Windows infections, or every ClickFix incident.
Run Microsoft Defender scans in the right order
Windows 10 and Windows 11 include Microsoft Defender. The official response uses its built-in security controls rather than a generic cleanup utility.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Update Defender security intelligence
- Open Start and select Windows Security.
- Open Virus & threat protection.
- Under virus and threat protection updates, select Protection updates.
- Select Check for updates and allow the latest security intelligence to install.
Interface wording can differ slightly by Windows release or by organizational policy. If the computer is managed, let the security team decide how definitions should be updated while the device is isolated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Run a full scan
- In Windows Security > Virus & threat protection, select Scan options.
- Choose Full scan.
- Select Scan now and leave the computer powered on until the scan finishes.
A full scan examines the computer more broadly than a quick scan and is Microsoft’s appropriate option when infection is suspected. Save open work first, because a scan can take a long time and may affect performance. Do not use the computer for sensitive sign-ins while the investigation continues.
Use Microsoft Defender Offline when the risk remains
Choose Microsoft Defender Offline scan under Scan options when a detection returns, a threat cannot be removed while Windows is running, or the command may have installed persistence. Select Scan now, save open work, and accept the restart. Offline scanning runs outside the normal Windows environment, which can make it harder for malware to hide or interfere with removal.
Keep the computer disconnected from networks while deciding whether an Offline scan is needed. After Windows restarts, review the result in Windows Security’s protection history.
Read the result without over-interpreting it
- Threat removed or quarantined: follow the action offered in Windows Security and record the detection name and date.
- Threat blocked: the attempted action was stopped, but review whether another detection or persistence item remains.
- Threat returned after removal: treat recurrence as a sign that another component may be reinstalling it and escalate to Offline scanning or professional assistance.
- No current threats: continue with account protection. A scan cannot prove that a credential, browser cookie, or cloud token was not copied earlier.
Review detections and persistence carefully
Start with Protection History
Open Windows Security > Virus & threat protection > Protection history. For each ClickFix-related detection, read the severity, affected item, and available action. Use Microsoft Defender’s quarantine or removal action rather than manually deleting a file whose purpose you do not understand.
Know the persistence locations Microsoft has observed
Microsoft’s ClickFix-related guidance discusses examples including:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Scheduled tasks that launch a script or executable after logon or at a timed interval.
- Startup entries and Run locations that start a program when a user signs in.
- RunMRU history, which can show commands entered through the Run interface.
- Suspicious files in temporary folders or user AppData locations.
These are observed behaviors, not a universal cleanup checklist. Windows and legitimate applications also use scheduled tasks, startup entries, temporary files, and AppData. Do not delete an unfamiliar registry value, task, or system file solely because it looks unusual. If Defender names an item but does not remove it, or if you cannot determine whether an entry is legitimate, stop manual changes and ask IT or a qualified technician.
Preserve useful details
Write down the URL or page type that displayed the prompt, the approximate time, the exact command if you still have it, and every Defender detection name. Take screenshots from the isolated computer if needed, but do not upload the command or suspicious files to an untrusted service. These details help an organization or technician determine what accounts and data may be affected.
Protect passwords, browser sessions, and MFA from a clean device
Change passwords on a device that was not exposed
From a clean phone or computer, change passwords for accounts used on the affected Windows system. Prioritize email, password managers, financial services, work and school accounts, cloud storage, social networks, and any account that can reset another account. Use a different password for every service.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For a Microsoft account, Microsoft’s recovery guidance says to run a full malware scan before changing the password, then review the account. Because the potentially affected computer may still be unsafe, perform the password change and account review from the clean device instead.
Revoke active sessions
Sign out other browser and app sessions wherever the service provides a session-management page. Revocation matters because an attacker may have stolen an authentication cookie or token that remains usable even after you change the password. Review unfamiliar devices, locations, recovery addresses, forwarding rules, and newly added authentication methods.
Enable or refresh MFA
Turn on MFA for important accounts, or replace the existing authenticator enrollment if you suspect the account was accessed. Prefer a phishing-resistant method when the service supports one. Store recovery codes safely and remove unknown devices or authenticators from the account’s security settings.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Consider what information was exposed
Browser credential theft can include saved passwords, cookies, autofill data, and session tokens. Document theft can expose personal records, business files, invoices, source code, or identity documents. If sensitive information was stored or accessed on the computer, notify the relevant employer, school, bank, or service provider and follow its breach-response process.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteChoose the correct recovery path
| Situation | Recommended path | Why |
|---|---|---|
| Personal computer, one execution, no detections after a full scan, and no sensitive organizational data | Keep the device isolated during assessment, complete the full scan, protect accounts from a clean device, and monitor for recurring detections. | This addresses both the local malware risk and possible credential or session theft. |
| Detection returns, Defender cannot remove an item, or suspicious behavior continues | Run Microsoft Defender Offline and obtain qualified technical help if the result is unclear. | Recurrence can indicate persistence or a component that reinstalls the malware. |
| Work, school, client, or shared business computer | Contact the organization’s security or IT team before manual cleanup, password changes on the device, or a reset. | The organization may need containment, evidence, enterprise session revocation, and coordinated remediation. |
| Accounts, documents, or cloud resources may have been accessed | Use a clean device to revoke sessions, reset passwords, update MFA, and notify the affected service or organization. | Scanning the PC does not reverse theft that already occurred. |
| System changes appear irreversible, or malware survives supported scans | Discuss a Windows reset or reinstallation and restore only from a backup made before the incident. | Microsoft lists reset or reinstall as a fallback when normal remediation is not enough. |
When resetting or reinstalling Windows is justified
A reset is not the first response to every suspicious command. It becomes reasonable when detections persist, the system has unexplained changes, a qualified responder cannot establish that persistence is gone, or the computer contains high-value data and the cost of uncertainty is unacceptable.
Before a reset
- Complete account protection from a clean device.
- Tell your organization or incident responder before wiping a managed computer.
- Identify a backup made before the command was run. Do not assume a recent backup is clean merely because it completed successfully.
- Copy only necessary personal files, and scan them before restoring them.
- Record license information and recovery keys that you are legitimately entitled to use.
After a reset or reinstall
Apply Windows updates, update Defender security intelligence, reinstall applications from their official sources, and restore only the pre-infection backup. Recheck account sessions and MFA after the rebuilt system is ready. If a work or school device was involved, let the organization provision it according to its standard process.
Common mistakes that make ClickFix incidents worse
- Continuing to browse while “checking” the page: the page may deliver another command or collect more information.
- Deleting one suspicious filename and stopping: ClickFix payloads vary, and persistence may be elsewhere.
- Changing passwords on the exposed computer: a keylogger or browser stealer could capture the new password.
- Assuming no visible file means no infection: built-in Windows utilities can fetch or launch later stages.
- Restoring an old browser profile without review: it may contain saved credentials, cookies, extensions, or settings that should not be carried forward.
- Installing a random cleanup utility: Microsoft’s guidance does not require a generic third-party cleaner and an untrusted tool can add risk.
- Resetting a managed computer without approval: wiping it can destroy evidence and interfere with an organization’s response.
Troubleshooting decisions
Defender finds nothing, but you still entered passwords afterward
Keep the scan result, but treat the account risk separately. From a clean device, change those passwords, revoke sessions, review account activity, and update MFA. The absence of a current detection does not establish that credentials or tokens were never copied.
The scan is blocked or Windows Security will not open
Do not download a command from a pop-up promising to repair it. Disconnect the computer and contact your organization or a qualified technician from another device. A blocked security interface can be a policy issue, a damaged Windows component, or a sign of interference; the correct remedy depends on which one applies.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe same detection returns after reboot
Do not repeatedly delete the same file. Run Microsoft Defender Offline, preserve the detection details, and escalate. Reappearance can mean a scheduled task, startup entry, or another component is restoring the file.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
You cannot tell whether a scheduled task or registry entry is legitimate
Leave it unchanged and ask for qualified review. Microsoft’s examples help explain where ClickFix persistence may appear, but they are not permission to remove every unfamiliar Windows entry.
You need the computer for work immediately
Use another device if possible. If that is impossible, tell the organization’s IT or security team before reconnecting it. They can decide whether to isolate, image, replace, or re-provision the computer.
Prevent the next ClickFix attempt
Recognize the social-engineering pattern
A legitimate CAPTCHA or browser error does not normally require pasting a command into PowerShell. Treat instructions that say to press a key combination, open PowerShell, use the Run dialog, or paste text copied from a web page as high-risk, especially when paired with urgency, threats, or claims that your browser is broken.
Verify through a separate channel
If a support message appears, close the page and open the organization’s known website or support application manually. Do not use a phone number, download button, or command supplied by the suspicious prompt. Ask the supposed sender through a previously trusted contact method.
Reduce the impact of mistakes
- Keep Windows, browsers, and security intelligence updated.
- Use separate standard and administrator accounts where practical.
- Store passwords in a reputable password manager rather than in browser fields when your organization requires stronger controls.
- Enable MFA and review account sessions regularly.
- Maintain backups that are separated from the computer and test that they can be restored.
- Report convincing fake verification or support pages to the relevant service and your organization.
What this guidance can and cannot establish
The title alone cannot identify the payload, the files it created, or whether any account was accessed. The steps above are general Windows response guidance based on Microsoft material available through October 2026; interface labels and campaign indicators can change. No scan performed here can determine the state of a particular computer.
The practical standard is not “Defender found nothing once.” It is containment, current scanning, Offline scanning or professional response when warranted, and account protection from a clean device. Escalate when the device is managed, data is sensitive, detections recur, or you cannot explain the system’s behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
