What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume an infostealer is both a malware infection and an account-compromise incident. Stop entering passwords or payment details on the suspected PC, disconnect it if practical, use a known-clean device to secure your accounts, then update Microsoft Defender and run a full scan followed by Microsoft Defender Offline. Escalate to clean-created boot media, trusted support, or a clean Windows installation when detections persist or you cannot trust the operating system.
What an infostealer can take
Infostealers are designed to collect credentials, browser session tokens and system-context data at scale. That can include saved browser passwords, cookies that keep you signed in, autofill data, cryptocurrency-wallet information, device details and other files or settings. A scan that removes the program does not automatically undo what it already copied.
Microsoft’s Digital Defense Report 2025 identifies malvertising, search-engine-optimization poisoning, cracked software, phishing and ClickFix lures as common delivery routes. In Microsoft’s reported 2025 top-five distribution, Lumma represented 51%, Atomic 21%, a Node.js-based stealer 16%, Sys01 8% and Rhadamanthys 4%. Microsoft Threat Intelligence recorded 44,197 Windows devices affected by Lumma in India, 40,868 in Russia, 21,137 in Brazil and 15,647 in the United States between March 16 and May 16, 2025. Those figures describe Microsoft’s telemetry for that period, not the prevalence on every Windows computer.
Because session cookies can let an attacker bypass a password until the session is revoked, changing passwords is only one part of recovery. Treat the event as two parallel jobs: remove or contain the code on the PC, and invalidate anything an attacker may have captured.
#1 Best Overall
- [Package Offer]: 1 Pack USB Flash Drive 8GB Available in black.
- [Plug and Play]: No need to install any software, Just plug in and use it. The metal clip rotates 360° round the ABS plastic body which. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- [Compatibilty and Interface]: Supports Windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS. Compatible with USB 2.0 and below. High speed USB 2.0, LED Indicator - Transfer status at a glance.
- [Suitable for All Uses and Data]: Suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies, software, and other files.
- [Warranty Policy]: 12-month warranty, our products are of good quality and we promise that any problem about the product within one year since you buy, it will be guaranteed for free.
Do this first: contain the suspected PC
- Stop sensitive activity on the computer. Do not open webmail, banking, shopping, cryptocurrency, work systems or your password manager on it. The Federal Trade Commission’s April 2025 guidance says: “Immediately stop logging into online accounts with your usernames, passwords, or other sensitive information — like shopping or banking.”
- Disconnect the network if practical. Turn off Wi-Fi, unplug Ethernet and disconnect unnecessary external drives. Isolation limits further theft and prevents the computer from downloading additional components. If the PC is needed to preserve evidence for an employer or investigation, follow that organization’s incident procedure before altering it.
- Do not delete random files or start changing passwords on the suspect machine. Use a phone or another computer you trust for account recovery. Keep notes of alerts, detections, dates and unusual activity so a support technician or employer can understand what happened.
Disconnecting does not clean the computer; it buys time to protect accounts and perform a controlled scan.
Secure accounts from a known-clean device
Use a phone or computer that was not exposed to the suspected stealer. Start with the accounts that can reset other accounts or move money.
- Change the primary email password. Review recovery addresses, phone numbers, forwarding rules, filters, app passwords and recent sign-ins. An attacker with mailbox access can reset other services even after their original password is changed.
- Change financial and payment-account passwords. Contact the institution through its official app or telephone number if you see an unfamiliar transfer, payee, card transaction or login. Consider replacing exposed cards or tokens according to the provider’s fraud process.
- Change the password-manager account password. Revoke logged-in sessions and device access where the service provides those controls. If the manager was unlocked on the infected PC, assume stored entries may have been exposed and prioritize the most sensitive entries.
- Change work, cloud-storage, social and shopping passwords. Use a different, unique password for each service. Do not reuse a password that was present in the browser or typed on the affected PC.
- Enable two-factor authentication. Prefer an authenticator app or hardware security key where available. Save recovery codes somewhere not stored only on the affected computer.
- Revoke active sessions and tokens. Look for controls named “sign out of all devices,” “active sessions,” “connected apps,” “authorized applications” or “revoke tokens.” This step matters for stolen cookies that may still be valid after a password change.
- Monitor alerts and statements. Review sign-in notifications, email-sent folders, social posts, cloud-file sharing, bank statements and credit-card activity for several weeks. Report unauthorized activity promptly under the provider’s fraud policy.
The FTC specifically recommends changing passwords and enabling two-factor authentication after possible malware exposure. Account protection should continue even if every local scan later reports a clean computer.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRun Microsoft Defender in the normal Windows environment
Update security intelligence
Reconnect only long enough to obtain current protection updates, or use your organization’s approved update process. Open Windows Security, select Virus & threat protection, and install available security-intelligence updates. Current definitions improve detection of recently distributed stealers.
Rank #2
- 10 Pack USB Sticks: 10 pieces of USB flash drives are fit for a variety of scenarios. Whether the flash drives USB are used as school supplies for high school students to backup data storaged in USB jump drives or music USB flash drive for car, zip drive can meet the basic storage needs. USB drive pack of 10 has a higher cost performance. USB flash drive pack of 10 is suitable for ordinary users with appropriate needs, but also for special groups such as companies, schools or other organizations that need a large number of U disks. In short, thumb drives can meet the needs of different customers.
- Swivel Design: With the 360° swivel design, all the ports of the thumb drives 10 pack can be hidden inside the metal casing. When needed, simply swivel the casing gently and the ports will automatically expose, making it convenient for you to insert and remove. This design is not only fashionable and beautiful but also more user-friendly, whether you'd like your flash drive for photos, flash drive for video storage, or memory sticks for computers. In addition, the swivel design can effectively protect the interface from damage and pollution, increasing the service life of the flash USB drive.
- Portability: The small hole on the thumbdrive USB is designed for lanyards, which is convenient to carry. Besides, the USB flash drive keychain can also be tied through the small hole to prevent loss. This design is very thoughtful and reflects the humanized design concept of the memorias USB flash drive.
- Plug and Play: You can use the computer storage flash drive immediately for data storage or backup without any additional installation after inserting it into the computer. This plug and play feature makes the laptop storage drive a very convenient external ssd. You can copy the required data files to the external drive at any time without worrying about computer system compatibility issues. In addition, the design of the external flash drive enables it to be quickly recognized by the system after being inserted into the computer. (NOTE: Please check if your device has a USB-A port before purchasing. If not, a USB-C hub is needed.)
- FAT32 format: The default system format for 8GB flash drive is FAT32. FAT32 USB flash drive is widely applicable, such as in televisions, DVD players, vehicles, printers, embroidery machines, etc. Be patient if you have problems with system recognition. It may take some time for initial recognition, but it will happen.
Run a full scan
- Open Windows Security.
- Select Virus & threat protection.
- Choose Scan options.
- Select Full scan, then Scan now.
A full scan examines all accessible files and running locations instead of only the areas checked by a quick scan. Let it finish, record the detection name and action, and restart if Windows Security requests it. Microsoft’s support guidance recommends uninstalling unwanted software, running a full Microsoft Defender scan and using Microsoft Defender Offline when unwanted software persists.
Microsoft’s InfoStealer guidance says Defender can detect and remove the threat, while warning that an infection may leave remnant files and system changes. Updated definitions and a full scan may address those remnants, but a “no current threats” result is not proof that previously stolen credentials or session cookies were harmless.
Run Microsoft Defender Offline for persistent threats
Microsoft Defender Offline restarts the computer into a separate scanning environment outside the ordinary Windows session. Malware that hides, starts automatically or interferes with security tools has fewer opportunities to conceal itself there.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Save work and close applications.
- Open Windows Security.
- Go to Virus & threat protection → Scan options.
- Select Microsoft Defender Offline scan.
- Choose Scan now and approve the restart.
Microsoft’s endpoint documentation says the offline scan takes about 15 minutes. Do not interrupt the restart or power off the PC while it is scanning. After Windows starts again, open Windows Security and review Protection history for the result.
Rank #3
- [Package Offer]: 5 Pack USB 2.0 Flash Drive 8GB Available in 5 different colors - Black Blue Green Red Silver. The different colors can help you to store different content.
- [Plug and Play]: No need to install any software, Just plug in and use it. The metal clip rotates 360° round the ABS plastic body which. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- [Compatibilty and Interface]: Supports Windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS. Compatible with USB 2.0 and below. High speed USB 2.0, LED Indicator - Transfer status at a glance.
- [Suitable for All Uses and Data]: Suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies, software, and other files.
- [Warranty Policy]: 12-month warranty, our products are of good quality and we promise that any problem about the product within one year since you buy, it will be guaranteed for free.
If the offline scan does nothing
Offline scanning relies on the Windows Recovery Environment (WinRE). Open an elevated Command Prompt and check its status with:
reagentc /info
If WinRE is disabled, enable it with:
reagentc /enable
Run reagentc /info again to confirm that the status is enabled, then retry the offline scan. On managed computers, organizational policy or disk-encryption procedures may restrict these changes; contact the administrator rather than bypassing them.
Use clean-created bootable media when Windows cannot be trusted
Bootable Microsoft Defender Offline media is useful when the installed Windows environment is damaged, repeatedly reinfected or unable to launch the offline scan. Create it on a different PC that you have no reason to suspect is infected.
- Prepare a blank CD, DVD or USB flash drive with at least 250 MB of free space. Microsoft warns that creating the USB media reformats it and erases all existing data.
- On the clean PC, download and create the official Microsoft Defender Offline media using Microsoft’s current instructions.
- Safely eject the media and connect it to the affected PC.
- Boot the affected PC from the removable device. The exact boot-menu key varies by manufacturer; consult the computer maker’s documentation if Windows does not start from the media automatically.
- Allow Defender to scan and remove detections. Do not use the USB drive for ordinary file storage afterward unless you have deliberately reformatted and secured it.
- Remove the media before allowing the computer to boot back into Windows.
The USB drive is only the delivery method for the scanner; it does not remove malware by itself. Any blank drive meeting Microsoft’s 250 MB minimum can work, provided its contents can be erased safely.
Rank #4
- Ultra-compact and portable contoured styling
- Share your photos, videos, songs and other files between computers with ease
- Protect your private files with included SanDisk SecureAccess software (Password protection uses 128-bit AES encryption and is supported by Windows Vista, Windows 7, Windows 8, Windows 10 and Mac OS X v10.6+ (Software download required for Mac, see official SanDisk Secure Access website for more details.))
- Store more with capacities up to 8GB (1 gigabyte (GB) = 1 billion bytes. Some capacity not available for data storage.)
Which removal method should you use?
| Approach | Where it runs | Best use | Limitations and disruption | Account protection |
|---|---|---|---|---|
| Microsoft Defender full scan | Inside normal Windows | Initial, broad check after updating definitions | Persistent malware may be running or hiding while Windows is active; scan time varies with storage and file count | None; you must secure accounts separately |
| Microsoft Defender Offline | Separate WinRE environment after a restart | Threats that persist, relaunch or interfere with Windows tools | Requires a restart and functioning WinRE; Microsoft documents about 15 minutes for the scan | None; stolen passwords and sessions remain a separate incident |
| Clean-created bootable media | Removable environment created on another PC | When WinRE or installed Windows cannot be trusted or will not run the offline scan | Needs a second clean PC and blank media; creating USB media erases its contents; boot-menu steps vary | None; perform password changes from a clean device |
These methods complement rather than replace one another. A full scan is the normal first pass, Offline is the next step for persistence, and clean-created media is an escalation when the installed recovery environment is unavailable or suspect.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should you reinstall Windows or get professional help?
There is no universal rule that every infostealer infection requires an immediate reinstall. The decision depends on whether scans remove the threat, whether Windows remains stable and whether you can establish confidence in the system’s integrity.
Escalate to trusted support when
- Microsoft Defender repeatedly detects the same threat after removal and restart.
- The PC remains unstable, redirects traffic, creates unexplained accounts or changes security settings.
- Security tools, Task Manager or Windows Update are disabled without explanation.
- Offline scanning cannot run and bootable media cannot be created or started.
- The computer contains sensitive work, health, financial or customer data and the consequences of a missed persistence mechanism are high.
The FTC recommends using trusted technical support when self-service removal is insufficient. Choose a provider you can independently verify, and avoid allowing an unknown caller or pop-up to take remote control of the computer.
Recommended Free Tools
When a clean reinstall is the risk-reducing choice
A clean installation is reasonable when detections persist, system integrity cannot be established or the machine is being returned to a high-assurance state. Before wiping it, preserve only trusted personal documents such as photographs or work files. Do not copy executable files, cracked installers, browser profiles, extensions or unknown scripts. From a clean device, make sure you have installation media, activation information, backups and drivers, then erase the system drive and install Windows from Microsoft’s official media. Afterward, fully update Windows, enable Defender, restore carefully screened documents and change passwords again if the old installation was used during recovery.
Best Value
- 【What You Get】 1 pieces 8 GB small capicity bulk usb flash drives,which allow you to classify your files, music, pictures etc. Great choice for enhancing your Name's visibility as the pen drives can be printed on
A reinstall removes the local operating system and its persistence mechanisms; it cannot reverse a stolen session cookie, password or financial transaction. Continue the account-recovery and monitoring steps even after wiping the drive.
Signs that justify investigating an infostealer
One symptom does not prove an infostealer, but combinations deserve prompt action. FTC indicators include:
- A computer that becomes unusually slow, freezes or crashes.
- A changed browser home page, unexpected redirects, new toolbars or unfamiliar add-ons.
- Unexpected pop-ups or repeated operating-system errors.
- Task Manager or other security tools being disabled.
- Email messages or social posts sent from your accounts that you did not create.
Microsoft’s InfoStealer page also lists slow performance, added or modified files, desktop changes, freezing or crashing and diminished storage. These symptoms have other possible causes, so use them as triggers to scan and secure accounts rather than as a diagnosis by themselves.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
After cleanup: prevent a second infection
- Patch the whole stack. Keep Windows, browsers and installed applications current. Turn on automatic updates where practical.
- Keep real-time protection enabled. Do not disable Microsoft Defender to install an untrusted program or to make a crack work.
- Use official download sources. Avoid cracked software, key generators, suspicious advertisements, unexpected links, unfamiliar free-download sites and peer-to-peer sources.
- Treat ClickFix-style instructions as hostile. A webpage or caller that asks you to paste a command into Run, PowerShell or Command Prompt to “verify” or “fix” something is not giving ordinary browser support.
- Scan removable storage. Scan USB and external drives before opening files, especially drives shared between computers.
- Reduce saved secrets on browsers. Use unique passwords and, where appropriate, a password manager protected with strong multi-factor authentication. Review which browsers and extensions have access to sensitive data.
- Keep tested backups. Maintain at least one backup that is not continuously writable from the PC, and periodically verify that files can actually be restored.
A practical recovery checklist
- Stop banking, shopping, email and password-manager logins on the suspected PC.
- Disconnect its network connection when practical.
- From a clean device, change email, financial, password-manager, work and social passwords.
- Enable two-factor authentication, revoke sessions and review account alerts.
- Update Defender security intelligence and run a full scan.
- Run Microsoft Defender Offline; if necessary, verify WinRE with
reagentc /infoand enable it withreagentc /enable. - If Windows or WinRE cannot be trusted, create Defender Offline media on a clean PC using a blank drive of at least 250 MB, remembering that USB contents will be erased.
- Escalate to trusted support or a clean reinstall when detections persist or system integrity remains uncertain.
- Continue monitoring financial records, sign-in alerts and account activity after the PC is clean.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
