If you installed and ran a suspicious ChatGPT app—or pasted a command from a fake ChatGPT page—stop using it, uninstall the unwanted software, update Microsoft Defender’s security intelligence, and run a full scan. If the software persists, run a Microsoft Defender Offline scan. Removing the visible app alone does not establish that the malware is gone or that your accounts and files are safe.
First, stop the suspicious activity
Do not reopen the app, rerun its installer, or paste any more commands from the page that promoted it. Some fake ChatGPT lures have used a bogus verification page to persuade visitors to copy a command and run it through Windows; the command, rather than a conventional app installer, can be the execution step. A report by TechRadar, citing Huntress, described such a chain leading to a remote-access Trojan capable of controlling the infected system. A page redirect involving the real ChatGPT domain does not make a command on the destination page safe. TechRadar’s report describes that campaign.
Remove the unwanted app and scan Windows
Microsoft’s documented first response to unwanted software is to uninstall it, update Microsoft Defender’s security intelligence, and run a full scan. Follow the sequence below. The app’s uninstall entry is not itself a malware scan.
- Uninstall the suspicious app. Open Settings > Apps, then select Installed apps on current Windows interfaces, or Apps & features on interfaces using that label. Find the app you installed and choose Uninstall. If you cannot identify it, do not delete unfamiliar files based on a name alone; continue with Defender’s scan. Microsoft’s guidance is at Protect your PC from unwanted software.
- Update Defender security intelligence. Open Windows Security and go to its virus and threat protection area. Use the option to check for protection updates so Defender has current security intelligence before scanning. Microsoft’s linked instructions provide the current interface details.
- Run a full scan. In Windows Security, open Virus & threat protection, choose Scan options, select Full scan, and start it. Review the results and follow Windows Security’s remediation prompts for anything detected.
- If unwanted software persists, run Microsoft Defender Offline. Use Microsoft’s current Defender Offline instructions for the exact option and prompts in your version of Windows. Do not interrupt the process; Windows may restart to perform the scan.
A scan result is useful evidence, not a guarantee that every file, account, or device is safe. Microsoft recommends Defender Offline when unwanted software persists; the cited guidance does not set a universal rule that every infection requires reinstalling Windows.
#1 Best Overall
- WHAT YOU GET: FixMeStick Virus Removal Tool for Windows PCs (Windows XP, Vista, 7, 8, 8.1, 10, and 11. 512 MB RAM required), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
Consider account exposure
If you typed passwords, payment details, or other sensitive information on the affected PC—or the browser stored credentials there—treat those accounts as potentially exposed. Malwarebytes reported that one fake Windows ChatGPT download campaign used a credential-stealing loader, with potential exposure of passwords, browser information, and other sensitive data. That is evidence about that campaign, not proof that every fake app steals the same information. Malwarebytes’ campaign report explains the reported risk.
- From a device you believe is clean, change passwords for important accounts, starting with your email account and any account whose credentials you entered or stored on the affected PC.
- Use each service’s official account or recovery page, and enable multifactor authentication where available. Check account activity and sign out other sessions if the service offers that option.
- If a work or school account or sensitive business data may be involved, notify the organization’s IT or security team promptly.
These account-protection steps are prudent precautions; the campaign reports and Microsoft’s cited cleanup guidance do not provide a complete recovery checklist for every service or infection.
When to get expert help
Seek qualified incident-response help if Defender cannot remove the threat, the same unwanted software returns, you see continued suspicious activity, or the PC held sensitive business information. A remote-access Trojan can allow broad device access, so persistent signs or high-impact data raise the stakes. This is an escalation judgment, not a Microsoft requirement for every home user. Avoid treating generic PC-cleaner software or a paid scanner as a substitute for Microsoft’s documented steps.
Rank #2
- Emergency Boot USB compatible with Windows 98, 2000, XP, Vista, 7, and 10. It has never ben so easy to repair a hard drive or recover lost files
- Plug and Play type usb - Just boot up the usb and then follow the onscreen instructions for ease of use
- Boots up any PC or Laptop model and brand.
- Virus and Malware Removal made easy for you
- This is your one stop shop for PC Repair of any need!
How fake ChatGPT downloads have worked
There is no single fake-app infection pattern or universal set of file names to hunt for. Reports describe different lures and campaigns, so details from one sample should not be treated as a checklist for every incident.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Lookalike installer
Malwarebytes documented a lookalike site, openew[.]app, offering apparent Windows and Mac apps. In its Windows example, the Chat_GPT.exe installer created files under %APPDATA%LeronApplication, launched EApp.exe, and spawned PowerShell. Those paths and names belong to that reported sample; do not delete files or conclude you are infected solely because a name appears or does not appear.
Fake verification and command execution
A separate September 2026 report described a fake Custom GPT that sent users to a “backup” site, where a bogus Cloudflare verification page told them to copy and run a command using Windows Run. TechRadar, citing Huntress, reported that this chain led to a remote-access Trojan. If you ran a command from such a page, use the same remediation sequence above; do not assume that uninstalling an app entry addresses a command-based infection.
Rank #3
- [Win OS Install or reinstall] — Boot from the USB to install or reinstall Win 11, 10, or 7 Home & Pro editions. Includes OS installations and reinstallations media plus WinPE Utility Suite.
- [WinPE Repair & Recovery Tools] — Boot into the included WinPE utility suite to backup system and important files, troubleshoot startup problems, repair boot issues, recover data, recover Win User accounts password, and diagnose common PC problems.
- [All-in-One PC Rescue USB] — Combines Win 11, 10, and 7 installation media with PC repair, recovery, and diagnostic tools on one bootable 64GB USB drive, helping you troubleshoot and restore a computer without needing multiple discs or downloads.
- [Support] — Full instructions are included in packaging plus a printable copy of the instructions with troubleshooting information on the device. Also, a video “How to boot from a bootable USB drive.mp4” to help guide you through starting a PC from a USB drive. If you need help using the USB please contact us for assistance, we are here to help.
- [Video] - If you are new to booting from a USB drive or need a refresher see our video "How to boot from USB drive" both in description and on USB device.
Advertising figures are not infection counts
Tom’s Guide reported Island’s estimate that a May–August 2026 advertising campaign involved around 850 paid ads, 26 fake ChatGPT links, and 71 Google Ads campaign IDs. These are figures attributed to Island and reported by Tom’s Guide, not independently verified counts or a measure of how many people were infected. Tom’s Guide’s report provides the attribution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify the official Windows app source
OpenAI’s help page says the ChatGPT Windows app is available through the Microsoft Store. Use the official Windows app instructions to confirm the current route. OpenAI also advises downloading its apps only from in-app updates or its official webpages, and warns against unexpected installers delivered through ads, messages, or third-party download sites. OpenAI’s security update states: “Only download OpenAI apps from in-app updates or the official webpages below:”
Free tools Windows power users keep installed
One-click scans. No signup required.
Microsoft likewise advises: “Download apps only from trusted sources, such as Microsoft Store, and be thoughtful about which apps you install.” Microsoft’s unwanted-software guidance covers that advice. AI-brand lures can deliver malware or phishing without implying that the service being impersonated was itself compromised; Microsoft describes this broader pattern in its overview of AI-themed threats.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
