Assume both the computer and any accounts used on it may be exposed. Stop entering passwords on the suspected device, disconnect it from sensitive work, and clean it with updated trusted security software. After the device is clean—or from a separate trusted device if you cannot clean it confidently—change unique passwords, revoke unfamiliar access, inspect recovery and forwarding settings, and enable two-step verification.
Microsoft Support’s recovery guidance puts the order plainly: “Regardless of which antivirus app you install, run a full scan on your PC before you change your password.” Google’s compromised-account guidance adds that malware can capture a replacement password if it is still running. A successful scan is only the start; account settings and active sessions must also be checked.
As an Amazon Associate I earn from qualifying purchases.
What an information-stealing trojan can expose
An information-stealing trojan, often called an infostealer, is malicious software that runs while appearing to be a legitimate program, installer, document or browser add-on. Its purpose is to collect secrets such as saved browser passwords, typed credentials, authentication tokens, cryptocurrency-wallet data and personal information, then send them to an attacker. The exact data collected depends on the malware and the applications installed, so a normal-looking computer does not prove that no account data was taken.
The practical consequence is that you must treat the computer as untrusted until it has been checked. A clean account sign-in from that computer is not evidence of safety: the malware could capture the new password or an active session again. The recovery sequence below separates device cleanup from account recovery for that reason.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
1. Contain the suspected computer before doing anything sensitive
Stop using it for account access
- Do not sign in to email, banking, shopping, work, social or password-manager accounts on the suspected computer.
- Do not enter a replacement password, recovery code or one-time verification code there.
- Stop using browser-based payment pages and avoid copying passwords from a password manager into that machine.
Disconnect it without destroying evidence you may need
Disconnect Wi-Fi or unplug Ethernet. If the computer is managed by an employer or school, contact its IT or security team before deleting files or resetting it. Do not connect backup drives or other computers to the suspected system; an infostealer may access newly attached data.
Use a separate, trusted phone or computer for urgent account work. Keep the suspected device powered off if you cannot begin a scan promptly. Isolation limits additional theft but does not remove malware already installed.
Make a short incident list
From a clean device, write down when the suspicious behavior began, which accounts were used, and any alerts, unfamiliar transactions or changed settings. Save notification emails and screenshots in a safe location. This record helps you prioritize password changes and gives an employer, bank or service provider useful timestamps. Do not log back in to the suspected computer merely to collect more information.
2. Run an updated full scan
Windows Security procedure
On a Windows computer, Microsoft’s documented path is:
- Open Windows Security.
- Select Virus & threat protection.
- Choose Scan options.
- Select Full scan, then choose Scan now.
Allow the scan to finish. First update Windows Security’s protection intelligence if an update is offered. Review every detection and follow the security tool’s quarantine or removal action. A quick scan is not an equivalent substitute when an infostealer is suspected.
If the installed security tool is disabled
Malware can interfere with security software. From a clean device, obtain instructions from the operating-system maker or the security provider you already trust. Do not install random “cleaner” programs advertised in pop-ups, and do not disable protection to make an unfamiliar tool run.
Do you need to buy antivirus software?
The official guidance supports updated, trusted security software, including built-in Microsoft Defender on Windows; it does not require a particular paid brand or product. A purchase cannot substitute for the recovery steps. If you use another security product already supplied by your organization, follow its documented update, full-scan and quarantine process rather than running several unfamiliar cleaners at once.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What a clean result does—and does not—mean
A scan result is a point-in-time assessment, not proof that every stolen password or browser session is safe. The software may have been removed after credentials were copied, or a malicious extension and altered browser setting may remain. Continue with browser cleanup, software updates and account recovery even when the scan reports no active threat.
3. Remove unsafe software and repair the browser
Uninstall programs you do not trust
Remove applications you do not recognize, especially those installed immediately before suspicious activity. Use the operating system’s normal app-uninstall control rather than deleting random folders. If a work or school administrator installed the software, ask that administrator before removing it.
Review browser extensions
Open each browser’s extensions or add-ons page and remove entries you did not install or no longer need. An extension with broad permissions can read pages, modify content or access credentials. If you cannot identify an extension’s publisher, treat it as untrusted.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Reset browser settings when changes persist
Google’s malware-cleanup guidance recommends resetting browser settings when unsafe software has changed search, startup or other behavior. Record bookmarks or other data you need first, then use the browser’s built-in reset option. A reset can remove extensions, reset the default search engine and undo unwanted startup pages; it may not delete every file belonging to the malware.
Recommended Free Tools
Update the operating system and applications
Install operating-system, browser and application updates from their built-in update controls or official vendor channels. Restart when requested. Updates close vulnerabilities that may have allowed the trojan to run and reduce the chance of reinfection.
After cleanup, check that your browser’s home page, search provider, notification permissions and saved-password settings are expected. Do not import an old browser profile or extension collection until you have reviewed it; an unsafe add-on or altered setting can return with the profile.
4. Decide whether to reset the computer or get help
Escalate instead of repeatedly scanning if any of these conditions apply:
- The malware warning returns after removal.
- Security software, system settings or browser controls keep changing back.
- The computer still shows unexplained processes, pop-ups, redirects or account activity.
- You cannot update protection or complete a full scan.
- The device contains sensitive business, medical, financial or personal data and you need a defensible investigation.
Google’s malware guidance says a computer reset or help from the manufacturer may be necessary when signs continue. A reset erases applications and personal data, so back up only files you have reason to trust and scan those files before restoring them. Do not restore an old system image that may contain the trojan. Follow the computer maker’s official reset instructions, and keep the operating system and security updates current immediately afterward.
For a company-managed computer, preserve logs and contact the organization’s security team; resetting it yourself can remove information needed to determine what happened. If you cannot determine whether the rebuild succeeded, manufacturer support is safer than continuing to enter credentials on the device.
5. Recover the primary email account first
Use a separate trusted device, or the cleaned and fully updated computer only after you are satisfied it is no longer compromised. Start with the primary email account because it can receive password-reset links for many other services.
- Open the provider’s official sign-in or security page by typing the address yourself or using a known-good bookmark.
- Change the email password to a long, unique password that has never been used elsewhere.
- Sign out or revoke unfamiliar sessions and devices.
- Verify the recovery email address, recovery phone number and other sign-in methods.
- Enable two-step verification before moving to other accounts.
If you cannot sign in, use only the provider’s official account-recovery flow. Do not pay a third party that promises to bypass recovery or send it your verification codes. Search results and unsolicited messages can lead to look-alike recovery pages, so navigate from the provider’s known website or app.
6. Change every exposed or reused password
After securing the primary email, make a list of accounts that were used on the suspected computer. Include accounts with passwords saved in the browser, accounts reached through “sign in with” an email address, and any service that reused the same password.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteChange each password from the trusted device. Google advises changing the compromised account’s password and every other service where that password was reused, as well as services tied to the affected email address or saved-password store. Give every account a different password; a password manager can generate and store those unique credentials.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Prioritize accounts in this order:
- Primary email and password manager.
- Banking, payment, investment and cryptocurrency services.
- Work, school and cloud-storage accounts.
- Social, shopping, health and government services.
- Any account that can reset another account or contains personal information.
Do not paste a newly created password into the suspected computer to “test” it. If the device must be used for work, have the responsible administrator verify or rebuild it first.
Changing a password does not tell you which data was copied. Treat every password stored or typed on the device as exposed, even if the service shows no suspicious login, and replace it with a credential that has not appeared on any other account.
7. Review sessions, devices and account settings
Password changes do not necessarily invalidate every existing session. Provider controls differ, and consumer guidance does not offer one universal method for revoking every possible stolen browser cookie. Use each service’s official security page and support documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Check | What to do | Why it matters |
|---|---|---|
| Recent security events | Review sign-ins, password changes and recovery changes. Investigate unfamiliar locations, times or devices. | An attacker may have accessed the account before you changed its password. |
| Active devices and sessions | Remove devices and sessions you do not recognize. Use a “sign out everywhere” control when the service provides one. | A still-active session can provide access even after a password change. |
| Recovery details | Check recovery email, phone number, backup codes and alternate sign-in methods; remove unauthorized entries and generate new backup codes. | An intruder may try to retain a way back into the account. |
| Connected apps | Review third-party applications and revoke access you did not authorize or no longer need. | OAuth or other delegated access can survive a password change. |
| Email forwarding and filters | Inspect forwarding addresses, filters, rules, signatures and automatic replies; delete anything you did not create. | Forwarding can silently copy future messages and password-reset links. |
| Payment and profile data | Check payment methods, shipping addresses, phone numbers and profile changes. | Unauthorized changes can enable fraud or account takeover. |
Microsoft specifically calls out connected accounts, forwarding and automatic replies in compromised-account recovery. Google highlights suspicious events and unfamiliar devices. The labels and menu locations can change, so follow the current security page for the affected service.
Check linked accounts and delegated access
Review accounts linked for sign-in, mail delegation, shared folders and application permissions. Remove only entries you recognize as unauthorized or unnecessary, then review the service’s separate session and device controls. If a provider offers a “sign out of all sessions” action, use it after changing the password and repeat the device review afterward.
8. Add stronger sign-in protection
Turn on two-step verification
Enable two-step verification on the email account first, then on financial, work and other high-value services. Prefer an authenticator application, passkey or security key when the service supports it. Keep recovery codes offline in a secure place; do not store the only copy in the compromised email account.
Consider a passkey or physical security key
Google’s account-security guidance recommends a passkey or physical security key for certain at-risk sign-in situations. A FIDO2/WebAuthn key can resist phishing, but check three details before relying on one:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Compatibility: the service, browser and operating system must support the required standard.
- Connector or wireless support: choose a form that works with the computers and phones you actually use.
- Recovery: register a spare key or maintain another approved recovery method in case the key is lost.
No single second factor eliminates every risk. Protect the email account that controls recovery, and investigate unexpected prompts instead of approving them automatically. A security key is an optional control, not a reason to postpone password changes or session review.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. If you suspect financial or identity misuse
Contact your bank, card issuer or payment provider through its official number or application if you see unauthorized transactions or changed payment details. Ask what account-lock, card-replacement or transaction-dispute steps apply. For suspected identity theft, fraud or significant loss, contact the relevant local authorities. Keep copies of alerts, timestamps and support case numbers.
Do not use an unverified “recovery” service that requests your password, remote access or one-time codes. Legitimate providers use their published recovery processes.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
10. Monitor after the cleanup
Watch security notifications, account activity, forwarding settings and financial statements for unexpected changes after recovery. An attacker who copied credentials before cleanup may try them later, and an account can be targeted even when the original computer now appears normal. Respond to new alerts from the account provider itself rather than links in unexpected messages.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCommon mistakes that prolong an infection
- Changing passwords first on the infected computer: the replacement credentials may be captured.
- Stopping after one scan: account sessions, forwarding rules and connected apps may remain compromised.
- Reusing one new password: one later breach can unlock every account that shares it.
- Ignoring the email account: it can reset other accounts and receive security notifications.
- Restoring an unverified backup after a reset: the backup can reintroduce unsafe software or altered settings.
- Deleting evidence on a managed device: IT or investigators may need logs to determine scope and notification duties.
- Assuming a familiar location proves a login was yours: attackers can use stolen sessions or services that obscure their location.
- Trusting a pop-up cleanup offer: scareware may install another unwanted program or request payment.
- Keeping every old recovery method: an attacker-controlled phone, email address or backup code can preserve access.
When is the recovery complete?
Close the incident only after the computer has completed cleanup or been rebuilt, all high-value and reused passwords have been replaced from a trusted device, unfamiliar sessions and devices have been removed, recovery and forwarding settings are correct, connected applications have been reviewed, and two-step verification is active. Continue monitoring security alerts and financial statements for unexpected changes.
These steps reduce ongoing risk, but they cannot establish exactly what data an infostealer copied. If symptoms return, treat the computer as untrusted again and use the manufacturer’s support or your organization’s security process.
Frequently Asked Questions
Should I change my passwords immediately after finding a trojan?
Do not change them on the suspected computer. First disconnect it and run an updated full scan, or use a separate trusted device. Malware can capture replacement credentials while it is still active. Microsoft Support specifically directs users to run a full scan before changing a password.
Is one clean antivirus scan enough?
No. A scan is a point-in-time check. Remove unsafe software and extensions, reset changed browser settings, update the operating system and applications, and then review account sessions, recovery details, forwarding rules and connected apps.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What if I cannot log in to my email account?
Use only the provider’s official account-recovery page or sign-in helper. Do not give passwords or verification codes to a third-party recovery service. After regaining access, review devices, security events, recovery methods and forwarding before using the account normally.
Do I need to buy a paid antivirus product?
Not necessarily. The guidance supports updated, trusted security software, including Microsoft Defender on Windows, and does not identify a paid brand as required. Avoid random cleaners advertised by pop-ups.
Will changing a password sign out an attacker everywhere?
Not always. Provider controls differ, and an existing session or delegated application access may survive a password change. Use the service’s official device, session and connected-app controls, including “sign out everywhere” when available.
When should I reset the computer?
Consider a reset or manufacturer support if malware warnings return, security settings keep changing, scans cannot complete, or abnormal behavior continues. Back up only files you trust, scan them, and do not restore an unverified system image.
Are passkeys or hardware security keys required?
They are optional stronger protections when a service supports them. Check FIDO2/WebAuthn compatibility, the connector or wireless method, and how you will recover the account if the key is lost. Two-step verification and unique passwords remain essential.
What should I do about suspicious bank activity?
Contact the bank, card issuer or payment provider through its official application or published phone number. Ask about account locks, card replacement and transaction disputes, and contact local authorities for suspected identity theft, fraud or significant loss.
The Bottom Line
Treat an infostealer-infected computer as untrusted. Isolate it, run an updated full scan, remove unsafe software and extensions, reset the device if symptoms persist, and recover accounts from a trusted device. Change unique passwords, revoke unfamiliar sessions and connected apps, verify recovery and forwarding settings, and enable two-step verification. Keep monitoring afterward: cleanup reduces risk but cannot prove what information was already copied.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
