Recommended Free Tools
If you pasted and ran a PowerShell command from a fake CAPTCHA, browser error, verification page, or support prompt, assume the Windows computer may be compromised. Disconnect Wi‑Fi, Ethernet, and Bluetooth immediately, then use Windows Security to update Microsoft Defender and run a full scan. If detections recur or the risk is high, run Microsoft Defender Offline. From a different, clean device, change passwords used on the computer, revoke active browser sessions, and enable or refresh multifactor authentication (MFA). Work or school devices should be reported to the organization’s security team before you continue.
What to do first: contain the computer
Do not paste another command, revisit the page that displayed the prompt, or continue signing in on the affected computer. ClickFix is a social-engineering delivery technique, not a single malware family. A command can briefly invoke PowerShell, mshta.exe, or another built-in Windows utility, download a second stage, and leave little visible evidence. The payload and persistence method differ between campaigns.
As an Amazon Associate I earn from qualifying purchases.
- Disconnect every network path. Turn off Wi‑Fi, unplug Ethernet, and disable or disconnect Bluetooth. Also disconnect mapped network drives and removable devices that are not needed for evidence or recovery. Microsoft’s SuspClickFix.A guidance says to isolate the device immediately; its threat guidance states: “Immediately isolate the infected device from all networks to cut off threat actor access and stop data theft.”
- Stop using the computer for sensitive work. Do not enter passwords, approve MFA prompts, access company systems, or open personal documents until the first scan is complete. Leave the computer powered on if your organization’s incident-response team may need volatile evidence; otherwise, follow its instructions rather than improvising.
- Use another device to get help. For a work or school computer, contact IT or security from a known-clean phone or computer. Tell them when the command was run, what site or prompt displayed it, and which accounts were used afterward. Do not email suspicious files or paste the command into a chat unless the security team requests it.
Disconnecting first limits additional downloads and outbound theft. It does not undo data that may already have been copied, so account protection remains necessary even if a scan later reports no malware.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why a pasted command can still be malware
ClickFix lures a person with a fake error, CAPTCHA, verification step, or urgent support warning. The page instructs the visitor to perform an action that appears to repair the problem, often copying text into the Run dialog, Command Prompt, or PowerShell. Because the victim starts the process, normal browser protections may not stop the command from running.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Microsoft’s Trojan:Win32/ClickFix and Behavior:Win32/ClickFix descriptions explain that the command may use trusted Windows components to fetch or launch a payload. “ClickFix” therefore describes the initial-access method rather than a universal file name, registry key, or cleanup recipe. One campaign may install a credential stealer; another may establish a downloader, remote-access component, or a different payload entirely.
Microsoft’s 2025 Digital Defense Report identified ClickFix as the most common initial-access method in 47% of the Defender Expert notifications observed during the report’s preceding year. That percentage applies only to that specified Defender Experts notification population; it is not the share of all cyberattacks or all Windows infections.
Run Microsoft Defender in the correct order
1. Update security intelligence
After isolating the computer, open Windows Security from the Start menu. Select Virus & threat protection, then under Virus & threat protection updates choose Check for updates. Current security intelligence improves the chance of detecting recently identified components. If the computer cannot update because it is offline, leave it isolated and use your organization’s approved process or a clean device to obtain help; do not reconnect merely to browse for a random scanner.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Run a full scan
- In Windows Security > Virus & threat protection, select Scan options.
- Choose Full scan and select Scan now.
- Save open work first. A full scan can take substantially longer than a quick scan, especially on a large disk.
- When it finishes, open Protection history and record the detection name, affected path, action taken, and timestamp. Keep screenshots or export details for IT if the device is managed.
Microsoft Support recommends a full scan when infection is suspected. Allow Windows Security to quarantine or remove a detection using the action it presents. Do not restore an item merely because its file name looks familiar.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Use Microsoft Defender Offline when concern remains
Choose Microsoft Defender Offline scan in Windows Security > Virus & threat protection > Scan options when the full scan finds something that returns, cannot remove a component, or the computer behaves suspiciously while Windows is running. Windows will restart and scan outside the normal operating environment, which can make it harder for persistent malware to hide.
Save documents and close applications before starting. The computer will reboot, and you may not see the usual desktop during the scan. After Windows starts again, return to Protection history to review the result. Microsoft’s malware-removal troubleshooting guidance treats Offline scanning as a deeper remediation step for recurring or difficult detections, not as a replacement for isolating the device and protecting accounts.
Review detections without creating a second problem
ClickFix-related guidance from Microsoft calls out scheduled tasks, startup locations such as Run and RunMRU, and suspicious files in temporary or AppData directories. Those examples describe behaviors seen in particular campaigns. They are not a universal checklist, and deleting an unfamiliar registry value or system file can make Windows unstable or destroy evidence.
What to check
- Protection history: Confirm whether Defender quarantined or removed the item, and note whether it says remediation is pending.
- Scheduled tasks: Look for a task created around the time of the incident, especially one launching PowerShell, a script, or a file from a user-writable folder. Do not delete a task solely because its name is unfamiliar; ask IT or a qualified technician to validate its publisher, action, and creation time.
- Startup entries: Review recently added entries in Windows startup settings and the user’s startup folder. An entry pointing to a temporary or profile directory deserves investigation, but legitimate applications can also use those locations.
- Browser extensions and profiles: Record extensions installed or changed near the incident. Disable suspicious additions, but preserve details for an investigation before removing them on a managed device.
- Files in temporary and profile folders: Do not run, open, or email unknown files. Quarantine through Defender or have a professional collect them safely.
A campaign-specific filename copied from a forum is not proof that every file with that name is malicious. The actual payload cannot be identified from the phrase “ClickFix” alone.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Protect passwords, browser sessions, and MFA from a clean device
ClickFix campaigns can steal browser credentials, authentication tokens, and sensitive documents. Microsoft’s July 2026 reporting on ACR Stealer describes observed ClickFix intrusion chains with those capabilities and the potential to compromise accounts and cloud resources. A clean scan therefore does not prove that saved passwords or active sessions are safe.
- Use a different, trusted device. A personal phone or computer that was not exposed to the command is preferable. If you have no clean device, ask your organization, bank, or service provider for a safe recovery channel.
- Change passwords in priority order. Start with the primary email account, password manager, identity provider, financial accounts, and work or school account. Then change other accounts that were used on the affected computer. Use unique passwords; do not reuse the old password with a minor variation.
- Revoke active sessions. In each important account’s security settings, sign out other browsers and devices or use the account’s “sign out everywhere” control. Session cookies and tokens can remain useful to an attacker even after you change a password.
- Refresh MFA. Confirm that the correct phone number, authenticator, security key, and recovery codes are present. Remove unknown authenticators or trusted devices. Generate new recovery codes after securing the account.
- Review account activity. Check recent sign-ins, forwarding rules, mailbox delegates, newly created applications, payment changes, cloud sharing, and password-reset notices. Report unauthorized changes through the provider’s recovery process.
For a Microsoft account, Microsoft Support advises running a full malware scan before changing the password, then reviewing account settings. Follow that sequence from the clean device. If the account controls are unavailable or an attacker has changed recovery information, use the provider’s official compromised-account recovery process rather than repeatedly guessing credentials.
Choose the right recovery path
| Situation | Next action | Why |
|---|---|---|
| Personal Windows computer; no detections after an updated full scan; no unusual account activity | Keep the computer isolated until the scan result is understood, apply Windows and browser updates, then reconnect cautiously. Complete password and session protection from a clean device. | The initial risk may be contained, but account exposure is separate from the scan result. |
| Full scan detects malware, or the same detection returns | Quarantine or remove through Windows Security, restart if requested, and run Microsoft Defender Offline. Escalate if the detection returns again. | Recurring detections can indicate a component that reinstalls the malware or hides during normal Windows operation. |
| Work or school computer, regulated data, or shared business credentials | Stop making changes beyond isolation and contact the organization’s security team from another device. | Incident responders may need logs, memory, disk images, and coordinated credential revocation. Self-cleaning can destroy evidence or spread the incident. |
| Evidence of account takeover, data theft, or sensitive documents on the device | Revoke sessions and reset credentials from a clean device, notify affected organizations, and obtain professional incident-response help. | Removing a local file cannot retrieve stolen credentials, tokens, or copied documents. |
| Malware cannot be removed, system changes appear irreversible, or reinfection continues after Offline scanning | Back up only data that has been checked, reset or reinstall Windows, and restore from a backup made before the incident where possible. Have a qualified technician or your organization perform the rebuild. | A clean rebuild can be more reliable than trying to identify every persistence mechanism. |
When resetting or reinstalling Windows is justified
Do not reset a computer solely because a suspicious page was displayed. Begin with isolation and Defender scanning. A reset or reinstallation becomes reasonable when Microsoft Defender cannot remove the threat, detections recur after Offline scanning, system settings have been materially altered, or the device holds information whose integrity cannot be established.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Preserve account and incident details before wiping: detection names, timestamps, suspicious URLs, screenshots, and the list of accounts used.
- Do not restore executable files, browser profiles, scripts, or unknown installers from the potentially infected system.
- Use a backup created before the incident and verify that it is not carrying the suspicious file back onto the rebuilt computer.
- After reinstalling, fully update Windows, browsers, and applications before signing in to sensitive accounts.
- Reset passwords and revoke sessions regardless of whether the rebuilt system appears clean.
A reset removes local software and settings; it cannot undo a password theft or invalidate an attacker’s existing session by itself. Account recovery must be completed separately.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Common mistakes that make ClickFix incidents worse
Running the command again to “see what it does”
Do not test or decode the command by executing it. Repeated execution can download another payload, create additional persistence, or overwrite useful evidence. Preserve it as text or a screenshot only if a qualified responder asks for it.
Assuming a short PowerShell window means nothing happened
A launcher may run briefly and hand control to another process. The absence of a visible file, desktop shortcut, or pop-up does not establish that the command was harmless.
Changing passwords on the suspect computer
If a browser session, password, or token was captured, typing a new password on the same device can expose the replacement. Use a clean device and revoke sessions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Deleting random registry keys or system files
Campaign indicators vary, and an arbitrary deletion can damage Windows or remove evidence. Follow a documented Defender action or obtain professional guidance.
Installing a generic cleanup utility as the only response
Windows 10 and Windows 11 include Microsoft Defender, and the official response uses built-in scanning, account controls, and incident support. A third-party utility does not replace network isolation, session revocation, or a managed-device investigation.
After cleanup: verify and reduce future risk
- Run Windows Update and update browsers, document software, and other applications from their normal settings pages.
- Keep Microsoft Defender real-time protection enabled unless your organization’s security policy says otherwise.
- Remove browser extensions you do not recognize and review notification permissions for recently visited sites.
- Use a password manager and unique passwords rather than storing one password across multiple services.
- Keep MFA enabled, preferably with an authenticator or security key where supported.
- Maintain offline or otherwise protected backups and test that important files can be restored.
- Train users to treat browser prompts that ask them to press a key combination, open PowerShell, or paste a command as suspicious. A legitimate CAPTCHA or error page should not require arbitrary shell commands.
Continue watching account sign-in alerts, password-reset messages, mailbox rules, and cloud-file activity for several days after the incident. If a detection returns, stop using the computer for sensitive work and escalate rather than repeating ad hoc cleanup.
What this guidance can and cannot establish
This procedure is general Windows user guidance based on Microsoft material current through October 13, 2026. The exact payload cannot be determined from the title or from the fact that a PowerShell command was pasted. Campaign indicators, Windows interface labels, and attacker behavior can change. A scan can find known malware and support remediation, but it cannot prove that no credentials, browser sessions, documents, or tokens were copied. High-impact incidents, recurring detections, and organization-owned devices require qualified incident response.
Quick Recap
Source notes
- Microsoft Security Intelligence, Trojan:Win32/ClickFix threat description, published and updated May 8, 2025.
- Microsoft Security Intelligence, Behavior:Win32/ClickFix threat description, updated October 1, 2025.
- Microsoft Security Intelligence, Behavior:Win32/SuspClickFix.A threat description, updated February 9, 2026.
- Microsoft Security Research, ACR Stealer: Two observed intrusion chains amid increased threat activity, July 16, 2026.
- Microsoft Support, How to start a scan for viruses or malware in Microsoft Defender; Antivirus and antimalware software: FAQ; How to recover a hacked or compromised Microsoft account; and Troubleshoot problems with detecting and removing malware.
- Microsoft, Microsoft Digital Defense Report 2025.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
