Assume both the computer and your accounts are at risk. An infostealer can collect browser passwords, cookies, active-session tokens and system details. Disconnect or stop using the suspected PC for sensitive activity, change exposed passwords from a known-clean device, then update Microsoft Defender and run a full scan followed by Microsoft Defender Offline if needed. Escalate to trusted professional support or a clean Windows installation when detections persist or you cannot trust the operating system.
What an infostealer does and why removal alone is not enough
Infostealers are malware built to collect credentials, browser session tokens and system-context data at scale. A successful infection can therefore let someone access an account even after you delete the original malicious file: a stolen password may be reused, and a session token can sometimes let an attacker act as an already signed-in user.
As an Amazon Associate I earn from qualifying purchases.
Microsoft’s Digital Defense Report 2025 identifies malvertising, search-engine-optimization poisoning, cracked software, phishing and ClickFix lures as common delivery routes. In Microsoft’s reported top-five distribution for 2025, Lumma represented 51%, Atomic 21%, a Node.js-based stealer 16%, Sys01 8% and Rhadamanthys 4%. Microsoft Threat Intelligence recorded 44,197 Windows devices affected by Lumma in India, 40,868 in Russia, 21,137 in Brazil and 15,647 in the United States between March 16 and May 16, 2025. Those figures describe reported worldwide detections, not the probability that any particular PC is infected.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteThese numbers also show why an infection can arrive through an apparently ordinary browsing session. A malicious advertisement, poisoned search result or fake software update can lead to a download or a prompt that looks legitimate. Cracked programs and unfamiliar “free” downloads are especially risky because the user may grant them permission before any warning appears.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Treat the event as two linked incidents:
- Local compromise: malicious files, persistence mechanisms or system changes must be removed.
- Account compromise: credentials and active sessions used on the PC may already be exposed and must be replaced or revoked.
A clean scan does not undo a password theft that happened before the scan. Likewise, changing passwords does not remove malware that could steal the replacement credentials. Handle both tracks in parallel, using a separate device for account work.
First response: stop feeding the suspected malware
The Federal Trade Commission’s April 2025 consumer guidance is direct: “Immediately stop logging into online accounts with your usernames, passwords, or other sensitive information — like shopping or banking.” Follow that instruction before attempting cleanup.
- Disconnect the PC from Wi-Fi or unplug its network cable if practical. If you need an internet connection to download a security update, use a clean device instead.
- Do not open email, banking, shopping, work, password-manager or social-media accounts on the suspected PC.
- Do not type new passwords, payment details, recovery codes or identity information into it.
- Leave the computer powered on only when necessary to preserve evidence or run a scan. If it is unstable, shut it down rather than continuing normal work.
- Do not plug an unscanned USB stick into another computer merely to copy files. An infected executable or script can spread the problem.
Disconnecting limits additional theft; it does not prove that previously stored passwords or browser cookies are safe. If the machine belongs to an employer, disconnect it according to company incident procedures and notify the administrator rather than deleting files or resetting it immediately.
Secure accounts from a known-clean device
Use a phone or computer you trust. Work from the most important accounts outward, because control of email can allow an attacker to reset many other passwords. If the clean device shares the same browser profile or cloud synchronization with the suspect PC, use a separate browser profile or another trusted device where possible.
- Change the primary email password. Review recovery addresses, phone numbers, forwarding rules and recent sign-ins. Sign out other sessions where the service provides that control. Check for new filters or delegated access that could hide security messages.
- Change financial-service passwords. Check bank, card, payment and investment activity, and contact the institution through its official channel if you see an unfamiliar transaction or login. Never use a telephone number or link from a suspicious message.
- Change your password-manager password. If the manager was used on the suspected PC, assume stored credentials may have been exposed and rotate the highest-value entries first. Revoke other logged-in sessions and review the manager’s access history.
- Change work, cloud-storage and administrator accounts. Tell your employer or administrator if a work account was used on the machine so they can review logs, invalidate tokens and revoke sessions.
- Change social-media, shopping and other frequently used accounts. Look for messages, posts, purchases or profile changes you did not make. Remove unfamiliar connected applications.
- Enable two-factor authentication. Prefer an authenticator app or hardware method when the service supports it; keep recovery codes somewhere that was not exposed. SMS is still better than no second factor when stronger options are unavailable.
- Revoke active sessions and app access. Use each service’s account-security page to sign out browsers and remove unfamiliar connected applications. Session revocation matters because changing a password does not always invalidate every existing browser token.
- Monitor alerts and statements. Watch sign-in notifications, password-reset emails and financial statements for several weeks. Preserve suspicious messages and transaction details if you need to report fraud.
Do not wait for the scan to finish before changing credentials. The account-protection work addresses stolen information; the Windows scans address the local infection. If you cannot identify every account used on the PC, start with email, finance, password storage, work administration and any account that can reset others.
Recognize signs that justify an infostealer investigation
An infostealer can be quiet, so symptoms are clues rather than proof. FTC indicators include:
- A computer that becomes unusually slow, freezes or crashes.
- A changed browser home page, unexplained redirects, new toolbars or add-ons.
- Unexpected pop-ups or repeated operating-system errors.
- Security utilities such as Task Manager becoming disabled.
- Emails or social posts sent from your accounts that you did not send.
Microsoft’s InfoStealer guidance also lists slow performance, added or modified files, desktop changes, freezing or crashing and reduced available storage. A machine can be infected without showing any of these signs, especially when the stealer’s goal is to collect data quietly. Account symptoms—unexpected password-reset notices, unfamiliar sign-ins, new browser sessions or purchases—can be the first indication even when Windows appears normal.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Update Microsoft Defender and run a full scan
Start with the built-in protection already present in Windows. Microsoft recommends uninstalling unwanted software, updating security intelligence and running a full Microsoft Defender scan. Updated intelligence matters because a scan using old signatures may miss newer files or variants.
- Reconnect only long enough to obtain security-intelligence updates if necessary, then open Windows Security.
- Open Virus & threat protection and install any available security-intelligence update.
- Choose Scan options, select Full scan and start it.
- Allow the scan to complete. Review every detection and choose the offered quarantine or removal action.
- Restart when Windows requests it, then check Protection history for the detection name, action and status.
A full scan is more suitable than relying on a quick scan when you suspect an infostealer because it checks broadly across the system. Keep the PC connected only for the update and scan process, and avoid browsing or signing in while the scan runs. If Defender reports that a file is in use, requires a restart or cannot remove an item, record that message rather than repeatedly dismissing it.
Microsoft’s InfoStealer entry says Defender can detect and remove the threat, while warning that an infection may leave remnant files and system changes. Updating definitions and performing a full scan may address those remnants, but a successful removal message is not evidence that stolen credentials have been recovered.
Run Microsoft Defender Offline for persistent threats
Use the offline scan when unwanted software persists, returns after removal or appears able to hide while Windows is running. It restarts the PC and scans from a separate environment outside the normal Windows session, making it harder for persistent malware to conceal files or processes.
- Save work and close applications.
- Open Windows Security.
- Select Virus & threat protection → Scan options.
- Choose Microsoft Defender Offline scan, then select Scan now.
- Allow the restart and scan to finish. Microsoft’s endpoint documentation says the scan takes about 15 minutes; actual time can vary with the device and findings.
- After Windows starts again, open Protection history and review the result.
Because the computer restarts, save documents first and make sure you know any disk-encryption recovery information your organization requires. Do not interrupt the scan simply because the screen is blank or progress appears slow. If the machine powers off unexpectedly, restart it normally and check Protection history before trying again.
The offline scan depends on the Windows Recovery Environment (WinRE). If selecting it produces no restart or no scan, open an elevated Command Prompt and check the status with:
reagentc /infoIf WinRE is disabled, Microsoft documents enabling it with:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
reagentc /enableRun the command as an administrator, then retry the offline-scan path. If WinRE cannot be enabled or the scan still fails, use clean-created bootable media or obtain trusted support.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →When to use clean-created bootable media
Removable media is an alternative when the built-in offline workflow is unavailable or when you need a scan that starts independently of the installed Windows environment. Create it on a PC that is not infected. Do not prepare it on the suspect machine.
- On the clean PC, obtain Microsoft Defender Offline media creation instructions.
- Use a blank CD, DVD or USB flash drive with at least 250 MB of free space. An 8GB USB flash drive is a practical commonly sold size, but capacity alone does not make it a security tool.
- Back up anything you need from the USB first: creating the media reformats the drive and erases its contents.
- Finish creating the media, then connect it to the affected PC.
- Boot the affected PC from that media using the manufacturer’s boot-device procedure.
- Let Defender scan and remove detected malware.
- Remove the media before allowing the computer to reboot into Windows.
The USB drive is only the delivery mechanism for the scanner; it does not itself disinfect a computer. A second clean PC and a spare drive are required, and reformatting causes more disruption than the in-Windows scan. Treat the drive as disposable for this task: do not restore unrelated files to it until you have finished creating and using the media.
Which scan method should you choose?
| Method | Runs where | Best use | Extra equipment | Disruption | Credential protection |
|---|---|---|---|---|---|
| Microsoft Defender Full scan | Inside normal Windows | Initial broad check after updating security intelligence | None | Lowest; Windows remains available but should not be used for sensitive work | None; change passwords separately |
| Microsoft Defender Offline | Separate pre-Windows environment through WinRE | Threat persists, returns or may hide during normal operation | None when WinRE works; restart required | Moderate; the PC is unavailable during restart and scan | None; change passwords separately |
| Bootable Defender media | Independent removable-media environment | WinRE is unavailable or a separate boot path is needed | Clean PC and blank CD, DVD or USB with at least 250 MB; USB is erased | Highest setup burden; requires media creation and a boot-device selection | None; change passwords separately |
These methods are complementary rather than interchangeable. A full scan is the least disruptive starting point; Offline adds isolation from the running Windows installation; bootable media adds a clean creation system and removable-media handling. None of the three can tell you that a password or session token was not copied earlier, so account recovery remains a separate workstream.
How to decide whether Windows must be reinstalled
There is no universal rule that every infostealer infection requires a reinstall. The decision is based on evidence and trust:
Recommended Free Tools
- Continue monitored cleanup when Defender removes the detection, Offline completes successfully, the system behaves normally and no further detections or account anomalies appear.
- Escalate to trusted support when scans repeatedly detect the threat, the machine remains unstable, security tools are disabled, or you cannot interpret the findings safely. The FTC recommends using trusted support when self-service removal is insufficient.
- Consider a clean Windows installation when you cannot establish the integrity of the operating system, persistent malware returns after offline or media scans, or the device is used for high-value work and the residual risk is unacceptable.
A reinstall is a risk-management choice, not proof that every file will be harmless afterward. It takes time, removes installed applications and settings, and requires you to reinstall software from trusted official sources. Confirm that you have legitimate installation media, product access and backups before starting. If the PC is managed by an employer, let the administrator decide whether imaging or incident-response procedures are required.
Before a reinstall, preserve only trusted personal documents. Do not carry over unknown executables, cracked software, scripts, browser extensions or installers that may have delivered the infection. Scan any retained documents on a clean system. A reinstall removes the local Windows environment; it does not reverse stolen sessions or passwords, so complete the clean-device account steps as well.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
After cleanup: verify and harden the PC
Once scans are complete and accounts are secured, use the computer cautiously:
- Review Defender’s protection history and confirm that detections were quarantined or removed.
- Install pending Windows, browser and application updates.
- Keep Microsoft Defender real-time protection enabled.
- Remove software and browser extensions you do not recognize or no longer need.
- Download applications only from trusted official sources. Avoid cracked software, suspicious advertisements, unexpected links, unfamiliar free-download sites and peer-to-peer sources.
- Scan USB sticks and other external drives before opening files.
- Watch account sign-in alerts, email forwarding settings, social activity and financial statements for unexpected changes.
Use a staged return to normal activity. First verify that Windows updates and Defender operate normally; then reinstall essential applications from official sources; only afterward restore trusted documents. Do not disable real-time protection to run an untrusted installer or browser extension.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →If a newly changed password is exposed again, or a familiar detection returns, stop using the PC for sensitive work and escalate rather than repeatedly entering replacement credentials on it.
Common mistakes that make an infection worse
- Changing passwords on the infected PC: a stealer can capture the new values. Use a clean device.
- Running only a quick scan: it may not inspect every location. Update intelligence and use a full scan.
- Stopping after the first removal message: remnants or system changes can remain, and sessions may already be stolen.
- Creating boot media on the suspect computer: the creation process should use a clean PC.
- Forgetting USB contents: Defender media creation reformats the drive and erases its data.
- Assuming two-factor authentication fixes everything: it reduces future password-only access but does not automatically revoke existing sessions or undo fraudulent activity.
- Restoring every old file after reinstalling: unknown installers and executables can reintroduce the problem.
- Ignoring the browser: remove unfamiliar extensions and review saved passwords and active sessions from a clean device rather than assuming a browser reset alone is enough.
- Using a random “PC cleaner”: untrusted cleanup programs can add risk. Prefer Microsoft’s built-in tools or a provider whose reputation and support details you can verify.
When professional help is the safer option
Use a known, trusted support company or the device manufacturer when the built-in scans cannot complete, detections recur, Windows remains unstable, or the computer contains sensitive business, financial or personal information that you cannot risk exposing further. Before handing over the device, explain that an infostealer is suspected and tell the provider which accounts were used on it. Continue changing and monitoring accounts from a separate clean device while the local system is being examined.
Ask what the service will do before authorizing work: whether it will preserve evidence, reinstall Windows, retain personal files, or charge for data recovery. Avoid providers that promise guaranteed removal without explaining their process. If fraud or a workplace account is involved, follow the bank’s or employer’s reporting process as well as the technical cleanup.
Frequently Asked Questions
Am I safe after Microsoft Defender reports that the threat was removed?
Not automatically. The local file may be quarantined, but passwords, cookies or session tokens collected before removal may still be usable. Change passwords, revoke sessions and enable two-factor authentication from a known-clean device, then monitor account activity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Should I change every password after an infostealer infection?
Change passwords for every account used on the suspected PC, prioritizing email, financial services, password managers, work administration, cloud storage and social accounts. If you cannot inventory them all, start with accounts that can reset or unlock others.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Do I need to reinstall Windows?
No universal rule requires it. Consider a clean installation when detections return after full, Offline or bootable-media scans, Windows cannot be trusted, or the device handles high-value information. A reinstall does not undo stolen credentials or sessions.
How long does Microsoft Defender Offline take?
Microsoft’s endpoint documentation says about 15 minutes, although the actual time varies with the device and findings. Save work before starting and review Protection history after Windows restarts.
What if Defender Offline does nothing?
Check WinRE in an elevated Command Prompt with reagentc /info. If it is disabled, run reagentc /enable as an administrator and retry. If WinRE still fails, use media created on a clean PC or obtain trusted support.
Can I use any USB drive for Defender Offline media?
Microsoft specifies a blank CD, DVD or USB flash drive with at least 250 MB of free space. Creating the media reformats the USB and erases its contents, so copy off anything important first. An 8GB drive is a practical size, but the USB itself does not remove malware.
Can I keep using the PC while I change passwords?
Use a phone or computer you trust for all account changes. Do not enter replacement passwords, payment details or recovery codes on the suspected PC until scans and verification are complete.
What are common ways infostealers reach Windows?
Microsoft lists malvertising, search-engine-optimization poisoning, cracked software, phishing and ClickFix lures. Keep Windows, browsers and apps updated, download from official sources and avoid suspicious ads, unexpected links and peer-to-peer downloads.
The Bottom Line
Contain the PC, stop sensitive logins, and secure accounts from a clean device. Update Defender, run a Full scan, then use Defender Offline or clean-created bootable media when threats persist. Reinstall Windows or seek trusted help when you cannot establish system integrity—but remember that no scan or reinstall reverses credentials and sessions already stolen.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
