A fake CAPTCHA does not infect every visitor in the same way. Clicking a counterfeit checkbox and closing the tab is a lower-risk event; allowing notifications creates a browser-abuse problem; pressing Windows+R, pasting the clipboard contents, and pressing Enter can execute malware. If you ran that command or opened a downloaded file, disconnect the computer, stop logging in on it, and treat the device as potentially compromised until scans and persistence checks are complete.
These attacks, often called ClickFix, imitate reCAPTCHA or Cloudflare verification. Microsoft describes Trojan:HTML/FakeCaptcha as social engineering that tricks people into copying and running PowerShell. Malwarebytes has documented pages that silently put an obfuscated command on the clipboard and use mshta to retrieve an encoded payload. Observed payloads include information stealers such as Lumma Stealer and remote-access malware such as SecTopRAT.
As an Amazon Associate I earn from qualifying purchases.
First, work out what you actually did
Your cleanup plan depends on the last action you took. A checkbox click, a notification permission, and an executed command are different incidents.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →You clicked the fake checkbox only
If you did not paste text, run a command, download a file, install an extension, or allow notifications, close the tab. Delete any download that appeared. The likelihood of a system infection is lower in this case, but review notification permissions and extensions anyway, because the page may have attempted to plant a browser-level nuisance.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
You allowed browser notifications
Notifications can continue after the tab is closed and may advertise fake virus alerts, updates, or cleanup programs. They are a browser-permission issue, not proof that Windows malware is running. Remove the site permission, inspect extensions, and reset any homepage or search setting you did not choose.
You pressed Windows+R, Ctrl+V, and Enter, or ran a file
Assume the command executed. The Federal Trade Commission specifically warns about this key sequence in fake-CAPTCHA scams. Disconnect the computer from Wi-Fi or unplug Ethernet, stop using it for email, banking, work, and social logins, and begin the malware-response steps below. If you opened a downloaded installer or document, use the same higher-risk procedure even if no warning appeared.
Contain the computer before scanning
- Disconnect it. Turn off Wi-Fi from the taskbar or physically unplug the network cable. Do not reconnect merely to download a “cleaner” advertised by a pop-up.
- Leave the machine powered on if you need to record evidence. Note the fake page address, the approximate time, filenames in Downloads, and any security alert. If you have no incident-response requirement, shutting down is safer than continuing to use a possibly compromised session.
- Use a separate, trusted device for account changes. A phone or another computer that did not visit the page is preferable. Do not enter new passwords on the affected PC until cleanup is complete.
- Do not interact with the scam page again. Never call a phone number in a pop-up, install a browser “update” offered by the page, or download a removal tool from an advertisement. Google advises getting software updates from the program’s official website instead.
If you are helping someone else, write down whether the command window opened, whether a file was downloaded, and whether Windows Security displayed a detection. Those details help distinguish a browser nuisance from a system compromise and help an employer or responder decide what evidence to preserve.
Remove fake-CAPTCHA browser permissions
Chrome notifications
- Open Chrome and choose Settings.
- Select Privacy and security, then Site settings, then Notifications.
- Under Allowed to send notifications, find the fake-CAPTCHA domain and choose the three-dot menu beside it.
- Select Remove (or Block). Remove every unfamiliar domain added around the same time.
You can also open chrome://settings/content/notifications directly. Removing a permission stops that site from pushing notifications; it does not scan Windows.
Edge notifications
- Open Edge, select the three-dot menu, and choose Settings.
- Open Cookies and site permissions, then Notifications.
- Under Allow, remove or block the suspicious site.
The direct settings address is edge://settings/content/notifications. If you use another Chromium-based browser, look for its equivalent Site settings and Notifications page.
Review JavaScript and other site permissions
A fake CAPTCHA may request more than notifications. In the browser’s site-settings list, review permissions for the suspicious domain, including JavaScript, pop-ups, redirects, automatic downloads, camera, microphone, and clipboard access. Set unfamiliar permissions to Block or remove the site’s stored data. Do not broadly disable JavaScript for every website; use the per-site control and restore only permissions you recognize.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Remove extensions you did not install deliberately
- In Chrome, open
chrome://extensions; in Edge, openedge://extensions. - Record the name and publisher of anything unfamiliar, then select Remove. Do not keep an extension merely because its name contains “security,” “PDF,” “search,” or “update.”
- Restart the browser and check the list again. A reappearing extension is a persistence warning and should be handled as a possible system compromise, not repeatedly removed.
Undo browser changes and clear downloads
Open the browser’s Settings page for startup, homepage, and search engine. Restore values you recognize and remove unknown entries. Open the Downloads list with Ctrl+J, delete the fake CAPTCHA download, and empty the Recycle Bin. Do not open the file to identify it. If pop-ups, redirects, or notification prompts continue, use the browser’s reset-settings option after preserving bookmarks you need.
Update Defender and run a full scan
Microsoft says Microsoft Defender Antivirus automatically removes threats as they are detected. That does not mean a single clean result proves the computer is clean: Microsoft also warns that an infection can leave remnant files and system changes. Use current security intelligence and a full scan.
- Reconnect the computer only long enough to update Defender, or perform the update from a managed process if your organization provides one.
- Open Windows Security from the Start menu.
- Select Virus & threat protection, then under Virus & threat protection updates choose Check for updates.
- Return to Virus & threat protection, select Scan options, choose Full scan, and select Scan now.
- Allow Defender to quarantine or remove detections. Restart when Windows requests it, then review Protection history for the detection name, action, and status.
A full scan examines substantially more of the disk than a quick scan, so let it finish. Do not cancel it because the progress appears slow. If Windows Security cannot update or its controls are greyed out, do not keep retrying while connected; disconnect again and treat the failure as an escalation signal.
Use an offline scan when the threat resists cleanup
Choose Microsoft Defender Offline scan in Windows Security > Virus & threat protection > Scan options when a scan is blocked, malware returns after reboot, or suspicious processes remain. Windows restarts into a separate scanning environment before normal startup programs load, which can expose malware that interferes with an in-Windows scan.
If your organization supplies another trusted offline scanner, follow its documented procedure. Never substitute a pop-up’s “emergency scanner.” A detection-free offline scan is reassuring evidence, not an absolute guarantee.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchConsider a second opinion only from an official vendor
After Defender and the browser cleanup steps, you may use a reputable supplemental malware-removal utility if a qualified technician recommends one. Download it only from the vendor’s real website, verify the publisher, and avoid advertisements, search-result lookalikes, and “support” phone numbers. A second scanner can provide additional evidence, but it does not replace offline scanning, persistence checks, account protection, or a reinstall when compromise cannot be bounded.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Look for persistence that survives a reboot
ClickFix campaigns have used scheduled tasks and Registry Run keys. Microsoft has documented names including ScheduledDefrags, 0neNote (with a zero), and ChromeUpdater. The FBI’s Internet Crime Complaint Center has also documented payloads that place files in the Windows Startup folder. Names can be copied from legitimate software, so unfamiliar spelling alone is not proof.
Scheduled Tasks
- Open Start and search for Task Scheduler.
- Select Task Scheduler Library and sort by Created or Last Run Time if those columns are available.
- Inspect tasks created near the fake-CAPTCHA incident. Check the Actions tab for commands launching PowerShell,
mshta, scripts, or executables from a user profile, temporary folder, or Downloads directory. - Do not delete a task solely because its name is unfamiliar. If Defender flags it, quarantine the associated file and preserve the task details for a responder. If you are certain an entry is malicious, disable it first and document its path before removal.
Run keys
Press Windows+R, type regedit, and press Enter only if you are comfortable reading the Registry. Review these locations:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunHKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
Look for values created around the incident that launch a script, mshta, PowerShell, or an executable from an unusual directory. Export a key for backup before changing it, and ask an administrator or incident responder when you cannot identify an entry confidently. An incorrect Registry deletion can disable legitimate software or Windows components.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Startup folder
Press Windows+R, enter shell:startup, and inspect shortcuts and files. Also check the all-users folder with shell:common startup if you have permission. Record recently created items and let Defender quarantine suspicious files. Do not run a shortcut to discover what it does.
Protect accounts and data from a separate device
Information stealers can target browser passwords, cookies, and session tokens; remote-access malware can let an attacker operate the computer. From a trusted device, change passwords for email first, then banking, work, cloud storage, and social accounts. Prioritize accounts that were open in the browser during or after command execution.
- Change each password to a unique value that was not stored in the affected browser.
- Use the account’s security page to sign out of all sessions or revoke active sessions and remembered devices.
- Enable multifactor authentication, preferably with an authenticator app or security key where available.
- Review recovery email addresses, phone numbers, forwarding rules, new app passwords, and unfamiliar connected applications.
- Contact banks or payment providers immediately if financial accounts were open or if you see an unfamiliar transaction. Preserve transaction records and follow the institution’s fraud process.
If the device held business credentials, customer data, regulated information, or an administrator account, notify the employer’s security team before attempting extensive changes. They may need memory, disk, or log evidence that a consumer cleanup would destroy. Do not connect the computer to a company network to “test” whether it is clean.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Know when a clean scan is not enough
| What happened | Appropriate response | Escalation signal |
|---|---|---|
| Checkbox clicked; no permission, download, or command | Close the tab, delete any download, review notifications and extensions | Pop-ups, redirects, or an extension return after removal |
| Notifications allowed, but nothing executed | Remove the site permission and inspect browser settings and extensions | Unknown extensions reappear or browser settings change again |
| Windows+R paste-and-run sequence or downloaded file executed | Disconnect, run updated Defender Full and Offline scans, inspect persistence, and reset accounts from a clean device | Recurring detections, blocked security tools, unexplained tasks or Run entries, or remote-access behavior |
| Work-managed computer or privileged account involved | Disconnect according to company policy and contact the security team | Any uncertainty about evidence, lateral movement, or sensitive files |
The important comparison is not whether the CAPTCHA looked convincing; it is whether code ran and whether the browser or Windows environment changed afterward. A one-time notification cleanup may be enough for a permission-only event. It is not enough after command execution, a downloaded payload, or recurring persistence.
Recommended Free Tools
When to reinstall Windows or seek professional help
Get qualified incident-response assistance when security tools are disabled or blocked, detections return after reboot, unknown scheduled tasks, Run entries, or Startup files reappear, or ransomware or remote access is suspected. A work device should be handled by the organization’s security team rather than independently reinstalled.
A clean Windows reinstall is reasonable when you cannot bound the compromise, persistence keeps returning, or the computer contained sensitive material and reliable recovery is more important than preserving the current installation. Back up only personal data you can inspect safely; do not restore executable files, scripts, cracked software, browser profiles, or unknown archives. Reinstall from official Windows installation media, fully update Windows, enable security protections, and change account credentials from a clean device before restoring data.
Microsoft Defender Experts reported ClickFix campaigns affecting thousands of devices per month in 2025. Separate TerminalFix reporting describes multistage intrusion and Defender detections associated with ClickFix and TermFix. Those findings are why recurring behavior deserves escalation rather than repeated quick scans.
Common mistakes that make cleanup harder
- Continuing to bank or work on the infected PC: an information stealer may capture the next password or session token.
- Trusting a blocked first payload: the initial command can fail while leaving files or system changes behind.
- Deleting random Registry entries: a legitimate Windows or application component can look unfamiliar.
- Installing a “cleanup” tool from an alert: the alert may be the scam’s second payload.
- Changing passwords on the affected computer: the new credentials can be captured immediately.
- Restoring the entire browser profile: cookies, extensions, and settings may reintroduce the abuse after a reinstall.
- Assuming no symptoms means no compromise: stealers and remote-access tools can operate quietly.
- Reconnecting to check email: even a short session can expose a newly entered password or active token.
A practical completion checklist
- The fake site’s notification permission is removed in every browser used.
- Unrecognized extensions, homepage entries, search providers, JavaScript permissions, and downloads are gone.
- Defender security intelligence is current and a Full scan has completed.
- An Offline scan was run when the in-Windows scan was blocked, malware returned, or suspicious processes persisted.
- Scheduled Tasks, Run keys, and Startup folders were checked for recent unexplained entries.
- Passwords and active sessions were reset from a trusted device, with multifactor authentication enabled.
- Financial institutions or an employer’s security team were notified when exposure warranted it.
- Recurring detections, reappearing persistence, ransomware, remote access, or uncertainty about compromise triggered professional help or a reinstall decision.
Frequently Asked Questions
I only clicked the fake CAPTCHA checkbox. Am I infected?
A checkbox click alone is lower risk if you did not allow notifications, paste or run a command, download a file, or install an extension. Close the tab, delete any download, and still review notification permissions, extensions, homepage settings, and search settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What if I pressed Windows+R, Ctrl+V, and Enter?
Treat it as command execution. Disconnect the PC, stop using it for logins, run updated Defender Full and Offline scans, inspect scheduled tasks, Run keys, and Startup folders, and change account credentials from a separate trusted device.
Are fake CAPTCHA notifications proof that Windows malware is installed?
No. Notifications usually indicate that a website permission was granted. Remove the permission and suspicious extensions first. Recurring browser changes, blocked security tools, detections, or persistence entries require the broader malware-response procedure.
Is one clean Microsoft Defender scan enough?
No. Microsoft says Defender removes detected threats, but remnants and system changes can remain. Use current security intelligence, complete a Full scan, escalate to Offline scanning when indicated, and investigate recurring detections or persistence.
Should I change passwords on the affected computer?
No. Use a separate trusted phone or computer. Change email credentials first, then banking, work, cloud, and social passwords; revoke active sessions, review recovery settings and connected apps, and enable multifactor authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
Can I just delete the downloaded file?
Delete it without opening it, but do not assume that is sufficient. A file may already have run or created persistence. Scan the system and inspect browser settings, scheduled tasks, Run keys, and Startup folders.
When should I reinstall Windows?
Reinstall or obtain professional help when security tools are blocked, detections return after reboot, unknown persistence reappears, ransomware or remote access is suspected, or you cannot reliably bound the compromise. Back up only inspected personal data and restore from official installation media.
What should a business user do?
Disconnect according to company policy and contact the security team immediately, especially if a privileged account, customer data, regulated information, or shared network access was involved. Do not independently wipe the device if responders may need evidence.
The Bottom Line
A fake CAPTCHA is harmless only when nothing beyond the page interaction occurred. Notification permission calls for browser cleanup; a pasted command or opened file calls for isolation, Defender Full and Offline scans, persistence checks, and account resets from a clean device. Recurring detections, reappearing startup entries, blocked security tools, remote access, ransomware, or business exposure are reasons to escalate rather than keep repeating quick scans.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
