If malware or a suspicious app keeps returning after a scan, don’t keep using the device for banking or passwords. First protect your accounts, then use the recovery steps for your operating system: on Windows, run Microsoft Defender Offline; on Mac, update built-in protections, restart when prompted, and review login items carefully. A recurring detection can mean either reinfection from a website or email or a hidden component reinstalling the threat—it is not, by itself, proof that every unfamiliar background process is malicious.
Protect your accounts before troubleshooting
Stop entering passwords or payment details on a device you suspect is infected. If you think credentials may have been exposed, use a different, trusted device to change affected passwords and turn on two-factor authentication. The FTC’s U.S. consumer guidance recommends these steps when removing malware: FTC: How To Recognize, Remove, and Avoid Malware.
As an Amazon Associate I earn from qualifying purchases.
- Do not call a phone number shown in an unexpected security warning or pop-up, and do not buy cleanup software because an unsolicited message tells you to. Fake alerts can lead to remote-access scams, bogus repair charges, or more malware.
- If this is a work- or school-managed computer, contact its IT department rather than attempting an independent cleanup.
Windows: run Microsoft Defender Offline
Microsoft identifies two possible reasons a detection returns: the device may be getting infected again through a website or email, or an undetected component may be reinstalling the detected malware after a restart. Its targeted next step for repeated detections is Microsoft Defender Offline, which scans outside the normal Windows session, where some threats try to hide. Microsoft’s guidance is here: Troubleshoot problems with detecting and removing malware.
- Save open work. The offline scan restarts the PC.
- Update Windows and Microsoft Defender protection so the scan has current detection information.
- Open Start > Settings > Update & Security > Windows Security > Virus & threat protection > Scan options.
- Select Windows Defender Offline scan, then choose Scan now. The labels or path may differ across Windows releases.
- Let the PC restart and complete the scan, then review Windows Security for its result.
If the same detection returns, consider whether you are reopening a link, attachment, or website that could be bringing it back. Microsoft describes that as one possibility, not a diagnosis of your device; stop revisiting a suspected source while you investigate.
#1 Best Overall
- NEVER WORRY about losing important files and photos again! With 25GB of secure online storage, you know your files are safe and sound.
- KEEP YOUR COMPUTER RUNNING FAST with our system optimizer. By removing unnecessary files, it works like a PC tune-up, so you can keep working smoothly.
- Our PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, Webroot protection is quick and easy to download, install, and run, so you don’t have to wait around to be fully protected.
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES with cloud-based protection against viruses and other online threats.
Windows: prepare before a clean reinstall
If Windows scans do not resolve a suspected infection, Microsoft’s recovery guidance for Windows 10 and Windows 11 says to consider reinstalling Windows from installation media and choosing a clean installation. This is a last-resort recovery step, not another scan: it removes Windows, personal files, apps, and settings from the selected drive. Read Microsoft’s version-specific instructions before proceeding: Recovery options in Windows.
Prepare files, backups, and recovery information
- Back up only the files you need. A backup that was connected during an infection could have been modified; Microsoft recommends restoring from a backup made before the infection and stored externally.
- Check which drive the clean-install process will affect and make sure needed files are stored elsewhere. Do not assume every reset or reinstall option preserves personal files; the result depends on the method selected.
- If BitLocker is enabled, locate the recovery key before starting. Microsoft says it is needed for most recovery options in the Windows Recovery Environment.
- Expect to reinstall apps and reconfigure settings after a clean installation.
Create official Windows installation media
Microsoft says installation media can be created using another working PC and a USB drive with at least 8 GB of capacity. Create the media using Microsoft’s official download process on the working computer. The USB is a way to reinstall Windows; it is not antivirus software and does not clean an infected installation on its own.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Mac: update protections and restart when needed
macOS includes XProtect, Apple’s built-in antivirus technology for detecting and removing known malware. It can block known malware, move a detected item to Trash, or alert you; Apple also says XProtect periodically checks for remediation updates. The engine does not automatically restart the Mac, so detection should not be taken as a guarantee that every remediation action has finished. See Apple’s explanation of XProtect and malware removal.
Apple says background security and configuration updates are enabled by default, and some take effect only after a restart. Its support article, published December 15, 2025, describes XProtectPayloads and related data as removing known malware, and XProtectPlistConfigData as preventing known malware from running. Install available macOS and security updates, and restart if prompted. The settings path depends on macOS version; Apple’s instructions cover Tahoe 26 or later, Sequoia, Sonoma, Ventura, and earlier versions: Background Security Improvements and security updates.
Rank #3
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES, with cloud-based protection against viruses & other online threats
- Webroot PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, you know you’re in good hands. Stay safe from viruses, ransomware, phishing, and more.
- Webroot SOFTWARE UPDATES ITSELF AUTOMATICALLY, so you always have the most current protection without lifting a finger—and updates happen in the background so they won’t slow you down.
- PREMIUM FEATURES: Encrypts & protects passwords and account information for all your devices so you can stay protected wherever you are.
Mac: review apps that launch or run in the background
If the issue looks like an app opening at login, go to System Settings > General > Login Items & Extensions. Apple’s Mac User Guide explains how to remove a login item and review apps permitted to run in the background: Open items automatically when you log in on Mac.
Removing a login item is appropriate only when you recognize it as unwanted. Legitimate apps may use background activity for syncing or updates, and an unfamiliar name alone does not establish that an item is malware. Do not indiscriminately delete launch agents, daemons, or system files. If symptoms continue or you cannot identify an item confidently, get help from trusted support.
Rank #4
![Norton AntiVirus Plus 2027, 1 Device, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41VAV7G019L._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for your PC or Mac in minutes!
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- SAFEGUARD YOUR PASSWORDS Easily create, store, and manage your passwords, credit card information and other credentials online in your own encrypted, cloud-based vault.
- 2 GB SECURE PC CLOUD BACKUP Help prevent the loss of photos and files due to ransomware or hard drive failures.
How the Windows and Mac approaches differ
| Approach | What it does | Scope and preparation |
|---|---|---|
| Microsoft Defender Offline | Scans outside the running Windows session; Microsoft recommends it for repeated detections. | Windows. Save work because the PC restarts; this is the targeted recurrence step, not a reinstall. |
| Clean Windows installation from media | Reinstalls Windows from installation media. | Windows 10 and 11 recovery guidance. Removes files, apps, and settings from the selected drive; prepare backups and a BitLocker recovery key if applicable. |
| macOS built-in protections and login-item review | XProtect detects and remediates known malware; background security updates and a restart may be needed. Login Items settings let you review user-visible startup and background activity. | Mac. The reviewed Apple guidance emphasizes these protections and controls, not a universal manual cleanup procedure. |
When to get help
For a personal device, ask the manufacturer about support or use a support provider you already know and trust. The FTC warns that fake security alerts may use remote access and invented diagnostics to sell nonexistent repairs or install malware; never use a number in an unexpected warning. If the device is managed by an organization, contact its IT team.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- NEVER WORRY about losing important files and photos again! With 25GB of secure online storage, you know your files are safe and sound.
- KEEP YOUR COMPUTER RUNNING FAST with our system optimizer. By removing unnecessary files, it works like a PC tune-up, so you can keep working smoothly.
- Our PASSWORD MANAGER by Last Pass creates, encrypts, and saves all your passwords, so you only have to remember one.
- As the #1 TRUSTED PROVIDER OF THREAT INTELLIGENCE, Webroot protection is quick and easy to download, install, and run, so you don’t have to wait around to be fully protected.
- STAY PROTECTED EVERYWHERE you go, at home, in a café, at the airport—everywhere—on ALL YOUR DEVICES with cloud-based protection against viruses and other online threats.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
