Contain the problem, use trusted security tools, and secure exposed accounts from a separate device. If an infection persists or its scope is unclear, a clean reinstall or professional help may be safer than repeatedly trying random fixes.
Contain before you clean
If files are actively changing, an unknown person appears to control the computer, or a security tool reports serious compromise, disconnect the device from networks. Disconnect attached backup drives and shared storage where it is safe to do so. For a work computer, contact your organisation’s IT or security team before modifying evidence.
Avoid signing in to important accounts on the affected device. If you need to change passwords, use another device you trust. Malware that steals browser sessions may leave an attacker with access even after the local programme is removed.
Use a recovery path you can verify
- Open your existing security application through the operating system. Check that the publisher and programme are legitimate.
- Follow official guidance for updating protection and selecting a full or offline scan. Do not fetch recovery tools from pop-up warnings or unsolicited support messages.
- Allow the tool to quarantine or remove detected items according to its guidance. Record the results and restart if required.
- Check the same symptoms again and review protection history. Repeated detections need investigation of the original source.
- If protection cannot run, use the operating system’s documented recovery options or seek qualified assistance.
Separate malware from browser annoyances
Unwanted notifications can look like system warnings. Review the browser’s site-notification permissions and remove permissions from unfamiliar sites. Inspect extensions and reset only the relevant settings where possible. An ad blocker may reduce nuisance content, but it is not a complete cleanup tool.
If a browser repeatedly opens an unfamiliar search engine, check extension permissions and installed software. Removing a notification permission will not fix an application that keeps recreating it. Change one component at a time so you can tell what solved the problem.
When a clean installation is worth considering
Persistent infections, unknown administrator access, and important data theft can make it difficult to trust the remaining system. Reinstalling from official installation media can provide a more dependable starting point than dozens of undocumented registry or terminal changes.
Plan before reinstalling. Record software licences, verify backups, and follow the manufacturer’s recovery instructions. Restore documents carefully and reinstall applications from official sources. Copying the entire old system configuration back immediately can reintroduce the original problem.
Protect what the cleanup cannot restore
Change exposed or reused passwords, revoke unfamiliar sessions, check account recovery details, and enable strong authentication. Review email forwarding rules and connected applications if the email account may have been accessed. A device cleanup does not reverse a fraudulent account change.
Test a few restored files before declaring the backup successful. If ransomware or business data is involved, preserve relevant evidence and contact the appropriate organisation or professional. Do not assume that paying an extortion demand guarantees recovery or deletion of stolen information.
Build a quieter prevention routine
Keep the device supported and updated, remove software you no longer use, and maintain a backup that is not continuously exposed to the same risks as the main system. Install only one intended real-time antivirus engine unless the providers explicitly document a compatible combination.
The goal is not a machine covered in warning windows. It is a small set of protections whose status you understand. Read our malware explainer for the differences between threat types and the remote-access checklist if an unfamiliar support tool was involved.
Questions, answered
Will a factory reset always remove everything?
The result depends on the device and reset method. Follow official recovery instructions and separately secure cloud accounts, backups, and other affected devices.
Should I disable antivirus to run a cleanup tool?
Do not follow that instruction from an unverified source. Use the security vendor’s documented recovery procedure or obtain qualified help.
Sources & further reading
Source review: September 25, 2026. Product features and subscriptions can change; confirm the exact plan before purchase.
About the author
Oliver ReedDevice & family securityOliver’s coverage explores device protection, malware prevention, recovery, and family device controls. These guides put operating-system tools first, explain when extra protection may help, and distinguish prevention from a response to an active incident.
View profile and articles
