After allowing notifications from a shady website in Microsoft Edge, I started receiving a lot of unexpected notifications. I checked Event Viewer and noticed logon events 4624 and 4672 around the same time, so I'm worried that malware or a remote-access tool may have been installed. Microsoft Defender's quick scan initially found nothing, but Malwarebytes detected something, and I'm currently running a full Windows Security scan. What should I do next?
2 Answers
Those Event Viewer entries don’t prove you were hacked—4624 is a normal successful logon, and 4672 means that logon received administrator-level privileges. Website notifications are often just browser push spam, although the Malwarebytes detection should be investigated. Remove the suspicious site from Edge’s notification permissions, uninstall anything unfamiliar, update Windows and your browser, and let both Malwarebytes and Microsoft Defender complete full scans.
If the detection suggests a remote-access tool, credential stealer, or other serious malware, disconnect the computer from the internet and avoid signing into accounts on it. From a separate trusted device, change important passwords, enable two-factor authentication, and review recent account logins. If the infection can’t be confidently removed, back up only known-safe documents and pictures using a clean bootable environment, then perform a clean Windows installation that deletes the existing system partitions.
If this is my only computer, I can use a phone or another trusted device to change passwords and prepare recovery media. I’ll keep the computer offline while I figure out whether the detected file is actually dangerous.
The quick Defender scan was clean, but Malwarebytes found something, so I’m waiting for the full scan before deciding whether I need to reset Windows.