Windows 11 keeps opening Command Prompt after malware was detected—what should I do?

A clean install is the most reliable way to remove a suspected persistent infection. Use Microsoft’s official Windows 11 installation media on a USB drive, boot the affected PC from it, delete the existing Windows partitions during setup, and install Windows again. Back up only personal documents you trust, not programs or unknown executable files.

You can run a second-opinion scan such as Malwarebytes after disconnecting from the network, but if the installer fails with a virus-scan error or the behavior continues, stop downloading tools on that machine and perform the clean installation instead. Keep the computer offline until it has been reinstalled, updated, and scanned.

The Command Prompt windows don’t automatically prove that malware is still running. Some legitimate printer utilities, audio drivers, update tools, and startup tasks briefly launch command-line programs. Check Task Manager’s Startup apps and review Event Viewer or Task Scheduler to identify what is launching. Still, because Defender detected malware, don’t rely on that explanation alone.

Disconnect the computer from the internet immediately, including Wi‑Fi or Ethernet. From a different, trusted device, change important passwords—especially email, banking, and account recovery passwords. The safest option is a clean Windows installation that deletes the existing system and doesn’t preserve programs or executable files. You’ll typically need a USB installer created using another computer.