I accidentally opened a suspected malware file on my HP laptop. Shortly afterward, Microsoft Defender and other anti-malware tools stopped opening. I tried Safe Mode, PowerShell's Start-MpWDOScan command, DISM /Online /Cleanup-Image /RestoreHealth, and running Defender normally, but none of them helped. What should I do next to remove the infection without losing my files, and what actions should I avoid?
3 Answers
Because the malware may be blocking security tools, you can first try running RKill from a trusted source to stop common malicious processes, then run a reputable offline or bootable antivirus scanner. However, this is not a guarantee that the system is clean. Avoid downloading random cleanup tools or running commands you do not understand.
Assume that passwords used on the infected laptop may have been exposed. From a clean phone or computer, change important passwords, enable two-factor authentication, and sign out other sessions. If you have a reliable backup from before the infection, restoring that after a clean reinstall is safer than trying to preserve the current Windows installation.
The safest option when you cannot trust the operating system is to secure your accounts from a different, known-clean device, create Windows installation media on that device, and perform a clean installation. This removes the existing Windows installation, so anything important should be backed up carefully first. Do not blindly copy programs or suspicious files, since malware could come along with them.
If I back up only personal documents and scan them from a clean computer before opening them, is that generally safer than copying the entire drive?