I lent my Windows 11 laptop to a family member, and afterward it became unusually slow and started opening multiple Command Prompt windows. Several of my accounts were compromised, including Discord. I recovered them, but after logging back into Discord on the suspected infected laptop, someone accessed the account again the following day, so I'm worried my passwords or browser session cookies are being stolen. I don't know whether the problem came from a downloaded file or a malicious link. Since I don't have much important data on the laptop, would resetting Windows from Settings completely remove the infection, or should I reinstall Windows another way?
3 Answers
A reset from Windows Settings can remove most malware if you choose the option to remove everything and fully clean the drive, but a USB installation made on a known-clean computer is more trustworthy when accounts are actively being compromised. Back up only personal documents you’re certain are safe, not programs or unknown downloads, then delete the existing partitions during setup and install Windows fresh.
Before reinstalling, secure your accounts from a phone or another clean computer. Change passwords, revoke active login sessions, remove unfamiliar browser extensions and apps from the account security pages, check recovery email and phone settings, and contact support for any accounts that were taken over. Don’t test by logging in on the infected laptop again until Windows has been reinstalled and fully updated.
Treat the laptop as compromised and stop signing into any accounts on it. Using another trusted device, change your email password first, then change other important passwords, enable two-factor authentication, and sign out of existing sessions. A clean reinstall is the safest option here because the attacker may be stealing browser cookies or passwords, not just causing pop-ups.
Would the built-in Windows reset be enough, or do I really need to use a USB installer?
The USB method is a little more work, but it avoids relying on tools from the potentially infected Windows installation.